Function at 0x48a982
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov dl, byte [0x54dd08]
push ebx
push esi
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x2f3]
mov byte [ebp - 0x2f4], dl
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x1a3]
mov byte [ebp - 0x1a4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x3f3]
mov byte [ebp - 0x3f4], dl
mov esi, 0x9c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor ebx, ebx
push esi
lea eax, [ebp - 0xa4]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
mov edi, eax
cmp edi, ebx
jne 0x48aa24
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x94
push eax
call esi
test eax, eax
je 0x48ad4e
mov eax, dword [ebp - 0x94]
sub eax, ebx
je 0x48adf6
dec eax
je 0x48ad55
dec eax
jne 0x48ae09
push 5
pop esi
cmp dword [ebp - 0xa0], esi
jne 0x48aaae
cmp dword [ebp - 0x9c], 2
jne 0x48aa6f
lea eax, [ebp - 0x2f4]
push str.Microsoft_Windows_Server_2003_
push eax
call sub.MSVCRT.dll_strcpy
cmp dword [ebp - 0xa0], esi
pop ecx
pop ecx
jne 0x48aaae
cmp dword [ebp - 0x9c], 1
jne 0x48aa93
lea eax, [ebp - 0x2f4]
push str.Microsoft_Windows_XP
push eax
call sub.MSVCRT.dll_strcpy
cmp dword [ebp - 0xa0], esi
pop ecx
pop ecx
jne 0x48aaae
cmp dword [ebp - 0x9c], ebx
jne 0x48aaca
lea eax, [ebp - 0x2f4]
push str.Microsoft_Windows_2000
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
ja 0x48aaca
lea eax, [ebp - 0x2f4]
push str.Microsoft_Windows_NT
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
test edi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, reloc.WSOCK32.dll_bind
je 0x48abb0
cmp byte [ebp - 0xa], 1
jne 0x48ab10
cmp dword [ebp - 0xa0], 4
jne 0x48aaf6
push str.Workstation_4.0
jmp 0x48ab96
test byte [ebp - 0xb], 2
je 0x48ab06
push str.Home_Edition
jmp 0x48ab96
push str.Professional
jmp 0x48ab96
cmp byte [ebp - 0xa], 3
je 0x48ab20
cmp byte [ebp - 0xa], 2
jne 0x48ac9b
cmp dword [ebp - 0xa0], esi
jne 0x48ab8b
cmp dword [ebp - 0x9c], 2
jne 0x48ab61
test byte [ebp - 0xc], 0x80
je 0x48ab3e
push str.Datacenter_Edition
jmp 0x48ab96
test byte [ebp - 0xc], 2
je 0x48ab4b
push str.Enterprise_Edition
jmp 0x48ab96
cmp word [ebp - 0xc], 0x400
jne 0x48ab5a
push str.Web_Edition
jmp 0x48ab96
push str.Standard_Edition
jmp 0x48ab96
cmp dword [ebp - 0x9c], 0
jne 0x48ab8b
test byte [ebp - 0xc], 0x80
je 0x48ab77
push str.Datacenter_Server
jmp 0x48ab96
test byte [ebp - 0xc], 2
je 0x48ab84
push str.Advanced_Server
jmp 0x48ab96
push str.Server
jmp 0x48ab96
test byte [ebp - 0xc], 2
je 0x48aba9
push str.Server_4.0__Enterprise_Edition
lea eax, [ebp - 0x1a4]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x48ac9b
push str.Server_4.0
jmp 0x48ab96
push 0x50
lea eax, [ebp - 4]
pop esi
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x48ad4e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1f4]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48ad4e
cmp dword [ebp - 8], esi
ja 0x48ad4e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x1f4]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x48ac30
lea eax, [ebp - 0x1a4]
push str.Workstation
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x1f4]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x48ac55
lea eax, [ebp - 0x1a4]
push str.Server
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x1f4]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x48ac7a
lea eax, [ebp - 0x1a4]
push str.Advanced_Server
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push dword [ebp - 0x9c]
lea eax, [ebp - 0x3f4]
push dword [ebp - 0xa0]
push str._d._d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
cmp dword [ebp - 0xa0], 4
jne 0x48ad21
lea eax, [ebp - 0x90]
push str.Service_Pack_6
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x48ad21
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push ebx
call edi
test eax, eax
mov eax, dword [ebp - 0x98]
jne 0x48acf1
and eax, 0xffff
push eax
lea eax, [ebp - 0x3f4]
push str.Service_Pack_6a__Build__d_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x48ad13
and eax, 0xffff
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x3f4]
push str._s__Build__d_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48ae09
mov eax, dword [ebp - 0x98]
and eax, 0xffff
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x3f4]
push str._s__Build__d_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x48ae09
xor eax, eax
jmp 0x48ae32
cmp dword [ebp - 0xa0], 4
jne 0x48ae09
cmp dword [ebp - 0x9c], ebx
jne 0x48ada8
lea eax, [ebp - 0x2f4]
push str.Microsoft_Windows_95
push eax
call sub.MSVCRT.dll_strcpy
cmp byte [ebp - 0x8f], 0x43
pop ecx
pop ecx
je 0x48ad8f
cmp byte [ebp - 0x8f], 0x42
jne 0x48ad9f
push str.OSR2
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
jne 0x48ae09
cmp dword [ebp - 0x9c], 0xa
jne 0x48ade6
lea eax, [ebp - 0x2f4]
push str.Microsoft_Windows_98
push eax
call sub.MSVCRT.dll_strcpy
cmp byte [ebp - 0x8f], 0x41
pop ecx
pop ecx
jne 0x48addd
push 0x535e70
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
pop ecx
cmp dword [ebp - 0xa0], 4
jne 0x48ae09
cmp dword [ebp - 0x9c], 0x5a
jne 0x48ae09
push str.Microsoft_Windows_Millennium_Edition
jmp 0x48adfb
push str.Microsoft_Win32s
lea eax, [ebp - 0x2f4]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x3f4]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x2f4]
push eax
push str._s__s__s
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret