Function at 0x4906e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x26c
mov dword [ebp - 0x1c], 0x3fe
mov dword [ebp - 0x20], 1
lea edx, [ebp - 0x1a8]
mov eax, 0
mov ecx, 9
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x9c
mov dword [esp + 4], 0
lea eax, [ebp - 0x184]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x184], 0x9c
lea eax, [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
sub esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4901a0
mov dword [ebp - 0x184], 0x94
lea eax, [ebp - 0x184]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
sub esp, 4
test eax, eax
jne 0x4901a0
mov eax, 0
jmp 0x491d85
movzx eax, byte [0x589ce0]
test al, al
je 0x4901b5
mov eax, 0x589ce0
jmp 0x491d85
mov eax, dword [ebp - 0x174]
cmp eax, 2
je 0x4901df
cmp eax, 2
ja 0x491d32
test eax, eax
je 0x491cf8
cmp eax, 1
je 0x491c10
jmp 0x491d32
mov eax, dword [ebp - 0x180]
cmp eax, 6
jne 0x4908fe
mov eax, dword [ebp - 0x17c]
test eax, eax
je 0x490207
mov eax, dword [ebp - 0x17c]
cmp eax, 1
jne 0x4908fe
mov eax, dword [ebp - 0x17c]
test eax, eax
jne 0x49025c
movzx eax, byte [ebp - 0xea]
cmp al, 1
jne 0x49023c
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft_Windows_Vista
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x4902b0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft_Windows_Server_2008
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x4902b0
mov eax, dword [ebp - 0x17c]
cmp eax, 1
jne 0x4902b0
movzx eax, byte [ebp - 0xea]
cmp al, 1
jne 0x490292
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft_Windows_7
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x4902b0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft_Windows_Server_2008_R2
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
mov dword [esp], 0x503d1a
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetProductInfo
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x180]
cmp eax, 6
jne 0x49033a
mov eax, dword [ebp - 0x17c]
test eax, eax
jne 0x49033a
lea eax, [ebp - 0x1ac]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 6
mov eax, dword [ebp - 0x28]
call eax
sub esp, 0x14
jmp 0x49036b
lea eax, [ebp - 0x1ac]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 6
mov eax, dword [ebp - 0x28]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x1ac]
cmp eax, 0x29
ja 0x490390
test eax, eax
je case.0x49038e.0
cmp eax, 0x29
ja case.0x49038e.0
mov eax, dword [eax*4 + 0x504650]
jmp eax
cmp eax, 0xabcdabcd
jne case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Product_Unlicensed
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Business_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Business_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Cluster_Server_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Datacenter_Edition__full_
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Datacenter_Edition__core_
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Datacenter_Edition__core_
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Datacenter_Edition__full_
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Enterprise_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Enterprise_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Enterprise_Edition__full_
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Enterprise_Edition__core_
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Enterprise_Edition__core_
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Enterprise_Edition_for_Itanium_based_Systems
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Enterprise_Edition__full_
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Home_Basic_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Home_Basic_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Home_Premium_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Home_Premium_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Home_Server_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Essential_Business_Server_Management_Server
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Essential_Business_Server_Messaging_Server
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Essential_Business_Server_Security_Server
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Small_Business_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Small_Business_Server
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Small_Business_Server_Premium_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Standard_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Standard_Edition__core_
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Standard_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Standard_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Starter_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Storage_Server_Enterprise_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Storage_Server_Express_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Storage_Server_Standard_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Storage_Server_Workgroup_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Ultimate_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Ultimate_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Web_Server_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp case.0x49038e.0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Web_Server_Edition
mov dword [esp], 0x589ce0
call sym._strncat
nop
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x490d19
mov eax, dword [ebp - 0x180]
cmp eax, 6
jne 0x490ad1
mov eax, dword [ebp - 0x17c]
cmp eax, 2
je 0x490927
mov eax, dword [ebp - 0x17c]
cmp eax, 3
jne 0x490ad1
mov eax, esp
mov esi, eax
mov dword [ebp - 0x2c], 0x400
mov eax, dword [ebp - 0x2c]
sub eax, 1
mov dword [ebp - 0x30], eax
mov eax, 0x10
lea edx, [eax - 1]
mov eax, dword [ebp - 0x2c]
add eax, edx
mov edi, 0x10
mov edx, 0
div edi
imul eax, eax, 0x10
call fcn.004d7290
sub esp, eax
lea eax, [esp + 0x1c]
add eax, 0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1b0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov dword [esp + 4], 0x504030
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
je 0x4909d3
mov dword [esp + 0xc], str.Error_opening_Windows_registry.
