Function at 0x47a4c0
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
mov eax, dword [0x5142b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x64
push 1
call fcn.00491e51
add esp, 8
push 0x4d0894
mov dword [ebp - 0x4a8], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor eax, eax
push 0x9c
push eax
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4cc], eax
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4b0], eax
lea eax, [ebp - 0x4a0]
push eax
call fcn.00492ac0
add esp, 0xc
push 0x4d14c8
push 0x4d0894
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47a56e
lea ecx, [ebp - 0x4d0]
push ecx
call eax
jmp 0x47a57b
lea edx, [ebp - 0x4d0]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x4a0]
push eax
mov dword [ebp - 0x4a0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x4ac], eax
test eax, eax
jne 0x47a5ca
lea ecx, [ebp - 0x4a0]
push ecx
mov dword [ebp - 0x4a0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x47a5ca
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x47a7ae
push str.GetProductInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47a7ae
movzx ecx, word [ebp - 0x40a]
lea edx, [ebp - 0x4a4]
push edx
movzx edx, word [ebp - 0x40c]
push ecx
mov ecx, dword [ebp - 0x498]
push edx
mov edx, dword [ebp - 0x49c]
push ecx
push edx
call eax
test eax, eax
je 0x47a7ae
push ebx
push str.GetOSNameEx_:_dwMinorVersion_:__d_n
call fcn.00423960
push edi
push str.GetOSNameEx_:_dwMajorVersion_:__d_n
call fcn.00423960
add esp, 0x10
test edi, edi
jne 0x47a6fc
test ebx, ebx
jne 0x47a6fc
mov eax, dword [ebp - 0x49c]
push eax
push str.osvi.dwMajorVersion_:__d_n
call fcn.00423960
mov ecx, dword [ebp - 0x498]
push ecx
push str.osvi.dwMinorVersion_:__d_n
call fcn.00423960
movzx edx, word [ebp - 0x40c]
push edx
push str.osvi.wServicePackMajor_:__d_n
call fcn.00423960
movzx eax, word [ebp - 0x40a]
push eax
push str.osvi.wServicePackMinor_:__d_n
call fcn.00423960
mov ecx, dword [ebp - 0x4a4]
push ecx
push str.dwPlatformInfo_:__d_n
call fcn.00423960
movzx edx, word [ebp - 0x4d0]
push edx
push str.si.wProcessorArchitecture_:__d_n
call fcn.00423960
mov eax, dword [ebp - 0x494]
movzx ecx, word [ebp - 0x4d0]
movzx edx, byte [ebp - 0x406]
push eax
mov eax, dword [ebp - 0x4a4]
push ecx
movzx ecx, word [ebp - 0x40a]
push edx
movzx edx, word [ebp - 0x40c]
push eax
mov eax, dword [ebp - 0x498]
push ecx
mov ecx, dword [ebp - 0x49c]
push edx
push eax
push ecx
call fcn.00479a50
add esp, 0x50
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x49c]
push edx
push str.osvi.dwMajorVersion_:__d_n
call fcn.00423960
mov eax, dword [ebp - 0x498]
push eax
push str.osvi.dwMinorVersion_:__d_n
call fcn.00423960
movzx ecx, word [ebp - 0x40c]
push ecx
push str.osvi.wServicePackMajor_:__d_n
call fcn.00423960
movzx edx, word [ebp - 0x40a]
push edx
push str.osvi.wServicePackMinor_:__d_n
call fcn.00423960
mov eax, dword [ebp - 0x4a4]
push eax
push str.dwPlatformInfo_:__d_n
call fcn.00423960
movzx ecx, word [ebp - 0x4d0]
push ecx
push str.si.wProcessorArchitecture_:__d_n
call fcn.00423960
mov edx, dword [ebp - 0x494]
movzx eax, word [ebp - 0x4d0]
movzx ecx, byte [ebp - 0x406]
push edx
mov edx, dword [ebp - 0x4a4]
push eax
movzx eax, word [ebp - 0x40a]
push ecx
movzx ecx, word [ebp - 0x40c]
push edx
push eax
push ecx
push ebx
push edi
call fcn.00479a50
add esp, 0x50
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x490]
sub eax, 0
je 0x47ab51
dec eax
je 0x47aa61
dec eax
jne 0x47ab73
mov edx, dword [ebp - 0x498]
mov eax, dword [ebp - 0x49c]
push edx
push eax
call fcn.00479760
add esp, 8
cmp dword [ebp - 0x4ac], 0
mov ebx, eax
je 0x47a962
mov al, byte [ebp - 0x406]
cmp al, 1
jne 0x47a85b
cmp word [ebp - 0x4d0], 9
jne 0x47a828
cmp dword [ebp - 0x49c], 5
jne 0x47a92f
cmp dword [ebp - 0x498], 2
jne 0x47a92f
mov eax, str.Professional_x64_Edition
jmp 0x47a935
cmp dword [ebp - 0x49c], 4
jne 0x47a83b
mov eax, str.Workstation_4.0
