Function at 0x1002cb20
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100314e9
mov eax, dword fs:[0]
push eax
sub esp, 0x38c
mov eax, dword [0x1003d3d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x50], 0x50
push 1
push 3
lea ecx, [ebp - 0x21c]
call fcn.10012e30
mov dword [ebp - 4], 1
push 0x11c
push 0
lea eax, [ebp - 0x174]
push eax
call fcn.1001a810
add esp, 0xc
mov dword [ebp - 0x174], 0x11c
lea ecx, [ebp - 0x174]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x1002cbf8
mov dword [ebp - 0x174], 0x114
lea edx, [ebp - 0x174]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1002cbf8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x21c]
call fcn.10012f60
mov ecx, dword [ebp - 0x30c]
or ecx, 1
mov dword [ebp - 0x30c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.10012550
mov eax, dword [ebp + 8]
jmp 0x1002d7ad
mov edx, dword [ebp - 0x164]
mov dword [ebp - 0x310], edx
cmp dword [ebp - 0x310], 0
je 0x1002d744
cmp dword [ebp - 0x310], 1
je 0x1002d5bf
cmp dword [ebp - 0x310], 2
je 0x1002cc2c
jmp 0x1002d77d
cmp dword [ebp - 0x170], 6
jne 0x1002cc77
cmp dword [ebp - 0x16c], 1
jne 0x1002cc77
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002cc59
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x314], ecx
jmp 0x1002cc63
mov dword [ebp - 0x314], 0
push str.Microsoft_Windows_7
mov edx, dword [ebp - 0x314]
push edx
call fcn.10016de0
add esp, 8
cmp dword [ebp - 0x170], 6
jne 0x1002ccc2
cmp dword [ebp - 0x16c], 0
jne 0x1002ccc2
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002cca4
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x318], ecx
jmp 0x1002ccae
mov dword [ebp - 0x318], 0
push str.Microsoft_Windows_Vista
mov edx, dword [ebp - 0x318]
push edx
call fcn.10016de0
add esp, 8
cmp dword [ebp - 0x170], 5
jne 0x1002cd0d
cmp dword [ebp - 0x16c], 2
jne 0x1002cd0d
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002ccef
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x31c], ecx
jmp 0x1002ccf9
mov dword [ebp - 0x31c], 0
push str.Microsoft_Windows_Server_2003_
mov edx, dword [ebp - 0x31c]
push edx
call fcn.10016de0
add esp, 8
cmp dword [ebp - 0x170], 5
jne 0x1002cd58
cmp dword [ebp - 0x16c], 1
jne 0x1002cd58
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002cd3a
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x320], ecx
jmp 0x1002cd44
mov dword [ebp - 0x320], 0
push str.Microsoft_Windows_XP
mov edx, dword [ebp - 0x320]
push edx
call fcn.10016de0
add esp, 8
cmp dword [ebp - 0x170], 5
jne 0x1002cda3
cmp dword [ebp - 0x16c], 0
jne 0x1002cda3
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002cd85
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x324], ecx
jmp 0x1002cd8f
mov dword [ebp - 0x324], 0
push str.Microsoft_Windows_2000
mov edx, dword [ebp - 0x324]
push edx
call fcn.10016de0
add esp, 8
cmp dword [ebp - 0x170], 4
ja 0x1002cde5
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002cdc7
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x328], ecx
jmp 0x1002cdd1
mov dword [ebp - 0x328], 0
push str.Microsoft_Windows_NT
mov edx, dword [ebp - 0x328]
push edx
call fcn.10016de0
add esp, 8
cmp dword [ebp - 0x4c], 0
je 0x1002d16c
movzx eax, byte [ebp - 0x5a]
cmp eax, 1
jne 0x1002cec8
cmp dword [ebp - 0x170], 4
jne 0x1002ce43
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002ce20
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x32c], edx
jmp 0x1002ce2a
mov dword [ebp - 0x32c], 0
push str.Workstation_4.0
mov eax, dword [ebp - 0x32c]
push eax
call fcn.10016de0
add esp, 8
jmp 0x1002cec3
movzx ecx, word [ebp - 0x5c]
and ecx, 0x200
je 0x1002ce8a
lea edx, [ebp - 0x21c]
test edx, edx
je 0x1002ce6a
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x330], eax
jmp 0x1002ce74
mov dword [ebp - 0x330], 0
push str.Home_Edition
mov ecx, dword [ebp - 0x330]
push ecx
call fcn.10016de0
add esp, 8
jmp 0x1002cec3
lea edx, [ebp - 0x21c]
test edx, edx
je 0x1002cea5
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x334], eax
jmp 0x1002ceaf
mov dword [ebp - 0x334], 0
push str.Professional
mov ecx, dword [ebp - 0x334]
push ecx
call fcn.10016de0
add esp, 8
jmp 0x1002d167
movzx edx, byte [ebp - 0x5a]
cmp edx, 3
je 0x1002cede
movzx eax, byte [ebp - 0x5a]
cmp eax, 2
jne 0x1002d167
cmp dword [ebp - 0x170], 5
jne 0x1002d00a
cmp dword [ebp - 0x16c], 2
jne 0x1002d00a
movzx ecx, word [ebp - 0x5c]
and ecx, 0x80
je 0x1002cf42
lea edx, [ebp - 0x21c]
test edx, edx
je 0x1002cf1f
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x338], eax
jmp 0x1002cf29
mov dword [ebp - 0x338], 0
push str.Datacenter_Edition
mov ecx, dword [ebp - 0x338]
push ecx
call fcn.10016de0
add esp, 8
jmp 0x1002d005
movzx edx, word [ebp - 0x5c]
and edx, 2
je 0x1002cf86
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002cf66
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x33c], ecx
jmp 0x1002cf70
mov dword [ebp - 0x33c], 0
push str.Enterprise_Edition
mov edx, dword [ebp - 0x33c]
push edx
call fcn.10016de0
add esp, 8
jmp 0x1002d005
movzx eax, word [ebp - 0x5c]
cmp eax, 0x400
jne 0x1002cfcc
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002cfac
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x340], edx
jmp 0x1002cfb6
mov dword [ebp - 0x340], 0
push str.Web_Edition
mov eax, dword [ebp - 0x340]
push eax
call fcn.10016de0
add esp, 8
jmp 0x1002d005
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002cfe7
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x344], edx
jmp 0x1002cff1
mov dword [ebp - 0x344], 0
push str.Standard_Edition
mov eax, dword [ebp - 0x344]
push eax
call fcn.10016de0
add esp, 8
jmp 0x1002d167
cmp dword [ebp - 0x170], 5
jne 0x1002d0ea
cmp dword [ebp - 0x16c], 0
jne 0x1002d0ea
movzx ecx, word [ebp - 0x5c]
and ecx, 0x80
je 0x1002d06b
lea edx, [ebp - 0x21c]
test edx, edx
je 0x1002d04b
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x348], eax
jmp 0x1002d055
mov dword [ebp - 0x348], 0
push str.Datacenter_Server
mov ecx, dword [ebp - 0x348]
push ecx
call fcn.10016de0
add esp, 8
jmp 0x1002d0e8
movzx edx, word [ebp - 0x5c]
and edx, 2
je 0x1002d0af
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002d08f
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x34c], ecx
jmp 0x1002d099
mov dword [ebp - 0x34c], 0
push 0x10036540
mov edx, dword [ebp - 0x34c]
push edx
call fcn.10016de0
add esp, 8
jmp 0x1002d0e8
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002d0ca
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x350], ecx
jmp 0x1002d0d4
mov dword [ebp - 0x350], 0
push 0x10036554
mov edx, dword [ebp - 0x350]
push edx
call fcn.10016de0
add esp, 8
jmp 0x1002d167
movzx eax, word [ebp - 0x5c]
and eax, 2
je 0x1002d12e
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002d10e
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x354], edx
jmp 0x1002d118
mov dword [ebp - 0x354], 0
push str.Server_4.0__Enterprise_Edition
mov eax, dword [ebp - 0x354]
push eax
call fcn.10016de0
add esp, 8
jmp 0x1002d167
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002d149
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x358], edx
jmp 0x1002d153
