Function at 0x417520
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x9c
call esi
mov edi, eax
test edi, edi
jne 0x41756f
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x94
call esi
test eax, eax
je 0x4178e4
mov eax, dword [esp + 0x28]
sub eax, 0
je 0x41796c
dec eax
je 0x4178ee
dec eax
jne 0x417979
mov eax, dword [esp + 0x1c]
mov esi, 5
cmp eax, esi
jne 0x4175e4
cmp dword [esp + 0x20], 2
jne 0x4175b3
push str.Microsoft_Windows_Servernbsp_2003_family_
call fcn.004bcf00
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, esi
jne 0x4175e4
cmp dword [esp + 0x20], 1
jne 0x4175cf
push str.Microsoft_Windows_XP
call fcn.004bcf00
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, esi
jne 0x4175e4
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4175f8
push str.Microsoft_Windows_2000
call fcn.004bcf00
add esp, 4
cmp dword [esp + 0x1c], 4
ja 0x4175f8
push str.Microsoft_Windows_NT
call fcn.004bcf00
add esp, 4
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test edi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x417755
mov al, byte [esp + 0xb2]
cmp al, 1
jne 0x417666
cmp dword [esp + 0x1c], 4
jne 0x417636
push str.Workstation_4.0
call fcn.004bcf00
add esp, 4
jmp 0x41782c
mov eax, dword [esp + 0xb0]
test ah, 2
je 0x417654
push str.Home_Edition
call fcn.004bcf00
add esp, 4
jmp 0x41782c
push str.Professional
call fcn.004bcf00
add esp, 4
jmp 0x41782c
cmp al, 3
jne 0x41782c
cmp dword [esp + 0x1c], esi
jne 0x417727
mov eax, dword [esp + 0x20]
cmp eax, 2
jne 0x4176de
mov eax, dword [esp + 0xb0]
test al, al
jns 0x41769e
push str.Datacenter_Edition
call fcn.004bcf00
add esp, 4
jmp 0x41782c
test al, 2
je 0x4176b4
push str.Enterprise_Edition
call fcn.004bcf00
add esp, 4
jmp 0x41782c
cmp ax, 0x400
jne 0x4176cc
push str.Web_Edition
call fcn.004bcf00
add esp, 4
jmp 0x41782c
push str.Standard_Edition
call fcn.004bcf00
add esp, 4
jmp 0x41782c
test eax, eax
jne 0x417727
mov al, byte [esp + 0xb0]
test al, al
jns 0x4176ff
push str.Datacenter_Server
call fcn.004bcf00
add esp, 4
jmp 0x41782c
test al, 2
je 0x417715
push str.Advanced_Server
call fcn.004bcf00
add esp, 4
jmp 0x41782c
push str.Server
call fcn.004bcf00
add esp, 4
jmp 0x41782c
test byte [esp + 0xb0], 2
je 0x417743
push str.Server_4.0__Enterprise_Edition
call fcn.004bcf00
add esp, 4
jmp 0x41782c
push str.Server_4.0
call fcn.004bcf00
add esp, 4
jmp 0x41782c
lea edx, [esp + 0x10]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x50
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x4178e4
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xbc]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4178e4
cmp dword [esp + 0x14], esi
ja 0x4178e4
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0xb8]
push ecx
push str.WINNT
call ebx
test eax, eax
jne 0x4177d5
push str.Workstation
call fcn.004bcf00
add esp, 4
lea edx, [esp + 0xb8]
push edx
push str.LANMANNT
call ebx
test eax, eax
jne 0x4177f5
push str.Server
call fcn.004bcf00
add esp, 4
lea eax, [esp + 0xb8]
push eax
push str.SERVERNT
call ebx
test eax, eax
jne 0x417815
push str.Advanced_Server
call fcn.004bcf00
add esp, 4
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push str._d._d
call fcn.004bcf00
add esp, 0xc
cmp dword [esp + 0x1c], 4
jne 0x4178bb
push str.Service_Pack_6
lea eax, [esp + 0x30]
push eax
call ebx
test eax, eax
jne 0x4178bb
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x41788b
mov edx, dword [esp + 0x24]
and edx, 0xffff
push edx
push str.Service_Pack_6a__Build__d__n
call fcn.004bcf00
mov edx, dword [esp + 0x18]
add esp, 8
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
and eax, 0xffff
push eax
lea ecx, [esp + 0x30]
push ecx
push str._s__Build__d__n
call fcn.004bcf00
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
and eax, 0xffff
push eax
lea ecx, [esp + 0x30]
push ecx
push str._s__Build__d__n
call fcn.004bcf00
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov esi, 4
cmp eax, esi
jne 0x417979
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x41792f
push str.Microsoft_Windows_95
call fcn.004bcf00
mov al, byte [esp + 0x31]
add esp, 4
cmp al, 0x43
je 0x41791c
cmp al, 0x42
jne 0x417929
push str.OSR2
call fcn.004bcf00
add esp, 4
cmp dword [esp + 0x1c], esi
jne 0x417979
cmp dword [esp + 0x20], 0xa
jne 0x41795e
push str.Microsoft_Windows_98
call fcn.004bcf00
mov al, byte [esp + 0x31]
add esp, 4
cmp al, 0x41
jne 0x417958
push 0x58523c
call fcn.004bcf00
add esp, 4
cmp dword [esp + 0x1c], esi
jne 0x417979
cmp dword [esp + 0x20], 0x5a
jne 0x417979
push str.Microsoft_Windows_Millennium_Edition_n
jmp 0x417971
push str.Microsoft_Win32s_n
call fcn.004bcf00
add esp, 4
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret