Function at 0x4a8e75
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push 0x11c
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.004ba860
add esp, 0xc
mov dword [ebp - 0x11c], 0x11c
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jne 0x4a8edc
mov dword [ebp - 0x11c], 0x114
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4a8edc
xor eax, eax
jmp 0x4a958f
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
je 0x4a9563
cmp dword [ebp - 0x45c], 1
je 0x4a94de
cmp dword [ebp - 0x45c], 2
je 0x4a8f10
jmp 0x4a9577
cmp dword [ebp - 0x118], 6
jne 0x4a8f5f
cmp dword [ebp - 0x114], 0
jne 0x4a8f5f
mov ecx, dword [ebp - 2]
and ecx, 0xff
cmp ecx, 1
jne 0x4a8f46
push str.Windows_Vista
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba79a
add esp, 8
jmp 0x4a8f5a
push str.Windows_Server__Longhorn_
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ba79a
add esp, 8
jmp 0x4a90b4
cmp dword [ebp - 0x118], 5
jne 0x4a9025
cmp dword [ebp - 0x114], 2
jne 0x4a9025
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x4a8fac
lea ecx, [ebp - 0x1ac]
push ecx
call dword [ebp - 0x120]
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4a8fce
push str.Windows_Server_2003__R2_
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba79a
add esp, 8
jmp 0x4a9020
mov eax, dword [ebp - 2]
and eax, 0xff
cmp eax, 1
jne 0x4a900c
mov ecx, dword [ebp - 0x1ac]
and ecx, 0xffff
cmp ecx, 9
jne 0x4a900c
push str.Windows_XP_Professional_x64_Edition
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba79a
add esp, 8
mov dword [0x5340c4], 1
jmp 0x4a9020
push str.Windows_Server_2003
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ba79a
add esp, 8
jmp 0x4a90b4
cmp dword [ebp - 0x118], 5
jne 0x4a9065
cmp dword [ebp - 0x114], 1
jne 0x4a9065
push str.Windows_XP
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba79a
add esp, 8
mov edx, dword [ebp - 8]
and edx, 0xffff
cmp edx, 3
jne 0x4a9063
mov dword [0x5340c0], 1
jmp 0x4a90b4
cmp dword [ebp - 0x118], 5
jne 0x4a9097
cmp dword [ebp - 0x114], 0
jne 0x4a9097
push str.Windows_2000
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ba79a
add esp, 8
mov dword [0x5340b8], 1
jmp 0x4a90b4
cmp dword [ebp - 0x118], 4
ja 0x4a90b4
push str.Windows_NT
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba79a
add esp, 8
cmp dword [ebp - 0x188], 0
je 0x4a9394
mov edx, dword [ebp - 2]
and edx, 0xff
cmp edx, 1
jne 0x4a9140
mov eax, dword [ebp - 0x1ac]
and eax, 0xffff
cmp eax, 9
je 0x4a9140
cmp dword [ebp - 0x118], 4
jne 0x4a90fe
push str._Workstation_4.0
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba770
add esp, 8
jmp 0x4a913b
mov edx, dword [ebp - 4]
and edx, 0xffff
and edx, 0x200
test edx, edx
je 0x4a9127
push str._Home_Edition
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ba770
add esp, 8
jmp 0x4a913b
push str._Professional
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba770
add esp, 8
jmp 0x4a938f
mov edx, dword [ebp - 2]
and edx, 0xff
cmp edx, 3
je 0x4a915f
mov eax, dword [ebp - 2]
and eax, 0xff
cmp eax, 2
jne 0x4a938f
cmp dword [ebp - 0x118], 5
jne 0x4a92e0
cmp dword [ebp - 0x114], 2
jne 0x4a92e0
mov ecx, dword [ebp - 0x1ac]
and ecx, 0xffff
cmp ecx, 6
jne 0x4a91dc
mov edx, dword [ebp - 4]
and edx, 0xffff
and edx, 0x80
test edx, edx
je 0x4a91b3
push 0x52202c
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ba770
add esp, 8
jmp 0x4a91d7
mov ecx, dword [ebp - 4]
and ecx, 0xffff
and ecx, 2
test ecx, ecx
je 0x4a91d7
push 0x522054
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba770
add esp, 8
jmp 0x4a92db
mov eax, dword [ebp - 0x1ac]
and eax, 0xffff
cmp eax, 9
jne 0x4a9253
mov ecx, dword [ebp - 4]
and ecx, 0xffff
and ecx, 0x80
test ecx, ecx
je 0x4a9215
push str.Datacenter_x64_Edition
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba770
add esp, 8
jmp 0x4a924e
mov eax, dword [ebp - 4]
and eax, 0xffff
and eax, 2
test eax, eax
je 0x4a923a
push str.Enterprise_x64_Edition
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba770
add esp, 8
jmp 0x4a924e
push str.Standard_x64_Edition
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba770
add esp, 8
jmp 0x4a92db
mov eax, dword [ebp - 4]
and eax, 0xffff
and eax, 0x80
test eax, eax
je 0x4a927a
push str.Datacenter_Edition
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba770
add esp, 8
jmp 0x4a92db
mov edx, dword [ebp - 4]
and edx, 0xffff
and edx, 2
test edx, edx
je 0x4a92a0
push str.Enterprise_Edition
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ba770
add esp, 8
jmp 0x4a92db
mov ecx, dword [ebp - 4]
and ecx, 0xffff
cmp ecx, 0x400
jne 0x4a92c7
push str.Web_Edition
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba770
add esp, 8
jmp 0x4a92db
push str.Standard_Edition
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ba770
add esp, 8
jmp 0x4a938f
cmp dword [ebp - 0x118], 5
jne 0x4a9356
cmp dword [ebp - 0x114], 0
jne 0x4a9356
mov ecx, dword [ebp - 4]
and ecx, 0xffff
and ecx, 0x80
test ecx, ecx
je 0x4a931b
push str.Datacenter_Server
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba770
add esp, 8
jmp 0x4a9354
mov eax, dword [ebp - 4]
and eax, 0xffff
and eax, 2
test eax, eax
je 0x4a9340
push 0x5221c0
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba770
add esp, 8
jmp 0x4a9354
push 0x5221e4
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba770
add esp, 8
jmp 0x4a938f
mov eax, dword [ebp - 4]
and eax, 0xffff
and eax, 2
test eax, eax
je 0x4a937b
push str.Server_4.0__Enterprise_Edition
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba770
add esp, 8
jmp 0x4a938f
push str.Server_4.0
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba770
add esp, 8
jmp 0x4a94d9
mov dword [ebp - 0x458], 0xa0
lea eax, [ebp - 0x454]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
je 0x4a93cf
xor eax, eax
jmp 0x4a958f
lea ecx, [ebp - 0x458]
push ecx
lea edx, [ebp - 0x450]
push edx
push 0
push 0
push str.ProductType
mov eax, dword [ebp - 0x454]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x3b0], eax
mov ecx, dword [ebp - 0x454]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3b0], 0
jne 0x4a9418
cmp dword [ebp - 0x458], 0x50
jbe 0x4a941f
xor eax, eax
jmp 0x4a958f
lea edx, [ebp - 0x450]
push edx
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4a944b
push str.Workstation
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ba770
add esp, 8
jmp 0x4a94a1
lea ecx, [ebp - 0x450]
push ecx
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4a9477
push str.Server
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba770
add esp, 8
jmp 0x4a94a1
lea eax, [ebp - 0x450]
push eax
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4a94a1
push str.Advanced_Server
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba770
add esp, 8
mov edx, dword [ebp - 0x114]
push edx
mov eax, dword [ebp - 0x118]
push eax
push str._d._d
lea ecx, [ebp - 0x184]
push ecx
call fcn.004ba7bf
add esp, 0x10
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ba770
add esp, 8
jmp 0x4a9577
cmp dword [ebp - 0x118], 4
jne 0x4a953b
cmp dword [ebp - 0x114], 0xa
jne 0x4a953b
push str.Windows_98
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba79a
add esp, 8
mov edx, dword [ebp - 0x106]
and edx, 0xffff
cmp edx, 0x41
je 0x4a9525
mov eax, dword [ebp - 0x106]
and eax, 0xffff
cmp eax, 0x42
jne 0x4a9539
push 0x522370
lea ecx, [ebp - 0x3ac]
push ecx
call fcn.004ba770
add esp, 8
jmp 0x4a9561
cmp dword [ebp - 0x118], 4
jne 0x4a9561
cmp dword [ebp - 0x114], 0x5a
jne 0x4a9561
push str.Windows_ME
lea edx, [ebp - 0x3ac]
push edx
call fcn.004ba79a
add esp, 8
jmp 0x4a9577
push str.Microsoft_Win32s_n
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ba79a
add esp, 8
lea ecx, [ebp - 0x3ac]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004ba79a
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret