Function at 0x41da90
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5ac
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41e6ec
lea ecx, [ebp - 0x580]
mov dword [ebp - 0x45c], 1
mov dword [ebp - 0x580], 0x11c
call fcn.0041d5e0
test eax, eax
jne 0x41dafa
lea ecx, [ebp - 0x580]
mov dword [ebp - 0x580], 0x114
call fcn.0041d5e0
test eax, eax
je 0x41e6ec
mov dword [ebp - 0x45c], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41db22
lea ecx, [ebp - 0x5a4]
push ecx
call eax
jmp 0x41db2f
lea eax, [ebp - 0x5a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x458], 6
mov dword [ebp - 0x454], str.Business
mov dword [ebp - 0x450], 0x10
mov dword [ebp - 0x44c], str.Business_N
mov dword [ebp - 0x448], 0x12
mov dword [ebp - 0x444], str.HPC_Edition
mov dword [ebp - 0x440], 8
mov dword [ebp - 0x43c], str.Server_Datacenter__full_installation_
mov dword [ebp - 0x438], 0xc
mov dword [ebp - 0x434], str.Server_Datacenter__core_installation_
mov dword [ebp - 0x430], 0x27
mov dword [ebp - 0x42c], str.Server_Datacenter_without_Hyper_V__core_installation_
mov dword [ebp - 0x428], 0x25
mov dword [ebp - 0x424], str.Server_Datacenter_without_Hyper_V__full_installation_
mov dword [ebp - 0x420], 4
mov dword [ebp - 0x41c], 0x43faa4
mov dword [ebp - 0x418], 0x46
mov dword [ebp - 0x414], str.Not_supported
mov dword [ebp - 0x410], 0x1b
mov dword [ebp - 0x40c], str.Enterprise_N
mov dword [ebp - 0x408], 0xa
mov dword [ebp - 0x404], str.Server_Enterprise__full_installation_
mov dword [ebp - 0x400], 0xe
mov dword [ebp - 0x3fc], str.Server_Enterprise__core_installation_
mov dword [ebp - 0x3f8], 0x29
mov dword [ebp - 0x3f4], str.Server_Enterprise_without_Hyper_V__core_installation_
mov dword [ebp - 0x3f0], 0xf
mov dword [ebp - 0x3ec], str.Server_Enterprise_for_Itanium_based_Systems
mov dword [ebp - 0x3e8], 0x26
mov dword [ebp - 0x3e4], str.Server_Enterprise_without_Hyper_V__full_installation_
mov dword [ebp - 0x3e0], 2
mov dword [ebp - 0x3dc], str.Home_Basic
mov dword [ebp - 0x3d8], 0x43
mov dword [ebp - 0x3d4], str.Not_supported
mov dword [ebp - 0x3d0], 5
mov dword [ebp - 0x3cc], str.Home_Basic_N
mov dword [ebp - 0x3c8], 3
mov dword [ebp - 0x3c4], str.Home_Premium
mov dword [ebp - 0x3c0], 0x44
mov dword [ebp - 0x3bc], str.Not_supported
mov dword [ebp - 0x3b8], 0x1a
mov dword [ebp - 0x3b4], str.Home_Premium_N
mov dword [ebp - 0x3b0], 0x2a
mov dword [ebp - 0x3ac], str.Microsoft_Hyper_V_Server
mov dword [ebp - 0x3a8], 0x1e
mov dword [ebp - 0x3a4], str.Essential_Business_Server_Management_Server
mov dword [ebp - 0x3a0], 0x20
mov dword [ebp - 0x39c], str.Essential_Business_Server_Messaging_Server
mov dword [ebp - 0x398], 0x1f
mov dword [ebp - 0x394], str.Essential_Business_Server_Security_Server
mov dword [ebp - 0x390], 0x30
mov dword [ebp - 0x38c], str.Professional
mov dword [ebp - 0x388], 0x45
mov dword [ebp - 0x384], str.Not_supported
mov dword [ebp - 0x380], 0x31
mov dword [ebp - 0x37c], str.Professional_N
mov dword [ebp - 0x378], 0x18
mov dword [ebp - 0x374], str.for_Windows_Essential_Server_Solutions
mov dword [ebp - 0x370], 0x23
mov dword [ebp - 0x36c], str.without_Hyper_V_for_Windows_Essential_Server_Solutions
mov dword [ebp - 0x368], 0x21
mov dword [ebp - 0x364], str.Server_Foundation
mov dword [ebp - 0x360], 0x22
mov dword [ebp - 0x35c], str.Home_Server_2011
mov dword [ebp - 0x358], 0x32
mov dword [ebp - 0x354], str.Small_Business_Server_2011_Essentials
mov dword [ebp - 0x350], 0x13
mov dword [ebp - 0x34c], str.Storage_Server_2008_R2_Essentials
mov dword [ebp - 0x348], 9
mov dword [ebp - 0x344], str.Small_Business_Server
mov dword [ebp - 0x340], 0x38
mov dword [ebp - 0x33c], str.MultiPoint_Server
mov dword [ebp - 0x338], 7
mov dword [ebp - 0x334], str.Server_Standard__full_installation_
mov dword [ebp - 0x330], 0xd
mov dword [ebp - 0x32c], str.Server_Standard__core_installation_
mov dword [ebp - 0x328], 0x28
mov dword [ebp - 0x324], str.Server_Standard_without_Hyper_V__core_installation_
mov dword [ebp - 0x320], 0x24
mov dword [ebp - 0x31c], str.Server_Standard_without_Hyper_V__full_installation_
mov dword [ebp - 0x318], 0xb
push str.Microsoft
push 0x18
push esi
mov dword [ebp - 0x314], str.Starter
mov dword [ebp - 0x310], 0x42
mov dword [ebp - 0x30c], str.Not_supported
mov dword [ebp - 0x308], 0x2f
mov dword [ebp - 0x304], str.Starter_N
mov dword [ebp - 0x300], 0x17
mov dword [ebp - 0x2fc], str.Storage_Server_Enterprise
mov dword [ebp - 0x2f8], 0x14
mov dword [ebp - 0x2f4], str.Storage_Server_Express
mov dword [ebp - 0x2f0], 0x15
mov dword [ebp - 0x2ec], str.Storage_Server_Standard
mov dword [ebp - 0x2e8], 0x16
mov dword [ebp - 0x2e4], str.Storage_Server_Workgroup
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0x2dc], str.An_unknown_product
mov dword [ebp - 0x2d8], 1
mov dword [ebp - 0x2d4], str.Ultimate
mov dword [ebp - 0x2d0], 0x47
mov dword [ebp - 0x2cc], str.Not_supported
mov dword [ebp - 0x2c8], 0x1c
mov dword [ebp - 0x2c4], str.Ultimate_N
mov dword [ebp - 0x2c0], 0x11
mov dword [ebp - 0x2bc], str.Web_Server__full_installation_
mov dword [ebp - 0x2b8], 0x1d
mov dword [ebp - 0x2b4], str.Web_Server__core_installation_
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
mov eax, dword [ebp - 0x570]
add esp, 0xc
sub eax, 0
je 0x41e6c2
dec eax
je 0x41e5f6
dec eax
jne 0x41e6d6
cmp dword [ebp - 0x57c], 6
mov edi, dword [sym.imp.MSVCR110.dll_wcscat_s]
jne 0x41e08e
cmp dword [ebp - 0x578], 3
jne 0x41dfad
push str.Windows_8.1
push 0x208
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x578], 2
jne 0x41dfc6
push str.Windows_8
push 0x208
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x578], 1
jne 0x41dfef
cmp byte [ebp - 0x466], 1
jne 0x41dfdf
push str.Windows_7
jmp 0x41dfe4
push str.Windows_Server_2008_R2
push 0x208
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x578], 0
jne 0x41e018
cmp byte [ebp - 0x466], 1
jne 0x41e008
push str.Windows_Vista
jmp 0x41e00d
push str.Windows_Server_2008
push 0x208
push esi
call edi
add esp, 0xc
push str.GetProductInfo
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x460]
push ecx
push 0
push 0
push dword [ebp - 0x578]
push dword [ebp - 0x57c]
call eax
xor ebx, ebx
jmp 0x41e050
mov eax, dword [ebp - 0x460]
cmp eax, dword [ebp + ebx*8 - 0x458]
jne 0x41e071
push dword [ebp + ebx*8 - 0x454]
push 0x208
push esi
call edi
add esp, 0xc
inc ebx
cmp ebx, 0x35
jb 0x41e050
push str._An_unknown_product_
push 0x208
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x57c], 6
jb 0x41e0b9
mov ax, word [ebp - 0x5a4]
cmp ax, 9
jne 0x41e0a4
push str.__64_bit
jmp 0x41e0ae
test ax, ax
jne 0x41e0b9
push str.__32_bit
push 0x208
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x57c], 5
jne 0x41e272
mov eax, dword [ebp - 0x578]
cmp eax, 2
jne 0x41e1db
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x41e0e8
push str.Windows_Server_2003_R2_
jmp 0x41e11c
mov eax, 0x2000
cmp word [ebp - 0x468], ax
jne 0x41e0fd
push str.Windows_Storage_Server_2003
jmp 0x41e11c
cmp byte [ebp - 0x466], 1
jne 0x41e117
cmp word [ebp - 0x5a4], 9
jne 0x41e117
push str.Windows_XP_Professional_x64_Edition
jmp 0x41e11c
push str.Windows_Server_2003
push 0x208
push esi
call edi
add esp, 0xc
cmp byte [ebp - 0x466], 1
je 0x41e1c8
mov ax, word [ebp - 0x5a4]
cmp ax, 6
jne 0x41e15d
mov eax, dword [ebp - 0x468]
test al, al
jns 0x41e152
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x41e1bd
test al, 2
je 0x41e1c8
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x41e1bd
cmp ax, 9
mov eax, dword [ebp - 0x468]
jne 0x41e186
test al, al
jns 0x41e174
push str.Datacenter_x64_Edition
jmp 0x41e1bd
test al, 2
je 0x41e17f
push str.Enterprise_x64_Edition
jmp 0x41e1bd
push str.Standard_x64_Edition
jmp 0x41e1bd
test eax, 0x4000
je 0x41e194
push str.Compute_Cluster_Edition
jmp 0x41e1bd
test al, al
jns 0x41e19f
push str.Datacenter_Edition
jmp 0x41e1bd
test al, 2
je 0x41e1aa
push str.Enterprise_Edition
jmp 0x41e1bd
test eax, 0x400
je 0x41e1b8
push str.Web_Edition
jmp 0x41e1bd
push str.Standard_Edition
push 0x208
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x57c], 5
jne 0x41e272
mov eax, dword [ebp - 0x578]
cmp eax, 1
jne 0x41e222
push str.Windows_XP
push 0x208
push esi
call edi
add esp, 0xc
test dword [ebp - 0x468], 0x200
je 0x41e203
push str.Home_Edition
jmp 0x41e208
push str.Professional
push 0x208
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x57c], 5
jne 0x41e272
mov eax, dword [ebp - 0x578]
test eax, eax
jne 0x41e27f
push str.Windows_2000
push 0x208
push esi
call edi
add esp, 0xc
cmp byte [ebp - 0x466], 1
jne 0x41e246
push str.Professional
jmp 0x41e267
mov eax, dword [ebp - 0x468]
test al, al
jns 0x41e257
push str.Datacenter_Server
jmp 0x41e267
test al, 2
je 0x41e262
push str.Advanced_Server
jmp 0x41e267
push 0x440880
push 0x208
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x57c], 4
jbe 0x41e30a
lea ecx, [ebp - 0x56c]
lea edx, [ecx + 2]
jmp 0x41e290
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e290
sub ecx, edx
sar ecx, 1
je 0x41e2c0
push 0x438eb8
push 0x208
push esi
call edi
lea eax, [ebp - 0x56c]
push eax
push 0x208
push esi
call edi
add esp, 0x18
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e2c5
push dword [ebp - 0x574]
sub ecx, edx
sar ecx, 1
mov eax, 0x208
sub eax, ecx
push str.__Build__d_
push eax
lea eax, [esi + ecx*2]
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
push str.Windows_NT
push 0x208
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
add esp, 0xc
cmp dword [ebp - 0x45c], 0
je 0x41e387
mov al, byte [ebp - 0x466]
cmp al, 1
jne 0x41e348
push str.Workstation
push 0x208
push esi
call edi
add esp, 0xc
jmp 0x41e493
cmp al, 3
je 0x41e354
cmp al, 2
jne 0x41e493
test byte [ebp - 0x468], 2
je 0x41e372
push str.Enterprise
push 0x208
push esi
call edi
add esp, 0xc
jmp 0x41e493
push str.Server
push 0x208
push esi
call edi
add esp, 0xc
jmp 0x41e493
lea eax, [ebp - 0x5a8]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [ebp - 0x45c], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e6d6
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0xa8]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x5a8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41e6d6
cmp dword [ebp - 0x45c], 0x50
ja 0x41e6d6
push dword [ebp - 0x5a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa8]
push eax
push str.WINNT
call ebx
test eax, eax
jne 0x41e41a
push str.Workstation
push 0x208
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
push str.LANMANNT
call ebx
test eax, eax
jne 0x41e43c
push str.Server
push 0x208
push esi
call edi
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
push str.SERVERNT
call ebx
test eax, eax
jne 0x41e45e
push str.Advance_Server
push 0x208
push esi
call edi
add esp, 0xc
push dword [ebp - 0x578]
lea eax, [ebp - 0x2b0]
push dword [ebp - 0x57c]
push str.__d._d
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
lea eax, [ebp - 0x2b0]
push eax
push 0x208
push esi
call edi
add esp, 0x20
cmp dword [ebp - 0x57c], 4
jne 0x41e593
push str.Service_Pack_6
lea eax, [ebp - 0x56c]
push eax
call ebx
test eax, eax
jne 0x41e593
lea eax, [ebp - 0x5a8]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e528
movzx eax, word [ebp - 0x574]
push eax
push str.Service_Pack_6a__Build__d_
lea eax, [ebp - 0x2b0]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
lea eax, [ebp - 0x2b0]
push eax
push 0x208
push esi
call edi
add esp, 0x1c
push dword [ebp - 0x5a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x56c]
push eax
push 0x208
push esi
call edi
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e540
movzx eax, word [ebp - 0x574]
push eax
sub ecx, edx
sar ecx, 1
mov eax, 0x208
sub eax, ecx
push str.__Build__d_
push eax
lea eax, [esi + ecx*2]
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x10
push dword [ebp - 0x5a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
mov ebx, esi
lea ecx, [ebx + 2]
jmp 0x41e5a0
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x41e5a0
lea eax, [ebp - 0x56c]
push eax
sub ebx, ecx
push 0x208
push esi
sar ebx, 1
call edi
movzx eax, word [ebp - 0x574]
push eax
mov eax, 0x208
sub eax, ebx
push str.__Build__d_
push eax
lea eax, [esi + ebx*2]
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x1c
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x57c], 4
jne 0x41e6d6
mov eax, dword [ebp - 0x578]
mov edi, dword [sym.imp.MSVCR110.dll_wcscat_s]
test eax, eax
jne 0x41e659
push str.Windows_95
push 0x208
push esi
call edi
mov ax, word [ebp - 0x56a]
add esp, 0xc
cmp ax, 0x43
je 0x41e636
cmp ax, 0x42
jne 0x41e646
push str._OSR2
push 0x208
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x57c], 4
jne 0x41e6d6
mov eax, dword [ebp - 0x578]
cmp eax, 0xa
jne 0x41e697
push str.Windows_98
push 0x208
push esi
call edi
add esp, 0xc
cmp word [ebp - 0x56a], 0x41
jne 0x41e688
push 0x440a44
push 0x208
push esi
call edi
add esp, 0xc
cmp dword [ebp - 0x57c], 4
jne 0x41e6d6
mov eax, dword [ebp - 0x578]
cmp eax, 0x5a
jne 0x41e6d6
push str.Windows_ME
push 0x208
push esi
call edi
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
push str.Windows_Unknown
push 0x208
push esi
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret