Function at 0x417270
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x3c8
mov eax, dword [0x4a6c44]
xor eax, esp
mov dword [esp + 0x3c4], eax
push esi
push 0x118
lea eax, [esp + 0x14]
mov byte [0x4ada28], 0
push 0
push eax
call fcn.00447100
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x18]
add esp, 0xc
mov dword [esp + 0xc], 0x11c
push eax
call esi
mov dword [esp + 4], eax
test eax, eax
jne 0x4172e8
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
call esi
test eax, eax
jne 0x4172e8
xor al, al
pop esi
mov ecx, dword [esp + 0x3c4]
xor ecx, esp
call fcn.004440d2
add esp, 0x3c8
ret
mov eax, dword [esp + 0x1c]
push ebx
push edi
sub eax, 0
je 0x41782d
sub eax, 1
je 0x4176dd
sub eax, 1
jne 0x417866
mov edx, dword [esp + 0x18]
mov ebx, 0x4ada28
cmp edx, 4
ja 0x41735b
lea ecx, [ebx - 1]
nop word [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417320
mov eax, dword [str.Microsoft_Windows_NT]
mov dword [ecx], eax
mov eax, dword [0x47fcec]
mov dword [ecx + 4], eax
mov eax, dword [0x47fcf0]
mov dword [ecx + 8], eax
mov eax, dword [0x47fcf4]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47fcf8]
mov dword [ecx + 0x10], eax
mov ax, word [0x47fcfc]
mov word [ecx + 0x14], ax
push ebp
mov ebp, dword [esp + 0x20]
cmp edx, 5
jne 0x41740e
test ebp, ebp
jne 0x4173ab
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417370
mov eax, dword [str.Microsoft_Windows_2000]
mov dword [ecx], eax
mov eax, dword [0x47fd04]
mov dword [ecx + 4], eax
mov eax, dword [0x47fd08]
mov dword [ecx + 8], eax
mov eax, dword [0x47fd0c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47fd10]
mov dword [ecx + 0x10], eax
mov eax, dword [0x47fd14]
mov dword [ecx + 0x14], eax
jmp 0x417428
cmp ebp, 1
jne 0x4173f0
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4173b3
mov eax, dword [str.Microsoft_Windows_XP]
mov dword [ecx], eax
mov eax, dword [0x47fd1c]
mov dword [ecx + 4], eax
mov eax, dword [0x47fd20]
mov dword [ecx + 8], eax
mov eax, dword [0x47fd24]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47fd28]
mov dword [ecx + 0x10], eax
mov ax, word [0x47fd2c]
mov word [ecx + 0x14], ax
jmp 0x417428
cmp ebp, 2
jne 0x417428
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4173f8
mov ecx, 7
mov esi, str.Windows_Server_2003_family
rep movsd dword es:[edi], dword [esi]
jmp 0x417428
jbe 0x417428
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x417413
mov ecx, 6
mov esi, str.Microsoft_Windows_Vista
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 0
je 0x41755e
mov al, byte [esp + 0x132]
cmp al, 1
jne 0x4174a8
test dword [esp + 0x130], 0x200
lea ecx, [ebx - 1]
je 0x417478
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417450
mov eax, dword [str.Personal]
mov dword [ecx], eax
mov eax, dword [0x47fd6c]
mov dword [ecx + 4], eax
mov ax, word [0x47fd70]
mov word [ecx + 8], ax
jmp 0x417669
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417478
mov eax, dword [str.Professional]
mov dword [ecx], eax
mov eax, dword [0x47fd78]
mov dword [ecx + 4], eax
mov eax, dword [0x47fd7c]
mov dword [ecx + 8], eax
mov ax, word [0x47fd80]
mov word [ecx + 0xc], ax
jmp 0x417669
cmp al, 3
jne 0x417669
mov eax, dword [esp + 0x130]
lea ecx, [ebx - 1]
test al, al
jns 0x417500
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4174c0
mov eax, dword [str.DataCenter_Server]
mov dword [ecx], eax
mov eax, dword [0x47fd88]
mov dword [ecx + 4], eax
mov eax, dword [0x47fd8c]
mov dword [ecx + 8], eax
mov eax, dword [0x47fd90]
mov dword [ecx + 0xc], eax
mov ax, word [0x47fd94]
mov word [ecx + 0x10], ax
mov al, byte [0x47fd96]
mov byte [ecx + 0x12], al
jmp 0x417669
test al, 2
je 0x417540
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417504
mov eax, dword [str.Advanced_Server]
mov dword [ecx], eax
mov eax, dword [0x47fd9c]
mov dword [ecx + 4], eax
mov eax, dword [0x47fda0]
mov dword [ecx + 8], eax
mov eax, dword [0x47fda4]
mov dword [ecx + 0xc], eax
mov al, byte [0x47fda8]
mov byte [ecx + 0x10], al
jmp 0x417669
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417540
mov eax, dword [str.Server]
mov dword [ecx], eax
mov eax, dword [0x47fdb0]
