Function at 0x505155
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x15c
lea ebp, [esp - 4]
mov eax, dword [0x7c0650]
xor eax, ebp
mov dword [ebp + 0x15c], eax
push 0xa0
mov eax, 0x68191f
call fcn.00645482
mov edi, dword [ebp + 0x168]
xor ebx, ebx
push str.getOsVersionString
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], ebx
call fcn.0061a2cd
push ebx
lea ecx, [ebp + 0xb8]
mov dword [ebp - 4], ebx
mov dword [ebp + 0xd0], 0xf
call fcn.00402c9d
mov esi, 0x9c
push esi
lea eax, [ebp]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.006455e0
add esp, 0xc
lea eax, [ebp]
mov dword [ebp], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
setne byte [ebp - 0xd]
cmp byte [ebp - 0xd], bl
jne 0x505237
lea eax, [ebp]
push eax
mov dword [ebp], 0x94
call esi
test eax, eax
jne 0x505237
push str.Unknown_OS
lea ecx, [ebp - 0x3c]
call fcn.00401baa
lea eax, [ebp - 0x3c]
push eax
push edi
mov byte [ebp - 4], 2
call fcn.004da304
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040234a
push ebx
push 1
lea ecx, [ebp + 0xb8]
call fcn.0040234a
lea ecx, [ebp - 0x18]
call fcn.006193de
mov eax, edi
jmp 0x505758
mov eax, dword [ebp + 0x10]
dec eax
je 0x5056a9
dec eax
jne 0x50572e
cmp dword [ebp + 4], 4
ja 0x50525e
push str.Microsoft_Windows_NT
lea ecx, [ebp + 0xb8]
call fcn.00453767
cmp dword [ebp + 4], 5
jne 0x505279
cmp dword [ebp + 8], ebx
jne 0x505279
push str.Microsoft_Windows_2000
lea ecx, [ebp + 0xb8]
call fcn.00453767
cmp byte [ebp - 0xd], bl
je 0x505350
cmp byte [ebp + 0x9a], 1
jne 0x5052cc
cmp dword [ebp + 4], 5
jne 0x5052a7
cmp dword [ebp + 8], 1
jne 0x5052a7
push str.Microsoft_Windows_XP
lea ecx, [ebp + 0xb8]
call fcn.00453767
test word [ebp + 0x98], 0x200
lea ecx, [ebp + 0xb8]
je 0x5052c2
push str.Home_Edition
jmp 0x505448
push str.Professional
jmp 0x505448
cmp byte [ebp + 0x9a], 3
jne 0x50544d
cmp dword [ebp + 4], 5
jne 0x5052f5
cmp dword [ebp + 8], 2
jne 0x5052f5
push str.Microsoft_Windows_.NET
lea ecx, [ebp + 0xb8]
call fcn.00453767
test byte [ebp + 0x98], 0x80
je 0x505308
push str.DataCenter_Server
jmp 0x505442
test byte [ebp + 0x98], 2
lea ecx, [ebp + 0xb8]
je 0x505331
cmp dword [ebp + 4], 4
jne 0x505327
push str.Advanced_Server
jmp 0x505448
push str.Enterprise_Server
jmp 0x505448
cmp word [ebp + 0x98], 0x400
jne 0x505346
push str.Web_Server
jmp 0x505448
push str.Server
jmp 0x505448
push 0x50
pop edi
lea eax, [ebp - 0x1c]
push eax
xor esi, esi
inc esi
push esi
push ebx
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x5053a3
push str.Unknown_OS
lea ecx, [ebp - 0x3c]
call fcn.00401baa
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004da304
pop ecx
pop ecx
lea ecx, [ebp - 0x3c]
push ebx
push esi
call fcn.0040234a
push ebx
push esi
jmp 0x505742
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x10c]
push eax
push ebx
push ebx
push str.ProductType
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x505682
cmp dword [ebp - 0x20], edi
ja 0x505682
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x10c]
push eax
push str.WINNT
call fcn.0064cef9
test eax, eax
pop ecx
pop ecx
jne 0x5053ff
push str.Professional
lea ecx, [ebp + 0xb8]
call fcn.00453767
lea eax, [ebp + 0x10c]
push eax
push str.LANMANNT
call fcn.0064cef9
test eax, eax
pop ecx
pop ecx
jne 0x505426
push str.Server
lea ecx, [ebp + 0xb8]
call fcn.00453767
lea eax, [ebp + 0x10c]
push eax
push str.SERVERNT
call fcn.0064cef9
test eax, eax
pop ecx
pop ecx
jne 0x50544d
push str.Advanced_Server
lea ecx, [ebp + 0xb8]
call fcn.00453767
cmp dword [ebp + 4], 4
lea ecx, [ebp + 0xb8]
ja 0x5055ca
push str.version
