Function at 0x435810
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x27c
mov eax, dword [0x4c437c]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push esi
mov esi, dword [esp + 0x288]
push edi
xor ebx, ebx
push 3
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x4a608c
mov ecx, esi
mov dword [esp + 0x14], ebx
mov byte [esi + 4], bl
call fcn.004110d0
lea eax, [esp + 0xbc]
push eax
mov dword [esp + 0xc0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, dword [esp + 0x154]
mov al, byte [esp + 0x156]
and edi, 0x200
cmp al, 3
je 0x435888
mov dword [esp + 0xc], ebx
cmp al, 2
jne 0x435890
mov dword [esp + 0xc], 1
push 0x12b
lea ecx, [esp + 0x15d]
push ebx
push ecx
mov byte [esp + 0x164], bl
call fcn.00469be0
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 1
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push SysStringLen
mov dword [esp + 0x28], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43590d
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x15c]
push ecx
push ebx
push ebx
push 0x4a6050
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4358fb
cmp dword [esp + 0x14], 1
jae 0x435902
mov byte [esp + 0x158], bl
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4e9ec0]
add eax, 0xfffffff9
cmp eax, 7
ja case.default.0x43591e
jmp dword [eax*4 + 0x435d14]
push str.2000
mov ecx, esi
call fcn.004305b0
jmp 0x435a9e
push 0x4a6044
mov ecx, esi
call fcn.004305b0
mov eax, str._home
cmp edi, ebx
jne 0x435950
mov eax, str._pro
push eax
mov ecx, esi
call fcn.004305b0
jmp 0x435a9e
push str.2003
mov ecx, esi
call fcn.004305b0
jmp 0x435a9e
push str.vista
mov ecx, esi
call fcn.004305b0
jmp 0x435a9e
push str.2008
mov ecx, esi
call fcn.004305b0
jmp 0x435a9e
push 0x4a6018
mov ecx, esi
call fcn.004305b0
jmp 0x435a9e
push str.2008r2
mov ecx, esi
call fcn.004305b0
jmp 0x435a9e
push ebx
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], 0x4a5f3c
mov dword [esp + 0x44], 0x4a5f34
mov dword [esp + 0x90], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
call fcn.00434880
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x40]
mov dword [esp + eax + 0x34], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
call fcn.0042b820
mov ecx, dword [0x4e9ec8]
mov edx, dword [0x4e9ec4]
push ecx
push 0x4a600c
push edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x4c], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
call fcn.004350c0
push eax
call fcn.00434a20
add esp, 8
mov ecx, eax
call fcn.004350c0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
call fcn.00430640
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0042fac0
cmp dword [esp + 0x30], 0x10
jb 0x435a67
mov edx, dword [esp + 0x1c]
push edx
call fcn.00469bc3
add esp, 4
lea ecx, [esp + 0x88]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.0042d4d0
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x8c], vtable.std::ios_base.0
call fcn.0049c6ce
add esp, 4
cmp dword [esp + 0xc], ebx
je 0x435ab2
push 7
push str._server
mov ecx, esi
call fcn.0042fbc0
mov eax, dword [0x4e9ec4]
cmp eax, ebx
jg 0x435ac6
mov byte [0], bl
mov eax, dword [0x4e9ec4]
shl eax, 8
or eax, dword [0x4e9ec8]
shl eax, 8
or eax, dword [0x4e9ecc]
cmp eax, 0x60000
jl 0x435bcb
cmp edi, ebx
je 0x435afa
push 5
push str._home
mov ecx, esi
call fcn.0042fbc0
jmp 0x435bcb
lea ecx, [esp + 0x158]
push str.Standard
push ecx
call fcn.0046d660
add esp, 8
test eax, eax
je 0x435b26
push 9
push str._standard
mov ecx, esi
call fcn.0042fbc0
jmp 0x435bcb
lea edx, [esp + 0x158]
push str.Professional
push edx
call fcn.0046d660
add esp, 8
test eax, eax
je 0x435b46
push str._pro
jmp 0x435bc4
lea eax, [esp + 0x158]
push str.Business
push eax
call fcn.0046d660
add esp, 8
test eax, eax
je 0x435b66
push str._business
jmp 0x435bc4
lea ecx, [esp + 0x158]
push str.Enterprise
push ecx
call fcn.0046d660
add esp, 8
test eax, eax
je 0x435b86
push str._enterprise
jmp 0x435bc4
lea edx, [esp + 0x158]
push str.Datacenter
push edx
call fcn.0046d660
add esp, 8
test eax, eax
je 0x435ba6
push str._datacenter
jmp 0x435bc4
lea eax, [esp + 0x158]
push str.Ultimate
push eax
call fcn.0046d660
add esp, 8
test eax, eax
je 0x435bcb
push str._ultimate
mov ecx, esi
call fcn.004305b0
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x435be0
push 8
push str._starter
jmp 0x435c00
lea ecx, [esp + 0x158]
push str.Basic
push ecx
call fcn.0046d660
add esp, 8
test eax, eax
je 0x435c07
push 6
push str._basic
mov ecx, esi
call fcn.0042fbc0
call fcn.004273b0
test eax, eax
je 0x435c1e
push 4
push str._x64
mov ecx, esi
call fcn.0042fbc0
cmp dword [0x4e9ecc], ebx
jle 0x435cfa
push ebx
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], 0x4a5f3c
mov dword [esp + 0x44], 0x4a5f34
mov dword [esp + 0x90], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
call fcn.00434880
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 4]
mov dword [esp + ecx + 0x34], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
lea ecx, [esp + 0x40]
call fcn.0042b820
mov edx, dword [0x4e9ecc]
push edx
lea eax, [esp + 0x40]
push 0x4a5f54
push eax
mov dword [esp + 0x4c], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
call fcn.00434a20
add esp, 8
mov ecx, eax
call fcn.004350c0
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x44]
call fcn.00430640
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.0042fac0
cmp dword [esp + 0x30], 0x10
jb 0x435cd3
mov eax, dword [esp + 0x1c]
push eax
call fcn.00469bc3
add esp, 4
lea ecx, [esp + 0x88]
call fcn.0042d4d0
lea ecx, [esp + 0x88]
push ecx
mov dword [esp + 0x8c], vtable.std::ios_base.0
call fcn.0049c6ce
add esp, 4
mov ecx, dword [esp + 0x284]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0046a1be
add esp, 0x27c
ret