mov dword [ecx + 4], eax
jmp 0x417669
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x138]
push eax
push 0
push 0
push str.ProductType
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [esp + 0x134]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x4175eb
lea ecx, [ebx - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4175c0
mov eax, dword [str.Professional]
mov dword [ecx], eax
mov eax, dword [0x47fd78]
mov dword [ecx + 4], eax
mov eax, dword [0x47fd7c]
mov dword [ecx + 8], eax
mov ax, word [0x47fd80]
mov word [ecx + 0xc], ax
lea eax, [esp + 0x134]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x41761a
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417601
mov eax, dword [str.Server]
mov dword [ecx], eax
mov eax, dword [0x47fdb0]
mov dword [ecx + 4], eax
lea eax, [esp + 0x134]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x417661
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417630
mov eax, dword [str.Advanced_Server]
mov dword [ecx], eax
mov eax, dword [0x47fd9c]
mov dword [ecx + 4], eax
mov eax, dword [0x47fda0]
mov dword [ecx + 8], eax
mov eax, dword [0x47fda4]
mov dword [ecx + 0xc], eax
mov al, byte [0x47fda8]
mov byte [ecx + 0x10], al
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
movzx eax, word [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1dc]
cmp edx, 4
ja 0x417692
push ebp
push edx
push str.version__d._d__s__Build__d_
push eax
call fcn.00407cd0
add esp, 0x18
jmp 0x4176a0
push str._s__Build__d_
push eax
call fcn.00407cd0
add esp, 0x10
lea edx, [esp + 0x1d4]
mov esi, edx
pop ebp
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4176b0
sub edx, esi
dec ebx
nop word [eax + eax]
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x4176c0
mov ecx, edx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x417866
cmp dword [esp + 0x18], 4
jne 0x417866
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x417772
mov ebx, 0x4ada28
lea ecx, [ebx - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417700
mov eax, dword [str.Microsoft_Windows_95]
mov dword [ecx], eax
mov eax, dword [0x47fe94]
mov dword [ecx + 4], eax
mov eax, dword [0x47fe98]
mov dword [ecx + 8], eax
mov eax, dword [0x47fe9c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47fea0]
mov dword [ecx + 0x10], eax
movzx eax, word [0x47fea4]
mov word [ecx + 0x14], ax
mov ax, word [esp + 0x2a]
cmp ax, 0x43
je 0x417751
cmp ax, 0x42
jne 0x417866
dec ebx
mov al, byte [ebx + 1]
lea ebx, [ebx + 1]
test al, al
jne 0x417752
mov eax, dword [str.OSR2]
mov dword [ebx], eax
mov ax, word [0x47feac]
mov word [ebx + 4], ax
jmp 0x417866
cmp eax, 0xa
jne 0x4177de
mov ebx, 0x4ada28
lea ecx, [ebx - 1]
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417780
cmp word [esp + 0x2a], 0x41
mov eax, dword [str.Microsoft_Windows_98]
mov dword [ecx], eax
mov eax, dword [0x47feb4]
mov dword [ecx + 4], eax
mov eax, dword [0x47feb8]
mov dword [ecx + 8], eax
mov eax, dword [0x47febc]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47fec0]
mov dword [ecx + 0x10], eax
mov ax, word [0x47fec4]
mov word [ecx + 0x14], ax
jne 0x417866
dec ebx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x4177c8
mov eax, dword [0x47fec8]
mov edi, ebx
mov dword [edi], eax
jmp 0x417866
cmp eax, 0x5a
jne 0x417866
mov ecx, 0x4ada28
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4177f0
mov eax, dword [str.Microsoft_Windows_Me]
mov dword [ecx], eax
mov eax, dword [0x47fed0]
mov dword [ecx + 4], eax
mov eax, dword [0x47fed4]
mov dword [ecx + 8], eax
mov eax, dword [0x47fed8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47fedc]
mov dword [ecx + 0x10], eax
mov ax, word [0x47fee0]
mov word [ecx + 0x14], ax
jmp 0x417866
mov ecx, 0x4ada28
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417833
mov eax, dword [str.Microsoft_Win32s]
mov dword [ecx], eax
mov eax, dword [0x47fee8]
mov dword [ecx + 4], eax
mov eax, dword [0x47feec]
mov dword [ecx + 8], eax
mov eax, dword [0x47fef0]
mov dword [ecx + 0xc], eax
mov ax, word [0x47fef4]
mov word [ecx + 0x10], ax
mov ecx, dword [esp + 0x3d0]
mov al, 1
pop edi
pop ebx
pop esi
xor ecx, esp
call fcn.004440d2
add esp, 0x3c8
ret