Function at 0x417830
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x9c
call esi
mov edi, eax
test edi, edi
jne 0x41787f
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x94
call esi
test eax, eax
je 0x417bf4
mov eax, dword [esp + 0x28]
sub eax, 0
je 0x417c7c
dec eax
je 0x417bfe
dec eax
jne 0x417c89
mov eax, dword [esp + 0x1c]
mov esi, 5
cmp eax, esi
jne 0x4178f4
cmp dword [esp + 0x20], 2
jne 0x4178c3
push str.Microsoft_Windows_Servernbsp_2003_family_
call fcn.004c20e0
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, esi
jne 0x4178f4
cmp dword [esp + 0x20], 1
jne 0x4178df
push str.Microsoft_Windows_XP
call fcn.004c20e0
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, esi
jne 0x4178f4
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x417908
push str.Microsoft_Windows_2000
call fcn.004c20e0
add esp, 4
cmp dword [esp + 0x1c], 4
ja 0x417908
push str.Microsoft_Windows_NT
call fcn.004c20e0
add esp, 4
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test edi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x417a65
mov al, byte [esp + 0xb2]
cmp al, 1
jne 0x417976
cmp dword [esp + 0x1c], 4
jne 0x417946
push str.Workstation_4.0
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
mov eax, dword [esp + 0xb0]
test ah, 2
je 0x417964
push str.Home_Edition
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
push str.Professional
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
cmp al, 3
jne 0x417b3c
cmp dword [esp + 0x1c], esi
jne 0x417a37
mov eax, dword [esp + 0x20]
cmp eax, 2
jne 0x4179ee
mov eax, dword [esp + 0xb0]
test al, al
jns 0x4179ae
push str.Datacenter_Edition
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
test al, 2
je 0x4179c4
push str.Enterprise_Edition
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
cmp ax, 0x400
jne 0x4179dc
push str.Web_Edition
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
push str.Standard_Edition
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
test eax, eax
jne 0x417a37
mov al, byte [esp + 0xb0]
test al, al
jns 0x417a0f
push str.Datacenter_Server
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
test al, 2
je 0x417a25
push str.Advanced_Server
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
push str.Server
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
test byte [esp + 0xb0], 2
je 0x417a53
push str.Server_4.0__Enterprise_Edition
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
push str.Server_4.0
call fcn.004c20e0
add esp, 4
jmp 0x417b3c
lea edx, [esp + 0x10]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x50
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x417bf4
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xbc]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417bf4
cmp dword [esp + 0x14], esi
ja 0x417bf4
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0xb8]
push ecx
push str.WINNT
call ebx
test eax, eax
jne 0x417ae5
push str.Workstation
call fcn.004c20e0
add esp, 4
lea edx, [esp + 0xb8]
push edx
push str.LANMANNT
call ebx
test eax, eax
jne 0x417b05
push str.Server
call fcn.004c20e0
add esp, 4
lea eax, [esp + 0xb8]
push eax
push str.SERVERNT
call ebx
test eax, eax
jne 0x417b25
push str.Advanced_Server
call fcn.004c20e0
add esp, 4
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push str._d._d
call fcn.004c20e0
add esp, 0xc
cmp dword [esp + 0x1c], 4
jne 0x417bcb
push str.Service_Pack_6
lea eax, [esp + 0x30]
push eax
call ebx
test eax, eax
jne 0x417bcb
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x417b9b
mov edx, dword [esp + 0x24]
and edx, 0xffff
push edx
push str.Service_Pack_6a__Build__d__n
call fcn.004c20e0
mov edx, dword [esp + 0x18]
add esp, 8
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
and eax, 0xffff
push eax
lea ecx, [esp + 0x30]
push ecx
push str._s__Build__d__n
call fcn.004c20e0
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
and eax, 0xffff
push eax
lea ecx, [esp + 0x30]
push ecx
push str._s__Build__d__n
call fcn.004c20e0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov esi, 4
cmp eax, esi
jne 0x417c89
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x417c3f
push str.Microsoft_Windows_95
call fcn.004c20e0
mov al, byte [esp + 0x31]
add esp, 4
cmp al, 0x43
je 0x417c2c
cmp al, 0x42
jne 0x417c39
push str.OSR2
call fcn.004c20e0
add esp, 4
cmp dword [esp + 0x1c], esi
jne 0x417c89
cmp dword [esp + 0x20], 0xa
jne 0x417c6e
push str.Microsoft_Windows_98
call fcn.004c20e0
mov al, byte [esp + 0x31]
add esp, 4
cmp al, 0x41
jne 0x417c68
push 0x59c8cc
call fcn.004c20e0
add esp, 4
cmp dword [esp + 0x1c], esi
jne 0x417c89
cmp dword [esp + 0x20], 0x5a
jne 0x417c89
push str.Microsoft_Windows_Millennium_Edition_n
jmp 0x417c81
push str.Microsoft_Win32s_n
call fcn.004c20e0
add esp, 4
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret