Function at 0x44b640
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0
mov eax, dword [0x497060]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1f0], ecx
push edi
lea ecx, [ebp - 0x1e8]
mov edi, 1
mov dword [ebp - 0x1e8], 0x11c
call fcn.0044b560
test eax, eax
jne 0x44b6a2
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x1e8], 0x114
call fcn.0044b560
test eax, eax
jne 0x44b6a0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460da6
mov esp, ebp
pop ebp
ret
xor edi, edi
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44b6c8
lea ecx, [ebp - 0xcc]
push ecx
call eax
jmp 0x44b6d5
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1d8]
push ebx
push esi
xor esi, esi
sub eax, esi
je 0x44b9e8
dec eax
je 0x44b9b6
dec eax
jne 0x44b9ed
mov edx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x1e0]
cmp edx, 5
ja 0x44b710
jne 0x44b720
test eax, eax
je 0x44b798
cmp word [ebp - 0xcc], 9
mov ecx, 0x80000
cmove esi, ecx
cmp edx, 6
jne 0x44b78f
cmp eax, 3
jne 0x44b735
or esi, 0x1800
jmp 0x44b9ed
cmp eax, 2
jne 0x44b745
or esi, 0x1700
jmp 0x44b9ed
cmp eax, 1
jne 0x44b768
cmp byte [ebp - 0xce], al
jne 0x44b75d
or esi, 0x1600
jmp 0x44b9ed
or esi, 0x150b
jmp 0x44b9ed
test eax, eax
jne 0x44b9ed
or esi, 0x1500
cmp byte [ebp - 0xce], 1
jne 0x44b787
or esi, 0xa
jmp 0x44b9ed
or esi, 0xb
jmp 0x44b9ed
cmp edx, 5
jne 0x44b895
cmp eax, 2
jne 0x44b83a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov bl, byte [ebp - 0xce]
mov ecx, dword [ebp - 0xd0]
test eax, eax
mov ax, word [ebp - 0xcc]
jne 0x44b7e7
mov edx, 0x2000
cmp cx, dx
je 0x44b7e7
mov edx, 0x8000
cmp cx, dx
je 0x44b7e7
cmp bl, 1
jne 0x44b7e7
cmp ax, 9
jne 0x44b7e7
or esi, 0x81300
jmp 0x44b827
or esi, 0x1400
test cl, cl
jns 0x44b7f6
or esi, 4
jmp 0x44b810
test cl, 2
je 0x44b800
or esi, 5
jmp 0x44b810
test ecx, 0x400
je 0x44b80d
or esi, 6
jmp 0x44b810
or esi, 7
cmp bl, 1
je 0x44b827
cmp ax, 6
je 0x44b821
cmp ax, 9
jne 0x44b827
or esi, 0x80000
mov edx, dword [ebp - 0x1e4]
cmp edx, 5
jne 0x44b8a1
mov eax, dword [ebp - 0x1e0]
jmp 0x44b846
mov bl, byte [ebp - 0xce]
mov ecx, dword [ebp - 0xd0]
cmp eax, 1
jne 0x44b861
or esi, 0x1300
test ecx, 0x200
je 0x44b874
or esi, 2
jmp 0x44b9ed
test eax, eax
jne 0x44b9ed
or esi, 0x1200
cmp bl, 1
jne 0x44b87c
or esi, 3
jmp 0x44b9ed
test cl, cl
jns 0x44b888
or esi, 4
jmp 0x44b9ed
test cl, 2
je 0x44b8eb
or esi, 8
jmp 0x44b9ed
mov bl, byte [ebp - 0xce]
mov ecx, dword [ebp - 0xd0]
cmp edx, 4
jne 0x44b8ae
or esi, 0x1100
jmp 0x44b8bf
jae 0x44b8b6
or esi, 0x1000
cmp edx, 4
ja 0x44b9ed
test edi, edi
je 0x44b8f3
cmp bl, 1
jne 0x44b8d0
or esi, 1
jmp 0x44b9ed
cmp bl, 3
je 0x44b8de
cmp bl, 2
jne 0x44b9ed
test cl, 2
je 0x44b8eb
or esi, 5
jmp 0x44b9ed
or esi, 9
jmp 0x44b9ed
lea eax, [ebp - 0x1ec]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
mov dword [ebp - 0xa8], 0x50
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44b9a3
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x1ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b9a3
cmp dword [ebp - 0xa8], 0x50
ja 0x44b9a3
push dword [ebp - 0x1ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0xa4]
push eax
push str.WINNT
call edi
test eax, eax
jne 0x44b977
or esi, 1
lea eax, [ebp - 0xa4]
push eax
push str.LANMANNT
call edi
test eax, eax
jne 0x44b98c
or esi, 9
lea eax, [ebp - 0xa4]
push eax
push str.SERVERNT
call edi
test eax, eax
jne 0x44b9ed
or esi, 8
jmp 0x44b9ed
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00460da6
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1e4], 4
jne 0x44b9ed
mov eax, dword [ebp - 0x1e0]
test eax, eax
jne 0x44b9d0
mov esi, 0x200
jmp 0x44b9ed
cmp eax, 0xa
jne 0x44b9dc
mov esi, 0x300
jmp 0x44b9ed
cmp eax, 0x5a
jne 0x44b9ed
mov esi, 0x400
jmp 0x44b9ed
mov esi, 0x100
mov eax, dword [ebp - 0x1f0]
test eax, eax
je 0x44b9f9
mov dword [eax], esi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
mov eax, 1
pop edi
call fcn.00460da6
mov esp, ebp
pop ebp
ret