Function at 0x41e440
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x4620c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x200
lea eax, [ebp - 0x284]
push 0x4441a6
push eax
call fcn.0040fb30
push 0x80
lea ecx, [ebp - 0x84]
push 0x4441a6
push ecx
call fcn.0040fb30
push 0x9c
lea edx, [ebp - 0x44c]
push 0
mov edi, 0x1869f
push edx
mov dword [ebp - 0x450], edi
call sub.MSVCR90.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0x24
lea eax, [ebp - 0x44c]
push eax
mov dword [ebp - 0x44c], 0x9c
call esi
mov ebx, eax
mov dword [ebp - 0x454], ebx
test ebx, ebx
jne 0x41e4f2
lea ecx, [ebp - 0x44c]
push ecx
mov dword [ebp - 0x44c], 0x94
call esi
test eax, eax
jne 0x41e4f2
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405fa8
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x43c]
sub eax, 0
je 0x41efdc
sub eax, 1
je 0x41ee88
sub eax, 1
jne 0x41eff5
mov ecx, dword [ebp - 0x448]
mov eax, dword [ebp - 0x444]
cmp ecx, 6
ja 0x41e624
jne 0x41e5c9
cmp eax, 4
ja 0x41e647
jne 0x41e553
xor edx, edx
cmp byte [ebp - 0x3b2], 1
setne dl
add edx, 0x18
mov dword [ebp - 0x450], edx
jmp 0x41e667
cmp eax, 2
je 0x41e55d
cmp eax, 3
jne 0x41e577
xor edx, edx
cmp byte [ebp - 0x3b2], 1
setne dl
add edx, 0x16
mov dword [ebp - 0x450], edx
jmp 0x41e65c
cmp eax, 1
jne 0x41e5a7
xor eax, eax
cmp byte [ebp - 0x3b2], 1
lea esi, [ebp - 0x284]
setne al
lea edi, [ebp - 0x84]
add eax, 0x14
mov dword [ebp - 0x450], eax
call fcn.0041df10
jmp 0x41e810
test eax, eax
jne 0x41e65c
xor ecx, ecx
cmp byte [ebp - 0x3b2], 1
setne cl
add ecx, 0x12
mov dword [ebp - 0x450], ecx
jmp 0x41e6d6
cmp ecx, 5
jne 0x41e613
mov eax, dword [ebp - 0x444]
cmp eax, 2
jb 0x41e5e8
mov dword [ebp - 0x450], 0xd
jmp 0x41e701
cmp eax, 1
jne 0x41e5fc
mov dword [ebp - 0x450], 9
jmp 0x41e73f
test eax, eax
jne 0x41e701
mov dword [ebp - 0x450], 5
jmp 0x41e777
cmp ecx, 4
ja 0x41e64d
mov dword [ebp - 0x450], 4
jmp 0x41e64d
cmp ecx, 0xa
jne 0x41e647
test eax, eax
jne 0x41e647
xor edx, edx
cmp byte [ebp - 0x3b2], 1
setne dl
add edx, 0x18
mov dword [ebp - 0x450], edx
jmp 0x41e7e2
mov dword [ebp - 0x450], edi
cmp ecx, 6
ja 0x41e7d9
jne 0x41e6f8
cmp eax, 4
ja 0x41e7ff
jne 0x41e687
mov eax, dword [ebp - 0x450]
push eax
lea esi, [ebp - 0x284]
lea edi, [ebp - 0x84]
call fcn.0041e320
add esp, 4
jmp 0x41e810
cmp eax, 2
je 0x41e691
cmp eax, 3
jne 0x41e6b3
mov edx, dword [ebp - 0x450]
lea ecx, [ebp - 0x84]
push ecx
push edx
push eax
lea esi, [ebp - 0x284]
call fcn.0041e140
add esp, 0xc
jmp 0x41e810
cmp eax, 1
jne 0x41e6ce
lea esi, [ebp - 0x284]
lea edi, [ebp - 0x84]
call fcn.0041df10
jmp 0x41e810
test eax, eax
jne 0x41e7a8
lea esi, [ebp - 0x284]
lea edi, [ebp - 0x84]
lea ebx, [ebp - 0x44c]
call fcn.0041d8e0
mov ebx, dword [ebp - 0x454]
jmp 0x41e810
cmp ecx, 5
jne 0x41e7a8
cmp eax, 2
jne 0x41e73a
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_2003
push eax
call fcn.0040fb30
push 0x80
lea ecx, [ebp - 0x84]
push str.win2003
push ecx
call fcn.0040fb30
add esp, 0x18
jmp 0x41e810
cmp eax, 1
jne 0x41e773
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_XP
push edx
call fcn.0040fb30
push 0x80
lea eax, [ebp - 0x84]
push str.winXP
push eax
call fcn.0040fb30
add esp, 0x18
jmp 0x41e810
test eax, eax
jne 0x41e7a8
push 0x200
lea ecx, [ebp - 0x284]
push str.Windows_2000
push ecx
call fcn.0040fb30
push 0x80
lea edx, [ebp - 0x84]
push str.win2000
push edx
call fcn.0040fb30
add esp, 0x18
jmp 0x41e810
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_NT
push eax
call fcn.0040fb30
push 0x80
lea ecx, [ebp - 0x84]
push str.winNT
push ecx
call fcn.0040fb30
add esp, 0x18
jmp 0x41e810
cmp ecx, 0xa
jne 0x41e7ff
test eax, eax
jne 0x41e7ff
mov edx, dword [ebp - 0x450]
push edx
lea esi, [ebp - 0x284]
lea edi, [ebp - 0x84]
call fcn.0041e320
add esp, 4
jmp 0x41e810
lea esi, [ebp - 0x284]
lea edi, [ebp - 0x84]
call fcn.0041e3c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x41ec12
mov al, byte [ebp - 0x3b2]
cmp al, 1
jne 0x41e97d
mov eax, dword [ebp - 0x448]
cmp eax, 4
jne 0x41e869
push 0x200
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x284]
push 0x4451c8
push eax
call fcn.0040fb80
push 0x200
push str.Workstation_4.0
lea ecx, [ebp - 0x284]
push ecx
jmp 0x41edb6
cmp eax, 5
jne 0x41edbe
mov eax, dword [ebp - 0x444]
cmp eax, 2
jne 0x41e8b8
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_XP_Professional_x64_Edition
push edx
mov dword [ebp - 0x450], 0xc
call fcn.0040fb30
push 0x80
lea eax, [ebp - 0x84]
push str.winXPPro_64
push eax
call fcn.0040fb30
jmp 0x41edbb
cmp eax, 1
jne 0x41e93a
test dword [ebp - 0x3b4], 0x200
push 0x200
je 0x41e904
lea ecx, [ebp - 0x284]
push str.Windows_XP_Home_Edition
push ecx
mov dword [ebp - 0x450], 0xa
call fcn.0040fb30
push 0x80
lea edx, [ebp - 0x84]
push str.winXPHome
push edx
call fcn.0040fb30
jmp 0x41edbb
lea eax, [ebp - 0x284]
push str.Windows_XP_Professional
push eax
mov dword [ebp - 0x450], 0xb
call fcn.0040fb30
push 0x80
lea ecx, [ebp - 0x84]
push str.winXPPro
push ecx
call fcn.0040fb30
jmp 0x41edbb
test eax, eax
jne 0x41ee41
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_2000_Professional
push edx
mov dword [ebp - 0x450], 6
call fcn.0040fb30
push 0x80
lea eax, [ebp - 0x84]
push str.win2000Pro
push eax
call fcn.0040fb30
jmp 0x41edbb
cmp al, 3
je 0x41e989
cmp al, 2
jne 0x41edbe
cmp dword [ebp - 0x448], 5
jne 0x41edbe
mov eax, dword [ebp - 0x444]
cmp eax, 2
jne 0x41eb55
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x450], 0xf
test al, al
jns 0x41e9e8
push 0x200
lea ecx, [ebp - 0x284]
push str.Windows_Server_2003_Datacenter_Edition
push ecx
mov dword [ebp - 0x450], 0x11
call fcn.0040fb30
push 0x80
push str.winNetDatacenter
jmp 0x41eb0c
test al, 2
je 0x41ea22
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_Server_2003_Enterprise_Edition
push eax
mov dword [ebp - 0x450], 0x10
call fcn.0040fb30
push 0x80
push str.winNetEnterprise
lea ecx, [ebp - 0x84]
push ecx
jmp 0x41eb13
test eax, 0x400
je 0x41ea5f
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_Server_2003_Web_Edition
push edx
mov dword [ebp - 0x450], 0xe
call fcn.0040fb30
push 0x80
push str.winNetWeb
lea eax, [ebp - 0x84]
push eax
jmp 0x41eb13
test eax, 0x4000
je 0x41ea8b
push 0x200
lea ecx, [ebp - 0x284]
push str.Windows_Server_2003_Compute_Cluster_Edition
push ecx
call fcn.0040fb30
push 0x80
push str.winNetComputeCluster
jmp 0x41eb0c
test eax, 0x2000
je 0x41eabb
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_Storage_Server_2003
push eax
call fcn.0040fb30
push 0x80
push str.winNetStorageSvr
lea ecx, [ebp - 0x84]
push ecx
jmp 0x41eb13
test al, 1
je 0x41eaec
test al, 0x20
je 0x41eaec
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_Server_2003_Small_Business
push edx
call fcn.0040fb30
push 0x80
push str.winNetBusiness
lea eax, [ebp - 0x84]
push eax
jmp 0x41eb13
push 0x200
lea ecx, [ebp - 0x284]
push str.Windows_Server_2003_Standard_Edition
push ecx
call fcn.0040fb30
push 0x80
push str.winNetStandard
lea edx, [ebp - 0x84]
push edx
call fcn.0040fb30
add esp, 0x18
call fcn.0041d850
cmp eax, 0x40
jne 0x41edbe
push 0x80
lea eax, [ebp - 0x84]
push 0x4555f8
push eax
call fcn.0040fb80
push 0x200
push str.__64_bit_
lea ecx, [ebp - 0x284]
push ecx
jmp 0x41edb6
test eax, eax
jne 0x41ee41
mov al, byte [ebp - 0x3b4]
push 0x200
test al, al
jns 0x41eba2
lea edx, [ebp - 0x284]
push str.Windows_2000_Data_Center_Server
push edx
mov dword [ebp - 0x450], 7
call fcn.0040fb30
push 0x80
lea eax, [ebp - 0x84]
push str.win2000DataCentServ
push eax
call fcn.0040fb30
jmp 0x41edbb
test al, 2
je 0x41ebdc
lea ecx, [ebp - 0x284]
push str.Windows_2000_Advanced_Server
push ecx
mov dword [ebp - 0x450], 8
call fcn.0040fb30
push 0x80
lea edx, [ebp - 0x84]
push str.win2000AdvServ
push edx
call fcn.0040fb30
jmp 0x41edbb
lea eax, [ebp - 0x284]
push str.Windows_2000_Server
push eax
mov dword [ebp - 0x450], 7
call fcn.0040fb30
push 0x80
lea ecx, [ebp - 0x84]
push str.win2000Serv
push ecx
call fcn.0040fb30
jmp 0x41edbb
lea edx, [ebp - 0x454]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x458], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e4df
mov edx, dword [ebp - 0x454]
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x3b0]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e4df
cmp dword [ebp - 0x458], 0x64
ja 0x41e4df
mov eax, dword [ebp - 0x454]
push eax
call esi
lea ecx, [ebp - 0x3b0]
mov eax, str.WINNT
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ecb6
test dx, dx
je 0x41ecb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ecb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ec90
xor eax, eax
jmp 0x41ecbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41eceb
push 0x200
lea ecx, [ebp - 0x284]
push 0x4451c8
push ecx
call fcn.0040fb80
push 0x200
push str.Workstation
lea edx, [ebp - 0x284]
push edx
jmp 0x41edb6
lea ecx, [ebp - 0x3b0]
mov eax, str.LANMANNT
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ed1c
test dx, dx
je 0x41ed18
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ed1c
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ecf6
xor eax, eax
jmp 0x41ed21
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41ed4e
push 0x200
lea eax, [ebp - 0x284]
push 0x4451c8
push eax
call fcn.0040fb80
push 0x200
push str.Server
lea ecx, [ebp - 0x284]
push ecx
jmp 0x41edb6
lea ecx, [ebp - 0x3b0]
mov eax, str.SERVERNT
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ed86
test dx, dx
je 0x41ed82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ed86
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ed60
xor eax, eax
jmp 0x41ed8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41edbe
push 0x200
lea edx, [ebp - 0x284]
push 0x4451c8
push edx
call fcn.0040fb80
push 0x200
push str.Advanced_Server
lea eax, [ebp - 0x284]
push eax
call fcn.0040fb80
add esp, 0x18
cmp dword [ebp - 0x448], 4
jne 0x41ee41
push str.Service_Pack_6
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41ee41
lea edx, [ebp - 0x45c]
push edx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00421970
add esp, 0x14
lea ecx, [ebp - 0x2e8]
test eax, eax
jne 0x41ee12
movzx eax, word [ebp - 0x440]
push eax
push str.Service_Pack_6a
jmp 0x41ee21
movzx edx, word [ebp - 0x440]
push edx
lea eax, [ebp - 0x438]
push eax
push 0x4451c8
push str._s_s__Build__d_
push 0x64
push ecx
call fcn.0040fa60
mov edx, dword [ebp - 0x45c]
add esp, 0x18
push edx
call esi
jmp 0x41ee6b
movzx eax, word [ebp - 0x440]
push eax
lea ecx, [ebp - 0x438]
push ecx
push 0x4451c8
push str._s_s__Build__d_
lea edx, [ebp - 0x2e8]
push 0x64
push edx
call fcn.0040fa60
add esp, 0x18
push 0x200
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x284]
push ecx
call fcn.0040fb80
jmp 0x41eff2
cmp dword [ebp - 0x448], 4
jne 0x41eff5
mov eax, dword [ebp - 0x444]
test eax, eax
jne 0x41ef13
push 0x200
lea edx, [ebp - 0x284]
push str.Windows_95
push edx
mov dword [ebp - 0x450], 1
call fcn.0040fb30
push 0x80
lea eax, [ebp - 0x84]
push str.win95
push eax
call fcn.0040fb30
mov al, byte [ebp - 0x437]
add esp, 0x18
cmp al, 0x43
je 0x41eeea
cmp al, 0x42
jne 0x41ef8d
push 0x200
lea ecx, [ebp - 0x284]
push 0x4451c8
push ecx
call fcn.0040fb80
push 0x200
push str.OSR2
lea edx, [ebp - 0x284]
push edx
jmp 0x41ef85
cmp eax, 0xa
jne 0x41ef9c
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_98
push eax
mov dword [ebp - 0x450], 2
call fcn.0040fb30
push 0x80
lea ecx, [ebp - 0x84]
push str.win98
push ecx
call fcn.0040fb30
add esp, 0x18
cmp byte [ebp - 0x437], 0x41
jne 0x41ef8d
push 0x200
lea edx, [ebp - 0x284]
push 0x4451c8
push edx
call fcn.0040fb80
push 0x200
push 0x45540c
lea eax, [ebp - 0x284]
push eax
call fcn.0040fb80
add esp, 0x18
cmp dword [ebp - 0x448], 4
jne 0x41eff5
mov eax, dword [ebp - 0x444]
cmp eax, 0x5a
jne 0x41eff5
push 0x200
lea ecx, [ebp - 0x284]
push str.Windows_Me
push ecx
mov dword [ebp - 0x450], 3
call fcn.0040fb30
push 0x80
lea edx, [ebp - 0x84]
push str.winMe
push edx
call fcn.0040fb30
add esp, 0x18
jmp 0x41eff5
push 0x200
lea eax, [ebp - 0x284]
push str.Windows_32s
push eax
call fcn.0040fb30
add esp, 0xc
mov ecx, dword [ebp - 0x450]
lea eax, [ecx - 1]
cmp eax, 0x18
ja case.default.0x41f00a
movzx edx, byte [eax + 0x41f108]
jmp dword [edx*4 + 0x41f0dc]
mov eax, 1
jmp 0x41f063
mov eax, 2
jmp 0x41f063
mov eax, 3
jmp 0x41f063
mov eax, 4
jmp 0x41f063
mov eax, 5
jmp 0x41f063
mov eax, 6
jmp 0x41f063
mov eax, 7
jmp 0x41f063
mov eax, 8
jmp 0x41f063
mov eax, 9
jmp 0x41f063
mov eax, 0xa
jmp 0x41f063
mov eax, 0xb
jmp 0x41f063
mov eax, 0x1869f
mov edx, 1
mov esi, 0x46cb8c
xchg dword [esi], edx
test edx, edx
jne 0x41f063
mov dl, byte [0x46cba0]
test dl, dl
jne 0x41f0be
mov dword [0x46cb58], eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0x46e7e0
mov dword [0x46cb68], ecx
call fcn.0040fb30
push 0x200
lea ecx, [ebp - 0x284]
push ecx
push 0x46e5e0
call fcn.0040fb30
add esp, 0x18
mov byte [0x46cba0], 1
pop edi
mov dword [0x46cb8c], 0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00405fa8
mov esp, ebp
pop ebp
ret