Function at 0x4172e0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x3c8
mov eax, dword [0x4a6c44]
xor eax, esp
mov dword [esp + 0x3c4], eax
push esi
push 0x118
lea eax, [esp + 0x14]
mov byte [0x4ada28], 0
push 0
push eax
call fcn.00447160
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x18]
add esp, 0xc
mov dword [esp + 0xc], 0x11c
push eax
call esi
mov dword [esp + 4], eax
test eax, eax
jne 0x417358
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
call esi
test eax, eax
jne 0x417358
xor al, al
pop esi
mov ecx, dword [esp + 0x3c4]
xor ecx, esp
call fcn.00444138
add esp, 0x3c8
ret
mov eax, dword [esp + 0x1c]
push ebx
push edi
sub eax, 0
je 0x41789d
sub eax, 1
je 0x41774d
sub eax, 1
jne 0x4178d6
mov edx, dword [esp + 0x18]
mov ebx, 0x4ada28
cmp edx, 4
ja 0x4173cb
lea ecx, [ebx - 1]
nop word [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417390
mov eax, dword [str.Microsoft_Windows_NT]
mov dword [ecx], eax
mov eax, dword [0x47fd4c]
mov dword [ecx + 4], eax
mov eax, dword [0x47fd50]
mov dword [ecx + 8], eax
mov eax, dword [0x47fd54]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47fd58]
mov dword [ecx + 0x10], eax
mov ax, word [0x47fd5c]
mov word [ecx + 0x14], ax
push ebp
mov ebp, dword [esp + 0x20]
cmp edx, 5
jne 0x41747e
test ebp, ebp
jne 0x41741b
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4173e0
mov eax, dword [str.Microsoft_Windows_2000]
mov dword [ecx], eax
mov eax, dword [0x47fd64]
mov dword [ecx + 4], eax
mov eax, dword [0x47fd68]
mov dword [ecx + 8], eax
mov eax, dword [0x47fd6c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47fd70]
mov dword [ecx + 0x10], eax
mov eax, dword [0x47fd74]
mov dword [ecx + 0x14], eax
jmp 0x417498
cmp ebp, 1
jne 0x417460
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417423
mov eax, dword [str.Microsoft_Windows_XP]
mov dword [ecx], eax
mov eax, dword [0x47fd7c]
mov dword [ecx + 4], eax
mov eax, dword [0x47fd80]
mov dword [ecx + 8], eax
mov eax, dword [0x47fd84]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47fd88]
mov dword [ecx + 0x10], eax
mov ax, word [0x47fd8c]
mov word [ecx + 0x14], ax
jmp 0x417498
cmp ebp, 2
jne 0x417498
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x417468
mov ecx, 7
mov esi, str.Windows_Server_2003_family
rep movsd dword es:[edi], dword [esi]
jmp 0x417498
jbe 0x417498
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x417483
mov ecx, 6
mov esi, str.Microsoft_Windows_Vista
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 0
je 0x4175ce
mov al, byte [esp + 0x132]
cmp al, 1
jne 0x417518
test dword [esp + 0x130], 0x200
lea ecx, [ebx - 1]
je 0x4174e8
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4174c0
mov eax, dword [str.Personal]
mov dword [ecx], eax
mov eax, dword [0x47fdcc]
mov dword [ecx + 4], eax
mov ax, word [0x47fdd0]
mov word [ecx + 8], ax
jmp 0x4176d9
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4174e8
mov eax, dword [str.Professional]
mov dword [ecx], eax
mov eax, dword [0x47fdd8]
mov dword [ecx + 4], eax
mov eax, dword [0x47fddc]
mov dword [ecx + 8], eax
mov ax, word [0x47fde0]
mov word [ecx + 0xc], ax
jmp 0x4176d9
cmp al, 3
jne 0x4176d9
mov eax, dword [esp + 0x130]
lea ecx, [ebx - 1]
test al, al
jns 0x417570
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417530
mov eax, dword [str.DataCenter_Server]
mov dword [ecx], eax
mov eax, dword [0x47fde8]
mov dword [ecx + 4], eax
mov eax, dword [0x47fdec]
mov dword [ecx + 8], eax
mov eax, dword [0x47fdf0]
mov dword [ecx + 0xc], eax
mov ax, word [0x47fdf4]
mov word [ecx + 0x10], ax
mov al, byte [0x47fdf6]
mov byte [ecx + 0x12], al
jmp 0x4176d9
test al, 2
je 0x4175b0
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417574
mov eax, dword [str.Advanced_Server]
mov dword [ecx], eax
mov eax, dword [0x47fdfc]
mov dword [ecx + 4], eax
mov eax, dword [0x47fe00]
mov dword [ecx + 8], eax
mov eax, dword [0x47fe04]
mov dword [ecx + 0xc], eax
mov al, byte [0x47fe08]
mov byte [ecx + 0x10], al
jmp 0x4176d9
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4175b0
mov eax, dword [str.Server]
mov dword [ecx], eax
mov eax, dword [0x47fe10]
