Function at 0x43c905
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x124
mov eax, dword [0x5e4ce0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, str.unknown
push esi
mov dword [ebp - 0x80], edi
call fcn.004013dd
lea ecx, [edi + 4]
push esi
mov dword [ebp - 0x7c], ecx
call fcn.004013dd
lea ecx, [edi + 8]
push esi
mov dword [ebp - 0x88], ecx
call fcn.004013dd
lea ebx, [ebp - 0x84]
lea edi, [ebp - 0x78]
call fcn.0043c88c
test eax, eax
je 0x43cd8b
lea esi, [ebp - 0xac]
call fcn.0043c8d2
mov eax, dword [ebp - 0x68]
xor edi, edi
sub eax, edi
je 0x43cd58
dec eax
je 0x43ccc6
dec eax
jne 0x43cd8b
cmp dword [ebp - 0x74], 6
push 5
pop esi
push 2
pop ebx
jne 0x43c9b3
cmp dword [ebp - 0x70], edi
jne 0x43ca36
cmp byte [ebp + 0x22], 1
mov ecx, dword [ebp - 0x80]
jne 0x43c9a9
push str.Microsoft_Windows_Vista
jmp 0x43c9ae
push str.Windows_Server_Longhorn
call fcn.004013dd
cmp dword [ebp - 0x74], esi
jne 0x43ca23
cmp dword [ebp - 0x70], ebx
jne 0x43c9f9
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x43c9d0
push str.Microsoft_Windows_Server_2003__R2_
jmp 0x43c9ec
cmp byte [ebp + 0x22], 1
jne 0x43c9e7
cmp word [ebp - 0xac], 9
jne 0x43c9e7
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x43c9ec
push str.Microsoft_Windows_Server_2003
mov ecx, dword [ebp - 0x80]
call fcn.004013dd
cmp dword [ebp - 0x74], esi
jne 0x43ca23
cmp dword [ebp - 0x70], 1
jne 0x43ca11
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_XP
call fcn.004013dd
cmp dword [ebp - 0x74], esi
jne 0x43ca23
cmp dword [ebp - 0x70], edi
jne 0x43ca36
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_2000
call fcn.004013dd
cmp dword [ebp - 0x74], 4
ja 0x43ca36
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_NT
call fcn.004013dd
cmp dword [ebp - 0x84], edi
je 0x43cb78
cmp byte [ebp + 0x22], 1
jne 0x43ca85
cmp word [ebp - 0xac], 9
je 0x43cc52
cmp dword [ebp - 0x74], 4
mov ecx, dword [ebp - 0x7c]
jne 0x43ca69
push str.Workstation_4.0
jmp 0x43cb6e
test word [ebp + 0x20], 0x200
je 0x43ca7b
push str.Home_Edition
jmp 0x43cb6e
push str.Professional
jmp 0x43cb6e
cmp byte [ebp + 0x22], 3
je 0x43ca94
cmp byte [ebp + 0x22], bl
jne 0x43cc52
cmp dword [ebp - 0x74], esi
jne 0x43cb5a
cmp dword [ebp - 0x70], ebx
jne 0x43cb32
cmp word [ebp - 0xac], 6
jne 0x43cacd
test byte [ebp + 0x20], 0x80
je 0x43cabd
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x43cb08
test byte [ebp + 0x20], bl
je 0x43ccb3
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x43cb08
cmp word [ebp - 0xac], 9
jne 0x43cafd
test byte [ebp + 0x20], 0x80
mov ecx, dword [ebp - 0x7c]
je 0x43caea
push str.Datacenter_x64_Edition
jmp 0x43cb6e
test byte [ebp + 0x20], bl
je 0x43caf6
push str.Enterprise_x64_Edition
jmp 0x43cb6e
push str.Standard_x64_Edition
jmp 0x43cb6e
test byte [ebp + 0x20], 0x80
je 0x43cb0d
push str.Datacenter_Edition
mov ecx, dword [ebp - 0x7c]
jmp 0x43cb6e
test byte [ebp + 0x20], bl
mov ecx, dword [ebp - 0x7c]
je 0x43cb1c
push str.Enterprise_Edition
jmp 0x43cb6e
cmp word [ebp + 0x20], 0x400
jne 0x43cb2b
push str.Web_Edition
jmp 0x43cb6e
push str.Standard_Edition
jmp 0x43cb6e
cmp dword [ebp - 0x70], edi
jne 0x43cb5a
test byte [ebp + 0x20], 0x80
mov ecx, dword [ebp - 0x7c]
je 0x43cb47
push str.Datacenter_Server
jmp 0x43cb6e
test byte [ebp + 0x20], bl
je 0x43cb53
push str.Advanced_Server
jmp 0x43cb6e
push 0x5b7b24
jmp 0x43cb6e
test byte [ebp + 0x20], bl
mov ecx, dword [ebp - 0x7c]
je 0x43cb69
push str.Server_4.0__Enterprise_Edition
jmp 0x43cb6e
push str.Server_4.0
call fcn.004013dd
jmp 0x43cc52
push 0x50
pop esi
lea eax, [ebp - 0x80]
push eax
push 1
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x84], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43cc37
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp + 0x24]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x80]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x43cc37
cmp dword [ebp - 0x84], esi
ja 0x43cc37
lea eax, [ebp + 0x24]
push eax
push str.WINNT
call fcn.004dc659
test eax, eax
pop ecx
pop ecx
jne 0x43cbf5
mov ecx, dword [ebp - 0x7c]
push str.Workstation
call fcn.004013dd
lea eax, [ebp + 0x24]
push eax
push str.LANMANNT
call fcn.004dc659
test eax, eax
pop ecx
pop ecx
jne 0x43cc16
mov ecx, dword [ebp - 0x7c]
push 0x5b7b24
call fcn.004013dd
lea eax, [ebp + 0x24]
push eax
push str.SERVERNT
call fcn.004dc659
test eax, eax
pop ecx
pop ecx
jne 0x43cc37
mov ecx, dword [ebp - 0x7c]
push str.Advanced_Server
call fcn.004013dd
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push str._d._d
push dword [ebp - 0x88]
call fcn.004037b5
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x74], 4
jne 0x43ccb3
lea eax, [ebp - 0x64]
push str.Service_Pack_6
push eax
call fcn.004dc659
test eax, eax
pop ecx
pop ecx
jne 0x43ccb3
lea eax, [ebp - 0x84]
push eax
push 1
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
movzx eax, word [ebp - 0x6c]
push eax
jne 0x43ccb8
push str.Service_Pack_6a__Build__d_
push dword [ebp - 0x88]
call fcn.004037b5
add esp, 0xc
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43cd8b
movzx eax, word [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push str._s__Build__d_
jmp 0x43cd7d
cmp dword [ebp - 0x74], 4
jne 0x43cd72
cmp dword [ebp - 0x70], edi
mov esi, 0x5af400
jne 0x43cd09
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_95
call fcn.004013dd
cmp byte [ebp - 0x63], 0x43
je 0x43ccf6
cmp byte [ebp - 0x63], 0x42
je 0x43ccf6
push esi
jmp 0x43ccfb
push str.OSR2
mov ecx, dword [ebp - 0x7c]
call fcn.004013dd
cmp dword [ebp - 0x74], 4
jne 0x43cd72
cmp dword [ebp - 0x70], 0xa
jne 0x43cd3e
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_98
call fcn.004013dd
cmp byte [ebp - 0x63], 0x41
je 0x43cd2b
cmp byte [ebp - 0x63], 0x42
je 0x43cd2b
push esi
jmp 0x43cd30
push 0x5b0e18
mov ecx, dword [ebp - 0x7c]
call fcn.004013dd
cmp dword [ebp - 0x74], 4
jne 0x43cd72
cmp dword [ebp - 0x70], 0x5a
jne 0x43cd72
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_ME
call fcn.004013dd
push str.Millennium_Edition
jmp 0x43cd6a
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Win32s
call fcn.004013dd
push 0x5af400
mov ecx, dword [ebp - 0x7c]
call fcn.004013dd
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push str._d._d
push dword [ebp - 0x88]
call fcn.004037b5
add esp, 0x10
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d99c4
add ebp, 0x78
leave
ret