Function at 0x1006e950
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x980
mov eax, dword [0x100cc8ec]
xor eax, esp
mov dword [esp + 0x97c], eax
mov eax, dword [esp + 0x984]
push ebx
push esi
push edi
mov dword [esp + 0x14], ecx
mov ecx, dword [ecx]
push str._CORE__XWHSMDriverManager::getSystemVersion__Start
push ecx
mov dword [esp + 0x20], eax
call fcn.100772b0
push 0x3ff
lea edx, [esp + 0x145]
push 0
push edx
or ebx, 0xffffffff
mov byte [esp + 0x14c], 0
call sub.MSVCR80.dll_memset
push 0x3ff
lea eax, [esp + 0x5a1]
push 0
push eax
mov byte [esp + 0x5a8], 0
call sub.MSVCR80.dll_memset
push 0x11c
lea ecx, [esp + 0x40]
push 0
push ecx
call sub.MSVCR80.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0x2c
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x11c
call esi
mov edi, eax
test edi, edi
jne 0x1006ea07
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x114
call esi
test eax, eax
jne 0x1006ea07
or eax, ebx
jmp 0x1006f3b3
mov eax, dword [esp + 0x2c]
sub eax, 0
push ebp
je 0x1006f346
sub eax, 1
je 0x1006f1e2
sub eax, 1
jne 0x1006f37e
mov ebp, dword [sym.imp.MSVCR80.dll_strncat]
mov esi, 5
cmp dword [esp + 0x24], esi
jne 0x1006eb0a
cmp dword [esp + 0x28], 2
jne 0x1006ea84
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ea50
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_Server_2003_family_
push edx
call ebp
add esp, 0xc
cmp dword [esp + 0x24], esi
mov ebx, 9
jne 0x1006eb0a
cmp dword [esp + 0x28], 1
jne 0x1006eac5
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ea95
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_XP
push edx
call ebp
add esp, 0xc
cmp dword [esp + 0x24], esi
mov ebx, 8
jne 0x1006eb0a
cmp dword [esp + 0x28], 0
jne 0x1006eca5
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006eae0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_2000
push edx
call ebp
add esp, 0xc
mov ebx, 7
cmp dword [esp + 0x24], 6
jne 0x1006ec2a
cmp dword [esp + 0x28], 0
jne 0x1006eb5b
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006eb26
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_Vista
push edx
call ebp
add esp, 0xc
cmp dword [esp + 0x24], 6
mov ebx, 0xa
jne 0x1006ec2a
cmp dword [esp + 0x28], 1
jne 0x1006eba5
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006eb70
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_7
push edx
call ebp
add esp, 0xc
cmp dword [esp + 0x24], 6
mov ebx, 0xb
jne 0x1006ec2a
cmp dword [esp + 0x28], 2
jne 0x1006ebe7
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ebb6
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_8
push edx
call ebp
add esp, 0xc
cmp dword [esp + 0x24], 6
mov ebx, 0xc
jne 0x1006ec2a
cmp dword [esp + 0x28], 3
jne 0x1006eca5
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ec00
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_8.1
push edx
call ebp
add esp, 0xc
mov ebx, 0xd
cmp dword [esp + 0x24], 0xa
jne 0x1006ec6c
cmp dword [esp + 0x28], 0
jne 0x1006eca5
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ec42
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_10
push edx
call ebp
add esp, 0xc
mov ebx, 0xe
cmp dword [esp + 0x24], 4
ja 0x1006eca5
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ec80
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_NT
push edx
call ebp
add esp, 0xc
test edi, edi
mov esi, dword [sym.imp.MSVCR80.dll_sprintf]
je 0x1006ef6c
mov al, byte [esp + 0x13a]
cmp al, 1
jne 0x1006ed5e
cmp dword [esp + 0x24], 4
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
jne 0x1006ecff
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ecd3
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Workstation_4.0
push edx
call ebp
mov ebx, 5
jmp 0x1006f100
test dword [esp + 0x138], 0x200
je 0x1006ed37
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ed10
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Home_Edition
push edx
call ebp
jmp 0x1006f100
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ed37
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Professional
push edx
call ebp
jmp 0x1006f100
cmp al, 3
jne 0x1006f103
cmp dword [esp + 0x24], 5
jne 0x1006eef7
mov eax, dword [esp + 0x28]
cmp eax, 2
jne 0x1006ee4e
mov eax, dword [esp + 0x138]
test al, al
jns 0x1006edba
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ed93
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Datacenter_Edition
push edx
call ebp
jmp 0x1006f100
test al, 2
je 0x1006edef
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006edc8
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Enterprise_Edition
push edx
call ebp
jmp 0x1006f100
cmp ax, 0x400
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
jne 0x1006ee27
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ee00
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Web_Edition
push edx
call ebp
jmp 0x1006f100
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ee27
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Standard_Edition
push edx
call ebp
jmp 0x1006f100
test eax, eax
jne 0x1006eef7
mov al, byte [esp + 0x138]
test al, al
jns 0x1006ee97
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
jmp 0x1006ee70
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ee70
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Datacenter_Server
push edx
call ebp
jmp 0x1006f100
test al, 2
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
je 0x1006eed0
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006eea5
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Advanced_Server
push edx
call ebp
jmp 0x1006f100
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006eed0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Server
push edx
call ebp
jmp 0x1006f100
test byte [esp + 0x138], 2
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
je 0x1006ef40
jmp 0x1006ef10
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ef10
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Server_4.0__Enterprise_Edition
push edx
call ebp
mov ebx, 6
jmp 0x1006f100
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006ef40
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Server_4.0
push edx
call ebp
mov ebx, 6
jmp 0x1006f100
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x50
push closesocket
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1006f1da
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x540]
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.ProductType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1006f1da
cmp dword [esp + 0x14], esi
ja 0x1006f1da
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 6
lea edi, [esp + 0x53c]
mov esi, str.WINNT
mov ecx, ebx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1006f01f
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006eff5
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Workstation
push edx
call ebp
add esp, 0xc
mov ebx, 5
lea edi, [esp + 0x53c]
mov esi, str.LANMANNT
mov ecx, 9
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1006f065
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f040
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Server
push edx
call ebp
add esp, 0xc
lea edi, [esp + 0x53c]
mov esi, str.SERVERNT
mov ecx, 9
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1006f0ab
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f086
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Advanced_Server
push edx
call ebp
add esp, 0xc
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x594]
push str._d._d
push edx
call dword [sym.imp.MSVCR80.dll_sprintf]
lea eax, [esp + 0x14c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f0d5
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x590]
push edx
lea eax, [esp + 0x144]
push eax
call ebp
mov esi, dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
cmp dword [esp + 0x24], 4
jne 0x1006f186
push str.Service_Pack_6
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1006f186
lea edx, [esp + 0x10]
push edx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
lea ecx, [esp + 0x58c]
jne 0x1006f163
movzx eax, word [esp + 0x2c]
push eax
push str.Service_Pack_6a__Build__d_
push ecx
call esi
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1006f1a3
movzx edx, word [esp + 0x2c]
push edx
lea eax, [esp + 0x38]
push eax
push str._s__Build__d_
push ecx
call esi
mov edx, dword [esp + 0x20]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1006f1a3
movzx eax, word [esp + 0x2c]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x594]
push str._s__Build__d_
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f1b0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x590]
push edx
lea eax, [esp + 0x144]
push eax
call ebp
jmp 0x1006f37b
or eax, 0xffffffff
jmp 0x1006f3b2
mov ebp, 4
cmp dword [esp + 0x24], ebp
jne 0x1006f37e
cmp dword [esp + 0x28], 0
mov esi, dword [sym.imp.MSVCR80.dll_strncat]
jne 0x1006f284
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f210
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_95
push edx
call esi
mov ax, word [esp + 0x42]
add esp, 0xc
cmp ax, 0x43
je 0x1006f246
cmp ax, 0x42
jne 0x1006f275
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f250
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.OSR2
push edx
call esi
add esp, 0xc
cmp dword [esp + 0x24], ebp
mov ebx, 2
jne 0x1006f37e
cmp dword [esp + 0x28], 0xa
jne 0x1006f30b
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f2a0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_98
push edx
call esi
add esp, 0xc
cmp word [esp + 0x36], 0x41
jne 0x1006f2fc
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f2d7
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push 0x100acfd4
push edx
call esi
add esp, 0xc
cmp dword [esp + 0x24], ebp
mov ebx, 3
jne 0x1006f37e
cmp dword [esp + 0x28], 0x5a
jne 0x1006f37e
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f320
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_Millennium_Edition
push edx
call esi
mov ebx, ebp
jmp 0x1006f37b
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f350
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Win32s
push edx
call dword [sym.imp.MSVCR80.dll_strncat]
mov ebx, 1
add esp, 0xc
mov eax, dword [esp + 0x998]
mov edx, dword [esp + 0x1c]
add eax, 0xffffffff
push eax
lea ecx, [esp + 0x140]
push ecx
push edx
call dword [sym.imp.MSVCR80.dll_strncpy]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
push str._CORE__XWHSMDriverManager::getSystemVersion__End
push ecx
call fcn.100772b0
add esp, 0x14
mov eax, ebx
pop ebp
mov ecx, dword [esp + 0x988]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10090524
add esp, 0x980
ret 8