Function at 0x5c9ac0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x667710]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x118
lea eax, [ebp - 0x31c]
mov edi, ecx
push 0
push eax
call fcn.004e0bc0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x320]
add esp, 0xc
mov dword [ebp - 0x320], 0x11c
push eax
call esi
mov ebx, eax
test ebx, ebx
jne 0x5c9b35
lea eax, [ebp - 0x320]
mov dword [ebp - 0x320], 0x114
push eax
call esi
test eax, eax
jne 0x5c9b35
push 0x6349bc
mov ecx, edi
call fcn.0040d2ee
jmp 0x5ca0d5
mov eax, dword [0x668294]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x310]
sub eax, 0
je 0x5ca098
sub eax, 1
je 0x5c9fd0
sub eax, 1
jne 0x5ca0b1
cmp dword [ebp - 0x31c], 6
jne 0x5c9bbe
mov eax, dword [ebp - 0x318]
cmp eax, 1
jne 0x5c9b9d
mov esi, str.Windows_7
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f513
cmp dword [ebp - 0x31c], 6
jne 0x5c9bbe
mov eax, dword [ebp - 0x318]
test eax, eax
jne 0x5c9c6c
mov esi, str.Windows_Vista__Longhorn_
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f513
cmp dword [ebp - 0x31c], 5
jne 0x5c9c44
mov eax, dword [ebp - 0x318]
cmp eax, 2
jne 0x5c9bfa
mov esi, 0x63ea60
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f513
cmp dword [ebp - 0x31c], 5
jne 0x5c9c44
mov eax, dword [ebp - 0x318]
cmp eax, 1
jne 0x5c9c27
mov esi, str.Windows_XP
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f513
cmp dword [ebp - 0x31c], 5
jne 0x5c9c44
mov eax, dword [ebp - 0x318]
test eax, eax
jne 0x5c9c6c
mov esi, str.Windows_2000
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f513
cmp dword [ebp - 0x31c], 4
ja 0x5c9c66
mov esi, str.Windows_NT
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f513
mov eax, dword [ebp - 0x318]
test ebx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
je 0x5c9d58
mov cl, byte [ebp - 0x206]
cmp cl, 1
jne 0x5c9cb0
cmp dword [ebp - 0x31c], 4
jne 0x5c9c98
mov esi, str.Workstation_4.0
jmp 0x5c9d3f
mov eax, 0x200
mov esi, str.Home_Edition
test word [ebp - 0x208], ax
mov eax, str.Professional
jmp 0x5c9d27
cmp cl, 3
jne 0x5c9eb0
cmp dword [ebp - 0x31c], 5
jne 0x5c9d2c
cmp eax, 2
jne 0x5c9d02
test byte [ebp - 0x208], 0x80
je 0x5c9cd7
mov esi, str.Datacenter_Edition
jmp 0x5c9d3f
test byte [ebp - 0x208], 2
je 0x5c9ce7
mov esi, str.Enterprise_Edition
jmp 0x5c9d3f
mov ecx, 0x400
mov esi, str.Web_Edition
cmp word [ebp - 0x208], cx
mov eax, str.Standard_Edition
cmovne esi, eax
jmp 0x5c9d3f
test eax, eax
jne 0x5c9d2c
test byte [ebp - 0x208], 0x80
je 0x5c9d16
mov esi, str.Datacenter_Server
jmp 0x5c9d3f
test byte [ebp - 0x208], 2
mov esi, str.Advanced_Server
mov eax, str.Server
cmove esi, eax
jmp 0x5c9d3f
test byte [ebp - 0x208], 2
mov esi, str.Server_4.0__Enterprise_Edition
jne 0x5c9d3f
mov esi, str.Server_4.0
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f454
jmp 0x5c9eb0
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.004e0bc0
add esp, 0xc
lea eax, [ebp - 0x330]
mov esi, 0x100
mov dword [ebp - 0x32c], esi
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5ca0b1
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5c9fc8
cmp dword [ebp - 0x32c], esi
ja 0x5c9fc8
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x204]
push eax
push str.WINNT
call ebx
test eax, eax
jne 0x5c9e0a
mov esi, str.Workstation
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f454
lea eax, [ebp - 0x204]
push eax
push str.LANMANNT
call ebx
test eax, eax
jne 0x5c9e35
mov esi, str.Server
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f454
lea eax, [ebp - 0x204]
push eax
push str.SERVERNT
call ebx
test eax, eax
jne 0x5c9e60
mov esi, str.Advanced_Server
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f454
push dword [ebp - 0x318]
mov eax, dword [0x668294]
push dword [ebp - 0x31c]
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x328]
push str._d._d
push eax
call fcn.0040cefd
mov esi, dword [ebp - 0x328]
lea ecx, [ebp - 0x324]
add esp, 0x10
push esi
push dword [esi - 8]
call fcn.0040f454
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x5c9eb0
call fcn.00407965
cmp dword [ebp - 0x31c], 4
jne 0x5c9f6c
push str.Service_Pack_6
lea eax, [ebp - 0x30c]
push eax
call ebx
test eax, eax
jne 0x5c9f6c
lea eax, [ebp - 0x32c]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, dword [0x668294]
mov dword [ebp - 0x328], eax
movzx eax, word [ebp - 0x314]
push eax
jne 0x5c9f1b
lea eax, [ebp - 0x328]
push str.Service_Pack_6a__Build__d_
push eax
call fcn.0040cefd
add esp, 0xc
jmp 0x5c9f36
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x328]
push str._s__Build__d_
push eax
call fcn.0040cefd
add esp, 0x10
mov esi, dword [ebp - 0x328]
lea ecx, [ebp - 0x324]
push esi
push dword [esi - 8]
call fcn.0040f454
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x5c9f5b
call fcn.00407965
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5ca0b1
mov eax, dword [0x668294]
mov dword [ebp - 0x328], eax
movzx eax, word [ebp - 0x314]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x328]
push str._s__Build__d_
push eax
call fcn.0040cefd
mov esi, dword [ebp - 0x328]
lea ecx, [ebp - 0x324]
add esp, 0x10
push esi
push dword [esi - 8]
call fcn.0040f454
lea ecx, [esi - 0xc]
cmp ecx, 0x668010
je 0x5ca0b1
call fcn.00407965
jmp 0x5ca0b1
push dword [ebp - 0x330]
jmp 0x5c9f61
cmp dword [ebp - 0x31c], 4
jne 0x5ca0b1
mov eax, dword [ebp - 0x318]
test eax, eax
jne 0x5ca03c
mov esi, str.Windows_95
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f513
cmp word [ebp - 0x30a], 0x43
je 0x5ca014
cmp word [ebp - 0x30a], 0x42
jne 0x5ca02d
mov esi, str.OSR2
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f454
cmp dword [ebp - 0x31c], 4
jne 0x5ca0b1
mov eax, dword [ebp - 0x318]
cmp eax, 0xa
jne 0x5ca08c
mov esi, str.Windows_98
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f513
cmp word [ebp - 0x30a], 0x41
jne 0x5ca07d
mov esi, 0x63ef1c
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f454
cmp dword [ebp - 0x31c], 4
jne 0x5ca0b1
mov eax, dword [ebp - 0x318]
cmp eax, 0x5a
jne 0x5ca0b1
mov esi, str.Windows_Millennium_Edition
jmp 0x5ca09d
mov esi, str.Win32s
push esi
call fcn.00505bb3
pop ecx
push esi
push eax
lea ecx, [ebp - 0x324]
call fcn.0040f513
lea eax, [ebp - 0x324]
mov ecx, edi
push eax
call fcn.0040d36e
mov ecx, dword [ebp - 0x324]
add ecx, 0xfffffff4
cmp ecx, 0x668010
je 0x5ca0d5
call fcn.00407965
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004da623
leave
ret