Function at 0x409e10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x124
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x120], eax
push 0xc7
lea eax, [esp + 0x5d]
push 0
push eax
mov byte [esp + 0x64], 0
call fcn.0043aba0
mov eax, dword [esi + 0x14]
add esp, 0xc
sub eax, 0
je 0x40a378
push ebx
mov ebx, 1
sub eax, ebx
push edi
je 0x40a263
sub eax, ebx
je 0x409ea1
push 7
push str.Unknown
lea ecx, [esi + 0xa8]
call fcn.00404eb0
push 7
push str.Unknown
lea ecx, [esi + 0xc4]
call fcn.00404eb0
pop edi
mov dword [esi + 0xa4], 0
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.0043671a
add esp, 0x124
ret
cmp dword [esi + 8], 4
ja 0x409ec3
push 0x14
push str.Microsoft_Windows_NT
lea ecx, [esi + 0xa8]
call fcn.00404eb0
mov dword [esi + 0xa4], 2
mov edi, 5
cmp dword [esi + 8], edi
jne 0x409f3c
cmp dword [esi + 0xc], 0
jne 0x409eef
push 0x16
push str.Microsoft_Windows_2000
lea ecx, [esi + 0xa8]
call fcn.00404eb0
mov dword [esi + 0xa4], 8
cmp dword [esi + 8], edi
jne 0x409f3c
cmp dword [esi + 0xc], ebx
jne 0x409f15
push 0x14
push str.Microsoft_Windows_XP
lea ecx, [esi + 0xa8]
call fcn.00404eb0
mov dword [esi + 0xa4], 9
cmp dword [esi + 8], edi
jne 0x409f3c
cmp dword [esi + 0xc], 2
jb 0x409f3c
push 0x1d
push str.Microsoft_Windows_Server_2003
lea ecx, [esi + 0xa8]
call fcn.00404eb0
mov dword [esi + 0xa4], 0xa
cmp dword [esi + 8], 6
jne 0x409f64
cmp dword [esi + 0xc], 0
jne 0x409f64
push 0x17
push str.Microsoft_Windows_Vista
lea ecx, [esi + 0xa8]
call fcn.00404eb0
mov dword [esi + 0xa4], 0xb
mov eax, dword [esi + 8]
cmp eax, 6
jne 0x409f7d
cmp dword [esi + 0xc], ebx
jne 0x409f7a
push 0x17
push str.Microsoft_Windows_seven
jmp 0x409f90
cmp eax, 6
ja 0x409f89
cmp eax, 6
jne 0x409fa5
cmp dword [esi + 0xc], ebx
jbe 0x409fa5
push 0x2c
push str.Unknown_Windows_version__but_above_Windows_7
lea ecx, [esi + 0xa8]
call fcn.00404eb0
mov dword [esi + 0xa4], 0xc
cmp byte [esi + 0xa0], 0
je 0x40a173
mov al, byte [esi + 0x9e]
cmp al, bl
jne 0x40a11a
cmp dword [esi + 8], 6
jne 0x40a0e0
cmp dword [esi + 0xc], 0
jne 0x40a0e0
push str.Kernel32
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x40a22c
push str.GetProductInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a0d4
mov edx, dword [esi + 0xc]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esi + 8]
push 0
push 0
push edx
push ecx
call eax
test eax, eax
je 0x40a0d4
mov eax, dword [esp + 8]
cmp eax, 6
je 0x40a02e
cmp eax, 0x10
jne 0x40a043
lea edx, [esi + 0xa8]
push edx
mov edx, str._Business
call fcn.00404aa0
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x40a04c
cmp eax, 0x1c
jne 0x40a061
lea eax, [esi + 0xa8]
push eax
mov edx, str._Ultimate
call fcn.00404aa0
mov eax, dword [esp + 8]
cmp eax, 0x13
jne 0x40a07b
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Home_Server
call fcn.00404aa0
mov eax, dword [esp + 8]
cmp eax, 2
je 0x40a085
cmp eax, 5
jne 0x40a09a
lea edx, [esi + 0xa8]
push edx
mov edx, str._Home_Basic
call fcn.00404aa0
mov eax, dword [esp + 8]
cmp eax, 3
je 0x40a0a4
cmp eax, 0x1a
jne 0x40a0b9
lea eax, [esi + 0xa8]
push eax
mov edx, str._Home_Premium
call fcn.00404aa0
mov eax, dword [esp + 8]
cmp eax, 4
je 0x40a0c3
cmp eax, 0x1b
jne 0x40a0d4
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Enterprise
call fcn.00404aa0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40a22c
mov edx, 0x200
test word [esi + 0x9c], dx
je 0x40a104
lea eax, [esi + 0xa8]
push eax
mov edx, str._Personal
call fcn.00404aa0
jmp 0x40a22c
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Professional
call fcn.00404aa0
jmp 0x40a22c
cmp al, 3
jne 0x40a22c
movzx eax, word [esi + 0x9c]
test al, al
jns 0x40a143
lea edx, [esi + 0xa8]
push edx
mov edx, str._DataCenter_Server
call fcn.00404aa0
jmp 0x40a22c
test al, 2
je 0x40a15d
lea eax, [esi + 0xa8]
push eax
mov edx, str._Advanced_Server
call fcn.00404aa0
jmp 0x40a22c
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Server
call fcn.00404aa0
jmp 0x40a22c
lea edx, [esp + 8]
push edx
push ebx
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push str.WINNT
call fcn.004438f6
add esp, 8
test eax, eax
jne 0x40a1dc
push 0xd
push str._Professional
lea eax, [esi + 0xa8]
call fcn.00404b10
lea edx, [esp + 0x10]
push edx
push str.LANMANNT
call fcn.004438f6
add esp, 8
test eax, eax
jne 0x40a204
push 7
push str._Server
lea eax, [esi + 0xa8]
call fcn.00404b10
lea eax, [esp + 0x10]
push eax
push str.SERVERNT
call fcn.004438f6
add esp, 8
test eax, eax
jne 0x40a22c
push 0x10
push str._Advanced_Server
lea eax, [esi + 0xa8]
call fcn.00404b10
movzx ecx, word [esi + 0x10]
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esi + 0x18]
push edx
push eax
push ecx
lea edx, [esp + 0x70]
push str.Version__d._d__s__Build__d_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x78]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a257
jmp 0x40a34e
mov ebx, 4
cmp dword [esi + 8], ebx
jne 0x40a31c
cmp dword [esi + 0xc], 0
jne 0x40a2b1
push 0x14
lea edi, [esi + 0xa8]
push str.Microsoft_Windows_95
mov ecx, edi
call fcn.00404eb0
mov al, byte [esi + 0x19]
mov dword [esi + 0xa4], 3
cmp al, 0x43
je 0x40a2a0
cmp al, 0x42
jne 0x40a2b1
push edi
mov edx, str._OSR2
call fcn.00404aa0
mov dword [esi + 0xa4], ebx
cmp dword [esi + 8], ebx
jne 0x40a31c
cmp dword [esi + 0xc], 0xa
jne 0x40a2f5
push 0x14
lea edi, [esi + 0xa8]
push str.Microsoft_Windows_98
mov ecx, edi
call fcn.00404eb0
cmp byte [esi + 0x19], 0x41
mov dword [esi + 0xa4], 5
jne 0x40a2f5
push edi
mov edx, 0x495e94
call fcn.00404aa0
mov dword [esi + 0xa4], 6
cmp dword [esi + 8], ebx
jne 0x40a31c
cmp dword [esi + 0xc], 0x5a
jne 0x40a31c
push 0x14
push str.Microsoft_Windows_Me
lea ecx, [esi + 0xa8]
call fcn.00404eb0
mov dword [esi + 0xa4], 7
movzx edx, word [esi + 0x10]
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x18]
push ecx
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x70]
push str.Version__d._d_Build__d__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x78]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a347
sub eax, edx
push eax
lea eax, [esp + 0x64]
push eax
lea ecx, [esi + 0xc4]
call fcn.00404eb0
pop edi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.0043671a
add esp, 0x124
ret
push 0x10
push str.Microsoft_Win32s
lea ecx, [esi + 0xa8]
call fcn.00404eb0
mov ecx, dword [esp + 0x120]
xor ecx, esp
mov dword [esi + 0xa4], 1
call fcn.0043671a
add esp, 0x124
ret