Function at 0x409f20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x124
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x120], eax
push 0xc7
lea eax, [esp + 0x5d]
push 0
push eax
mov byte [esp + 0x64], 0
call fcn.0043abe0
mov eax, dword [esi + 0x14]
add esp, 0xc
sub eax, 0
je 0x40a488
push ebx
mov ebx, 1
sub eax, ebx
push edi
je 0x40a373
sub eax, ebx
je 0x409fb1
push 7
push str.Unknown
lea ecx, [esi + 0xa8]
call fcn.00404f50
push 7
push str.Unknown
lea ecx, [esi + 0xc4]
call fcn.00404f50
pop edi
mov dword [esi + 0xa4], 0
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.0043675a
add esp, 0x124
ret
cmp dword [esi + 8], 4
ja 0x409fd3
push 0x14
push str.Microsoft_Windows_NT
lea ecx, [esi + 0xa8]
call fcn.00404f50
mov dword [esi + 0xa4], 2
mov edi, 5
cmp dword [esi + 8], edi
jne 0x40a04c
cmp dword [esi + 0xc], 0
jne 0x409fff
push 0x16
push str.Microsoft_Windows_2000
lea ecx, [esi + 0xa8]
call fcn.00404f50
mov dword [esi + 0xa4], 8
cmp dword [esi + 8], edi
jne 0x40a04c
cmp dword [esi + 0xc], ebx
jne 0x40a025
push 0x14
push str.Microsoft_Windows_XP
lea ecx, [esi + 0xa8]
call fcn.00404f50
mov dword [esi + 0xa4], 9
cmp dword [esi + 8], edi
jne 0x40a04c
cmp dword [esi + 0xc], 2
jb 0x40a04c
push 0x1d
push str.Microsoft_Windows_Server_2003
lea ecx, [esi + 0xa8]
call fcn.00404f50
mov dword [esi + 0xa4], 0xa
cmp dword [esi + 8], 6
jne 0x40a074
cmp dword [esi + 0xc], 0
jne 0x40a074
push 0x17
push str.Microsoft_Windows_Vista
lea ecx, [esi + 0xa8]
call fcn.00404f50
mov dword [esi + 0xa4], 0xb
mov eax, dword [esi + 8]
cmp eax, 6
jne 0x40a08d
cmp dword [esi + 0xc], ebx
jne 0x40a08a
push 0x17
push str.Microsoft_Windows_seven
jmp 0x40a0a0
cmp eax, 6
ja 0x40a099
cmp eax, 6
jne 0x40a0b5
cmp dword [esi + 0xc], ebx
jbe 0x40a0b5
push 0x2c
push str.Unknown_Windows_version__but_above_Windows_7
lea ecx, [esi + 0xa8]
call fcn.00404f50
mov dword [esi + 0xa4], 0xc
cmp byte [esi + 0xa0], 0
je 0x40a283
mov al, byte [esi + 0x9e]
cmp al, bl
jne 0x40a22a
cmp dword [esi + 8], 6
jne 0x40a1f0
cmp dword [esi + 0xc], 0
jne 0x40a1f0
push str.Kernel32
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x40a33c
push str.GetProductInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a1e4
mov edx, dword [esi + 0xc]
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esi + 8]
push 0
push 0
push edx
push ecx
call eax
test eax, eax
je 0x40a1e4
mov eax, dword [esp + 8]
cmp eax, 6
je 0x40a13e
cmp eax, 0x10
jne 0x40a153
lea edx, [esi + 0xa8]
push edx
mov edx, str._Business
call fcn.00404af0
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x40a15c
cmp eax, 0x1c
jne 0x40a171
lea eax, [esi + 0xa8]
push eax
mov edx, str._Ultimate
call fcn.00404af0
mov eax, dword [esp + 8]
cmp eax, 0x13
jne 0x40a18b
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Home_Server
call fcn.00404af0
mov eax, dword [esp + 8]
cmp eax, 2
je 0x40a195
cmp eax, 5
jne 0x40a1aa
lea edx, [esi + 0xa8]
push edx
mov edx, str._Home_Basic
call fcn.00404af0
mov eax, dword [esp + 8]
cmp eax, 3
je 0x40a1b4
cmp eax, 0x1a
jne 0x40a1c9
lea eax, [esi + 0xa8]
push eax
mov edx, str._Home_Premium
call fcn.00404af0
mov eax, dword [esp + 8]
cmp eax, 4
je 0x40a1d3
cmp eax, 0x1b