jmp 0x47a935
test dword [ebp - 0x408], 0x200
je 0x47a851
mov eax, str.Home_Edition
jmp 0x47a935
mov eax, str.Professional
jmp 0x47a935
cmp al, 3
je 0x47a867
cmp al, 2
jne 0x47a92f
cmp dword [ebp - 0x49c], 5
jne 0x47a918
mov eax, dword [ebp - 0x498]
cmp eax, 2
jne 0x47a8f1
cmp word [ebp - 0x4d0], 9
jne 0x47a8b5
mov al, byte [ebp - 0x408]
test al, 2
je 0x47a89d
mov eax, str.__Enterprise_x64_Edition
jmp 0x47a935
test al, al
jns 0x47a8ab
mov eax, str.__Datacenter_x64_Edition
jmp 0x47a935
mov eax, str.__Standard_x64_Edition
jmp 0x47a935
mov eax, dword [ebp - 0x408]
test al, al
jns 0x47a8c6
mov eax, str.__Datacenter_Edition
jmp 0x47a935
test al, 2
je 0x47a8d1
mov eax, str.__Enterprise_Edition
jmp 0x47a935
test eax, 0x400
je 0x47a8df
mov eax, str.__Web_Edition
jmp 0x47a935
test al, 0x21
jne 0x47a8ea
mov eax, str.__Standard_Edition
jmp 0x47a935
mov eax, str._for_Small_Business_Server
jmp 0x47a935
test eax, eax
jne 0x47a918
mov al, byte [ebp - 0x408]
test al, al
jns 0x47a906
mov eax, str.Datacenter_Server
jmp 0x47a935
test al, 2
je 0x47a911
mov eax, str.Advanced_Server
jmp 0x47a935
mov eax, str.Server
jmp 0x47a935
test byte [ebp - 0x408], 0x10
je 0x47a928
mov eax, str.Server_4.0__Terminal_Server_Edition
jmp 0x47a935
mov eax, str.Server_4.0
jmp 0x47a935
mov eax, dword [ebp - 0x4ac]
mov ecx, dword [ebp - 0x4a8]
push eax
push ebx
push 0x4d1734
push ecx
call fcn.00492848
mov eax, dword [ebp - 0x4a8]
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x4ac]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x400
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x4a4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47a5b7
mov edx, dword [ebp - 0x4ac]
lea eax, [ebp - 0x4a4]
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47a5b7
cmp dword [ebp - 0x4a4], esi
ja 0x47a5b7
mov eax, dword [ebp - 0x4ac]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [ebp - 0x404]
push ecx
push str.WINNT
call edi
mov esi, str.Workstation
test eax, eax
je 0x47a9f8
mov esi, dword [ebp - 0x4ac]
lea edx, [ebp - 0x404]
push edx
push str.LANMANNT
call edi
test eax, eax
jne 0x47aa0f
mov esi, str.Server
lea eax, [ebp - 0x404]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x47aa26
mov esi, str.Advanced_Server
mov ecx, dword [ebp - 0x498]
mov edx, dword [ebp - 0x49c]
mov eax, dword [ebp - 0x4a8]
push ecx
push edx
push esi
push ebx
push str._s_s__d._d
push eax
call fcn.00492848
mov eax, dword [ebp - 0x4a8]
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
mov ecx, 4
cmp dword [ebp - 0x49c], ecx
jne 0x47ab73
cmp dword [ebp - 0x498], 0
jne 0x47aab2
mov edx, dword [str.Windows_95]
mov eax, dword [ebp - 0x4a8]
mov dword [eax], edx
mov edx, dword [0x4e0564]
mov dword [eax + 4], edx
mov dx, word [0x4e0568]
mov word [eax + 8], dx
mov dl, byte [0x4e056a]
mov byte [eax + 0xa], dl
cmp dword [ebp - 0x49c], ecx
jne 0x47ab73
cmp dword [ebp - 0x498], 0xa
jne 0x47ab1c
mov edx, dword [str.Windows_98]
mov eax, dword [ebp - 0x4a8]
mov dword [eax], edx
mov edx, dword [0x4e0558]
mov dword [eax + 4], edx
mov dx, word [0x4e055c]
mov word [eax + 8], dx
mov dl, byte [0x4e055e]
mov byte [eax + 0xa], dl
cmp byte [ebp - 0x48b], 0x41
jne 0x47ab14
mov edx, dword [str.Windows_98_SE]
mov dword [eax], edx
mov edx, dword [0x4e1440]
mov dword [eax + 4], edx
mov edx, dword [0x4e1444]
mov dword [eax + 8], edx
mov dx, word [0x4e1448]
mov word [eax + 0xc], dx
cmp dword [ebp - 0x49c], ecx
jne 0x47ab73
cmp dword [ebp - 0x498], 0x5a
jne 0x47ab73
mov edi, dword [ebp - 0x4a8]
mov eax, dword [ebp - 0x4a8]
mov ecx, 6
mov esi, str.Windows_Millennium_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ed61
mov esp, ebp
pop ebp
ret
mov ecx, dword [str.Win32s]
mov eax, dword [ebp - 0x4a8]
mov dword [eax], ecx
mov dx, word [0x4e141c]
mov word [eax + 4], dx
mov cl, byte [0x4e141e]
mov byte [eax + 6], cl
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ed61
mov esp, ebp
pop ebp
ret