Function at 0x49cbc0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7a8
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x9c
lea eax, [ebp - 0x7a0]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.004a3190
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [ebp - 0x7a0]
push ecx
mov dword [ebp - 0x7a0], 0x9c
call esi
mov edi, eax
test edi, edi
jne 0x49cc3a
lea edx, [ebp - 0x7a0]
push edx
mov dword [ebp - 0x7a0], 0x94
call esi
test eax, eax
jne 0x49cc3a
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x790]
sub eax, 0
je 0x49d3c6
dec eax
je 0x49d249
dec eax
jne 0x49d404
mov esi, 5
cmp dword [ebp - 0x79c], esi
jne 0x49ccdd
cmp dword [ebp - 0x798], 2
jne 0x49cc8f
push str.Windows_Server_2003_family_
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
cmp dword [ebp - 0x79c], esi
jne 0x49ccdd
cmp dword [ebp - 0x798], 1
jne 0x49ccba
push str.Windows_XP
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
cmp dword [ebp - 0x79c], esi
jne 0x49ccdd
cmp dword [ebp - 0x798], 0
jne 0x49cd08
push str.Windows_2000
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
cmp dword [ebp - 0x79c], 4
ja 0x49cd00
push str.Windows_NT
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
cmp dword [ebp - 0x79c], esi
jne 0x49cd22
push str.Windows_XP
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
mov esi, 6
cmp dword [ebp - 0x79c], esi
jne 0x49cd49
push str.Windows_Vista
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
cmp dword [ebp - 0x79c], 7
jne 0x49cd79
cmp dword [ebp - 0x798], 3
jne 0x49cdfa
push str.Windows_XP
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
cmp dword [ebp - 0x79c], esi
jne 0x49cdfa
cmp dword [ebp - 0x798], 1
jne 0x49cdac
push str.Windows_7
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
cmp dword [ebp - 0x79c], esi
jne 0x49cdfa
cmp dword [ebp - 0x798], 2
jne 0x49cdd7
push str.Windows_8
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
cmp dword [ebp - 0x79c], esi
jne 0x49cdfa
cmp dword [ebp - 0x798], 3
jne 0x49cdfa
push str.Windows_8.1
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
movzx eax, word [ebp - 0x70c]
dec eax
mov edx, 0x200
je 0x49ce66
dec eax
je 0x49ce46
dec eax
lea eax, [ebp - 0x204]
je 0x49ce30
cmp byte [eax], 0
je 0x49ce23
inc eax
dec edx
jne 0x49ce15
jmp 0x49cea3
test edx, edx
je 0x49cea3
push 0x4b5e54
jmp 0x49ce84
cmp byte [eax], 0
je 0x49ce3b
inc eax
dec edx
jne 0x49ce30
jmp 0x49cea3
test edx, edx
je 0x49cea3
push str.SP3
jmp 0x49ce84
lea eax, [ebp - 0x204]
lea esp, [esp]
cmp byte [eax], 0
je 0x49ce5b
inc eax
dec edx
jne 0x49ce50
jmp 0x49cea3
test edx, edx
je 0x49cea3
push str.SP2
jmp 0x49ce84
lea eax, [ebp - 0x204]
lea esp, [esp]
cmp byte [eax], 0
je 0x49ce7b
inc eax
dec edx
jne 0x49ce70
jmp 0x49cea3
test edx, edx
je 0x49cea3
push str.SP1
mov ecx, 0x200
sub ecx, edx
mov eax, 0x200
sub eax, ecx
mov edx, 0x7fffffff
lea ecx, [ebp + ecx - 0x204]
call fcn.00401000
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x49cef3
mov edx, 0x200
lea eax, [ebp - 0x204]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x49cecb