jne 0x40a1e4
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Enterprise
call fcn.00404af0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40a33c
mov edx, 0x200
test word [esi + 0x9c], dx
je 0x40a214
lea eax, [esi + 0xa8]
push eax
mov edx, str._Personal
call fcn.00404af0
jmp 0x40a33c
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Professional
call fcn.00404af0
jmp 0x40a33c
cmp al, 3
jne 0x40a33c
movzx eax, word [esi + 0x9c]
test al, al
jns 0x40a253
lea edx, [esi + 0xa8]
push edx
mov edx, str._DataCenter_Server
call fcn.00404af0
jmp 0x40a33c
test al, 2
je 0x40a26d
lea eax, [esi + 0xa8]
push eax
mov edx, str._Advanced_Server
call fcn.00404af0
jmp 0x40a33c
lea ecx, [esi + 0xa8]
push ecx
mov edx, str._Server
call fcn.00404af0
jmp 0x40a33c
lea edx, [esp + 8]
push edx
push ebx
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push str.WINNT
call fcn.00443946
add esp, 8
test eax, eax
jne 0x40a2ec
push 0xd
push str._Professional
lea eax, [esi + 0xa8]
call fcn.00404bb0
lea edx, [esp + 0x10]
push edx
push str.LANMANNT
call fcn.00443946
add esp, 8
test eax, eax
jne 0x40a314
push 7
push str._Server
lea eax, [esi + 0xa8]
call fcn.00404bb0
lea eax, [esp + 0x10]
push eax
push str.SERVERNT
call fcn.00443946
add esp, 8
test eax, eax
jne 0x40a33c
push 0x10
push str._Advanced_Server
lea eax, [esi + 0xa8]
call fcn.00404bb0
movzx ecx, word [esi + 0x10]
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esi + 0x18]
push edx
push eax
push ecx
lea edx, [esp + 0x70]
push str.Version__d._d__s__Build__d_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x78]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a367
jmp 0x40a45e
mov ebx, 4
cmp dword [esi + 8], ebx
jne 0x40a42c
cmp dword [esi + 0xc], 0
jne 0x40a3c1
push 0x14
lea edi, [esi + 0xa8]
push str.Microsoft_Windows_95
mov ecx, edi
call fcn.00404f50
mov al, byte [esi + 0x19]
mov dword [esi + 0xa4], 3
cmp al, 0x43
je 0x40a3b0
cmp al, 0x42
jne 0x40a3c1
push edi
mov edx, str._OSR2
call fcn.00404af0
mov dword [esi + 0xa4], ebx
cmp dword [esi + 8], ebx
jne 0x40a42c
cmp dword [esi + 0xc], 0xa
jne 0x40a405
push 0x14
lea edi, [esi + 0xa8]
push str.Microsoft_Windows_98
mov ecx, edi
call fcn.00404f50
cmp byte [esi + 0x19], 0x41
mov dword [esi + 0xa4], 5
jne 0x40a405
push edi
mov edx, 0x495f00
call fcn.00404af0
mov dword [esi + 0xa4], 6
cmp dword [esi + 8], ebx
jne 0x40a42c
cmp dword [esi + 0xc], 0x5a
jne 0x40a42c
push 0x14
push str.Microsoft_Windows_Me
lea ecx, [esi + 0xa8]
call fcn.00404f50
mov dword [esi + 0xa4], 7
movzx edx, word [esi + 0x10]
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x18]
push ecx
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x70]
push str.Version__d._d_Build__d__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x78]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a457
sub eax, edx
push eax
lea eax, [esp + 0x64]
push eax
lea ecx, [esi + 0xc4]
call fcn.00404f50
pop edi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.0043675a
add esp, 0x124
ret
push 0x10
push str.Microsoft_Win32s
lea ecx, [esi + 0xa8]
call fcn.00404f50
mov ecx, dword [esp + 0x120]
xor ecx, esp
mov dword [esi + 0xa4], 1
call fcn.0043675a
add esp, 0x124
ret