mov dword [esp + 8], str.getuname
mov dword [esp + 4], 0x665
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov eax, dword [ebp - 0x1b0]
lea edx, [ebp - 0x1b4]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x34]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x504080
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x490a63
mov eax, dword [ebp - 0x38]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Error_reading_Windows_registry.__Error__u_
mov dword [esp + 8], str.getuname
mov dword [esp + 4], 0x66a
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5040b8
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x490ab1
mov eax, dword [ebp - 0x1b0]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft
mov dword [esp], 0x589ce0
call sym._strncat
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
mov esp, esi
jmp 0x490d19
mov eax, dword [ebp - 0x180]
cmp eax, 5
jne 0x490bfe
mov eax, dword [ebp - 0x17c]
cmp eax, 2
jne 0x490bfe
mov dword [esp], 0x503d1a
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], 0x5040e7
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x490b31
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
call eax
sub esp, 4
jmp 0x490b55
mov dword [esp + 0xc], 0x5040fc
mov dword [esp + 8], str.getuname
mov dword [esp + 4], 0x67a
mov dword [esp], str.shared_file_op.c
call dbg._mwarn
mov dword [esp], 0x59
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
call eax
sub esp, 4
test eax, eax
je 0x490b8a
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x504144
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x490be0
movzx eax, byte [ebp - 0xea]
cmp al, 1
jne 0x490bc2
movzx eax, word [ebp - 0x1a8]
cmp ax, 9
jne 0x490bc2
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x504168
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x490be0
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft_Windows_Server_2003_
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x490d19
mov eax, dword [ebp - 0x180]
cmp eax, 5
jne 0x490c50
mov eax, dword [ebp - 0x17c]
cmp eax, 1
jne 0x490c50
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5041b8
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x490d19
mov eax, dword [ebp - 0x180]
cmp eax, 5
jne 0x490c9e
mov eax, dword [ebp - 0x17c]
test eax, eax
jne 0x490c9e
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5041ce
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x490d19
mov eax, dword [ebp - 0x180]
cmp eax, 4
ja 0x490ce2
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5041e6
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x490d19
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft_Windows_Unknown
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
je 0x491380
cmp dword [ebp - 0x24], 0
je 0x491167
movzx eax, byte [ebp - 0xea]
cmp al, 1
jne 0x490de7
movzx eax, word [ebp - 0x1a8]
cmp ax, 9
je 0x490de7
mov eax, dword [ebp - 0x180]
cmp eax, 4
jne 0x490d78
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Workstation_4.0
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x490dc9
movzx eax, word [ebp - 0xec]
movzx eax, ax
and eax, 0x200
test eax, eax
je 0x490dab
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Home_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x490dc9
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Professional
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x491380
movzx eax, byte [ebp - 0xea]
cmp al, 3
je 0x490e01
movzx eax, byte [ebp - 0xea]
cmp al, 2
jne 0x491380
mov eax, dword [ebp - 0x180]
cmp eax, 5
jne 0x49102e
mov eax, dword [ebp - 0x17c]
cmp eax, 2
jne 0x49102e
movzx eax, word [ebp - 0x1a8]
cmp ax, 6
jne 0x490eb0
movzx eax, word [ebp - 0xec]
movzx eax, ax
and eax, 0x80
test eax, eax
je 0x490e63
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Datacenter_Edition_for_Itanium_based_Systems
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x490e92
movzx eax, word [ebp - 0xec]
movzx eax, ax
and eax, 2
test eax, eax
je 0x490e92
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Enterprise_Edition_for_Itanium_based_Systems
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x491380
movzx eax, word [ebp - 0x1a8]
cmp ax, 9
jne 0x490f61
movzx eax, word [ebp - 0xec]
movzx eax, ax
and eax, 0x80
test eax, eax
je 0x490ef4
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Datacenter_x64_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x490f43
movzx eax, word [ebp - 0xec]
movzx eax, ax
and eax, 2
test eax, eax
je 0x490f25
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Enterprise_x64_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x490f43
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Standard_x64_Edition
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x491380
movzx eax, word [ebp - 0xec]
movzx eax, ax
and eax, 0x80
test eax, eax
je 0x490f94
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Datacenter_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x491010
movzx eax, word [ebp - 0xec]
movzx eax, ax
and eax, 2
test eax, eax
je 0x490fc5
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Enterprise_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x491010
movzx eax, word [ebp - 0xec]
cmp ax, 0x400
jne 0x490ff2
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Web_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x491010
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Standard_Edition
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x491380
mov eax, dword [ebp - 0x180]
cmp eax, 5
jne 0x4910eb
mov eax, dword [ebp - 0x17c]
test eax, eax
jne 0x4910eb
movzx eax, word [ebp - 0xec]
movzx eax, ax
and eax, 0x80
test eax, eax
je 0x49107e
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Datacenter_Server
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x4910cd
movzx eax, word [ebp - 0xec]
movzx eax, ax
and eax, 2
test eax, eax
je 0x4910af
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Advanced_Server
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x4910cd
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Server
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x491380
mov eax, dword [ebp - 0x180]
cmp eax, 4
ja 0x491380
movzx eax, word [ebp - 0xec]
movzx eax, ax
and eax, 2
test eax, eax
je 0x49112b
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Server_4.0__Enterprise_Edition
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x491149
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Server_4.0
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x491380
mov dword [ebp - 0x1bc], 0x50
lea eax, [ebp - 0x1b8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetControlProductOptions
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x491380
mov eax, dword [ebp - 0x1b8]
lea edx, [ebp - 0x1bc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x22d]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProductType
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1b8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
cmp dword [ebp - 0x40], 0
jne 0x491380
mov eax, dword [ebp - 0x1bc]
cmp eax, 0x4f
ja 0x491380
lea eax, [ebp - 0x22d]
mov dword [esp + 4], eax
mov dword [esp], str.WINNT
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
call eax
sub esp, 8
test eax, eax
jne 0x49125e
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Workstation
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x4912da
lea eax, [ebp - 0x22d]
mov dword [esp + 4], eax
mov dword [esp], str.LANMANNT
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
call eax
sub esp, 8
test eax, eax
jne 0x49129d
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Server
mov dword [esp], 0x589ce0
call sym._strncat
jmp 0x4912da
lea eax, [ebp - 0x22d]
mov dword [esp + 4], eax
mov dword [esp], str.SERVERNT
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
call eax
sub esp, 8
test eax, eax
jne 0x4912da
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Advanced_Server
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x24d]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0x17c]
mov edx, eax
mov eax, dword [ebp - 0x180]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._d._d
mov dword [esp + 4], 0x1f
lea eax, [ebp - 0x24d]
mov dword [esp], eax
call sym._snprintf_59
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
lea eax, [ebp - 0x24d]
mov dword [esp + 4], eax
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x24d]
mov dword [esp], eax
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x180]
cmp eax, 4
jne 0x4914f3
mov dword [esp + 4], str.Service_Pack_6
lea eax, [ebp - 0x184]
add eax, 0x14
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
call eax
sub esp, 8
test eax, eax
jne 0x4914f3
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x1c0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x491452
mov eax, dword [ebp - 0x178]
movzx eax, ax
mov edx, dword [ebp - 0x17c]
mov ecx, edx
mov edx, dword [ebp - 0x180]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.Service_Pack_6a__Ver:__i._i._d_
mov dword [esp + 4], 0x3f
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._snprintf_59
