Function at 0x408a90
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0xec
push ebx
mov ebx, dword [esp + 0xf4]
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x14]
mov byte [ebx], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x408c88
mov eax, dword [esp + 0x24]
sub eax, 0
je 0x408c5e
dec eax
je 0x408c3d
dec eax
jne 0x408c88
mov edx, dword [esp + 0x18]
push ebp
cmp edx, 4
ja 0x408b1a
mov edi, str.Microsoft_Windows_NT
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp edx, 5
jne 0x408b49
mov edi, str.Microsoft_Windows_2000
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0xac]
push ecx
push edx
push 0
push 0
push str.ProductType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea edx, [esp + 0xac]
push edx
push str.WINNT
call ebp
test eax, eax
jne 0x408bcf
mov edi, str.Workstation
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xac]
push eax
push str.SERVERNT
call ebp
test eax, eax
pop ebp
jne 0x408c0b
mov edi, str.Server
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
and eax, 0xffff
lea ecx, [esp + 0x28]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push ebx
push str._s_version__d._d__s__Build__d_
push ebx
call fcn.00413f87
add esp, 0x1c
pop edi
pop esi
pop ebx
add esp, 0xec
ret
mov eax, dword [esp + 0x18]
cmp eax, 4
ja 0x408c57
jne 0x408c50
mov eax, dword [esp + 0x1c]
test eax, eax
ja 0x408c57
mov edi, str.Microsoft_Windows_95
jmp 0x408c63
mov edi, str.Microsoft_Windows_98
jmp 0x408c63
mov edi, str.Microsoft_Win32s
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0xec
ret