Function at 0x49bcc0
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x4f6fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x552e63]
mov byte [ebp - 0x104], al
push 0xfe
push 0
lea ecx, [ebp - 0x103]
push ecx
call fcn.004b6780
add esp, 0xc
cmp dword [0x4f3a5c], 1
jne 0x49cab5
mov dword [0x4f3a5c], 0
push 0x24
push 0
lea edx, [ebp - 0x338]
push edx
call fcn.004b6780
add esp, 0xc
push 0x9c
push 0
lea eax, [ebp - 0x2f0]
push eax
call fcn.004b6780
add esp, 0xc
mov dword [ebp - 0x2f0], 0x9c
lea ecx, [ebp - 0x2f0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
jne 0x49bd7c
mov dword [ebp - 0x2f0], 0x94
lea edx, [ebp - 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x49bd7c
xor eax, eax
jmp 0x49caba
push str.GetNativeSystemInfo
push 0x4f3a74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0
je 0x49bdb1
lea eax, [ebp - 0x338]
push eax
call dword [ebp - 0x304]
jmp 0x49bdbe
lea ecx, [ebp - 0x338]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x2e0]
mov dword [ebp - 0x2f8], edx
cmp dword [ebp - 0x2f8], 0
je 0x49c9ea
cmp dword [ebp - 0x2f8], 1
je 0x49c8e7
cmp dword [ebp - 0x2f8], 2
je 0x49bdf2
jmp 0x49ca08
cmp dword [ebp - 0x2ec], 0xa
jne 0x49be04
cmp dword [ebp - 0x2e8], 0
ja 0x49be0d
cmp dword [ebp - 0x2ec], 0xa
jbe 0x49be30
push str.Windows_Max
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0x15
jmp 0x49bf29
cmp dword [ebp - 0x2ec], 0xa
jne 0x49be71
cmp dword [ebp - 0x2e8], 0
jne 0x49be71
movzx ecx, byte [ebp - 0x256]
cmp ecx, 1
jne 0x49be71
push str.Windows_10
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0x14
jmp 0x49bf29
cmp dword [ebp - 0x2ec], 0xa
jne 0x49beaf
cmp dword [ebp - 0x2e8], 0
jne 0x49beaf
movzx eax, byte [ebp - 0x256]
cmp eax, 1
je 0x49beaf
push str.Windows_10_Server
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0x13
jmp 0x49bf29
cmp dword [ebp - 0x2ec], 6
jne 0x49beed
cmp dword [ebp - 0x2e8], 3
jne 0x49beed
movzx edx, byte [ebp - 0x256]
cmp edx, 1
je 0x49beed
push str.Windows_8_Server_R2
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0x12
jmp 0x49bf29
cmp dword [ebp - 0x2ec], 6
jne 0x49bf29
cmp dword [ebp - 0x2e8], 3
jne 0x49bf29
movzx ecx, byte [ebp - 0x256]
cmp ecx, 1
jne 0x49bf29
push str.Windows_8.1
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0x11
cmp dword [ebp - 0x2ec], 6
jne 0x49bf85
cmp dword [ebp - 0x2e8], 2
jne 0x49bf85
movzx eax, byte [ebp - 0x256]
cmp eax, 1
jne 0x49bf67
push str.Windows_8
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0xf
jmp 0x49bf85
push str.Windows_Server_2012
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0x10
cmp dword [ebp - 0x2ec], 6
jne 0x49bfe1
cmp dword [ebp - 0x2e8], 1
jne 0x49bfe1
movzx eax, byte [ebp - 0x256]
cmp eax, 1
jne 0x49bfc3
push str.Windows_7
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0xe
jmp 0x49bfe1
push str.Windows_Server_2008_R2
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0xb
cmp dword [ebp - 0x2ec], 6
jne 0x49c2b2
cmp dword [ebp - 0x2e8], 0
jne 0x49c2b2
movzx eax, byte [ebp - 0x256]
cmp eax, 1
jne 0x49c027
push str.Microsoft_Windows_Vista
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0xa
jmp 0x49c045
push str.Windows_Server_2008
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0xb
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0
push 6
call dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x314]
mov dword [ebp - 0x2f4], ecx
mov edx, dword [ebp - 0x2f4]
sub edx, 1
mov dword [ebp - 0x2f4], edx
cmp dword [ebp - 0x2f4], 0x18
ja case.0x49c0a5.4
mov eax, dword [ebp - 0x2f4]
jmp dword [eax*4 + 0x49cac8]
push str.Ultimate_Edition
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Home_Premium_Edition
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Home_Basic_Edition
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push 0x4f3bb8
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Business_Edition
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Starter_Edition
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Cluster_Server_Edition
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push 0x4f3c08
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Datacenter_Edition__core_installation_
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push 0x4f3c44
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Enterprise_Edition__core_installation_
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push 0x4f3c80
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Small_Business_Server
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Small_Business_Server_Premium_Edition
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push 0x4f3cf0
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Standard_Edition__core_installation_
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp case.0x49c0a5.4
push str.Web_Server_Edition
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
movzx eax, word [ebp - 0x338]
cmp eax, 9
jne 0x49c263
push str.__64_bit
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49c282
movzx edx, word [ebp - 0x338]
test edx, edx
jne 0x49c282
push str.__32_bit
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5f60
add esp, 4
movsx edx, byte [ebp + eax - 0x105]
cmp edx, 0x20
je 0x49c2b2
push 0x4f3d58
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
cmp dword [ebp - 0x2ec], 5
jne 0x49c34e
cmp dword [ebp - 0x2e8], 2
jne 0x49c34e
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x49c2f8
push str.Microsoft_Windows_Server_2003__R2_
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0xd
jmp 0x49c34e
movzx edx, byte [ebp - 0x256]
cmp edx, 1
jne 0x49c330
movzx eax, word [ebp - 0x338]
cmp eax, 9
jne 0x49c330
push str.Microsoft_Windows_XP_Professional_x64_Edition
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 9
jmp 0x49c34e
push str.Microsoft_Windows_Server_2003_
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 0xc
cmp dword [ebp - 0x2ec], 5
jne 0x49c37e
cmp dword [ebp - 0x2e8], 1
jne 0x49c37e
push str.Microsoft_Windows_XP
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 8
cmp dword [ebp - 0x2ec], 5
jne 0x49c3ae
cmp dword [ebp - 0x2e8], 0
jne 0x49c3ae
push str.Microsoft_Windows_2000
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 5
cmp dword [ebp - 0x2ec], 4
ja 0x49c3d5
push str.Microsoft_Windows_NT
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 4
cmp dword [0x4e1450], 0xa
je 0x49c7fb
cmp dword [0x4e1450], 0xe
je 0x49c7fb
cmp dword [0x4e1450], 0xf
je 0x49c7fb
cmp dword [ebp - 0x300], 0
je 0x49c731
movzx eax, byte [ebp - 0x256]
cmp eax, 1
jne 0x49c510
movzx ecx, word [ebp - 0x338]
cmp ecx, 9
je 0x49c510
cmp dword [ebp - 0x2ec], 4
jne 0x49c44b
push str.Workstation_4.0
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp 0x49c50b
movzx eax, word [ebp - 0x258]
and eax, 0x200
je 0x49c472
push str.Home_Edition
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49c50b
movzx edx, word [ebp - 0x258]
and edx, 1
je 0x49c494
push 0x4f3e3c
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp 0x49c50b
movzx ecx, word [ebp - 0x258]
and ecx, 0x20
je 0x49c4b6
push str.Business
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp 0x49c50b
movzx eax, word [ebp - 0x258]
and eax, 2
je 0x49c4d8
push str.Enterprise
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49c50b
cmp dword [0x4e1450], 0xa
jne 0x49c4f7
push str.Ultimate
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp 0x49c50b
push 0x4f3e6c
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp 0x49c72c
movzx ecx, byte [ebp - 0x256]
cmp ecx, 3
je 0x49c52c
movzx edx, byte [ebp - 0x256]
cmp edx, 2
jne 0x49c72c
cmp dword [ebp - 0x2ec], 5
jne 0x49c688
cmp dword [ebp - 0x2e8], 2
jne 0x49c688
movzx eax, word [ebp - 0x338]
cmp eax, 6
jne 0x49c59c
movzx ecx, word [ebp - 0x258]
and ecx, 0x80
je 0x49c577
push str.Datacenter_Edition_for_Itanium_based_Systems
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp 0x49c597
movzx eax, word [ebp - 0x258]
and eax, 2
je 0x49c597
push str.Enterprise_Edition_for_Itanium_based_Systems
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49c683
movzx edx, word [ebp - 0x338]
cmp edx, 9
jne 0x49c604
movzx eax, word [ebp - 0x258]
and eax, 0x80
je 0x49c5cc
push str.Datacenter_x64_Edition
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49c602
movzx edx, word [ebp - 0x258]
and edx, 2
je 0x49c5ee
push str.Enterprise_x64_Edition
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp 0x49c602
push str.Standard_x64_Edition
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49c683
movzx edx, word [ebp - 0x258]
and edx, 0x80
je 0x49c629
push str.Datacenter_Edition
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp 0x49c683
movzx ecx, word [ebp - 0x258]
and ecx, 2
je 0x49c64b
push str.Enterprise_Edition
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp 0x49c683
movzx eax, word [ebp - 0x258]
cmp eax, 0x400
jne 0x49c66f
push str.Web_Edition
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49c683
push str.Standard_Edition
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
jmp 0x49c72c
cmp dword [ebp - 0x2ec], 5
jne 0x49c6f6
cmp dword [ebp - 0x2e8], 0
jne 0x49c6f6
movzx eax, word [ebp - 0x258]
and eax, 0x80
je 0x49c6be
push str.Datacenter_Server
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49c6f4
movzx edx, word [ebp - 0x258]
and edx, 2
je 0x49c6e0
push 0x4f3f84
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp 0x49c6f4
push 0x4f3f98
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49c72c
movzx edx, word [ebp - 0x258]
and edx, 2
je 0x49c718
push str.Server_4.0__Enterprise_Edition
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
jmp 0x49c72c
push str.Server_4.0
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49c7fb
lea edx, [ebp - 0x2fc]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x154]
push ecx
push 0
push 0
push str.ProductType
mov edx, dword [ebp - 0x2fc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x2fc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x154]
push ecx
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x49c7a7
push str.Professional
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
lea eax, [ebp - 0x154]
push eax
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x49c7d1
push str.Server
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
lea edx, [ebp - 0x154]
push edx
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x49c7fb
push str.Advanced_Server
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
cmp dword [ebp - 0x2ec], 4
jne 0x49c8a5
push str.Service_Pack_6
lea ecx, [ebp - 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x49c8a5
lea edx, [ebp - 0x310]
push edx
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x49c86e
mov eax, dword [ebp - 0x2e4]
and eax, 0xffff
push eax
push str.Service_Pack_6a__Build__d_
lea ecx, [ebp - 0x254]
push ecx
call fcn.004b6e08
add esp, 0xc
jmp 0x49c896
mov edx, dword [ebp - 0x2e4]
and edx, 0xffff
push edx
lea eax, [ebp - 0x2dc]
push eax
push 0x4f40bc
lea ecx, [ebp - 0x254]
push ecx
call fcn.004b6e08
add esp, 0x10
mov edx, dword [ebp - 0x310]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x49c8cc
mov eax, dword [ebp - 0x2e4]
and eax, 0xffff
push eax
lea ecx, [ebp - 0x2dc]
push ecx
push str._s__Build__d_
lea edx, [ebp - 0x254]
push edx
call fcn.004b6e08
add esp, 0x10
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
jmp 0x49ca08
cmp dword [ebp - 0x2ec], 4
jne 0x49c955
cmp dword [ebp - 0x2e8], 0
jne 0x49c955
push str.Microsoft_Windows_95
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov eax, 1
shl eax, 0
movsx ecx, byte [ebp + eax - 0x2dc]
cmp ecx, 0x43
je 0x49c937
mov edx, 1
shl edx, 0
movsx eax, byte [ebp + edx - 0x2dc]
cmp eax, 0x42
jne 0x49c94b
push str.OSR2
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 1
cmp dword [ebp - 0x2ec], 4
jne 0x49c9b8
cmp dword [ebp - 0x2e8], 0xa
jne 0x49c9b8
push str.Microsoft_Windows_98
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 3
mov eax, 1
shl eax, 0
movsx ecx, byte [ebp + eax - 0x2dc]
cmp ecx, 0x41
jne 0x49c9b8
push 0x4f4114
lea edx, [ebp - 0x104]
push edx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 6
cmp dword [ebp - 0x2ec], 4
jne 0x49c9e8
cmp dword [ebp - 0x2e8], 0x5a
jne 0x49c9e8
push str.Microsoft_Windows_Me
lea eax, [ebp - 0x104]
push eax
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 7
jmp 0x49ca08
push str.Microsoft_Win32s
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5e70
add esp, 8
mov dword [0x4e1450], 2
lea edx, [ebp - 0x104]
push edx
push 0x4ff080
call fcn.004b5e60
add esp, 8
lea eax, [ebp - 0x104]
push eax
push 1
call fcn.004417b0
add esp, 8
push 0x4f4144
lea ecx, [ebp - 0x104]
push ecx
call fcn.004b5ff0
add esp, 8
test eax, eax
je 0x49ca6c
push str.Service_Pack_3
lea edx, [ebp - 0x104]
push edx
call fcn.004b5ff0
add esp, 8
test eax, eax
jne 0x49ca6c
push str.ERROR:_You_may_not_be_able_to_connect_unless_you_update_XP_to_Service_Pack_3
push 0
call fcn.004417b0
add esp, 8
movsx eax, byte [0x4df56a]
cmp eax, 0x63
jne 0x49cab5
cmp dword [0x4e1450], 1
je 0x49caa5
cmp dword [0x4e1450], 2
je 0x49caa5
cmp dword [0x4e1450], 3
je 0x49caa5
cmp dword [0x4e1450], 6
je 0x49caa5
cmp dword [0x4e1450], 7
jne 0x49caae
mov byte [0x4df56a], 0x2a
jmp 0x49cab5
mov byte [0x4df56a], 0x2a
mov eax, dword [0x4e1450]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b6253
mov esp, ebp
pop ebp
ret