jmp 0x4914a0
mov eax, dword [ebp - 0x178]
movzx eax, ax
mov edx, dword [ebp - 0x17c]
mov ecx, edx
mov edx, dword [ebp - 0x180]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
lea eax, [ebp - 0x184]
add eax, 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s__Ver:__i._i._d_
mov dword [esp + 4], 0x3f
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._snprintf_59
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
lea eax, [ebp - 0x22d]
mov dword [esp + 4], eax
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c0]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
jmp 0x491c0b
mov eax, dword [ebp - 0x180]
cmp eax, 6
jne 0x491b5f
mov eax, dword [ebp - 0x17c]
cmp eax, 2
je 0x49151c
mov eax, dword [ebp - 0x17c]
cmp eax, 3
jne 0x491b5f
mov eax, esp
mov esi, eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x48], 0x1e
mov eax, dword [ebp - 0x48]
sub eax, 1
mov dword [ebp - 0x4c], eax
mov eax, 0x10
lea edx, [eax - 1]
mov eax, dword [ebp - 0x48]
add eax, edx
mov edi, 0x10
mov edx, 0
div edi
imul eax, eax, 0x10
call fcn.004d7290
sub esp, eax
lea eax, [esp + 0x1c]
add eax, 0
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
sub eax, 1
mov dword [ebp - 0x54], eax
mov eax, 0x10
lea edx, [eax - 1]
mov eax, dword [ebp - 0x48]
add eax, edx
mov edi, 0x10
mov edx, 0
div edi
imul eax, eax, 0x10
call fcn.004d7290
sub esp, eax
lea eax, [esp + 0x1c]
add eax, 0
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d8], 4
lea eax, [ebp - 0x1c4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov dword [esp + 4], 0x504030
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
je 0x49163d
mov dword [esp + 0xc], str.Error_opening_Windows_registry.
mov dword [esp + 8], str.getuname
mov dword [esp + 4], 0x743
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov eax, dword [ebp - 0x1c4]
lea edx, [ebp - 0x1d4]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1c8]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x1d8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x50441b
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x491926
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1c4]
lea edx, [ebp - 0x1d4]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1cc]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x1d8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x504435
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x49170e
mov eax, dword [ebp - 0x5c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x504450
mov dword [esp + 8], str.getuname
mov dword [esp + 4], 0x74c
mov dword [esp], str.shared_file_op.c
call dbg._merror
jmp 0x49190e
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1c4]
lea edx, [ebp - 0x1d4]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x58]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x50449c
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x4917be
mov eax, dword [ebp - 0x5c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x5044b0
mov dword [esp + 8], str.getuname
mov dword [esp + 4], 0x752
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov edx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1c8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.__Ver:__d._d_
mov dword [esp + 4], 0x3f
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._snprintf_59
jmp 0x49190e
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1c4]
lea edx, [ebp - 0x1d4]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1d0]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x1d8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x504503
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x49184c
mov edx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [ebp - 0x58]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.__Ver:__d._d._s_
mov dword [esp + 4], 0x40
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._snprintf_59
jmp 0x49188f
mov ecx, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x1cc]
mov eax, dword [ebp - 0x1c8]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0x58]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.__Ver:__d._d._s._lu_
mov dword [esp + 4], 0x40
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._snprintf_59
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x60], 0
mov dword [esp + 8], 0xa
lea eax, [ebp - 0x1dc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call sym._strtol
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1dc]
movzx eax, byte [eax]
test al, al
jne 0x49190e
cmp dword [ebp - 0x64], 0x55ef
