Function at 0x496600
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4f0fec
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x178], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x190]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1a0]
mov edi, dword [esp + 0x1a4]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x198], 0
push 0x11c
lea eax, [esp + 0x24]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.RtlGetVersion
push 0x5176c4
mov dword [esp + 0x28], 0x11c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4966a7
lea ecx, [esp + 0x20]
push ecx
call eax
test eax, eax
jne 0x4966a7
mov eax, 1
jmp 0x4966a9
xor eax, eax
test eax, eax
mov eax, dword [esp + 0x24]
setne bl
shl eax, 8
add eax, dword [esp + 0x28]
cmp eax, 0x400
jne 0x4966ca
push str.WinNT
jmp 0x496807
cmp eax, 0x500
jne 0x4966db
push str.Win2000
jmp 0x496807
cmp eax, 0x501
jne 0x4966ec
push str.WinXP
jmp 0x496807
cmp eax, 0x502
jne 0x496717
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [esp + 0x14]
test eax, eax
je 0x49670d
push str.Win2003_Server_R2
jmp 0x49680b
push str.Win2003_Server
jmp 0x49680b
cmp eax, 0x600
jne 0x496740
cmp byte [esp + 0x13a], 1
lea ecx, [esp + 0x14]
jne 0x496736
push str.Vista
jmp 0x49680b
push str.Win2008_Server
jmp 0x49680b
cmp eax, 0x601
jne 0x496769
cmp byte [esp + 0x13a], 1
lea ecx, [esp + 0x14]
jne 0x49675f
push str.Windows_7
jmp 0x49680b
push str.Win2008_Server_R2
jmp 0x49680b
cmp eax, 0x602
jne 0x49678f
cmp byte [esp + 0x13a], 1
lea ecx, [esp + 0x14]
jne 0x496788
push str.Windows_8
jmp 0x49680b
push str.Win2012_Server
jmp 0x49680b
cmp eax, 0x603
jne 0x4967b2
cmp byte [esp + 0x13a], 1
lea ecx, [esp + 0x14]
jne 0x4967ab
push str.Windows_8.1
jmp 0x49680b
push str.Win2012_Server_R2
jmp 0x49680b
cmp eax, 0xa00
jne 0x496811
cmp byte [esp + 0x13a], 1
jne 0x4967e2
movzx edx, word [esp + 0x2c]
lea ecx, [esp + 0x14]
cmp edx, 0x55f0
jb 0x4967db
push str.Windows_11
jmp 0x49680b
push str.Windows_10
jmp 0x49680b
mov eax, dword [esp + 0x2c]
cmp eax, 0x4a74
jb 0x4967f4
push str.Windows_2022_Server
jmp 0x496807
cmp eax, 0x4563
jb 0x496802
push str.Windows_2019_Server
jmp 0x496807
push str.Windows_2016_Server
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
test bl, bl
je 0x4968dc
mov al, byte [esp + 0x13a]
cmp al, 1
jne 0x496849
test dword [esp + 0x138], 0x200
lea ecx, [esp + 0x14]
je 0x49683f
push str._Home
jmp 0x4969cb
push str._Pro
jmp 0x4969cb
cmp al, 3
jne 0x4969d1
push 0x5116d8
push str._Server
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
cmp dword [esp + 0x24], 5
jne 0x496882
cmp dword [esp + 0x28], 1
jne 0x496882
push str._.NET_Server
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_945]
mov eax, dword [esp + 0x138]
test al, al
jns 0x496897
push str._DataCenter_Server
jmp 0x4969c7
test al, 2
je 0x4968ba
cmp dword [esp + 0x24], 4
lea ecx, [esp + 0x14]
jne 0x4968b0
push str._Advanced_Server
jmp 0x4969cb
push str._Enterprise_Server
jmp 0x4969cb
mov ecx, 0x400
cmp ax, cx
lea ecx, [esp + 0x14]
jne 0x4968d2
push str._Web_Server
jmp 0x4969cb
push str._Server
jmp 0x4969cb
push 0x4f
lea edx, [esp + 0x141]
push 0
push edx
mov byte [esp + 0x148], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x140]
push edx
push 0
push 0
push str.ProductType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea edx, [esp + 0x13c]
push edx
push str.WINNT
call esi
test eax, eax
jne 0x496965
push str._Professional
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_945]
lea eax, [esp + 0x13c]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x49699b
push 0x5116d8
push str._Server
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
push str._Server
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_945]
lea ecx, [esp + 0x13c]
push ecx
push str.SERVERNT
call esi
test eax, eax
jne 0x4969d1
push 0x5116d8
push str._Server
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_5924]
push str._Advanced_Server
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_945]
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x34]
cmp eax, 4
ja 0x4969fc
movzx edx, word [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
push edx
push eax
push str.version__d._d__ws__Build__d_
push edi
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x18
jmp 0x496a12
movzx eax, word [esp + 0x2c]
push eax
push ecx
push str._ws__Build__d_
push edi
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x10
call fcn.004965b0
test eax, eax
je 0x496a2a
push str._x64
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_945]
mov eax, dword [esp + 0x14]
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x496a32
push str.Server
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x496a65
mov dword [esp + 0x198], 0xffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov al, 1
jmp 0x496a7c
mov dword [esp + 0x198], 0xffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor al, al
mov ecx, dword [esp + 0x190]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x178]
xor ecx, esp
call fcn.004e0148
add esp, 0x188
ret