Function at 0x417400
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x9c
call esi
mov edi, eax
test edi, edi
jne 0x41744f
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x94
call esi
test eax, eax
je 0x4177c4
mov eax, dword [esp + 0x28]
sub eax, 0
je 0x41784c
dec eax
je 0x4177ce
dec eax
jne 0x417859
mov eax, dword [esp + 0x1c]
mov esi, 5
cmp eax, esi
jne 0x4174c4
cmp dword [esp + 0x20], 2
jne 0x417493
push str.Microsoft_Windows_Servernbsp_2003_family_
call fcn.004bab20
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, esi
jne 0x4174c4
cmp dword [esp + 0x20], 1
jne 0x4174af
push str.Microsoft_Windows_XP
call fcn.004bab20
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, esi
jne 0x4174c4
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4174d8
push str.Microsoft_Windows_2000
call fcn.004bab20
add esp, 4
cmp dword [esp + 0x1c], 4
ja 0x4174d8
push str.Microsoft_Windows_NT
call fcn.004bab20
add esp, 4
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test edi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x417635
mov al, byte [esp + 0xb2]
cmp al, 1
jne 0x417546
cmp dword [esp + 0x1c], 4
jne 0x417516
push str.Workstation_4.0
call fcn.004bab20
add esp, 4
jmp 0x41770c
mov eax, dword [esp + 0xb0]
test ah, 2
je 0x417534
push str.Home_Edition
call fcn.004bab20
add esp, 4
jmp 0x41770c
push str.Professional
call fcn.004bab20
add esp, 4
jmp 0x41770c
cmp al, 3
jne 0x41770c
cmp dword [esp + 0x1c], esi
jne 0x417607
mov eax, dword [esp + 0x20]
cmp eax, 2
jne 0x4175be
mov eax, dword [esp + 0xb0]
test al, al
jns 0x41757e
push str.Datacenter_Edition
call fcn.004bab20
add esp, 4
jmp 0x41770c
test al, 2
je 0x417594
push str.Enterprise_Edition
call fcn.004bab20
add esp, 4
jmp 0x41770c
cmp ax, 0x400
jne 0x4175ac
push str.Web_Edition
call fcn.004bab20
add esp, 4
jmp 0x41770c
push str.Standard_Edition
call fcn.004bab20
add esp, 4
jmp 0x41770c
test eax, eax
jne 0x417607
mov al, byte [esp + 0xb0]
test al, al
jns 0x4175df
push str.Datacenter_Server
call fcn.004bab20
add esp, 4
jmp 0x41770c
test al, 2
je 0x4175f5
push str.Advanced_Server
call fcn.004bab20
add esp, 4
jmp 0x41770c
push str.Server
call fcn.004bab20
add esp, 4
jmp 0x41770c
test byte [esp + 0xb0], 2
je 0x417623
push str.Server_4.0__Enterprise_Edition
call fcn.004bab20
add esp, 4
jmp 0x41770c
push str.Server_4.0
call fcn.004bab20
add esp, 4
jmp 0x41770c
lea edx, [esp + 0x10]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x50
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x4177c4
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xbc]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4177c4
cmp dword [esp + 0x14], esi
ja 0x4177c4
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0xb8]
push ecx
push str.WINNT
call ebx
test eax, eax
jne 0x4176b5
push str.Workstation
call fcn.004bab20
add esp, 4
lea edx, [esp + 0xb8]
push edx
push str.LANMANNT
call ebx
test eax, eax
jne 0x4176d5
push str.Server
call fcn.004bab20
add esp, 4
lea eax, [esp + 0xb8]
push eax
push str.SERVERNT
call ebx
test eax, eax
jne 0x4176f5
push str.Advanced_Server
call fcn.004bab20
add esp, 4
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push str._d._d
call fcn.004bab20
add esp, 0xc
cmp dword [esp + 0x1c], 4
jne 0x41779b
push str.Service_Pack_6
lea eax, [esp + 0x30]
push eax
call ebx
test eax, eax
jne 0x41779b
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x41776b
mov edx, dword [esp + 0x24]
and edx, 0xffff
push edx
push str.Service_Pack_6a__Build__d__n
call fcn.004bab20
mov edx, dword [esp + 0x18]
add esp, 8
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
and eax, 0xffff
push eax
lea ecx, [esp + 0x30]
push ecx
push str._s__Build__d__n
call fcn.004bab20
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
and eax, 0xffff
push eax
lea ecx, [esp + 0x30]
push ecx
push str._s__Build__d__n
call fcn.004bab20
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov esi, 4
cmp eax, esi
jne 0x417859
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x41780f
push str.Microsoft_Windows_95
call fcn.004bab20
mov al, byte [esp + 0x31]
add esp, 4
cmp al, 0x43
je 0x4177fc
cmp al, 0x42
jne 0x417809
push str.OSR2
call fcn.004bab20
add esp, 4
cmp dword [esp + 0x1c], esi
jne 0x417859
cmp dword [esp + 0x20], 0xa
jne 0x41783e
push str.Microsoft_Windows_98
call fcn.004bab20
mov al, byte [esp + 0x31]
add esp, 4
cmp al, 0x41
jne 0x417838
push 0x58224c
call fcn.004bab20
add esp, 4
cmp dword [esp + 0x1c], esi
jne 0x417859
cmp dword [esp + 0x20], 0x5a
jne 0x417859
push str.Microsoft_Windows_Millennium_Edition_n
jmp 0x417851
push str.Microsoft_Win32s_n
call fcn.004bab20
add esp, 4
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret