Function at 0x473ebe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x124
mov eax, dword [0x6c0bc0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, str.unknown
push esi
mov dword [ebp - 0x80], edi
call fcn.004014d3
lea ecx, [edi + 4]
push esi
mov dword [ebp - 0x7c], ecx
call fcn.004014d3
lea ecx, [edi + 8]
push esi
mov dword [ebp - 0x88], ecx
call fcn.004014d3
lea ebx, [ebp - 0x84]
lea edi, [ebp - 0x78]
call fcn.00473e45
test eax, eax
je 0x474344
lea esi, [ebp - 0xac]
call fcn.00473e8b
mov eax, dword [ebp - 0x68]
xor edi, edi
sub eax, edi
je 0x474311
dec eax
je 0x47427f
dec eax
jne 0x474344
cmp dword [ebp - 0x74], 6
push 5
pop esi
push 2
pop ebx
jne 0x473f6c
cmp dword [ebp - 0x70], edi
jne 0x473fef
cmp byte [ebp + 0x22], 1
mov ecx, dword [ebp - 0x80]
jne 0x473f62
push str.Microsoft_Windows_Vista
jmp 0x473f67
push str.Windows_Server_Longhorn
call fcn.004014d3
cmp dword [ebp - 0x74], esi
jne 0x473fdc
cmp dword [ebp - 0x70], ebx
jne 0x473fb2
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x473f89
push str.Microsoft_Windows_Server_2003__R2_
jmp 0x473fa5
cmp byte [ebp + 0x22], 1
jne 0x473fa0
cmp word [ebp - 0xac], 9
jne 0x473fa0
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x473fa5
push str.Microsoft_Windows_Server_2003
mov ecx, dword [ebp - 0x80]
call fcn.004014d3
cmp dword [ebp - 0x74], esi
jne 0x473fdc
cmp dword [ebp - 0x70], 1
jne 0x473fca
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_XP
call fcn.004014d3
cmp dword [ebp - 0x74], esi
jne 0x473fdc
cmp dword [ebp - 0x70], edi
jne 0x473fef
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_2000
call fcn.004014d3
cmp dword [ebp - 0x74], 4
ja 0x473fef
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_NT
call fcn.004014d3
cmp dword [ebp - 0x84], edi
je 0x474131
cmp byte [ebp + 0x22], 1
jne 0x47403e
cmp word [ebp - 0xac], 9
je 0x47420b
cmp dword [ebp - 0x74], 4
mov ecx, dword [ebp - 0x7c]
jne 0x474022
push str.Workstation_4.0
jmp 0x474127
test word [ebp + 0x20], 0x200
je 0x474034
push str.Home_Edition
jmp 0x474127
push str.Professional
jmp 0x474127
cmp byte [ebp + 0x22], 3
je 0x47404d
cmp byte [ebp + 0x22], bl
jne 0x47420b
cmp dword [ebp - 0x74], esi
jne 0x474113
cmp dword [ebp - 0x70], ebx
jne 0x4740eb
cmp word [ebp - 0xac], 6
jne 0x474086
test byte [ebp + 0x20], 0x80
je 0x474076
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x4740c1
test byte [ebp + 0x20], bl
je 0x47426c
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x4740c1
cmp word [ebp - 0xac], 9
jne 0x4740b6
test byte [ebp + 0x20], 0x80
mov ecx, dword [ebp - 0x7c]
je 0x4740a3
push str.Datacenter_x64_Edition
jmp 0x474127
test byte [ebp + 0x20], bl
je 0x4740af
push str.Enterprise_x64_Edition
jmp 0x474127
push str.Standard_x64_Edition
jmp 0x474127
test byte [ebp + 0x20], 0x80
je 0x4740c6
push str.Datacenter_Edition
mov ecx, dword [ebp - 0x7c]
jmp 0x474127
test byte [ebp + 0x20], bl
mov ecx, dword [ebp - 0x7c]
je 0x4740d5
push str.Enterprise_Edition
jmp 0x474127
cmp word [ebp + 0x20], 0x400
jne 0x4740e4
push str.Web_Edition
jmp 0x474127
push str.Standard_Edition
jmp 0x474127
cmp dword [ebp - 0x70], edi
jne 0x474113
test byte [ebp + 0x20], 0x80
mov ecx, dword [ebp - 0x7c]
je 0x474100
push str.Datacenter_Server
jmp 0x474127
test byte [ebp + 0x20], bl
je 0x47410c
push str.Advanced_Server
jmp 0x474127
push str.Server
jmp 0x474127
test byte [ebp + 0x20], bl
mov ecx, dword [ebp - 0x7c]
je 0x474122
push str.Server_4.0__Enterprise_Edition
jmp 0x474127
push str.Server_4.0
call fcn.004014d3
jmp 0x47420b
push 0x50
pop esi
lea eax, [ebp - 0x80]
push eax
push 1
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x84], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4741f0
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp + 0x24]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x80]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x4741f0
cmp dword [ebp - 0x84], esi
ja 0x4741f0
lea eax, [ebp + 0x24]
push eax
push str.WINNT
call fcn.00591d01
test eax, eax
pop ecx
pop ecx
jne 0x4741ae
mov ecx, dword [ebp - 0x7c]
push str.Workstation
call fcn.004014d3
lea eax, [ebp + 0x24]
push eax
push str.LANMANNT
call fcn.00591d01
test eax, eax
pop ecx
pop ecx
jne 0x4741cf
mov ecx, dword [ebp - 0x7c]
push str.Server
call fcn.004014d3
lea eax, [ebp + 0x24]
push eax
push str.SERVERNT
call fcn.00591d01
test eax, eax
pop ecx
pop ecx
jne 0x4741f0
mov ecx, dword [ebp - 0x7c]
push str.Advanced_Server
call fcn.004014d3
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push str._d._d
push dword [ebp - 0x88]
call fcn.004048ab
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x74], 4
jne 0x47426c
lea eax, [ebp - 0x64]
push str.Service_Pack_6
push eax
call fcn.00591d01
test eax, eax
pop ecx
pop ecx
jne 0x47426c
lea eax, [ebp - 0x84]
push eax
push 1
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
movzx eax, word [ebp - 0x6c]
push eax
jne 0x474271
push str.Service_Pack_6a__Build__d_
push dword [ebp - 0x88]
call fcn.004048ab
add esp, 0xc
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x474344
movzx eax, word [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push str._s__Build__d_
jmp 0x474336
cmp dword [ebp - 0x74], 4
jne 0x47432b
cmp dword [ebp - 0x70], edi
mov esi, 0x61b5f4
jne 0x4742c2
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_95
call fcn.004014d3
cmp byte [ebp - 0x63], 0x43
je 0x4742af
cmp byte [ebp - 0x63], 0x42
je 0x4742af
push esi
jmp 0x4742b4
push str.OSR2
mov ecx, dword [ebp - 0x7c]
call fcn.004014d3
cmp dword [ebp - 0x74], 4
jne 0x47432b
cmp dword [ebp - 0x70], 0xa
jne 0x4742f7
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_98
call fcn.004014d3
cmp byte [ebp - 0x63], 0x41
je 0x4742e4
cmp byte [ebp - 0x63], 0x42
je 0x4742e4
push esi
jmp 0x4742e9
push 0x61e4fc
mov ecx, dword [ebp - 0x7c]
call fcn.004014d3
cmp dword [ebp - 0x74], 4
jne 0x47432b
cmp dword [ebp - 0x70], 0x5a
jne 0x47432b
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_ME
call fcn.004014d3
push str.Millennium_Edition
jmp 0x474323
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Win32s
call fcn.004014d3
push 0x61b5f4
mov ecx, dword [ebp - 0x7c]
call fcn.004014d3
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push str._d._d
push dword [ebp - 0x88]
call fcn.004048ab
add esp, 0x10
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058cc82
add ebp, 0x78
leave
ret