Function at 0x4d1362
Capabilities:
Check os version
Get file version info
Query or enumerate registry value

Disassembly:
mov eax, 0x52ba3a
call fcn.0051f7c8
sub esp, 0x508
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov ebx, 0x561720
push str.winnt
mov ecx, 0x561848
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], esi
call fcn.0040b6f0
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
mov ecx, 0x561810
call fcn.00403000
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0xf0], 7
call fcn.00403f70
push 2
mov byte [ebp - 4], 1
pop esi
cmp esi, dword [ebx + 0x68]
jae 0x4d13fe
lea edi, [ebx + 0x54]
push esi
mov ecx, edi
call fcn.00402db0
movzx eax, word [eax]
push eax
call fcn.004f1e71
pop ecx
test eax, eax
je 0x4d13fe
push esi
mov ecx, edi
call fcn.00402db0
movzx eax, word [eax]
push eax
push 1
lea ecx, [ebp - 0x108]
call fcn.00409f20
inc esi
jmp 0x4d13c4
and dword [ebp - 0x144], 0
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x140]
rep stosd dword es:[edi], eax
mov eax, dword [0x543aac]
mov dword [ebp - 0x514], eax
mov eax, dword [0x543ab0]
push 0x202
mov dword [ebp - 0x510], eax
lea eax, [ebp - 0x50c]
push 0
push eax
call fcn.004f4810
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x514]
push eax
push 0x400000
call esi
test eax, eax
jne 0x4d147c
push 0x1c
lea eax, [ebp - 0x144]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push edi
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x140]
call esi
lea esi, [ebx + 0xb8]
push esi
lea edx, [ebp - 0x514]
call fcn.00408f00
xor edi, edi
push esi
inc edi
lea ebx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x5c
call fcn.00403100
push esi
lea ecx, [eax + 1]
xor edx, edx
lea esi, [ebp - 0x60]
call fcn.00402e10
mov ebx, dword [ebp - 0x20]
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebx + 0xd4]
mov byte [ebp - 4], 2
call fcn.00403000
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00402d80
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x514]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x4d17e5
lea ebx, [ebp - 0x19]
lea esi, [ebp - 0x54]
mov byte [ebp - 0x19], 0
call fcn.00403240
mov byte [ebp - 4], 3
push dword [ebp - 0x50]
xor ebx, ebx
push edi
push ebx
lea eax, [ebp - 0x514]
push eax
mov dword [ebp - 0x18], ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4d1530
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x534e64
push dword [ebp - 0x50]
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x4d1666
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
xor ecx, ecx
or ecx, esi
xor edi, edi
or edx, edi
mov edi, dword [ebp - 0x20]
mov dword [edi + 0x70], ecx
mov dword [edi + 0x74], edx
mov ecx, dword [eax + 0x1c]
and ecx, dword [eax + 0x18]
lea eax, [ebp - 0x2ec]
and cl, 2
neg cl
sbb cl, cl
inc cl
push eax
mov byte [edi + 0xb4], cl
call fcn.00416c30
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x12]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.00402b90
mov esi, 0x53afb0
push esi
push eax
call fcn.00405660
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, word [ecx + 0x10]
push ecx
push eax
call fcn.00402b90
push esi
push eax
call fcn.00405660
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, word [ecx + 0x16]
push ecx
push eax
call fcn.00402b90
lea ecx, [ebp - 0x128]
lea eax, [ebp - 0x2ec]
call fcn.00416d70
mov byte [ebp - 4], 5