jle 0x49190e
mov dword [esp + 4], str.Microsoft_Windows_10
mov dword [esp], 0x589ce0
call sym._strstr
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x49190e
mov dword [esp + 8], 0x14
mov dword [esp + 4], str.Microsoft_Windows_11
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x1c4]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
jmp 0x491b1f
mov eax, dword [ebp - 0x1c4]
lea edx, [ebp - 0x1d4]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x50]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x504557
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x4919b9
mov eax, dword [ebp - 0x5c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x504568
mov dword [esp + 8], str.getuname
mov dword [esp + 4], 0x76f
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov dword [esp + 8], str.__Ver:_6.2_
mov dword [esp + 4], 0x3f
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._snprintf_59
jmp 0x491b0c
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1c4]
lea edx, [ebp - 0x1d4]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x58]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x50449c
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x491a55
mov eax, dword [ebp - 0x5c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x5044b0
mov dword [esp + 8], str.getuname
mov dword [esp + 4], 0x776
mov dword [esp], str.shared_file_op.c
call dbg._merror
mov dword [esp + 8], str.__Ver:_6.2_
mov dword [esp + 4], 0x3f
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._snprintf_59
jmp 0x491b0c
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1c4]
lea edx, [ebp - 0x1d4]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1d0]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x1d8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x504503
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x491ad6
mov eax, dword [ebp - 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.__Ver:__s._s_
mov dword [esp + 4], 0x40
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._snprintf_59
jmp 0x491b0c
mov eax, dword [ebp - 0x1d0]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.__Ver:__s._s._lu_
mov dword [esp + 4], 0x40
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._snprintf_59
mov eax, dword [ebp - 0x1c4]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
lea eax, [ebp - 0x22d]
mov dword [esp + 4], eax
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
mov esp, esi
jmp 0x491c0b
mov dword [esp + 8], 0x40
mov dword [esp + 4], 0
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0x178]
movzx eax, ax
mov edx, dword [ebp - 0x17c]
mov ecx, edx
mov edx, dword [ebp - 0x180]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
lea eax, [ebp - 0x184]
add eax, 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s__Ver:__i._i._d_
mov dword [esp + 4], 0x3f
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._snprintf_59
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
lea eax, [ebp - 0x22d]
mov dword [esp + 4], eax
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x22d]
mov dword [esp], eax
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x491d32
jmp 0x491d32
mov eax, dword [ebp - 0x180]
cmp eax, 4
jne 0x491c5c
mov eax, dword [ebp - 0x17c]
test eax, eax
jne 0x491c5c
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5045d6
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x180]
cmp eax, 4
jne 0x491ca9
mov eax, dword [ebp - 0x17c]
cmp eax, 0xa
jne 0x491ca9
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5045ec
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x180]
cmp eax, 4
jne 0x491d31
mov eax, dword [ebp - 0x17c]
cmp eax, 0x5a
jne 0x491d31
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft_Windows_Millennium_Edition
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x491d31
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.Microsoft_Win32s
mov dword [esp], 0x589ce0
call sym._strncat
mov ebx, dword [ebp - 0x1c]
mov dword [esp], 0x589ce0
call sym._strlen
sub ebx, eax
mov edx, ebx
lea eax, [edx - 1]
mov dword [ebp - 0x1c], eax
jmp 0x491d32
nop
mov dword [esp + 0x10], 0x50463a
mov dword [esp + 0xc], str.Wazuh
mov dword [esp + 8], str.____s__s
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [ebp - 0xe5]
mov dword [esp], eax
call sym._snprintf_59
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [esp + 8], eax
lea eax, [ebp - 0xe5]
mov dword [esp + 4], eax
mov dword [esp], 0x589ce0
call sym._strncat
mov eax, 0x589ce0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret