Function at 0x4ef455
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x274
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x26c], eax
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x10]
mov esi, str.unknown
lea ecx, [esp + 0x18]
call fcn.004ef1a6
mov eax, dword [esp + 0x28]
sub eax, 1
je 0x4efabd
sub eax, 1
jne 0x4efba3
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
inc ebx
push 2
pop ebp
cmp ecx, 3
jne 0x4ef4c4
push dword [esp + 0x20]
lea eax, [esp + 0x15c]
push str.Windows_NT3._d
push 0x40
push eax
call fcn.004ea423
add esp, 0x10
jmp 0x4ef656
mov eax, dword [esp + 0x20]
cmp ecx, 4
jne 0x4ef529
test eax, eax
jne 0x4ef63d
mov edi, str.Windows_NT4
cmp dword [esp + 0x10], 0
je 0x4ef93b
cmp ecx, 5
jne 0x4ef9dd
test eax, eax
jne 0x4ef8c6
cmp byte [esp + 0xb2], bl
je 0x4ef931
cmp byte [esp + 0xb2], 3
jne 0x4ef9dd
test byte [esp + 0xb0], 0x80
je 0x4ef8ac
mov esi, str.DataCenter_Server
jmp 0x4ef9dd
cmp ecx, 5
jne 0x4ef593
test eax, eax
jne 0x4ef539
mov edi, str.Windows_2000
jmp 0x4ef4da
cmp eax, ebx
jne 0x4ef544
mov edi, str.Windows_XP
jmp 0x4ef4da
cmp eax, ebp
jne 0x4ef63d
mov edx, 0x2000
cmp word [esp + 0xb0], dx
jne 0x4ef565
mov edi, str.Windows_Storage_Server_2003
jmp 0x4ef4da
cmp byte [esp + 0xb2], bl
jne 0x4ef589
call fcn.004ef018
mov ecx, dword [esp + 0x1c]
test eax, eax
mov eax, dword [esp + 0x20]
je 0x4ef589
mov edi, str.Windows_XP
jmp 0x4ef665
mov edi, str.Windows_Server_2003
jmp 0x4ef665
cmp ecx, 6
jne 0x4ef5f3
test eax, eax
jne 0x4ef5b6
cmp byte [esp + 0xb2], 1
mov edi, str.Windows_Server_2008
mov eax, str.Windows_Vista
cmove edi, eax
jmp 0x4ef66e
cmp eax, ebx
jne 0x4ef5cd
mov edi, str.Windows_Server_2008_R2
mov eax, str.Windows_7
cmp byte [esp + 0xb2], bl
jmp 0x4ef5ae
cmp eax, ebp
jne 0x4ef5dd
mov edi, str.Windows_Server_2012
mov eax, str.Windows_8
jmp 0x4ef5c4
cmp eax, 3
jne 0x4ef5ee
mov edi, str.Windows_Server_2012_R2
mov eax, str.Windows_8.1
jmp 0x4ef5c4
cmp eax, 4
je 0x4ef5f8
cmp ecx, 0xa
jb 0x4ef63d
cmp byte [esp + 0xb2], bl
je 0x4ef626
cmp dword [esp + 0x24], 0x4f78
jb 0x4ef612
mov edi, str.Windows_Server_2022
jmp 0x4ef665
cmp dword [esp + 0x24], 0x4563
mov edi, str.Windows_Server_2019
mov edx, str.Windows_Server_2016
jmp 0x4ef638
cmp dword [esp + 0x24], 0x55ec
mov edi, str.Windows_11
mov edx, str.Windows_10
cmovb edi, edx
jmp 0x4ef665
push eax
push ecx
push str.Windows_NT__d._d
lea eax, [esp + 0x164]
push 0x40
push eax
call fcn.004ea423
add esp, 0x14
mov ecx, dword [esp + 0x1c]
lea edi, [esp + 0x158]
mov eax, dword [esp + 0x20]
cmp ecx, 6
jb 0x4ef4da
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x606654], eax
test eax, eax
je 0x4ef9dd
lea ecx, [esp + 0x10]
xor ebx, ebx
push ecx
push ebx
push ebx
push dword [esp + 0x2c]
mov dword [esp + 0x20], ebx
push dword [esp + 0x2c]
call eax
mov eax, dword [esp + 0x10]
cmp eax, 0x12
ja 0x4ef783
je 0x4ef779
lea ecx, [eax - 1]
cmp ecx, 0x10
ja case.default.0x4ef6c8
jmp dword [ecx*4 + 0x4efbc1]
mov esi, str.Business
jmp 0x4ef9dd
mov esi, str.Business_N
jmp 0x4ef9dd
mov esi, str.Datacenter__Full_installation_
jmp 0x4ef9dd
mov esi, str.Datacenter__Server_Core_installation_
jmp 0x4ef9dd
mov esi, str.Enterprise
jmp 0x4ef9dd
mov esi, str.Enterprise__Full_installation_
jmp 0x4ef9dd
mov esi, str.Enterprise__Server_Core_installation_
jmp 0x4ef9dd
mov esi, str.Datacenter_Enterprise_for_Itanium_based_Systems
jmp 0x4ef9dd
mov esi, str.Home_Basic
jmp 0x4ef9dd
mov esi, str.Home_Basic_N
jmp 0x4ef9dd
mov esi, str.Home_Premium
jmp 0x4ef9dd
mov esi, str.Small_Business_Server
jmp 0x4ef9dd
mov esi, str.Server_Standard__full_installation_
jmp 0x4ef9dd
mov esi, str.Server_Standard__core_installation_
jmp 0x4ef9dd
mov esi, str.Starter
jmp 0x4ef9dd
mov esi, str.Ultimate
jmp 0x4ef9dd
mov esi, str.Web_Server
jmp 0x4ef9dd
mov esi, str.Cluster_Server
jmp 0x4ef9dd
cmp eax, 0x3b
ja 0x4ef85e
je 0x4ef8a2
cmp eax, 0x19
ja 0x4ef803
je 0x4ef7f9
mov ecx, eax
sub ecx, 0x13
je 0x4ef7ef
sub ecx, 1
je 0x4ef7e5
sub ecx, 1
je 0x4ef7db
sub ecx, 1
je 0x4ef7d1
sub ecx, 1
je 0x4ef7c7
sub ecx, 1
jne case.default.0x4ef6c8
mov esi, str.Server_for_Small_Business
jmp 0x4ef9dd
mov esi, str.Storage_Server_Enterprise
jmp 0x4ef9dd
mov esi, str.Storage_Server_Workgroup
jmp 0x4ef9dd
mov esi, str.Storage_Server_Standard
jmp 0x4ef9dd
mov esi, str.Storage_Server_Express
jmp 0x4ef9dd
mov esi, str.Home_Server
jmp 0x4ef9dd
mov esi, str.Small_Business_Server_Premium
jmp 0x4ef9dd
mov ecx, eax
sub ecx, 0x1a
je 0x4ef854
sub ecx, 1
je 0x4ef84a
sub ecx, 1
je 0x4ef840
sub ecx, 0x14
je 0x4ef82a
sub ecx, 1
jne case.default.0x4ef6c8
mov esi, str.Pro_N
mov eax, str.Professional_N
jmp 0x4ef834
mov esi, 0x5aa780
mov eax, str.Professional
cmp dword [esp + 0x20], ebp
cmovb esi, eax
jmp 0x4ef9dd
mov esi, str.Ultimate_N
jmp 0x4ef9dd
mov esi, str.Enterprise_N
jmp 0x4ef9dd
mov esi, str.Home_Premium_N
jmp 0x4ef9dd
cmp eax, 0x3c
je 0x4ef8a2
cmp eax, 0x3d
je 0x4ef8a2
cmp eax, 0x3e
je 0x4ef8a2
cmp eax, 0xabcdabcd
je 0x4ef898
push eax
push str.0x_x
lea eax, [esp + 0x140]
push 0x20
push eax
call fcn.004ea423
add esp, 0x10
lea esi, [esp + 0x138]
jmp 0x4ef9dd
mov esi, str.Unlicensed
jmp 0x4ef9dd
mov esi, str.Essentials
jmp 0x4ef9dd
test byte [esp + 0xb0], 2
mov esi, str.Advanced_Server
mov eax, str.Server
cmove esi, eax
jmp 0x4ef9dd
cmp eax, ebx
jb 0x4ef9dd
test dword [esp + 0xb0], 0x200
je 0x4ef8e5
mov esi, str.Home_Edition
jmp 0x4ef9dd
test byte [esp + 0xb0], 0x80
je 0x4ef8f9
mov esi, str.Datacenter_Edition
jmp 0x4ef9dd
test byte [esp + 0xb0], 2
je 0x4ef90d
mov esi, str.Enterprise_Edition
jmp 0x4ef9dd
test dword [esp + 0xb0], 0x400
je 0x4ef924
mov esi, str.Web_Edition
jmp 0x4ef9dd
cmp byte [esp + 0xb2], bl
jne 0x4ef9dd
mov esi, str.Professional
jmp 0x4ef9dd
lea eax, [esp + 0x10]
push eax
push ebx
xor ebx, ebx
push ebx
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ef9dd
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1dc]
push eax
push ebx
push ebx
push str.ProductType
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ef9d3
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [esp + 0x1d8]
push eax
push str.WINNT
call ebx
test eax, eax
jne 0x4ef99e
mov esi, str.Workstation
jmp 0x4ef9d3
lea eax, [esp + 0x1d8]
push eax
push str.LANMANNT
call ebx
test eax, eax
jne 0x4ef9b8
mov esi, str.Server
jmp 0x4ef9d3
lea eax, [esp + 0x1d8]
push eax
push str.SERVERNT
call ebx
test eax, eax
mov ecx, str.Advanced_Server
cmovne ecx, esi
mov esi, ecx
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
lea eax, [esp + 0x30]
push eax
push 0x40
pop edx
lea ecx, [esp + 0x1a0]
call fcn.004ea31a
push ecx
push ecx
lea ecx, [esp + 0x1a8]
call fcn.004efebe
push dword [esp + 0x30]
mov ebp, eax
lea eax, [esp + 0x10c]
push dword [esp + 0x30]
push str._d._d
push 0x40
push eax
call fcn.004ea423
add esp, 0x24
lea eax, [esp + 0xb8]
push dword [esp + 0x24]
push 0x5896f4
push 0x40
push eax
call fcn.004ea423
add esp, 0x10
call fcn.004ef018
test eax, eax
je 0x4efa4c
mov ebx, 0x5aa290
jmp 0x4efa60
call fcn.004ef063
test eax, eax
mov ebx, str.IA64
mov ecx, 0x55f3a0
cmove ebx, ecx
push ebp
call fcn.00520660
pop ecx
test eax, eax
lea eax, [esp + 0xb8]
push ebx
push eax
lea eax, [esp + 0x100]
push eax
jne 0x4efa98
push ebp
push esi
push edi
push str._s__s__s___s_Build__s____s_
push 0x100
push 0x896280
call fcn.004ea423
add esp, 0x24
jmp 0x4efab1
push esi
push edi
push str._s__s___s_Build__s____s_
push 0x100
push 0x896280
call fcn.004ea423
add esp, 0x20
mov ecx, ebp
call fcn.004ebe45
jmp 0x4efba3
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4efb08
cmp eax, 0xa
je 0x4efadc
cmp eax, 0x5a
mov esi, str.Windows_9x
mov ecx, str.Windows_Me
cmove esi, ecx
jmp 0x4efb45
mov ecx, 0x8ae
cmp word [esp + 0x24], cx
jb 0x4efaef
mov esi, str.Windows_98_SE
jmp 0x4efb45
mov edx, 0x7d0
mov esi, str.Windows_98_SP1
cmp word [esp + 0x24], dx
mov ecx, str.Windows_98
cmovb esi, ecx
jmp 0x4efb45
mov ecx, 0x4be
cmp word [esp + 0x24], cx
jb 0x4efb1b
mov esi, str.Windows_95_OSR2.5
jmp 0x4efb45
mov ecx, 0x4bc
cmp word [esp + 0x24], cx
jb 0x4efb2e
mov esi, str.Windows_95_OSR2.1
jmp 0x4efb45
mov edx, 0x457
mov esi, str.Windows_95_OSR2
cmp word [esp + 0x24], dx
mov ecx, str.Windows_95
cmovne esi, ecx
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x100]
push str._d._d
push 0x40
push eax
call fcn.004ea423
movzx eax, word [esp + 0x38]
add esp, 0x14
push eax
push 0x5896f4
lea eax, [esp + 0xc0]
push 0x40
push eax
call fcn.004ea423
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x10c]
push eax
push esi
push str._s___s_Build__s_
push 0x100
push 0x896280
call fcn.004ea423
add esp, 0x28
mov ecx, dword [esp + 0x27c]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x274
ret