Function at 0x1800ff50
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3b8]
sub esp, 0x438
mov eax, dword [0x180f51f0]
xor eax, ebp
mov dword [ebp + 0x3b4], eax
mov eax, dword [ebp + 0x3c0]
push ebx
push esi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x3c4]
push edi
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x3c8]
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x80], eax
mov word [eax], cx
xor eax, eax
mov esi, 0x11c
push esi
push eax
mov word [ebp + 0x1ac], ax
lea eax, [ebp - 0x70]
push eax
mov ebx, edx
call fcn.1809d820
add esp, 0xc
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
mov dword [ebp - 0x7c], eax
test eax, eax
jne 0x1800ffdc
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x70], 0x114
call esi
test eax, eax
jne 0x1800ffdc
xor al, al
jmp 0x1801046c
movzx eax, word [ebp + 0xa4]
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x78]
mov dword [edi], ecx
mov dword [ebx], edx
mov dword [esi], eax
movzx eax, word [ebp + 0xa6]
mov esi, dword [ebp - 0x74]
mov dword [esi], eax
mov eax, dword [ebp - 0x60]
sub eax, 0
je 0x18010424
dec eax
je 0x18010397
dec eax
je 0x1801001e
push str.Unknown_operating_system
jmp 0x18010429
push 5
pop esi
cmp ecx, esi
jne 0x18010079
cmp edx, 2
jne 0x18010042
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_Server_2003_family_
push eax
call fcn.18009f78
pop ecx
pop ecx
cmp dword [ebp - 0x6c], esi
jne 0x18010079
cmp dword [ebp - 0x68], 1
jne 0x18010060
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_XP
push eax
call fcn.18009f78
pop ecx
pop ecx
cmp dword [ebp - 0x6c], esi
jne 0x18010079
cmp dword [ebp - 0x68], 0
jne 0x18010092
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_2000
push eax
call fcn.18009f78
pop ecx
pop ecx
cmp dword [ebp - 0x6c], 4
ja 0x18010092
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_NT
push eax
call fcn.18009f78
pop ecx
pop ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
cmp dword [ebp - 0x7c], eax
je 0x180101a9
cmp byte [ebp + 0xaa], 1
jne 0x180100e2
cmp dword [ebp - 0x6c], 4
lea eax, [ebp + 0x1ac]
jne 0x180100c2
push str.Workstation_4.0
jmp 0x1801019c
test dword [ebp + 0xa8], 0x200
je 0x180100d8
push str.Home_Edition
jmp 0x1801019c
push str.Professional
jmp 0x1801019c
cmp byte [ebp + 0xaa], 3
je 0x180100f8
cmp byte [ebp + 0xaa], 2
jne 0x180102bf
cmp dword [ebp - 0x6c], esi
jne 0x18010181
cmp dword [ebp - 0x68], 2
jne 0x1801014f
test byte [ebp + 0xa8], 0x80
je 0x18010117
push str.Datacenter_Edition
jmp 0x18010125
test byte [ebp + 0xa8], 2
je 0x1801012d
push str.Enterprise_Edition
lea eax, [ebp + 0x1ac]
jmp 0x1801019c
mov eax, 0x400
cmp word [ebp + 0xa8], ax
lea eax, [ebp + 0x1ac]
jne 0x18010148
push str.Web_Edition
jmp 0x1801019c
push str.Standard_Edition
jmp 0x1801019c
cmp dword [ebp - 0x68], eax
jne 0x18010181
test byte [ebp + 0xa8], 0x80
lea eax, [ebp + 0x1ac]
je 0x1801016a
push str.Datacenter_Server
jmp 0x1801019c
test byte [ebp + 0xa8], 2
je 0x1801017a
push str.Advanced_Server
jmp 0x1801019c
push str.Server
jmp 0x1801019c
test byte [ebp + 0xa8], 2
lea eax, [ebp + 0x1ac]
je 0x18010197
push str.Server_4.0__Enterprise_Edition
jmp 0x1801019c
push str.Server_4.0
push eax
call fcn.18009f78
pop ecx
pop ecx
jmp 0x180102bf
push 0x7e
push eax
lea eax, [ebp + 0xae]
xor ecx, ecx
push eax
mov word [ebp + 0xac], cx
call fcn.1809d820
add esp, 0xc
push 0x40
pop esi
lea eax, [ebp - 0x78]
push eax
push 1
xor edi, edi
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [ebp - 0x74], esi
call ebx
test eax, eax
jne 0x1800ffd5
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xac]
push eax
push edi
push edi
push str.ProductType
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800ffd5
cmp dword [ebp - 0x74], esi
ja 0x1800ffd5
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp + 0xac]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x18010247
lea eax, [ebp + 0x1ac]
push str.Workstation
push eax
call fcn.18009f78
pop ecx
pop ecx
lea eax, [ebp + 0xac]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x1801026c
lea eax, [ebp + 0x1ac]
push str.Server
push eax
call fcn.18009f78
pop ecx
pop ecx
lea eax, [ebp + 0xac]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x18010291
lea eax, [ebp + 0x1ac]
push str.Advanced_Server
push eax
call fcn.18009f78
pop ecx
pop ecx
push dword [ebp - 0x68]
lea eax, [ebp + 0x12c]
push dword [ebp - 0x6c]
push 0x180c5de0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18009f78
add esp, 0x18
cmp dword [ebp - 0x6c], 4
jne 0x18010361
push str.Service_Pack_6
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18010361
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push 0x80000002
call ebx
test eax, eax
movzx eax, word [ebp - 0x64]
push eax
jne 0x18010327
lea eax, [ebp + 0x12c]
push str.Service_Pack_6a__Build__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18009f78
add esp, 0x14
jmp 0x18010353
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x12c]
push str._s__Build__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18009f78
add esp, 0x18
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x18010437
movzx eax, word [ebp - 0x64]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x12c]
push str._s__Build__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x12c]
push eax
lea eax, [ebp + 0x1ac]
push eax
call fcn.18009f78
add esp, 0x18
jmp 0x18010437
cmp ecx, 4
jne 0x18010437
test edx, edx
jne 0x180103de
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_95
push eax
call fcn.18009f78
cmp word [ebp - 0x5a], 0x43
pop ecx
pop ecx
je 0x180103c5
cmp word [ebp - 0x5a], 0x42
jne 0x180103d8
lea eax, [ebp + 0x1ac]
push str.OSR2
push eax
call fcn.18009f78
pop ecx
pop ecx
cmp dword [ebp - 0x6c], 4
jne 0x18010437
cmp dword [ebp - 0x68], 0xa
jne 0x18010417
lea eax, [ebp + 0x1ac]
push str.Microsoft_Windows_98
push eax
call fcn.18009f78
cmp word [ebp - 0x5a], 0x41
pop ecx
pop ecx
jne 0x18010411
lea eax, [ebp + 0x1ac]
push 0x180c5f40
push eax
call fcn.18009f78
pop ecx
pop ecx
cmp dword [ebp - 0x6c], 4
jne 0x18010437
cmp dword [ebp - 0x68], 0x5a
jne 0x18010437
push str.Microsoft_Windows_Millennium_Edition
jmp 0x18010429
push str.Microsoft_Win32s
lea eax, [ebp + 0x1ac]
push eax
call fcn.18009f78
pop ecx
pop ecx
lea eax, [ebp + 0x1ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 + 0x1aa]
cmp word [eax], 0
jne 0x18010456
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x80]
push 0x104
lea edx, [ebp + 0x1ac]
call fcn.180097ec
pop ecx
mov al, 1
mov ecx, dword [ebp + 0x3b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1809cca5
add ebp, 0x3b8
leave
ret