Function at 0x4253be
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa4]
sub esp, 0x124
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp + 0xa0], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0xc7
lea eax, [ebp - 0x77]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x78], bl
call fcn.00443310
mov eax, dword [esi + 0x14]
add esp, 0xc
sub eax, ebx
je 0x42573c
dec eax
je 0x425658
dec eax
je 0x425432
mov edi, str.Unknown
push edi
lea ecx, [esi + 0xb4]
call fcn.0040332a
push edi
lea ecx, [esi + 0xd0]
call fcn.0040332a
mov dword [esi + 0xa4], ebx
jmp 0x425756
cmp dword [esi + 8], 4
ja 0x425452
push str.Microsoft_Windows_NT
lea ecx, [esi + 0xb4]
call fcn.0040332a
mov dword [esi + 0xa4], 2
cmp dword [esi + 8], 5
jne 0x4254c3
cmp dword [esi + 0xc], ebx
jne 0x425477
push str.Microsoft_Windows_2000
lea ecx, [esi + 0xb4]
call fcn.0040332a
mov dword [esi + 0xa4], 8
cmp dword [esi + 8], 5
jne 0x4254c3
cmp dword [esi + 0xc], 1
jne 0x42549d
push str.Microsoft_Windows_XP
lea ecx, [esi + 0xb4]
call fcn.0040332a
mov dword [esi + 0xa4], 9
cmp dword [esi + 8], 5
jne 0x4254c3
cmp dword [esi + 0xc], 2
jb 0x4254c3
push str.Microsoft_Windows_Server_2003
lea ecx, [esi + 0xb4]
call fcn.0040332a
mov dword [esi + 0xa4], 0xa
push 6
pop edi
cmp dword [esi + 8], edi
jne 0x4254ea
cmp dword [esi + 0xc], ebx
jne 0x4254ea
push str.Microsoft_Windows_Vista
lea ecx, [esi + 0xb4]
call fcn.0040332a
mov dword [esi + 0xa4], 0xb
mov eax, dword [esi + 8]
cmp eax, edi
jne 0x425500
cmp dword [esi + 0xc], 1
jne 0x4254fe
push str.Microsoft_Windows_seven
jmp 0x425511
cmp eax, edi
ja 0x42550c
cmp eax, edi
jne 0x425526
cmp dword [esi + 0xc], 1
jbe 0x425526
push str.Unknown_Windows_version__but_above_Windows_7
lea ecx, [esi + 0xb4]
call fcn.0040332a
mov dword [esi + 0xa4], 0xc
cmp byte [esi + 0xa0], bl
je 0x42559b
mov al, byte [esi + 0x9e]
cmp al, 1
jne 0x425560
mov eax, 0x200
lea ecx, [esi + 0xb4]
test word [esi + 0x9c], ax
je 0x425556
push str._Personal
jmp 0x42563a
push str._Professional
jmp 0x42563a
cmp al, 3
jne 0x42563f
movzx eax, word [esi + 0x9c]
test al, al
jns 0x42557d
push str._DataCenter_Server
jmp 0x425634
lea ecx, [esi + 0xb4]
test al, 2
je 0x425591
push str._Advanced_Server
jmp 0x42563a
push str._Server
jmp 0x42563a
lea eax, [ebp - 0x7c]
push eax
push 1
push ebx
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x50]
push eax
push ebx
push ebx
push str.ProductType
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x50]
push eax
push str.WINNT
call fcn.00451a04
pop ecx
pop ecx
test eax, eax
jne 0x4255f7
push str._Professional
lea ecx, [esi + 0xb4]
call fcn.00403347
lea eax, [ebp + 0x50]
push eax
push str.LANMANNT
call fcn.00451a04
pop ecx
pop ecx
test eax, eax
jne 0x42561b
push str._Server
lea ecx, [esi + 0xb4]
call fcn.00403347
lea eax, [ebp + 0x50]
push eax
push str.SERVERNT
call fcn.00451a04
pop ecx
pop ecx
test eax, eax
jne 0x42563f
push str._Advanced_Server
lea ecx, [esi + 0xb4]
call fcn.00403347
movzx eax, word [esi + 0x10]
push eax
lea eax, [esi + 0x18]
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push str.Version__d._d__s__Build__d_
jmp 0x42571e
cmp dword [esi + 8], 4
jne 0x42570a
cmp dword [esi + 0xc], ebx
jne 0x4256a2
lea ebx, [esi + 0xb4]
push str.Microsoft_Windows_95
mov ecx, ebx
call fcn.0040332a
mov al, byte [esi + 0x19]
lea edi, [esi + 0xa4]
mov dword [edi], 3
cmp al, 0x43
je 0x425690
cmp al, 0x42
jne 0x4256a2
push str._OSR2
mov ecx, ebx
call fcn.00403347
mov dword [edi], 4
cmp dword [esi + 8], 4
jne 0x42570a
cmp dword [esi + 0xc], 0xa
jne 0x4256e4
lea ebx, [esi + 0xb4]
push str.Microsoft_Windows_98
mov ecx, ebx
call fcn.0040332a
cmp byte [esi + 0x19], 0x41
lea edi, [esi + 0xa4]
mov dword [edi], 5
jne 0x4256e4
push 0x46637c
mov ecx, ebx
call fcn.00403347
mov dword [edi], 6
cmp dword [esi + 8], 4
jne 0x42570a
cmp dword [esi + 0xc], 0x5a
jne 0x42570a
push str.Microsoft_Windows_Me
lea ecx, [esi + 0xb4]
call fcn.0040332a
mov dword [esi + 0xa4], 7
lea eax, [esi + 0x18]
push eax
movzx eax, word [esi + 0x10]
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push str.Version__d._d_Build__d__s
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
lea ecx, [esi + 0xd0]
call fcn.0040332a
jmp 0x425756
push str.Microsoft_Win32s
lea ecx, [esi + 0xb4]
call fcn.0040332a
mov dword [esi + 0xa4], 1
mov ecx, dword [ebp + 0xa0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004432f5
add ebp, 0xa4
leave
ret