Function at 0x10071c10
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5ac
mov eax, dword [0x100e6018]
xor eax, esp
mov dword [esp + 0x5a8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x1007286a
mov edi, dword [ebp + 0xc]
cmp edi, 0x100
jb 0x1007286a
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x1c], 0x11c
call sym.iImportLib.dll_int___cdecl_elex::os::ISAFE_GetVersionExW_struct__OSVERSIONINFOW__
add esp, 4
test eax, eax
jne 0x10071c8d
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x114
call sym.iImportLib.dll_int___cdecl_elex::os::ISAFE_GetVersionExW_struct__OSVERSIONINFOW__
add esp, 4
test eax, eax
je 0x1007286a
mov dword [esp + 0xc], 0
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10071cb4
lea ecx, [esp + 0x13c]
push ecx
call eax
jmp 0x10071cc2
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [esp + 0x160], 6
mov dword [esp + 0x164], str.Business
mov dword [esp + 0x168], 0x10
mov dword [esp + 0x16c], str.Business_N
mov dword [esp + 0x170], 0x12
mov dword [esp + 0x174], str.HPC_Edition
mov dword [esp + 0x178], 8
mov dword [esp + 0x17c], str.Server_Datacenter__full_installation_
mov dword [esp + 0x180], 0xc
mov dword [esp + 0x184], str.Server_Datacenter__core_installation_
mov dword [esp + 0x188], 0x27
mov dword [esp + 0x18c], str.Server_Datacenter_without_Hyper_V__core_installation_
mov dword [esp + 0x190], 0x25
mov dword [esp + 0x194], str.Server_Datacenter_without_Hyper_V__full_installation_
mov dword [esp + 0x198], 4
mov dword [esp + 0x19c], 0x100b862c
mov dword [esp + 0x1a0], 0x46
mov dword [esp + 0x1a4], str.Not_supported
mov dword [esp + 0x1a8], 0x1b
mov dword [esp + 0x1ac], str.Enterprise_N
mov dword [esp + 0x1b0], 0xa
mov dword [esp + 0x1b4], str.Server_Enterprise__full_installation_
mov dword [esp + 0x1b8], 0xe
mov dword [esp + 0x1bc], str.Server_Enterprise__core_installation_
mov dword [esp + 0x1c0], 0x29
mov dword [esp + 0x1c4], str.Server_Enterprise_without_Hyper_V__core_installation_
mov dword [esp + 0x1c8], 0xf
mov dword [esp + 0x1cc], str.Server_Enterprise_for_Itanium_based_Systems
mov dword [esp + 0x1d0], 0x26
mov dword [esp + 0x1d4], str.Server_Enterprise_without_Hyper_V__full_installation_
mov dword [esp + 0x1d8], 2
mov dword [esp + 0x1dc], str.Home_Basic
mov dword [esp + 0x1e0], 0x43
mov dword [esp + 0x1e4], str.Not_supported
mov dword [esp + 0x1e8], 5
mov dword [esp + 0x1ec], str.Home_Basic_N
mov dword [esp + 0x1f0], 3
mov dword [esp + 0x1f4], str.Home_Premium
mov dword [esp + 0x1f8], 0x44
mov dword [esp + 0x1fc], str.Not_supported
mov dword [esp + 0x200], 0x1a
mov dword [esp + 0x204], str.Home_Premium_N
mov dword [esp + 0x208], 0x2a
mov dword [esp + 0x20c], str.Microsoft_Hyper_V_Server
mov dword [esp + 0x210], 0x1e
mov dword [esp + 0x214], str.Essential_Business_Server_Management_Server
mov dword [esp + 0x218], 0x20
mov dword [esp + 0x21c], str.Essential_Business_Server_Messaging_Server
mov dword [esp + 0x220], 0x1f
mov dword [esp + 0x224], str.Essential_Business_Server_Security_Server
mov dword [esp + 0x228], 0x30
mov dword [esp + 0x22c], str.Professional
mov dword [esp + 0x230], 0x45
mov dword [esp + 0x234], str.Not_supported
mov dword [esp + 0x238], 0x31
mov dword [esp + 0x23c], str.Professional_N
mov dword [esp + 0x240], 0x18
mov dword [esp + 0x244], str.for_Windows_Essential_Server_Solutions
mov dword [esp + 0x248], 0x23
mov dword [esp + 0x24c], str.without_Hyper_V_for_Windows_Essential_Server_Solutions
mov dword [esp + 0x250], 0x21
mov dword [esp + 0x254], str.Server_Foundation
mov dword [esp + 0x258], 0x22
mov dword [esp + 0x25c], str.Home_Server_2011
mov dword [esp + 0x260], 0x32
mov dword [esp + 0x264], str.Small_Business_Server_2011_Essentials
mov dword [esp + 0x268], 0x13
mov dword [esp + 0x26c], str.Storage_Server_2008_R2_Essentials
mov dword [esp + 0x270], 9
mov dword [esp + 0x274], str.Small_Business_Server
mov dword [esp + 0x278], 0x38
mov dword [esp + 0x27c], str.MultiPoint_Server
mov dword [esp + 0x280], 7
mov dword [esp + 0x284], str.Server_Standard__full_installation_
mov dword [esp + 0x288], 0xd
mov dword [esp + 0x28c], str.Server_Standard__core_installation_
mov dword [esp + 0x290], 0x28
mov dword [esp + 0x294], str.Server_Standard_without_Hyper_V__core_installation_
mov dword [esp + 0x298], 0x24
mov dword [esp + 0x29c], str.Server_Standard_without_Hyper_V__full_installation_
mov dword [esp + 0x2a0], 0xb
push str.Microsoft
push 0x18
push esi
mov dword [esp + 0x2b0], str.Starter
mov dword [esp + 0x2b4], 0x42
mov dword [esp + 0x2b8], str.Not_supported
mov dword [esp + 0x2bc], 0x2f
mov dword [esp + 0x2c0], str.Starter_N
mov dword [esp + 0x2c4], 0x17
mov dword [esp + 0x2c8], str.Storage_Server_Enterprise
mov dword [esp + 0x2cc], 0x14
mov dword [esp + 0x2d0], str.Storage_Server_Express
mov dword [esp + 0x2d4], 0x15
mov dword [esp + 0x2d8], str.Storage_Server_Standard
mov dword [esp + 0x2dc], 0x16
mov dword [esp + 0x2e0], str.Storage_Server_Workgroup
mov dword [esp + 0x2e4], 0
mov dword [esp + 0x2e8], str.An_unknown_product
mov dword [esp + 0x2ec], 1
mov dword [esp + 0x2f0], str.Ultimate
mov dword [esp + 0x2f4], 0x47
mov dword [esp + 0x2f8], str.Not_supported
mov dword [esp + 0x2fc], 0x1c
mov dword [esp + 0x300], str.Ultimate_N
mov dword [esp + 0x304], 0x11
mov dword [esp + 0x308], str.Web_Server__full_installation_
mov dword [esp + 0x30c], 0x1d
mov dword [esp + 0x310], str.Web_Server__core_installation_
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
mov eax, dword [esp + 0x34]
add esp, 0xc
sub eax, 0
je 0x10072840
dec eax
je 0x10072798
dec eax
jne 0x10072850
cmp dword [esp + 0x1c], 0xa
mov ebx, dword [sym.imp.MSVCR110.dll_wcscat_s]
jne 0x1007219f
cmp dword [esp + 0x20], eax
jne 0x100722a3
push str.Windows_10
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x1c], 6
jne 0x100722a1
cmp dword [esp + 0x20], 4
jne 0x100721bd
push str.Windows_10
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x20], 3
jne 0x100721d0
push str.Windows_8.1
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x20], 2
jne 0x100721e3
push str.Windows_8
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x20], 1
jne 0x10072207
cmp byte [esp + 0x132], 1
jne 0x100721fb
push str.Windows_7
jmp 0x10072200
push str.Windows_Server_2008_R2
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x20], 0
jne 0x1007222b
cmp byte [esp + 0x132], 1
jne 0x1007221f
push str.Windows_Vista
jmp 0x10072224
push str.Windows_Server_2008
push edi
push esi
call ebx
add esp, 0xc
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call eax
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x10072260
lea ecx, [eax*8]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + ecx + 0x160]
jne 0x10072282
push dword [esp + ecx + 0x164]
push edi
push esi
call ebx
add esp, 0xc
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x35
jb 0x10072260
push str._An_unknown_product_
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x1c], 6
jb 0x100722c9
mov ax, word [esp + 0x13c]
cmp ax, 9
jne 0x100722b8
push str.__64_bit
jmp 0x100722c2
test ax, ax
jne 0x100722c9
push str.__32_bit
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x1c], 5
jne 0x10072463
cmp dword [esp + 0x20], 2
jne 0x100723dc
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x100722f2
push str.Windows_Server_2003_R2_
jmp 0x10072329
mov eax, 0x2000
cmp word [esp + 0x130], ax
jne 0x10072308
push str.Windows_Storage_Server_2003
jmp 0x10072329
cmp byte [esp + 0x132], 1
jne 0x10072324
cmp word [esp + 0x13c], 9
jne 0x10072324
push str.Windows_XP_Professional_x64_Edition
jmp 0x10072329
push str.Windows_Server_2003
push edi
push esi
call ebx
add esp, 0xc
cmp byte [esp + 0x132], 1
je 0x100723d1
mov ax, word [esp + 0x13c]
cmp ax, 6
jne 0x10072369
mov eax, dword [esp + 0x130]
test al, al
jns 0x1007235e
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x100723ca
test al, 2
je 0x100723d1
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x100723ca
cmp ax, 9
mov eax, dword [esp + 0x130]
jne 0x10072393
test al, al
jns 0x10072381
push str.Datacenter_x64_Edition
jmp 0x100723ca
test al, 2
je 0x1007238c
push str.Enterprise_x64_Edition
jmp 0x100723ca
push str.Standard_x64_Edition
jmp 0x100723ca
test eax, 0x4000
je 0x100723a1
push str.Compute_Cluster_Edition
jmp 0x100723ca
test al, al
jns 0x100723ac
push str.Datacenter_Edition
jmp 0x100723ca
test al, 2
je 0x100723b7
push str.Enterprise_Edition
jmp 0x100723ca
test eax, 0x400
je 0x100723c5
push str.Web_Edition
jmp 0x100723ca
push str.Standard_Edition
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x1c], 5
jne 0x10072463
cmp dword [esp + 0x20], 1
jne 0x10072416
push str.Windows_XP
push edi
push esi
call ebx
add esp, 0xc
test dword [esp + 0x130], 0x200
je 0x10072403
push str.Home_Edition
jmp 0x10072408
push str.Professional
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x1c], 5
jne 0x10072463
cmp dword [esp + 0x20], 0
jne 0x1007246a
push str.Windows_2000
push edi
push esi
call ebx
add esp, 0xc
cmp byte [esp + 0x132], 1
jne 0x1007243a
push str.Professional
jmp 0x1007245c
mov eax, dword [esp + 0x130]
test al, al
jns 0x1007244c
push str.Datacenter_Server
jmp 0x1007245c
test al, 2
je 0x10072457
push str.Advanced_Server
jmp 0x1007245c
push 0x100b9480
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x1c], 4
jbe 0x100724e2
lea ecx, [esp + 0x2c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10072471
sub ecx, edx
sar ecx, 1
je 0x10072497
push 0x100b5314
push edi
push esi
call ebx
lea eax, [esp + 0x38]
push eax
push edi
push esi
call ebx
add esp, 0x18
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100724a0
push dword [esp + 0x24]
sub ecx, edx
sar ecx, 1
push str.__Build__d_
sub edi, ecx
lea eax, [esi + ecx*2]
push edi
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5a8]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret
push str.Windows_NT
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0xc], 0
je 0x10072549
mov al, byte [esp + 0x132]
cmp al, 1
jne 0x10072511
push str.Workstation
push edi
push esi
call ebx
add esp, 0xc
jmp 0x10072647
cmp al, 3
je 0x1007251d
cmp al, 2
jne 0x10072647
test byte [esp + 0x130], 2
je 0x10072538
push str.Enterprise
push edi
push esi
call ebx
add esp, 0xc
jmp 0x10072647
push str.Server
push edi
push esi
call ebx
add esp, 0xc
jmp 0x10072647
