Function at 0x1006f1e0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x980
mov eax, dword [0x100cd8ec]
xor eax, esp
mov dword [esp + 0x97c], eax
mov eax, dword [esp + 0x984]
push ebx
push esi
push edi
mov dword [esp + 0x14], ecx
mov ecx, dword [ecx]
push str._CORE__XWHSMDriverManager::getSystemVersion__Start
push ecx
mov dword [esp + 0x20], eax
call fcn.10077b60
push 0x3ff
lea edx, [esp + 0x145]
push 0
push edx
or ebx, 0xffffffff
mov byte [esp + 0x14c], 0
call sub.MSVCR80.dll_memset
push 0x3ff
lea eax, [esp + 0x5a1]
push 0
push eax
mov byte [esp + 0x5a8], 0
call sub.MSVCR80.dll_memset
push 0x11c
lea ecx, [esp + 0x40]
push 0
push ecx
call sub.MSVCR80.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0x2c
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x11c
call esi
mov edi, eax
test edi, edi
jne 0x1006f297
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x114
call esi
test eax, eax
jne 0x1006f297
or eax, ebx
jmp 0x1006fc43
mov eax, dword [esp + 0x2c]
sub eax, 0
push ebp
je 0x1006fbd6
sub eax, 1
je 0x1006fa72
sub eax, 1
jne 0x1006fc0e
mov ebp, dword [sym.imp.MSVCR80.dll_strncat]
mov esi, 5
cmp dword [esp + 0x24], esi
jne 0x1006f39a
cmp dword [esp + 0x28], 2
jne 0x1006f314
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f2e0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_Server_2003_family_
push edx
call ebp
add esp, 0xc
cmp dword [esp + 0x24], esi
mov ebx, 9
jne 0x1006f39a
cmp dword [esp + 0x28], 1
jne 0x1006f355
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f325
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_XP
push edx
call ebp
add esp, 0xc
cmp dword [esp + 0x24], esi
mov ebx, 8
jne 0x1006f39a
cmp dword [esp + 0x28], 0
jne 0x1006f535
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f370
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_2000
push edx
call ebp
add esp, 0xc
mov ebx, 7
cmp dword [esp + 0x24], 6
jne 0x1006f4ba
cmp dword [esp + 0x28], 0
jne 0x1006f3eb
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f3b6
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_Vista
push edx
call ebp
add esp, 0xc
cmp dword [esp + 0x24], 6
mov ebx, 0xa
jne 0x1006f4ba
cmp dword [esp + 0x28], 1
jne 0x1006f435
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f400
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_7
push edx
call ebp
add esp, 0xc
cmp dword [esp + 0x24], 6
mov ebx, 0xb
jne 0x1006f4ba
cmp dword [esp + 0x28], 2
jne 0x1006f477
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f446
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_8
push edx
call ebp
add esp, 0xc
cmp dword [esp + 0x24], 6
mov ebx, 0xc
jne 0x1006f4ba
cmp dword [esp + 0x28], 3
jne 0x1006f535
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f490
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_8.1
push edx
call ebp
add esp, 0xc
mov ebx, 0xd
cmp dword [esp + 0x24], 0xa
jne 0x1006f4fc
cmp dword [esp + 0x28], 0
jne 0x1006f535
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f4d2
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_10
push edx
call ebp
add esp, 0xc
mov ebx, 0xe
cmp dword [esp + 0x24], 4
ja 0x1006f535
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f510
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_NT
push edx
call ebp
add esp, 0xc
test edi, edi
mov esi, dword [sym.imp.MSVCR80.dll_sprintf]
je 0x1006f7fc
mov al, byte [esp + 0x13a]
cmp al, 1
jne 0x1006f5ee
cmp dword [esp + 0x24], 4
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
jne 0x1006f58f
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f563
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Workstation_4.0
push edx
call ebp
mov ebx, 5
jmp 0x1006f990
test dword [esp + 0x138], 0x200
je 0x1006f5c7
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f5a0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Home_Edition
push edx
call ebp
jmp 0x1006f990
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f5c7
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Professional
push edx
call ebp
jmp 0x1006f990
cmp al, 3
jne 0x1006f993
cmp dword [esp + 0x24], 5
jne 0x1006f787
mov eax, dword [esp + 0x28]
cmp eax, 2
jne 0x1006f6de
mov eax, dword [esp + 0x138]
test al, al
jns 0x1006f64a
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f623
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Datacenter_Edition
push edx
call ebp
jmp 0x1006f990
test al, 2
je 0x1006f67f
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f658
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Enterprise_Edition
push edx
call ebp
jmp 0x1006f990
cmp ax, 0x400
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
jne 0x1006f6b7
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f690
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Web_Edition
push edx
call ebp
jmp 0x1006f990
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f6b7
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Standard_Edition
push edx
call ebp
jmp 0x1006f990
test eax, eax
jne 0x1006f787
mov al, byte [esp + 0x138]
test al, al
jns 0x1006f727
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
jmp 0x1006f700
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f700
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Datacenter_Server
push edx
call ebp
jmp 0x1006f990
test al, 2
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