mov dword [ecx + 4], eax
jmp 0x4176d9
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x138]
push eax
push 0
push 0
push str.ProductType
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [esp + 0x134]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x41765b
lea ecx, [ebx - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417630
mov eax, dword [str.Professional]
mov dword [ecx], eax
mov eax, dword [0x47fdd8]
mov dword [ecx + 4], eax
mov eax, dword [0x47fddc]
mov dword [ecx + 8], eax
mov ax, word [0x47fde0]
mov word [ecx + 0xc], ax
lea eax, [esp + 0x134]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x41768a
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417671
mov eax, dword [str.Server]
mov dword [ecx], eax
mov eax, dword [0x47fe10]
mov dword [ecx + 4], eax
lea eax, [esp + 0x134]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x4176d1
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4176a0
mov eax, dword [str.Advanced_Server]
mov dword [ecx], eax
mov eax, dword [0x47fdfc]
mov dword [ecx + 4], eax
mov eax, dword [0x47fe00]
mov dword [ecx + 8], eax
mov eax, dword [0x47fe04]
mov dword [ecx + 0xc], eax
mov al, byte [0x47fe08]
mov byte [ecx + 0x10], al
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
movzx eax, word [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1dc]
cmp edx, 4
ja 0x417702
push ebp
push edx
push str.version__d._d__s__Build__d_
push eax
call fcn.00407cd0
add esp, 0x18
jmp 0x417710
push str._s__Build__d_
push eax
call fcn.00407cd0
add esp, 0x10
lea edx, [esp + 0x1d4]
mov esi, edx
pop ebp
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x417720
sub edx, esi
dec ebx
nop word [eax + eax]
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x417730
mov ecx, edx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4178d6
cmp dword [esp + 0x18], 4
jne 0x4178d6
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4177e2
mov ebx, 0x4ada28
lea ecx, [ebx - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417770
mov eax, dword [str.Microsoft_Windows_95]
mov dword [ecx], eax
mov eax, dword [0x47fef4]
mov dword [ecx + 4], eax
mov eax, dword [0x47fef8]
mov dword [ecx + 8], eax
mov eax, dword [0x47fefc]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47ff00]
mov dword [ecx + 0x10], eax
movzx eax, word [0x47ff04]
mov word [ecx + 0x14], ax
mov ax, word [esp + 0x2a]
cmp ax, 0x43
je 0x4177c1
cmp ax, 0x42
jne 0x4178d6
dec ebx
mov al, byte [ebx + 1]
lea ebx, [ebx + 1]
test al, al
jne 0x4177c2
mov eax, dword [str.OSR2]
mov dword [ebx], eax
mov ax, word [0x47ff0c]
mov word [ebx + 4], ax
jmp 0x4178d6
cmp eax, 0xa
jne 0x41784e
mov ebx, 0x4ada28
lea ecx, [ebx - 1]
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4177f0
cmp word [esp + 0x2a], 0x41
mov eax, dword [str.Microsoft_Windows_98]
mov dword [ecx], eax
mov eax, dword [0x47ff14]
mov dword [ecx + 4], eax
mov eax, dword [0x47ff18]
mov dword [ecx + 8], eax
mov eax, dword [0x47ff1c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47ff20]
mov dword [ecx + 0x10], eax
mov ax, word [0x47ff24]
mov word [ecx + 0x14], ax
jne 0x4178d6
dec ebx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x417838
mov eax, dword [0x47ff28]
mov edi, ebx
mov dword [edi], eax
jmp 0x4178d6
cmp eax, 0x5a
jne 0x4178d6
mov ecx, 0x4ada28
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x417860
mov eax, dword [str.Microsoft_Windows_Me]
mov dword [ecx], eax
mov eax, dword [0x47ff30]
mov dword [ecx + 4], eax
mov eax, dword [0x47ff34]
mov dword [ecx + 8], eax
mov eax, dword [0x47ff38]
mov dword [ecx + 0xc], eax
mov eax, dword [0x47ff3c]
mov dword [ecx + 0x10], eax
mov ax, word [0x47ff40]
mov word [ecx + 0x14], ax
jmp 0x4178d6
mov ecx, 0x4ada28
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4178a3
mov eax, dword [str.Microsoft_Win32s]
mov dword [ecx], eax
mov eax, dword [0x47ff48]
mov dword [ecx + 4], eax
mov eax, dword [0x47ff4c]
mov dword [ecx + 8], eax
mov eax, dword [0x47ff50]
mov dword [ecx + 0xc], eax
mov ax, word [0x47ff54]
mov word [ecx + 0x10], ax
mov ecx, dword [esp + 0x3d0]
mov al, 1
pop edi
pop ebx
pop esi
xor ecx, esp
call fcn.00444138
add esp, 0x3c8
ret