inc eax
dec edx
jne 0x49cec0
jmp 0x49cef3
test edx, edx
je 0x49cef3
mov ecx, 0x200
sub ecx, edx
mov eax, 0x200
sub eax, ecx
push str.Tablet_PC_Edition
lea ecx, [ebp + ecx - 0x204]
mov edx, 0x7fffffff
call fcn.00401000
movzx eax, byte [ebp - 0x706]
mov ecx, dword [ebp - 0x794]
push eax
mov eax, dword [ebp - 0x798]
push ecx
mov ecx, dword [ebp - 0x79c]
lea edx, [ebp - 0x78c]
push edx
push eax
push ecx
push str.Major___d__Minor__d___CSD_s___Build_d_Product_Type__d
lea edx, [ebp - 0x704]
push 0x200
push edx
call fcn.00402830
add esp, 0x20
test edi, edi
je 0x49d174
mov al, byte [ebp - 0x706]
cmp al, 1
jne 0x49cfb1
cmp dword [ebp - 0x79c], 4
jne 0x49cf76
mov edx, 0x200
lea eax, [ebp - 0x204]
cmp byte [eax], 0
je 0x49cf64
inc eax
dec edx
jne 0x49cf56
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Workstation_4.0
jmp 0x49d3e5
test dword [ebp - 0x708], 0x200
je 0x49d404
mov edx, 0x200
lea eax, [ebp - 0x204]
cmp byte [eax], 0
je 0x49cf9f
inc eax
dec edx
jne 0x49cf91
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Home_Edition
jmp 0x49d3e5
cmp al, 3
je 0x49cfbd
cmp al, 2
jne 0x49d404
cmp dword [ebp - 0x79c], 5
jne 0x49d120
mov eax, dword [ebp - 0x798]
cmp eax, 2
jne 0x49d090
mov eax, dword [ebp - 0x708]
mov edx, 0x200
test al, al
jns 0x49d010
lea eax, [ebp - 0x204]
mov edi, edi
cmp byte [eax], 0
je 0x49cffe
inc eax
dec edx
jne 0x49cff0
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Datacenter_Edition
jmp 0x49d3e5
test al, 2
je 0x49d040
lea eax, [ebp - 0x204]
lea ebx, [ebx]
cmp byte [eax], 0
je 0x49d02e
inc eax
dec edx
jne 0x49d020
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Enterprise_Edition
jmp 0x49d3e5
mov ecx, 0x400
cmp ax, cx
lea eax, [ebp - 0x204]
jne 0x49d070
cmp byte [eax], 0
je 0x49d05e
inc eax
dec edx
jne 0x49d050
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Web_Edition
jmp 0x49d3e5
cmp byte [eax], 0
je 0x49d07e
inc eax
dec edx
jne 0x49d070
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Standard_Edition
jmp 0x49d3e5
test eax, eax
jne 0x49d120
mov al, byte [ebp - 0x708]
mov edx, 0x200
test al, al
jns 0x49d0d0
lea eax, [ebp - 0x204]
lea ecx, [ecx]
cmp byte [eax], 0
je 0x49d0be
inc eax
dec edx
jne 0x49d0b0
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Datacenter_Server
jmp 0x49d3e5
test al, 2
lea eax, [ebp - 0x204]
je 0x49d100
lea ebx, [ebx]
cmp byte [eax], 0
je 0x49d0ee
inc eax
dec edx
jne 0x49d0e0
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Advanced_Server
jmp 0x49d3e5
cmp byte [eax], 0
je 0x49d10e
inc eax
dec edx
jne 0x49d100
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Server
jmp 0x49d3e5
test byte [ebp - 0x708], 2
mov edx, 0x200
lea eax, [ebp - 0x204]
je 0x49d154
cmp byte [eax], 0
je 0x49d142
inc eax
dec edx
jne 0x49d134
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Server_4.0__Enterprise_Edition
jmp 0x49d3e5
cmp byte [eax], 0
je 0x49d162
inc eax
dec edx
jne 0x49d154
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Server_4.0
jmp 0x49d3e5