call fcn.00453767
xor esi, esi
inc esi
push esi
push 3
lea ecx, [ebp + 0xd4]
call fcn.0041b1af
push dword [ebp + 8]
lea ecx, [ebp + 0xdc]
push 0x716fe0
push dword [ebp + 4]
mov byte [ebp - 4], 5
call fcn.004459fe
push eax
call fcn.0041a871
pop ecx
pop ecx
mov ecx, eax
call fcn.004459fe
lea eax, [ebp + 0x9c]
push eax
lea ecx, [ebp + 0xd4]
call fcn.004192c7
lea eax, [ebp + 0x9c]
push eax
lea eax, [ebp - 0xac]
push eax
mov byte [ebp - 4], 6
call fcn.005d8542
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0xb8]
mov byte [ebp - 4], 7
call fcn.0041980e
push ebx
push esi
lea ecx, [ebp - 0xac]
call fcn.0040234a
push ebx
push esi
lea ecx, [ebp + 0x9c]
call fcn.0040234a
lea ecx, [ebp + 0xd4]
mov byte [ebp - 4], 1
call fcn.004189bb
push 0x71731c
lea ecx, [ebp + 0xb8]
call fcn.00453767
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp + 0xb8]
call fcn.00453767
push str.__Build
lea ecx, [ebp + 0xb8]
call fcn.00453767
push esi
push 3
lea ecx, [ebp + 0xd4]
call fcn.0041b1af
movzx eax, word [ebp + 0xc]
push eax
lea ecx, [ebp + 0xdc]
mov byte [ebp - 4], 8
call fcn.004459fe
lea eax, [ebp + 0x9c]
push eax
lea ecx, [ebp + 0xd4]
call fcn.004192c7
lea eax, [ebp + 0x9c]
push eax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x90]
push eax
call fcn.005d8542
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0xb8]
mov byte [ebp - 4], 0xa
call fcn.0041980e
push ebx
push esi
lea ecx, [ebp - 0x90]
call fcn.0040234a
push ebx
push esi
lea ecx, [ebp + 0x9c]
call fcn.0040234a
lea ecx, [ebp + 0xd4]
mov byte [ebp - 4], 1
call fcn.004189bb
push 0x7175b0
jmp 0x505723
lea eax, [ebp + 0x14]
push eax
call fcn.00453767
push str.__Build
lea ecx, [ebp + 0xb8]
call fcn.00453767
push 1
push 3
lea ecx, [ebp + 0xd4]
call fcn.0041b1af
movzx eax, word [ebp + 0xc]
push eax
lea ecx, [ebp + 0xdc]
mov byte [ebp - 4], 0xb
call fcn.004459fe
lea eax, [ebp + 0x9c]
push eax
lea ecx, [ebp + 0xd4]
call fcn.004192c7
lea eax, [ebp + 0x9c]
push eax
lea eax, [ebp - 0x74]
push eax
mov byte [ebp - 4], 0xc
call fcn.005d8542
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0xb8]
mov byte [ebp - 4], 0xd
call fcn.0041980e
push ebx
push 1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xc
call fcn.0040234a
push 0x7175b0
lea ecx, [ebp + 0xb8]
call fcn.00453767
push ebx
push 1
lea ecx, [ebp + 0x9c]
call fcn.0040234a
lea ecx, [ebp + 0xd4]
mov byte [ebp - 4], 1
call fcn.004189bb
jmp 0x50572e
push str.Unknown_OS
lea ecx, [ebp - 0x58]
call fcn.00401baa
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004da304
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
jmp 0x505395
cmp dword [ebp + 4], 4
jne 0x50572e
cmp dword [ebp + 8], ebx
jne 0x5056e6
push str.Microsoft_Windows_95
lea ecx, [ebp + 0xb8]
call fcn.00453767
cmp byte [ebp + 0x15], 0x43
je 0x5056d0
cmp byte [ebp + 0x15], 0x42
jne 0x5056e0
push str.OSR2
lea ecx, [ebp + 0xb8]
call fcn.00453767
cmp dword [ebp + 4], 4
jne 0x50572e
cmp dword [ebp + 8], 0xa
jne 0x505718
push str.Microsoft_Windows_98
lea ecx, [ebp + 0xb8]
call fcn.00453767
cmp byte [ebp + 0x15], 0x41
jne 0x505712
push 0x6f01e0
lea ecx, [ebp + 0xb8]
call fcn.00453767
cmp dword [ebp + 4], 4
jne 0x50572e
cmp dword [ebp + 8], 0x5a
jne 0x50572e
push str.Microsoft_Windows_Millennium_Edition
lea ecx, [ebp + 0xb8]
call fcn.00453767
lea eax, [ebp + 0xb8]
push eax
push dword [ebp - 0x14]
call fcn.004da304
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp + 0xb8]
call fcn.0040234a
lea ecx, [ebp - 0x18]
call fcn.006193de
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x15c]
xor ecx, ebp
call fcn.00644f58
add ebp, 0x160
leave
ret