mov dword [ebp - 0x358], 0
push str.Server_4.0
mov eax, dword [ebp - 0x358]
push eax
call fcn.10016de0
add esp, 8
jmp 0x1002d36e
mov dword [ebp - 0x2c4], 0x50
lea ecx, [ebp - 0x2c0]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
je 0x1002d1d5
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x21c]
call fcn.10012f60
mov eax, dword [ebp - 0x30c]
or eax, 1
mov dword [ebp - 0x30c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.10012550
mov eax, dword [ebp + 8]
jmp 0x1002d7ad
lea ecx, [ebp - 0x2c4]
push ecx
lea edx, [ebp - 0x2bc]
push edx
push 0
push 0
push str.ProductType
mov eax, dword [ebp - 0x2c0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
jne 0x1002d211
cmp dword [ebp - 0x2c4], 0x50
jbe 0x1002d246
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.10012f60
mov edx, dword [ebp - 0x30c]
or edx, 1
mov dword [ebp - 0x30c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.10012550
mov eax, dword [ebp + 8]
jmp 0x1002d7ad
mov eax, dword [ebp - 0x2c0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2bc]
push ecx
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1002d2a2
lea edx, [ebp - 0x21c]
test edx, edx
je 0x1002d284
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x35c], eax
jmp 0x1002d28e
mov dword [ebp - 0x35c], 0
push str.Workstation
mov ecx, dword [ebp - 0x35c]
push ecx
call fcn.10016de0
add esp, 8
lea edx, [ebp - 0x2bc]
push edx
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1002d2f1
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002d2d3
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x360], ecx
jmp 0x1002d2dd
mov dword [ebp - 0x360], 0
push str.Server
mov edx, dword [ebp - 0x360]
push edx
call fcn.10016de0
add esp, 8
lea eax, [ebp - 0x2bc]
push eax
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1002d340
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002d322
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x364], edx
jmp 0x1002d32c
mov dword [ebp - 0x364], 0
push str.Advanced_Server
mov eax, dword [ebp - 0x364]
push eax
call fcn.10016de0
add esp, 8
mov ecx, dword [ebp - 0x16c]
push ecx
push 0x10036660
mov edx, dword [ebp - 0x170]
push edx
lea ecx, [ebp - 0x20c]
call fcn.10012700
push eax
call fcn.10016de0
add esp, 8
mov ecx, eax
call fcn.10012700
cmp dword [ebp - 0x170], 4
jne 0x1002d4f5
push 0x10036664
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1002d4f5
lea ecx, [ebp - 0x2cc]
push ecx
push 1
push 0
push 0x10036688
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0
jne 0x1002d41f
lea edx, [ebp - 0x21c]
test edx, edx
je 0x1002d3da
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x368], eax
jmp 0x1002d3e4
mov dword [ebp - 0x368], 0
push 0x10036684
mov ecx, dword [ebp - 0x168]
and ecx, 0xffff
push ecx
push str.Service_Pack_6a__Build
mov edx, dword [ebp - 0x368]
push edx
call fcn.10016de0
add esp, 8
mov ecx, eax
call fcn.10012700
push eax
call fcn.10016de0
add esp, 8
jmp 0x1002d4e3
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.100037f1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002d450
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x36c], edx
jmp 0x1002d45a
mov dword [ebp - 0x36c], 0
lea eax, [ebp - 0x2ec]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.1002c550
add esp, 8
mov dword [ebp - 0x370], eax
mov edx, dword [ebp - 0x370]
mov dword [ebp - 0x374], edx
mov byte [ebp - 4], 3
push 0x10036718
mov eax, dword [ebp - 0x168]
and eax, 0xffff
push eax
push 0x1003671c
mov ecx, dword [ebp - 0x374]
push ecx
mov edx, dword [ebp - 0x36c]
push edx
call fcn.100170e0
add esp, 8
push eax
call fcn.10016de0
add esp, 8
mov ecx, eax
call fcn.10012700
push eax
call fcn.10016de0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.100011c6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2ec]
call fcn.1000385c
mov eax, dword [ebp - 0x2cc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002d5ba
lea ecx, [ebp - 0x160]
push ecx
lea ecx, [ebp - 0x308]
call fcn.100037f1
mov byte [ebp - 4], 4
lea edx, [ebp - 0x21c]
test edx, edx
je 0x1002d526
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x378], eax
jmp 0x1002d530
mov dword [ebp - 0x378], 0
lea ecx, [ebp - 0x308]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.1002c550
add esp, 8
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x380], eax
mov byte [ebp - 4], 5
push 0x10036728
mov ecx, dword [ebp - 0x168]
and ecx, 0xffff
push ecx
push str.__Build
mov edx, dword [ebp - 0x380]
push edx
mov eax, dword [ebp - 0x378]
push eax
call fcn.100170e0
add esp, 8
push eax
call fcn.10016de0
add esp, 8
mov ecx, eax
call fcn.10012700
push eax
call fcn.10016de0
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48]
call fcn.100011c6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x308]
call fcn.1000385c
jmp 0x1002d77d
cmp dword [ebp - 0x170], 4
jne 0x1002d663
cmp dword [ebp - 0x16c], 0
jne 0x1002d663
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002d5f4
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x384], edx
jmp 0x1002d5fe
mov dword [ebp - 0x384], 0
push str.Microsoft_Windows_95
mov eax, dword [ebp - 0x384]
push eax
call fcn.10016de0
add esp, 8
movzx ecx, word [ebp - 0x15e]
cmp ecx, 0x43
je 0x1002d62a
movzx edx, word [ebp - 0x15e]
cmp edx, 0x42
jne 0x1002d663
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002d645
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x388], ecx
jmp 0x1002d64f
mov dword [ebp - 0x388], 0
push str.OSR2
mov edx, dword [ebp - 0x388]
push edx
call fcn.10016de0
add esp, 8
cmp dword [ebp - 0x170], 4
jne 0x1002d6f7
cmp dword [ebp - 0x16c], 0xa
jne 0x1002d6f7
lea eax, [ebp - 0x21c]
test eax, eax
je 0x1002d694
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x38c], ecx
jmp 0x1002d69e
mov dword [ebp - 0x38c], 0
push str.Microsoft_Windows_98
mov edx, dword [ebp - 0x38c]
push edx
call fcn.10016de0
add esp, 8
movzx eax, word [ebp - 0x15e]
cmp eax, 0x41
jne 0x1002d6f7
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002d6d9
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x390], edx
jmp 0x1002d6e3
mov dword [ebp - 0x390], 0
push 0x10036770
mov eax, dword [ebp - 0x390]
push eax
call fcn.10016de0
add esp, 8
cmp dword [ebp - 0x170], 4
jne 0x1002d742
cmp dword [ebp - 0x16c], 0x5a
jne 0x1002d742
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002d724
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x394], edx
jmp 0x1002d72e
mov dword [ebp - 0x394], 0
push str.Microsoft_Windows_Millennium_Edition
mov eax, dword [ebp - 0x394]
push eax
call fcn.10016de0
add esp, 8
jmp 0x1002d77d
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x1002d75f
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x398], edx
jmp 0x1002d769
mov dword [ebp - 0x398], 0
push str.Microsoft_Win32s
mov eax, dword [ebp - 0x398]
push eax
call fcn.10016de0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.10012f60
mov edx, dword [ebp - 0x30c]
or edx, 1
mov dword [ebp - 0x30c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.10012550
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019b28
mov esp, ebp
pop ebp
ret