Function at 0x409e30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x124
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x120], eax
push 0xc7
lea eax, [esp + 0x5d]
push 0
push eax
mov byte [esp + 0x64], 0
call fcn.0043abc0
mov eax, dword [esi + 0x14]
add esp, 0xc
sub eax, 0
je 0x40a398
push ebx
mov ebx, 1
sub eax, ebx
push edi
je 0x40a283
sub eax, ebx
je 0x409ec1
push 7
push str.Unknown
lea ecx, [esi + 0xa8]
call fcn.00404f00
push 7
push str.Unknown
lea ecx, [esi + 0xc4]
call fcn.00404f00
pop edi
mov dword [esi + 0xa4], 0
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00436738
add esp, 0x124
ret
cmp dword [esi + 8], 4
ja 0x409ee3
push 0x14
push str.Microsoft_Windows_NT
lea ecx, [esi + 0xa8]
call fcn.00404f00
mov dword [esi + 0xa4], 2
mov edi, 5
cmp dword [esi + 8], edi
jne 0x409f5c
cmp dword [esi + 0xc], 0
jne 0x409f0f
push 0x16
push str.Microsoft_Windows_2000
lea ecx, [esi + 0xa8]
call fcn.00404f00
mov dword [esi + 0xa4], 8
cmp dword [esi + 8], edi
jne 0x409f5c
cmp dword [esi + 0xc], ebx
jne 0x409f35
push 0x14
push str.Microsoft_Windows_XP
lea ecx, [esi + 0xa8]
call fcn.00404f00
mov dword [esi + 0xa4], 9
cmp dword [esi + 8], edi
jne 0x409f5c
cmp dword [esi + 0xc], 2
jb 0x409f5c
push 0x1d
push str.Microsoft_Windows_Server_2003
lea ecx, [esi + 0xa8]
call fcn.00404f00
mov dword [esi + 0xa4], 0xa
cmp dword [esi + 8], 6
jne 0x409f84
cmp dword [esi + 0xc], 0
jne 0x409f84
push 0x17
push str.Microsoft_Windows_Vista
lea ecx, [esi + 0xa8]
call fcn.00404f00
mov dword [esi + 0xa4], 0xb
mov eax, dword [esi + 8]
cmp eax, 6
jne 0x409f9d
cmp dword [esi + 0xc], ebx
jne 0x409f9a
push 0x17
push str.Microsoft_Windows_seven
jmp 0x409fb0
cmp eax, 6
ja 0x409fa9
cmp eax, 6
jne 0x409fc5
cmp dword [esi + 0xc], ebx
jbe 0x409fc5
push 0x2c
push str.Unknown_Windows_version__but_above_Windows_7
lea ecx, [esi + 0xa8]
call fcn.00404f00
mov dword [esi + 0xa4], 0xc
cmp byte [esi + 0xa0], 0
je 0x40a193
mov al, byte [esi + 0x9e]
cmp al, bl
jne 0x40a13a
cmp dword [esi + 8], 6
jne 0x40a100
cmp dword [esi + 0xc], 0
jne 0x40a100
push str.Kernel32
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x40a24c
push str.GetProductInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a0f4
mov edx, dword [esi + 0xc]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esi + 8]
push 0
push 0
push edx
push ecx
call eax
test eax, eax
je 0x40a0f4
mov eax, dword [esp + 8]
cmp eax, 6
je 0x40a04e
cmp eax, 0x10
jne 0x40a063
lea edx, [esi + 0xa8]
push edx
mov edx, str._Business
call fcn.00404aa0
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x40a06c
cmp eax, 0x1c
jne 0x40a081
lea eax, [esi + 0xa8]
push eax
mov edx, str._Ultimate
call fcn.00404aa0
mov eax, dword [esp + 8]
cmp eax, 0x13
jne 0x40a09b
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Home_Server
call fcn.00404aa0
mov eax, dword [esp + 8]
cmp eax, 2
je 0x40a0a5
cmp eax, 5
jne 0x40a0ba
lea edx, [esi + 0xa8]
push edx
mov edx, str._Home_Basic
call fcn.00404aa0
mov eax, dword [esp + 8]
cmp eax, 3
je 0x40a0c4
cmp eax, 0x1a
jne 0x40a0d9
lea eax, [esi + 0xa8]
push eax
mov edx, str._Home_Premium
call fcn.00404aa0
mov eax, dword [esp + 8]
cmp eax, 4
je 0x40a0e3
cmp eax, 0x1b
jne 0x40a0f4
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Enterprise
call fcn.00404aa0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40a24c
mov edx, 0x200
test word [esi + 0x9c], dx
je 0x40a124
lea eax, [esi + 0xa8]
push eax
mov edx, str._Personal
call fcn.00404aa0
jmp 0x40a24c
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Professional
call fcn.00404aa0
jmp 0x40a24c
cmp al, 3
jne 0x40a24c
movzx eax, word [esi + 0x9c]
test al, al
jns 0x40a163
lea edx, [esi + 0xa8]
push edx
mov edx, str._DataCenter_Server
call fcn.00404aa0
jmp 0x40a24c
test al, 2
je 0x40a17d
lea eax, [esi + 0xa8]
push eax
mov edx, str._Advanced_Server
call fcn.00404aa0
jmp 0x40a24c
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Server
call fcn.00404aa0
jmp 0x40a24c
lea edx, [esp + 8]
push edx
push ebx
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push str.WINNT
call fcn.00443916
add esp, 8
test eax, eax
jne 0x40a1fc
push 0xd
push str._Professional
lea eax, [esi + 0xa8]
call fcn.00404b60
lea edx, [esp + 0x10]
push edx
push str.LANMANNT
call fcn.00443916
add esp, 8
test eax, eax
jne 0x40a224
push 7
push str._Server
lea eax, [esi + 0xa8]
call fcn.00404b60
lea eax, [esp + 0x10]
push eax
push str.SERVERNT
call fcn.00443916
add esp, 8
test eax, eax
jne 0x40a24c
push 0x10
push str._Advanced_Server
lea eax, [esi + 0xa8]
call fcn.00404b60
movzx ecx, word [esi + 0x10]
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esi + 0x18]
push edx
push eax
push ecx
lea edx, [esp + 0x70]
push str.Version__d._d__s__Build__d_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x78]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a277
jmp 0x40a36e
mov ebx, 4
cmp dword [esi + 8], ebx
jne 0x40a33c
cmp dword [esi + 0xc], 0
jne 0x40a2d1
push 0x14
lea edi, [esi + 0xa8]
push str.Microsoft_Windows_95
mov ecx, edi
call fcn.00404f00
mov al, byte [esi + 0x19]
mov dword [esi + 0xa4], 3
cmp al, 0x43
je 0x40a2c0
cmp al, 0x42
jne 0x40a2d1
push edi
mov edx, str._OSR2
call fcn.00404aa0
mov dword [esi + 0xa4], ebx
cmp dword [esi + 8], ebx
jne 0x40a33c
cmp dword [esi + 0xc], 0xa
jne 0x40a315
push 0x14
lea edi, [esi + 0xa8]
push str.Microsoft_Windows_98
mov ecx, edi
call fcn.00404f00
cmp byte [esi + 0x19], 0x41
mov dword [esi + 0xa4], 5
jne 0x40a315
push edi
mov edx, 0x495e54
call fcn.00404aa0
mov dword [esi + 0xa4], 6
cmp dword [esi + 8], ebx
jne 0x40a33c
cmp dword [esi + 0xc], 0x5a
jne 0x40a33c
push 0x14
push str.Microsoft_Windows_Me
lea ecx, [esi + 0xa8]
call fcn.00404f00
mov dword [esi + 0xa4], 7
movzx edx, word [esi + 0x10]
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x18]
push ecx
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x70]
push str.Version__d._d_Build__d__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x78]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a367
sub eax, edx
push eax
lea eax, [esp + 0x64]
push eax
lea ecx, [esi + 0xc4]
call fcn.00404f00
pop edi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00436738
add esp, 0x124
ret
push 0x10
push str.Microsoft_Win32s
lea ecx, [esi + 0xa8]
call fcn.00404f00
mov ecx, dword [esp + 0x120]
xor ecx, esp
mov dword [esi + 0xa4], 1
call fcn.00436738
add esp, 0x124
ret