Function at 0x488340
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x57c870]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x5f9d16]
mov byte [ebp - 0x108], al
push 0xfe
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.005323e0
add esp, 0xc
cmp dword [0x56b684], 1
jne 0x488f78
mov dword [0x56b684], 0
push 0x24
push 0
lea edx, [ebp - 0x234]
push edx
call fcn.005323e0
add esp, 0xc
push 0x9c
push 0
lea eax, [ebp - 0x2d8]
push eax
call fcn.005323e0
add esp, 0xc
mov dword [ebp - 0x2d8], 0x9c
lea ecx, [ebp - 0x2d8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x4883fc
mov dword [ebp - 0x2d8], 0x94
lea edx, [ebp - 0x2d8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4883fc
xor eax, eax
jmp 0x488f7d
push str.GetNativeSystemInfo
push 0x56b69c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x488431
lea eax, [ebp - 0x234]
push eax
call dword [ebp - 0x210]
jmp 0x48843e
lea ecx, [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x2c8]
mov dword [ebp - 0x344], edx
cmp dword [ebp - 0x344], 0
je 0x488eec
cmp dword [ebp - 0x344], 1
je 0x488e04
cmp dword [ebp - 0x344], 2
je 0x488472
jmp 0x488f0a
cmp dword [ebp - 0x2d4], 6
jne 0x4884ce
cmp dword [ebp - 0x2d0], 2
jne 0x4884ce
movzx eax, byte [ebp - 0x23e]
cmp eax, 1
jne 0x4884b0
push str.Windows_8
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 0xf
jmp 0x4884ce
push str.Windows_Server_2012
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 0x10
cmp dword [ebp - 0x2d4], 6
jne 0x48852a
cmp dword [ebp - 0x2d0], 1
jne 0x48852a
movzx eax, byte [ebp - 0x23e]
cmp eax, 1
jne 0x48850c
push str.Windows_7
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 0xe
jmp 0x48852a
push str.Windows_Server_2008_R2
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 0xb
cmp dword [ebp - 0x2d4], 6
jne 0x4887fb
cmp dword [ebp - 0x2d0], 0
jne 0x4887fb
movzx eax, byte [ebp - 0x23e]
cmp eax, 1
jne 0x488570
push str.Microsoft_Windows_Vista
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 0xa
jmp 0x48858e
push str.Windows_Server_2008
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 0xb
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2e0], eax
lea eax, [ebp - 0x2dc]
push eax
push 0
push 0
push 0
push 6
call dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp - 0x348], ecx
mov edx, dword [ebp - 0x348]
sub edx, 1
mov dword [ebp - 0x348], edx
cmp dword [ebp - 0x348], 0x18
ja case.0x4885ee.4
mov eax, dword [ebp - 0x348]
jmp dword [eax*4 + 0x488f8c]
push str.Ultimate_Edition
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Home_Premium_Edition
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Home_Basic_Edition
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push 0x56b788
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Business_Edition
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Starter_Edition
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Cluster_Server_Edition
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push 0x56b7d8
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Datacenter_Edition__core_installation_
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push 0x56b814
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Enterprise_Edition__core_installation_
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push 0x56b850
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Small_Business_Server
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Small_Business_Server_Premium_Edition
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push 0x56b8c0
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Standard_Edition__core_installation_
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp case.0x4885ee.4
push str.Web_Server_Edition
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
movzx eax, word [ebp - 0x234]
cmp eax, 9
jne 0x4887ac
push str.__64_bit
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp 0x4887cb
movzx edx, word [ebp - 0x234]
test edx, edx
jne 0x4887cb
push str.__32_bit
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532e80
add esp, 4
movsx edx, byte [ebp + eax - 0x109]
cmp edx, 0x20
je 0x4887fb
push 0x56b928
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
cmp dword [ebp - 0x2d4], 5
jne 0x488863
cmp dword [ebp - 0x2d0], 2
jne 0x488863
movzx ecx, byte [ebp - 0x23e]
cmp ecx, 1
jne 0x488845
movzx edx, word [ebp - 0x234]
cmp edx, 9
jne 0x488845
push str.Microsoft_Windows_XP_Professional_x64_Edition
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 9
jmp 0x488863
push str.Microsoft_Windows_Server_2003_
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 0xc
cmp dword [ebp - 0x2d4], 5
jne 0x488893
cmp dword [ebp - 0x2d0], 1
jne 0x488893
push str.Microsoft_Windows_XP
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 8
cmp dword [ebp - 0x2d4], 5
jne 0x4888c3
cmp dword [ebp - 0x2d0], 0
jne 0x4888c3
push str.Microsoft_Windows_2000
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 5
cmp dword [ebp - 0x2d4], 4
ja 0x4888ea
push str.Microsoft_Windows_NT
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 4
cmp dword [0x56a5e0], 0xa
je 0x488d16
cmp dword [0x56a5e0], 0xe
je 0x488d16
cmp dword [0x56a5e0], 0xf
je 0x488d16
cmp dword [ebp - 0x20c], 0
je 0x488c4c
movzx edx, byte [ebp - 0x23e]
cmp edx, 1
jne 0x488a26
movzx eax, word [ebp - 0x234]
cmp eax, 9
je 0x488a26
cmp dword [ebp - 0x2d4], 4
jne 0x488960
push str.Workstation_4.0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp 0x488a21
movzx edx, word [ebp - 0x240]
and edx, 0x200
je 0x488988
push str.Home_Edition
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp 0x488a21
movzx ecx, word [ebp - 0x240]
and ecx, 1
je 0x4889aa
push 0x56b9e8
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp 0x488a21
movzx eax, word [ebp - 0x240]
and eax, 0x20
je 0x4889cc
push str.Business
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp 0x488a21
movzx edx, word [ebp - 0x240]
and edx, 2
je 0x4889ee
push str.Enterprise
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp 0x488a21
cmp dword [0x56a5e0], 0xa
jne 0x488a0d
push str.Ultimate
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp 0x488a21
push 0x56ba18
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp 0x488c47
movzx eax, byte [ebp - 0x23e]
cmp eax, 3
je 0x488a42
movzx ecx, byte [ebp - 0x23e]
cmp ecx, 2
jne 0x488c47
cmp dword [ebp - 0x2d4], 5
jne 0x488ba2
cmp dword [ebp - 0x2d0], 2
jne 0x488ba2
movzx edx, word [ebp - 0x234]
cmp edx, 6
jne 0x488ab1
movzx eax, word [ebp - 0x240]
and eax, 0x80
je 0x488a8c
push str.Datacenter_Edition_for_Itanium_based_Systems
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp 0x488aac
movzx edx, word [ebp - 0x240]
and edx, 2
je 0x488aac
push str.Enterprise_Edition_for_Itanium_based_Systems
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp 0x488b9d
movzx ecx, word [ebp - 0x234]
cmp ecx, 9
jne 0x488b1d
movzx edx, word [ebp - 0x240]
and edx, 0x80
je 0x488ae2
push str.Datacenter_x64_Edition
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp 0x488b18
movzx ecx, word [ebp - 0x240]
and ecx, 2
je 0x488b04
push str.Enterprise_x64_Edition
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp 0x488b18
push str.Standard_x64_Edition
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp 0x488b9d
movzx ecx, word [ebp - 0x240]
and ecx, 0x80
je 0x488b42
push str.Datacenter_Edition
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp 0x488b9d
movzx eax, word [ebp - 0x240]
and eax, 2
je 0x488b64
push str.Enterprise_Edition
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp 0x488b9d
movzx edx, word [ebp - 0x240]
cmp edx, 0x400
jne 0x488b89
push str.Web_Edition
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp 0x488b9d
push str.Standard_Edition
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
jmp 0x488c47
cmp dword [ebp - 0x2d4], 5
jne 0x488c11
cmp dword [ebp - 0x2d0], 0
jne 0x488c11
movzx edx, word [ebp - 0x240]
and edx, 0x80
je 0x488bd9
push str.Datacenter_Server
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp 0x488c0f
movzx ecx, word [ebp - 0x240]
and ecx, 2
je 0x488bfb
push 0x56bb30
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp 0x488c0f
push 0x56bb44
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp 0x488c47
movzx ecx, word [ebp - 0x240]
and ecx, 2
je 0x488c33
push str.Server_4.0__Enterprise_Edition
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
jmp 0x488c47
push str.Server_4.0
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp 0x488d16
lea ecx, [ebp - 0x334]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x338]
push edx
lea eax, [ebp - 0x330]
push eax
push 0
push 0
push str.ProductType
mov ecx, dword [ebp - 0x334]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x334]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x330]
push eax
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x488cc2
push str.Professional
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
lea edx, [ebp - 0x330]
push edx
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x488cec
push str.Server
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
lea ecx, [ebp - 0x330]
push ecx
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x488d16
push str.Advanced_Server
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
cmp dword [ebp - 0x2d4], 4
jne 0x488dc1
push str.Service_Pack_6
lea eax, [ebp - 0x2c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x488dc1
lea ecx, [ebp - 0x33c]
push ecx
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0
jne 0x488d8a
mov edx, dword [ebp - 0x2cc]
and edx, 0xffff
push edx
push str.Service_Pack_6a__Build__d_
lea eax, [ebp - 0x208]
push eax
call fcn.00532706
add esp, 0xc
jmp 0x488db2
mov ecx, dword [ebp - 0x2cc]
and ecx, 0xffff
push ecx
lea edx, [ebp - 0x2c4]
push edx
push 0x56bc68
lea eax, [ebp - 0x208]
push eax
call fcn.00532706
add esp, 0x10
mov ecx, dword [ebp - 0x33c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x488de9
mov edx, dword [ebp - 0x2cc]
and edx, 0xffff
push edx
lea eax, [ebp - 0x2c4]
push eax
push str._s__Build__d_
lea ecx, [ebp - 0x208]
push ecx
call fcn.00532706
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
jmp 0x488f0a
cmp dword [ebp - 0x2d4], 4
jne 0x488e60
cmp dword [ebp - 0x2d0], 0
jne 0x488e60
push str.Microsoft_Windows_95
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
movsx edx, byte [ebp - 0x2c3]
cmp edx, 0x43
je 0x488e42
movsx eax, byte [ebp - 0x2c3]
cmp eax, 0x42
jne 0x488e56
push str.OSR2
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 1
cmp dword [ebp - 0x2d4], 4
jne 0x488eba
cmp dword [ebp - 0x2d0], 0xa
jne 0x488eba
push str.Microsoft_Windows_98
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 3
movsx eax, byte [ebp - 0x2c3]
cmp eax, 0x41
jne 0x488eba
push 0x56bcc0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 6
cmp dword [ebp - 0x2d4], 4
jne 0x488eea
cmp dword [ebp - 0x2d0], 0x5a
jne 0x488eea
push str.Microsoft_Windows_Me
lea edx, [ebp - 0x108]
push edx
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 7
jmp 0x488f0a
push str.Microsoft_Win32s
lea eax, [ebp - 0x108]
push eax
call fcn.00532590
add esp, 8
mov dword [0x56a5e0], 2
lea ecx, [ebp - 0x108]
push ecx
push 0x5c67d8
call fcn.00532580
add esp, 8
lea edx, [ebp - 0x108]
push edx
push 1
call fcn.00436500
add esp, 8
movsx eax, byte [0x56a5e4]
cmp eax, 0x63
jne 0x488f78
cmp dword [0x56a5e0], 1
je 0x488f68
cmp dword [0x56a5e0], 2
je 0x488f68
cmp dword [0x56a5e0], 3
je 0x488f68
cmp dword [0x56a5e0], 6
je 0x488f68
cmp dword [0x56a5e0], 7
jne 0x488f71
mov byte [0x56a5e4], 0x2a
jmp 0x488f78
mov byte [0x56a5e4], 0x2a
mov eax, dword [0x56a5e0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00532783
mov esp, ebp
pop ebp
ret