Function at 0x455e30
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x26c
mov eax, dword [0x634384]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push edi
push 0x98
lea eax, [esp + 0x40]
mov edi, str.Unknown
push 0
push eax
mov esi, 0x5e7424
call fcn.00551fd0
xor eax, eax
add esp, 0xc
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
cmp byte [0x651cf0], al
jne 0x4564d8
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x455ec4
pop edi
pop esi
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.005395e6
add esp, 0x26c
ret
push ebx
push ebp
push 0x118
lea eax, [esp + 0xe4]
mov dword [0x651df0], 0x2030000
push 0
push eax
call fcn.00551fd0
add esp, 0xc
mov dword [esp + 0xdc], 0x11c
push str.RtlGetVersion
push 0x5e9328
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x455f93
lea ecx, [esp + 0xdc]
push ecx
call eax
test eax, eax
jne 0x455f93
mov eax, dword [esp + 0xec]
mov bp, word [esp + 0x1f4]
mov ebx, dword [esp + 0xe8]
mov edx, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe4]
mov dword [esp + 0x50], eax
mov al, byte [esp + 0x1f6]
mov byte [esp + 0x13], al
mov byte [esp + 0xda], al
movzx eax, word [esp + 0x1f0]
mov word [esp + 0xd4], ax
movzx eax, word [esp + 0x1f2]
mov word [esp + 0xd6], ax
mov al, byte [esp + 0x13]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], ecx
mov word [esp + 0xd8], bp
jmp 0x455fae
mov al, byte [esp + 0xda]
mov bp, word [esp + 0xd8]
mov ebx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
cmp al, 1
jne 0x4562c4
cmp edx, 6
jbe 0x456100
cmp ebx, 0x55f0
jb 0x4560db
mov edi, 0x5ebdb4
mov dword [0x651df0], 0x2039000
cmp edx, 6
jb 0x4563fb
push 0x80
lea eax, [esp + 0x1fc]
push 0
push eax
call fcn.00551fd0
add esp, 0xc
mov dword [esp + 0x14], 0
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0x80
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4562a7
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x1fc]
push eax
push 0
push 0
push str.EditionID
push dword [esp + 0x28]
call esi
test eax, eax
je 0x456078
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x1fc]
push eax
push 0
push 0
push str.ProductName
push dword [esp + 0x28]
call esi
test eax, eax
jne 0x4562a7
lea eax, [esp + 0x1f8]
push 0x80
push eax
call fcn.00568a47
lea eax, [esp + 0x200]
push str.starter
push eax
call fcn.005530f0
add esp, 0x10
test eax, eax
jne 0x456293
lea eax, [esp + 0x1f8]
push str.basic
push eax
call fcn.005530f0
add esp, 8
test eax, eax
je 0x4561ac
mov eax, dword [0x651df0]
mov esi, str.Basic
or eax, 2
mov dword [0x651df0], eax
jmp 0x4562ac
lea eax, [ebx - 0x27d8]
cmp eax, 0x2e17
ja 0x455fda
mov edi, 0x5ebdb8
mov dword [0x651df0], 0x2035000
jmp 0x455fda
jne 0x456169
test ecx, ecx
jne 0x45611a
mov edi, str.Vista
mov dword [0x651df0], 0x2030600
jmp 0x455fe3
cmp ecx, 1
jne 0x456133
mov edi, 0x5ebdc4
mov dword [0x651df0], 0x2030800
jmp 0x455fe3
cmp ecx, 2
jne 0x45614c
mov edi, 0x5ebdc8
mov dword [0x651df0], 0x2031000
jmp 0x455fe3
cmp ecx, 3
jne 0x455fe3
mov edi, 0x5ebdcc
mov dword [0x651df0], 0x2033000
jmp 0x455fe3
cmp edx, 5
jne 0x455fda
test dword [esp + 0xd8], 0x200
mov edi, 0x5ebdd0
je 0x456198
mov dword [0x651df0], 0x2030401
mov esi, str.Home
jmp 0x4563fb
mov dword [0x651df0], 0x2030402
mov esi, str.Professional
jmp 0x4563fb
lea eax, [esp + 0x1f8]
push str.premium
push eax
call fcn.005530f0
add esp, 8
test eax, eax
je 0x4561dc
mov eax, dword [0x651df0]
mov esi, str.Premium
or eax, 3
mov dword [0x651df0], eax
jmp 0x4562ac
lea eax, [esp + 0x1f8]
push 0x5ebe64
push eax
call fcn.005530f0
add esp, 8
test eax, eax
je 0x45620c
mov eax, dword [0x651df0]
mov esi, str.Professional
or eax, 7
mov dword [0x651df0], eax
jmp 0x4562ac
lea eax, [esp + 0x1f8]
push str.enterprise
push eax
call fcn.005530f0
add esp, 8
test eax, eax
je 0x456239
mov eax, dword [0x651df0]
mov esi, str.Enterprise
or eax, 4
mov dword [0x651df0], eax
jmp 0x4562ac
lea eax, [esp + 0x1f8]
push str.business
push eax
call fcn.005530f0
add esp, 8
test eax, eax
je 0x456266
mov eax, dword [0x651df0]
mov esi, str.Business
or eax, 5
mov dword [0x651df0], eax
jmp 0x4562ac
lea eax, [esp + 0x1f8]
push str.ultimate
push eax
call fcn.005530f0
add esp, 8
test eax, eax
je 0x456293
mov eax, dword [0x651df0]
mov esi, str.Ultimate
or eax, 6
mov dword [0x651df0], eax
jmp 0x4562ac
mov eax, dword [0x651df0]
mov esi, str.Starter
or eax, 1
mov dword [0x651df0], eax
jmp 0x4562ac
mov esi, str.Starter
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4563fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4563fb
cmp al, 3
je 0x4562d0
cmp al, 2
jne 0x4563fb
cmp edx, 6
jbe 0x45631e
cmp ebx, 0x4f4c
jb 0x4562ec
mov edi, str.Server_2022
mov eax, 0x2037000
jmp 0x456379
lea eax, [ebx - 0x4524]
cmp eax, 0xa27
ja 0x456305
mov edi, str.Server_2019
mov eax, 0x2038000
jmp 0x456379
lea eax, [ebx - 0x37dc]
cmp eax, 0xd47
ja 0x456374
mov edi, str.Server_2016
mov eax, 0x2036000
jmp 0x456379
jne 0x456363
test ecx, ecx
jne 0x456330
mov edi, str.Server_2008
mov eax, 0x2030700
jmp 0x456379
cmp ecx, 1
jne 0x456341
mov edi, str.Server_2008_R2
mov eax, 0x2030900
jmp 0x456379
cmp ecx, 2
jne 0x456352
mov edi, str.Server_2012
mov eax, 0x2032000
jmp 0x456379
cmp ecx, 3
jne 0x456374
mov edi, str.Server_2012_R2
mov eax, 0x2034000
jmp 0x456379
cmp edx, 5
jne 0x456374
mov edi, str.Server_2003
mov eax, 0x2030500
jmp 0x456379
mov eax, dword [0x651df0]
mov ecx, 0x4000
cmp bp, cx
jne 0x45638d
mov esi, str.Compute_Cluster
or eax, 6
jmp 0x4563f1
mov ecx, 0x2000
cmp bp, cx
jne 0x4563a1
mov esi, str.Storage
or eax, 5
jmp 0x4563f1
mov cl, byte [esp + 0xd8]
test cl, cl
jns 0x4563b6
mov esi, str.Datacenter
or eax, 4
jmp 0x4563f1
test cl, 2
je 0x4563c5
mov esi, str.Enterprise
or eax, 3
jmp 0x4563f1
mov ecx, 0x400
cmp bp, cx
jne 0x4563d9
mov esi, 0x5ebf3c
or eax, 2
jmp 0x4563f1
cmp bp, 1
jne 0x4563e9
mov esi, str.Small_Business
or eax, 8
jmp 0x4563f1
mov esi, str.Standard
or eax, 1
or eax, 0x80
mov dword [0x651df0], eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x1c]
cmp ax, 9
jne 0x45641c
mov eax, dword [0x651df0]
or eax, 0x2230000
jmp 0x45642c
cmp ax, 6
mov eax, dword [0x651df0]
jne 0x456431
or eax, 0x2130000
mov dword [0x651df0], eax
and eax, 0x7fff0000
cmp eax, 0x2230000
je 0x456448
cmp eax, 0x2130000
je 0x456448
xor ecx, ecx
jmp 0x45644d
mov ecx, 1
mov ebp, 0x5e7424
test ecx, ecx
mov edx, ebp
mov ebx, 0x5ebf5c
cmovne edx, ebx
cmp eax, 0x2230000
jne 0x45646c
mov ecx, 0x5ebf64
jmp 0x45647e
cmp eax, 0x2130000
mov ecx, str.Itanium
mov ebx, 0x5ebf70
cmovne ecx, ebx
cmp byte [esp + 0x54], 0
lea eax, [esp + 0x54]
push eax
mov eax, 0x5ead74
cmove eax, ebp
cmp byte [edx], 0
push eax
movzx eax, word [esp + 0x54]
push eax
push edx
mov eax, 0x5ebf60
cmove eax, ebp
cmp byte [esi], 0
push eax
push ecx
push esi
mov eax, 0x5ebf74
cmove eax, ebp
push eax
push edi
push str.Windows__s_s_s__s_s_s__Build__d__s_s
push 0xff
push 0x100
push 0x651cf0
call fcn.00455df0
add esp, 0x34
mov byte [0x651def], 0
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
mov eax, 0x651cf0
pop edi
pop esi
xor ecx, esp
call fcn.005395e6
add esp, 0x26c
ret