lea edx, [ebp - 0x7a4]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x100
push 0x80000002
mov dword [ebp - 0x7a8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x49cc28
mov edx, dword [ebp - 0x7a4]
lea eax, [ebp - 0x7a8]
push eax
lea ecx, [ebp - 0x304]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49cc28
cmp dword [ebp - 0x7a8], esi
ja 0x49cc28
mov eax, dword [ebp - 0x7a4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x798]
mov edx, dword [ebp - 0x79c]
push ecx
push edx
push str._d._d
lea eax, [ebp - 0x504]
push 0x200
push eax
call fcn.00402830
add esp, 0x14
mov edx, 0x200
lea eax, [ebp - 0x204]
lea esp, [esp]
cmp byte [eax], 0
je 0x49d22e
inc eax
dec edx
jne 0x49d220
jmp 0x49d404
test edx, edx
je 0x49d404
mov ecx, 0x200
sub ecx, edx
lea edx, [ebp - 0x504]
push edx
jmp 0x49d3ec
mov esi, 4
cmp dword [ebp - 0x79c], esi
jne 0x49d404
cmp dword [ebp - 0x798], 0
jne 0x49d2ff
mov eax, 0x200
lea ecx, [ebp - 0x204]
cmp byte [ecx], 0
je 0x49d27d
inc ecx
dec eax
jne 0x49d272
jmp 0x49d2a5
test eax, eax
je 0x49d2a5
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push str.Microsoft_Windows_95
lea ecx, [ebp + ecx - 0x204]
mov edx, 0x7fffffff
call fcn.00401000
mov al, byte [ebp - 0x78b]
cmp al, 0x43
je 0x49d2b3
cmp al, 0x42
jne 0x49d2f3
mov eax, 0x200
lea ecx, [ebp - 0x204]
mov edi, edi
cmp byte [ecx], 0
je 0x49d2cb
inc ecx
dec eax
jne 0x49d2c0
jmp 0x49d2f3
test eax, eax
je 0x49d2f3
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push str.OSR2
lea ecx, [ebp + ecx - 0x204]
mov edx, 0x7fffffff
call fcn.00401000
cmp dword [ebp - 0x79c], esi
jne 0x49d404
cmp dword [ebp - 0x798], 0xa
jne 0x49d39b
mov eax, 0x200
lea ecx, [ebp - 0x204]
cmp byte [ecx], 0
je 0x49d322
inc ecx
dec eax
jne 0x49d317
jmp 0x49d34a
test eax, eax
je 0x49d34a
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push str.Microsoft_Windows_98
lea ecx, [ebp + ecx - 0x204]
mov edx, 0x7fffffff
call fcn.00401000
cmp byte [ebp - 0x78b], 0x41
jne 0x49d393
mov eax, 0x200
lea ecx, [ebp - 0x204]
mov edi, edi
cmp byte [ecx], 0
je 0x49d36b
inc ecx
dec eax
jne 0x49d360
jmp 0x49d393
test eax, eax
je 0x49d393
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push 0x4c047c
lea ecx, [ebp + ecx - 0x204]
mov edx, 0x7fffffff
call fcn.00401000
cmp dword [ebp - 0x79c], esi
jne 0x49d404
cmp dword [ebp - 0x798], 0x5a
jne 0x49d404
mov edx, 0x200
lea eax, [ebp - 0x204]
nop
cmp byte [eax], 0
je 0x49d3bb
inc eax
dec edx
jne 0x49d3b0
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Microsoft_Windows_Millennium_Edition
jmp 0x49d3e5
mov edx, 0x200
lea eax, [ebp - 0x204]
cmp byte [eax], 0
je 0x49d3dc
inc eax
dec edx
jne 0x49d3d1
jmp 0x49d404
test edx, edx
je 0x49d404
push str.Microsoft_Win32s
mov ecx, 0x200
sub ecx, edx
mov eax, 0x200
sub eax, ecx
mov edx, 0x7fffffff
lea ecx, [ebp + ecx - 0x204]
call fcn.00401000
lea eax, [ebp - 0x204]
push eax
mov edx, 0x7ffffffe
mov eax, 0x200
mov ecx, ebx
call fcn.00401000
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a01d6
mov esp, ebp
pop ebp
ret