cmp dword [eax + 0x18], 0x10
jb 0x4d15de
mov eax, dword [eax + 4]
jmp 0x4d15e1
add eax, 4
push eax
lea ecx, [edi + 0x7c]
call fcn.0040b6f0
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 4
call fcn.00402b30
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x14]
mov dword [edi + 0x78], eax
lea eax, [ebp - 0x2e4]
push esi
push eax
call fcn.00405660
pop ecx
pop ecx
push dword [edi + 0x78]
push eax
call fcn.0041f0d0
lea ecx, [ebp - 0x128]
lea eax, [ebp - 0x2ec]
call fcn.00416d70
mov byte [ebp - 4], 6
cmp dword [eax + 0x18], 0x10
jb 0x4d163b
mov eax, dword [eax + 4]
jmp 0x4d163e
add eax, 4
push eax
lea ecx, [edi + 0x98]
call fcn.0040b6f0
lea ecx, [ebp - 0x128]
call fcn.00402b30
lea eax, [ebp - 0x2ec]
mov byte [ebp - 4], 3
call fcn.0040e800
jmp 0x4d1669
mov edi, dword [ebp - 0x20]
push 0x543ab4
push dword [ebp - 0x50]
lea eax, [ebp - 0x40]
push eax
call fcn.004d10d3
add esp, 0xc
lea esi, [ebp - 0x128]
mov byte [ebp - 4], 7
call fcn.0040bab0
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.00402e40
mov ecx, esi
call fcn.00402b30
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00402d80
call fcn.004cefff
mov edx, dword [eax]
mov esi, 0x100
push esi
mov ecx, eax
call dword [edx + 8]
test al, al
je 0x4d1731
call fcn.004cf0d6
push 0x534dc0
push eax
call fcn.00405660
pop ecx
pop ecx
push str.TAppData::Init
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x534dd8
push eax
call fcn.00405660
pop ecx
pop ecx
push 0x2d7
push eax
call fcn.00402b90
push 0x534dd4
push eax
call fcn.00405660
pop ecx
pop ecx
push str.appid_which_read_from_.exe:
push eax
call fcn.00405660
pop ecx
pop ecx
push edi
push eax
call fcn.00405890
pop ecx
pop ecx
push 0x534dc4
push eax
call fcn.00405660
pop ecx
pop ecx
push esi
call fcn.004cf0e5
push 0x543b00
push dword [ebp - 0x50]
lea eax, [ebp - 0x40]
push eax
call fcn.004d10d3
add esp, 0xc
push 0xffffffffffffffff
push 0
lea ebx, [edi + 0x1c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 9
call fcn.00403000
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00402d80
push str.Comments
push dword [ebp - 0x50]
lea eax, [ebp - 0x40]
push eax
call fcn.004d10d3
add esp, 0xc
push 0xffffffffffffffff
push 0
lea esi, [edi + 0x38]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.00403000
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00402d80
cmp dword [edi + 0x4c], 0
jne 0x4d17a9
push 0xffffffffffffffff
push 0
push ebx
mov ecx, esi
call fcn.00403000
push 0x543b2c
push dword [ebp - 0x50]
lea eax, [ebp - 0x40]
push eax
call fcn.004d10d3
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
lea ecx, [edi + 0x54]
mov byte [ebp - 4], 0xb
call fcn.00403000
lea ecx, [ebp - 0x40]
call fcn.00402d80
lea esi, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.00439530
mov ebx, dword [ebp - 0x20]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push ebx
call fcn.00402b00
lea ecx, [ebp - 0x40]
call fcn.004cfd0a
add esp, 0x1c
push eax
mov byte [ebp - 4], 0xc
push dword [ebp + 0xc]
lea edi, [ebx + 0x180]
push dword [ebp + 8]
push edi
call fcn.004cf55c
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00402d80
lea eax, [ebp - 0x40]
push eax
mov ecx, edi
call fcn.004cfc1e
or dword [ebp - 0x24], 1
cmp dword [eax + 0x14], 0
jne 0x4d1873
cmp dword [ebx + 0x18], 0x10
lea esi, [ebx + 4]
jb 0x4d1843
mov eax, dword [esi]
jmp 0x4d1845
mov eax, esi
push str.barie
push eax
call fcn.005052c1
pop ecx
pop ecx
test eax, eax
je 0x4d186f
cmp dword [ebx + 0x18], 0x10
jb 0x4d185e
mov esi, dword [esi]
push str.barie64
push esi
call fcn.005052c1
pop ecx
pop ecx
test eax, eax
jne 0x4d1873
mov bl, 1
jmp 0x4d1875
xor bl, bl
test byte [ebp - 0x24], 1
je 0x4d1883
lea ecx, [ebp - 0x40]
call fcn.00402b30
test bl, bl
je 0x4d18b4
push str.vendor.xml
lea ecx, [ebp - 0x60]
call fcn.0040b580
lea eax, [ebp - 0x60]
push eax
mov byte [ebp - 4], 0xd
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call fcn.004cf55c
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.00402d80
push 0x118
xor ebx, ebx
lea eax, [ebp - 0x260]
push ebx
push eax
call fcn.004f4810
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
mov dword [ebp - 0x264], 0x11c
call esi
mov edi, eax
cmp edi, ebx
jne 0x4d1905
lea eax, [ebp - 0x264]
push eax
mov dword [ebp - 0x264], 0x114
call esi
cmp eax, ebx
je 0x4d1df0
movzx eax, word [ebp - 0x258]
mov esi, dword [ebp - 0x20]
mov dword [esi + 0x17c], eax
lea eax, [ebp - 0x2ec]
push eax
call fcn.004d2276
mov byte [ebp - 4], 0xe
push dword [ebp - 0x260]
lea eax, [ebp - 0x2e4]
push eax
call fcn.004d1e2e
push eax
call fcn.004d44a7
pop ecx
push dword [ebp - 0x25c]
push eax
call fcn.004d1e2e
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x2ec]
call fcn.004d235c
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x18], 8
jb 0x4d1967
mov eax, dword [eax + 4]
jmp 0x4d196a
add eax, 4
add esi, 0x160
push esi
mov edx, eax
call fcn.00408f00
lea ecx, [ebp - 0x40]
call fcn.00402d80
lea eax, [ebp - 0x2ec]
mov byte [ebp - 4], 1
call fcn.004d1e12
lea eax, [ebp - 0xec]
push eax
call fcn.004d2276
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x254]
sub eax, ebx
je 0x4d1d95
dec eax
je 0x4d1d00
dec eax
jne 0x4d1da8
lea eax, [ebp - 0xe4]
push str.Microsoft_Windows
push eax
call fcn.004d4668
pop ecx
pop ecx
push 5
pop esi
cmp dword [ebp - 0x260], esi
jne 0x4d1a3c
cmp dword [ebp - 0x25c], 2
jne 0x4d19fd
lea eax, [ebp - 0xe4]
push str.Server_2003_family
push eax
call fcn.004d4668
pop ecx
pop ecx
cmp dword [ebp - 0x260], esi
jne 0x4d1a3c
cmp dword [ebp - 0x25c], 1
jne 0x4d1a21
lea eax, [ebp - 0xe4]
push 0x543b9c
push eax
call fcn.004d4668
pop ecx
pop ecx
cmp dword [ebp - 0x260], esi
jne 0x4d1a3c
cmp dword [ebp - 0x25c], ebx
jne 0x4d1a58
lea eax, [ebp - 0xe4]
push str.2000
push eax
call fcn.004d4668
pop ecx
pop ecx
cmp dword [ebp - 0x260], 4
ja 0x4d1a58
lea eax, [ebp - 0xe4]
push 0x543bb0
push eax
call fcn.004d4668
pop ecx
pop ecx
cmp edi, ebx
je 0x4d1b69
cmp byte [ebp - 0x14a], 1
jne 0x4d1aa2
cmp dword [ebp - 0x260], 4
lea eax, [ebp - 0xe4]
jne 0x4d1a82
push str._Workstation_4.0
jmp 0x4d1b5c
test dword [ebp - 0x14c], 0x200
je 0x4d1a98
push str._Home_Edition
jmp 0x4d1b5c
push str._Professional
jmp 0x4d1b5c
cmp byte [ebp - 0x14a], 3
jne 0x4d1c70
cmp dword [ebp - 0x260], esi
jne 0x4d1b41
cmp dword [ebp - 0x25c], 2
jne 0x4d1b0c
test byte [ebp - 0x14c], 0x80
je 0x4d1ad4
push str._Datacenter_Edition
jmp 0x4d1ae2
test byte [ebp - 0x14c], 2
je 0x4d1aea
push str._Enterprise_Edition
lea eax, [ebp - 0xe4]
jmp 0x4d1b5c
mov eax, 0x400
cmp word [ebp - 0x14c], ax
lea eax, [ebp - 0xe4]
jne 0x4d1b05
push str._Web_Edition
jmp 0x4d1b5c
push str._Standard_Edition
jmp 0x4d1b5c
cmp dword [ebp - 0x25c], ebx
jne 0x4d1b41
test byte [ebp - 0x14c], 0x80