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10072850
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x30c]
push eax
push 0
push 0
push str.ProductType
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10072850
cmp dword [esp + 0xc], 0x50
ja 0x10072850
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x308]
push eax
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100725d2
push str.Workstation
push edi
push esi
call ebx
add esp, 0xc
lea eax, [esp + 0x308]
push eax
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100725f5
push str.Server
push edi
push esi
call ebx
add esp, 0xc
lea eax, [esp + 0x308]
push eax
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10072618
push str.Advance_Server
push edi
push esi
call ebx
add esp, 0xc
push dword [esp + 0x20]
lea eax, [esp + 0x3ac]
push dword [esp + 0x20]
push str.__d._d
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
lea eax, [esp + 0x3bc]
push eax
push edi
push esi
call ebx
add esp, 0x20
cmp dword [esp + 0x1c], 4
jne 0x1007273e
push str.Service_Pack_6
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1007273e
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100726d8
movzx eax, word [esp + 0x24]
push eax
push str.Service_Pack_6a__Build__d_
lea eax, [esp + 0x3b0]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
lea eax, [esp + 0x3b8]
push eax
push edi
push esi
call ebx
add esp, 0x1c
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5a8]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x2c]
push eax
push edi
push esi
call ebx
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100726f0
movzx eax, word [esp + 0x24]
push eax
sub ecx, edx
sar ecx, 1
push str.__Build__d_
sub edi, ecx
lea eax, [esi + ecx*2]
push edi
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x10
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5a8]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10072743
lea eax, [esp + 0x2c]
push eax
sub ecx, edx
sar ecx, 1
push edi
push esi
mov dword [esp + 0x18], ecx
call ebx
movzx eax, word [esp + 0x30]
push eax
mov eax, dword [esp + 0x1c]
sub edi, eax
push str.__Build__d_
lea eax, [esi + eax*2]
push edi
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x1c
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5a8]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x1c], 4
jne 0x10072850
mov eax, dword [esp + 0x20]
mov ebx, dword [sym.imp.MSVCR110.dll_wcscat_s]
test eax, eax
jne 0x100727e5
push str.Windows_95
push edi
push esi
call ebx
mov ax, word [esp + 0x3a]
add esp, 0xc
cmp ax, 0x43
je 0x100727ce
cmp ax, 0x42
jne 0x100727da
push str._OSR2
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x1c], 4
jne 0x10072850
mov eax, dword [esp + 0x20]
cmp eax, 0xa
jne 0x10072815
push str.Windows_98
push edi
push esi
call ebx
add esp, 0xc
cmp word [esp + 0x2e], 0x41
jne 0x1007280a
push 0x100b964c
push edi
push esi
call ebx
add esp, 0xc
cmp dword [esp + 0x1c], 4
jne 0x10072850
mov eax, dword [esp + 0x20]
cmp eax, 0x5a
jne 0x10072850
push str.Windows_ME
push edi
push esi
call ebx
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5a8]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret
push str.Windows_Unknown
push edi
push esi
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5a8]
xor ecx, esp
call fcn.100947be
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x5b4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100947be
mov esp, ebp
pop ebp
ret