je 0x1006f760
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f735
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Advanced_Server
push edx
call ebp
jmp 0x1006f990
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f760
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Server
push edx
call ebp
jmp 0x1006f990
test byte [esp + 0x138], 2
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
je 0x1006f7d0
jmp 0x1006f7a0
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f7a0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Server_4.0__Enterprise_Edition
push edx
call ebp
mov ebx, 6
jmp 0x1006f990
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f7d0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Server_4.0
push edx
call ebp
mov ebx, 6
jmp 0x1006f990
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x50
push closesocket
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1006fa6a
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x540]
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.ProductType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1006fa6a
cmp dword [esp + 0x14], esi
ja 0x1006fa6a
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 6
lea edi, [esp + 0x53c]
mov esi, str.WINNT
mov ecx, ebx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x1006f8af
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f885
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Workstation
push edx
call ebp
add esp, 0xc
mov ebx, 5
lea edi, [esp + 0x53c]
mov esi, str.LANMANNT
mov ecx, 9
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1006f8f5
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f8d0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Server
push edx
call ebp
add esp, 0xc
lea edi, [esp + 0x53c]
mov esi, str.SERVERNT
mov ecx, 9
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1006f93b
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f916
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Advanced_Server
push edx
call ebp
add esp, 0xc
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x594]
push str._d._d
push edx
call dword [sym.imp.MSVCR80.dll_sprintf]
lea eax, [esp + 0x14c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006f965
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x590]
push edx
lea eax, [esp + 0x144]
push eax
call ebp
mov esi, dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
cmp dword [esp + 0x24], 4
jne 0x1006fa16
push str.Service_Pack_6
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1006fa16
lea edx, [esp + 0x10]
push edx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
lea ecx, [esp + 0x58c]
jne 0x1006f9f3
movzx eax, word [esp + 0x2c]
push eax
push str.Service_Pack_6a__Build__d_
push ecx
call esi
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1006fa33
movzx edx, word [esp + 0x2c]
push edx
lea eax, [esp + 0x38]
push eax
push str._s__Build__d_
push ecx
call esi
mov edx, dword [esp + 0x20]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1006fa33
movzx eax, word [esp + 0x2c]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x594]
push str._s__Build__d_
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006fa40
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x590]
push edx
lea eax, [esp + 0x144]
push eax
call ebp
jmp 0x1006fc0b
or eax, 0xffffffff
jmp 0x1006fc42
mov ebp, 4
cmp dword [esp + 0x24], ebp
jne 0x1006fc0e
cmp dword [esp + 0x28], 0
mov esi, dword [sym.imp.MSVCR80.dll_strncat]
jne 0x1006fb14
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006faa0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_95
push edx
call esi
mov ax, word [esp + 0x42]
add esp, 0xc
cmp ax, 0x43
je 0x1006fad6
cmp ax, 0x42
jne 0x1006fb05
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006fae0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.OSR2
push edx
call esi
add esp, 0xc
cmp dword [esp + 0x24], ebp
mov ebx, 2
jne 0x1006fc0e
cmp dword [esp + 0x28], 0xa
jne 0x1006fb9b
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006fb30
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_98
push edx
call esi
add esp, 0xc
cmp word [esp + 0x36], 0x41
jne 0x1006fb8c
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006fb67
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push 0x100ae170
push edx
call esi
add esp, 0xc
cmp dword [esp + 0x24], ebp
mov ebx, 3
jne 0x1006fc0e
cmp dword [esp + 0x28], 0x5a
jne 0x1006fc0e
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006fbb0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Windows_Millennium_Edition
push edx
call esi
mov ebx, ebp
jmp 0x1006fc0b
lea eax, [esp + 0x13c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1006fbe0
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
push ecx
lea edx, [esp + 0x140]
push str.Microsoft_Win32s
push edx
call dword [sym.imp.MSVCR80.dll_strncat]
mov ebx, 1
add esp, 0xc
mov eax, dword [esp + 0x998]
mov edx, dword [esp + 0x1c]
add eax, 0xffffffff
push eax
lea ecx, [esp + 0x140]
push ecx
push edx
call dword [sym.imp.MSVCR80.dll_strncpy]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
push str._CORE__XWHSMDriverManager::getSystemVersion__End
push ecx
call fcn.10077b60
add esp, 0x14
mov eax, ebx
pop ebp
mov ecx, dword [esp + 0x988]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10090e24
add esp, 0x980
ret 8