lea eax, [ebp - 0xe4]
je 0x4d1b2a
push str._Datacenter_Server
jmp 0x4d1b5c
test byte [ebp - 0x14c], 2
je 0x4d1b3a
push str._Advanced_Server
jmp 0x4d1b5c
push str._Server
jmp 0x4d1b5c
test byte [ebp - 0x14c], 2
lea eax, [ebp - 0xe4]
je 0x4d1b57
push str._Server_4.0__Enterprise_Edition
jmp 0x4d1b5c
push str._Server_4.0
push eax
call fcn.004d4668
pop ecx
pop ecx
jmp 0x4d1c70
push 0x50
pop esi
lea eax, [ebp + 0xc]
push eax
push 1
push ebx
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4d1de1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x304]
push eax
push ebx
push ebx
push str.ProductType
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4d1de1
cmp dword [ebp + 8], esi
ja 0x4d1de1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [ebp - 0x304]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x4d1bee
lea eax, [ebp - 0xe4]
push str._Workstation
push eax
call fcn.004d4668
pop ecx
pop ecx
lea eax, [ebp - 0x304]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x4d1c13
lea eax, [ebp - 0xe4]
push str._Server
push eax
call fcn.004d4668
pop ecx
pop ecx
lea eax, [ebp - 0x304]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x4d1c38
lea eax, [ebp - 0xe4]
push str._Advanced_Server
push eax
call fcn.004d4668
pop ecx
pop ecx
lea eax, [ebp - 0xe4]
push 0x543804
push eax
call fcn.004d4668
pop ecx
pop ecx
push dword [ebp - 0x260]
push eax
call fcn.004d1e2e
push 0x5433b0
push eax
call fcn.004d4668
pop ecx
pop ecx
push dword [ebp - 0x25c]
push eax
call fcn.004d1e2e
cmp dword [ebp - 0x260], 4
jne 0x4d1ce1
push str.Service_Pack_6
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4d1ce1
lea eax, [ebp + 8]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
lea eax, [ebp - 0xe4]
jne 0x4d1cb7
push str._Service_Pack_6a
jmp 0x4d1ccb
push 0x543804
push eax
call fcn.004d4668
pop ecx
pop ecx
lea ecx, [ebp - 0x250]
push ecx
push eax
call fcn.004d4668
pop ecx
pop ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d1da8
lea eax, [ebp - 0xe4]
push 0x543804
push eax
call fcn.004d4668
pop ecx
pop ecx
lea ecx, [ebp - 0x250]
push ecx
jmp 0x4d1da0
cmp dword [ebp - 0x260], 4
jne 0x4d1da8
cmp dword [ebp - 0x25c], ebx
jne 0x4d1d43
lea eax, [ebp - 0xe4]
push str.Microsoft_Windows_95
push eax
call fcn.004d4668
cmp word [ebp - 0x24e], 0x43
pop ecx
pop ecx
je 0x4d1d3c
cmp word [ebp - 0x24e], 0x42
jne 0x4d1d7c
push str._OSR2
jmp 0x4d1d6e
cmp dword [ebp - 0x25c], 0xa
jne 0x4d1d85
lea eax, [ebp - 0xe4]
push str.Microsoft_Windows_98
push eax
call fcn.004d4668
cmp word [ebp - 0x24e], 0x41
pop ecx
pop ecx
jne 0x4d1d7c
push 0x543f40
lea eax, [ebp - 0xe4]
push eax
call fcn.004d4668
pop ecx
pop ecx
cmp dword [ebp - 0x260], 4
jne 0x4d1da8
cmp dword [ebp - 0x25c], 0x5a
jne 0x4d1da8
push str.Microsoft_Windows_Millennium_Edition
jmp 0x4d1d9a
push str.Microsoft_Win32s
lea eax, [ebp - 0xe4]
push eax
call fcn.004d4668
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0xec]
call fcn.004d235c
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x18], 8
jb 0x4d1dc5
mov eax, dword [eax + 4]
jmp 0x4d1dc8
add eax, 4
mov ecx, dword [ebp - 0x20]
add ecx, 0x144
push ecx
mov edx, eax
call fcn.00408f00
lea ecx, [ebp - 0x40]
call fcn.00402d80
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 1
call fcn.004d1e12
lea ecx, [ebp - 0x108]
call fcn.00402d80
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8