Function at 0x403d50
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x138
mov eax, dword [0x41c690]
xor eax, esp
mov dword [esp + 0x134], eax
mov eax, dword [0x41dd40]
push ebx
mov ebx, dword [esp + 0x140]
push ebp
push esi
push edi
mov byte [ebx], 0
test eax, eax
jne 0x403d85
call fcn.00403940
mov dword [0x41dd40], eax
mov ebp, eax
add eax, 0xfffffffe
cmp eax, 0x15
ja case.default.0x403d93
jmp dword [eax*4 + 0x403fe0]
mov esi, 0x41c26c
jmp 0x403e38
mov esi, 0x41c270
jmp 0x403e38
mov esi, 0x41c274
jmp 0x403e38
mov esi, 0x41c278
jmp 0x403e38
mov esi, str.2000
jmp 0x403e38
mov esi, 0x41c284
jmp 0x403e38
mov esi, str.Server_2003
jmp 0x403e38
mov esi, str.XP_Professional
jmp 0x403e38
mov esi, str.Home_Server
jmp 0x403e38
mov esi, str.Server_2003_R2
jmp 0x403e38
mov esi, str.Server_2008
jmp 0x403e38
mov esi, str.Vista
jmp 0x403e38
mov esi, str.Server_2008_R2
jmp 0x403e38
mov esi, 0x41c2e4
jmp 0x403e38
mov esi, str.Server_2012
jmp 0x403e38
mov esi, 0x41c2f4
jmp 0x403e38
mov esi, 0x41c2f8
jmp 0x403e38
mov esi, str.Server_2012_R2
jmp 0x403e38
mov esi, str.Server_Technical_Preview
jmp 0x403e38
mov esi, 0x41c328
jmp 0x403e38
mov esi, 0x41c32c
jmp 0x403e38
xor esi, esi
mov edi, dword [esp + 0x150]
push edi
push ebx
push str.Windows
call fcn.00401190
add esp, 0xc
test esi, esi
je 0x403e69
push edi
push ebx
push 0x41c030
call fcn.00401190
push edi
push ebx
push esi
call fcn.00401190
add esp, 0x18
push 0x9c
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00409190
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x9c
call esi
test eax, eax
jne 0x403ead
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0x94
call esi
test eax, eax
je 0x403fc4
cmp ebp, 5
jl 0x403f54
cmp ebp, 6
jg 0x403f54
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xb8]
push edx
push 0
push 0
push str._ProductType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0xb4]
push edx
push str.WINNT
call fcn.004100a8
add esp, 8
test eax, eax
jne 0x403f2c
push edi
push ebx
push str._Workstation
call fcn.00401190
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
push str.SERVERNT
call fcn.004100a8
add esp, 8
test eax, eax
jne 0x403f54
push edi
push ebx
push str._Server
call fcn.00401190
add esp, 0xc
movzx ecx, word [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push str.__d._d._d
lea ecx, [esp + 0x114]
push 0x3f
push ecx
call fcn.0040a1bb
push edi
lea edx, [esp + 0x120]
push ebx
push edx
call fcn.00401190
add esp, 0x24
cmp byte [esp + 0x2c], 0
je 0x403fac
push edi
push ebx
push 0x41c030
call fcn.00401190
push edi
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00401190
add esp, 0x18
call fcn.00403ce0
test al, al
je 0x403fc4
push edi
push ebx
push str._64_bit
call fcn.00401190
add esp, 0xc
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408f97
add esp, 0x138
ret