Function at 0x44c600
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x56d380]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x570518], 0
je 0x44c62c
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00500397
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x11c
push 0
push 0x5703d8
call fcn.00500080
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
push 0x5703d8
mov dword [0x5703d8], 0x11c
call esi
mov edi, eax
test edi, edi
jne 0x44c684
push 0x5703d8
mov dword [0x5703d8], 0x114
call esi
test eax, eax
jne 0x44c684
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00500397
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5703e8]
sub eax, 0
push ebx
je 0x44cbf5
dec eax
je 0x44cb31
dec eax
jne 0x44cc0f
lea esi, [eax + 9]
mov eax, dword [0x5703dc]
cmp eax, 6
jb 0x44c721
mov eax, dword [0x5703e0]
test eax, eax
jne 0x44c6e8
cmp byte [0x5704f2], 1
jne 0x44c6d4
mov dword [0x57051c], 0xc
push str.Microsoft_Windows_Vista
jmp 0x44c7e2
mov dword [0x57051c], 0xb
push str.Windows_Server__Longhorn_
jmp 0x44c7e2
cmp eax, 1
jne 0x44c7ed
cmp byte [0x5704f2], al
jne 0x44c70d
mov dword [0x57051c], 0xd
push str.Microsoft_Windows_7
jmp 0x44c7e2
mov dword [0x57051c], 0xe
push str.Microsoft_Server_2008_R2
jmp 0x44c7e2
cmp eax, 5
jne 0x44c7ce
mov eax, dword [0x5703e0]
cmp eax, 2
jne 0x44c7a3
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44c756
push 0x5704f4
call eax
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x44c76f
mov dword [0x57051c], esi
push str.Microsoft_Windows_Server_2003__R2_
jmp 0x44c7e2
cmp byte [0x5704f2], 1
jne 0x44c792
cmp word [0x5704f4], si
jne 0x44c792
mov dword [0x57051c], 0xa
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x44c7e2
mov dword [0x57051c], 8
push str.Microsoft_Windows_Server_2003_
jmp 0x44c7e2
cmp eax, 1
jne 0x44c7b9
mov dword [0x57051c], 7
push str.Microsoft_Windows_XP
jmp 0x44c7e2
test eax, eax
jne 0x44c7ed
mov dword [0x57051c], 6
push str.Microsoft_Windows_2000
jmp 0x44c7e2
cmp eax, 4
ja 0x44c7ed
mov dword [0x57051c], 5
push str.Microsoft_Windows_NT
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test edi, edi
je 0x44ca12
mov al, byte [0x5704f2]
cmp al, 1
jne 0x44c865
cmp word [0x5704f4], si
je 0x44cad7
cmp dword [0x5703dc], 4
jne 0x44c82f
push str.Workstation_4.0
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
test dword [0x5704f0], 0x200
je 0x44c850
push str.Home_Edition
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
push str.Professional
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
cmp al, 3
je 0x44c871
cmp al, 2
jne 0x44cad7
cmp dword [0x5703dc], 5
jne 0x44c9df
mov eax, dword [0x5703e0]
cmp eax, 2
jne 0x44c98f
mov ax, word [0x5704f4]
cmp ax, 6
jne 0x44c8d3
mov al, byte [0x5704f0]
test al, al
jns 0x44c8b6
push str.Datacenter_Edition_for_Itanium_based_Systems
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
test al, 2
je 0x44cc0f
push str.Enterprise_Edition_for_Itanium_based_Systems
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
cmp ax, si
jne 0x44c924
mov al, byte [0x5704f0]
test al, al
jns 0x44c8f6
push str.Datacenter_x64_Edition
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
test al, 2
je 0x44c90f
push str.Enterprise_x64_Edition
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
push str.Standard_x64_Edition
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
mov eax, dword [0x5704f0]
test al, al
jns 0x44c942
push str.Datacenter_Edition
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
test al, 2
je 0x44c95b
push str.Enterprise_Edition
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
mov ecx, 0x400
cmp ax, cx
jne 0x44c97a
push str.Web_Edition
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
push str.Standard_Edition
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
test eax, eax
jne 0x44c9df
mov al, byte [0x5704f0]
test al, al
jns 0x44c9b1
push str.Datacenter_Server
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
test al, 2
je 0x44c9ca
push str.Advanced_Server
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
push str.Server
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
test byte [0x5704f0], 2
je 0x44c9fd
push str.Server_4.0__Enterprise_Edition
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
push str.Server_4.0
push 0x570520
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x44cad7
lea edx, [ebp - 0x5c]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov edi, 0x50
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x58], edi
call ebx
test eax, eax
jne 0x44cb1e
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x44cb1e
cmp dword [ebp - 0x58], edi
ja 0x44cb1e
lea ecx, [ebp - 0x54]
push ecx
push str.WINNT
call fcn.00504686
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 8
test eax, eax
jne 0x44ca95
push str.Workstation
push 0x570520
call esi
lea edx, [ebp - 0x54]
push edx
push str.LANMANNT
call fcn.00504686
add esp, 8
test eax, eax
jne 0x44cab6
push str.Server
push 0x570520
call esi
lea eax, [ebp - 0x54]
push eax
push str.SERVERNT
call fcn.00504686
add esp, 8
test eax, eax
jne 0x44cad7
push str.Advanced_Server
push 0x570520
call esi
cmp dword [0x5703dc], 4
jne 0x44cc0f
push str.Service_Pack_6
push 0x5703ec
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44cc0f
lea ecx, [ebp - 0x58]
push ecx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.WS2_32.dll_bind
call ebx
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44cc0f
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00500397
mov esp, ebp
pop ebp
ret
mov ebx, 4
cmp dword [0x5703dc], ebx
jne 0x44cc0f
cmp dword [0x5703e0], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
jne 0x44cb93
push str.Microsoft_Windows_95
push 0x570520
mov dword [0x57051c], 2
call esi
mov ax, word [0x5703ee]
cmp ax, 0x43
je 0x44cb7f
cmp ax, 0x42
jne 0x44cb8b
push str.OSR2
push 0x570520
call edi
cmp dword [0x5703dc], ebx
jne 0x44cc0f
cmp dword [0x5703e0], 0xa
jne 0x44cbd8
push str.Microsoft_Windows_98
push 0x570520
mov dword [0x57051c], 3
call esi
mov ax, word [0x5703ee]
cmp ax, 0x41
je 0x44cbc4
cmp ax, 0x42
jne 0x44cbd0
push 0x545314
push 0x570520
call edi
cmp dword [0x5703dc], ebx
jne 0x44cc0f
cmp dword [0x5703e0], 0x5a
jne 0x44cc0f
push str.Microsoft_Windows_Millennium_Edition_n
push 0x570520
mov dword [0x57051c], ebx
call esi
jmp 0x44cc0f
push 0x5452a4
push 0x570520
mov dword [0x57051c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 4]
pop ebx
mov eax, 1
pop edi
xor ecx, ebp
mov dword [0x570518], eax
pop esi
call fcn.00500397
mov esp, ebp
pop ebp
ret