Function at 0x50c650
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527fc2
mov eax, dword fs:[0]
push eax
sub esp, 0x38c
mov eax, dword [0x5644a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x50], 0x50
push 1
push 3
lea ecx, [ebp - 0x21c]
call fcn.00422930
mov dword [ebp - 4], 1
push 0x11c
push 0
lea eax, [ebp - 0x174]
push eax
call fcn.00491e40
add esp, 0xc
mov dword [ebp - 0x174], 0x11c
lea ecx, [ebp - 0x174]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x50c728
mov dword [ebp - 0x174], 0x114
lea edx, [ebp - 0x174]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x50c728
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00422a60
mov ecx, dword [ebp - 0x30c]
or ecx, 1
mov dword [ebp - 0x30c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00422120
mov eax, dword [ebp + 8]
jmp 0x50d2dd
mov edx, dword [ebp - 0x164]
mov dword [ebp - 0x310], edx
cmp dword [ebp - 0x310], 0
je 0x50d274
cmp dword [ebp - 0x310], 1
je 0x50d0ef
cmp dword [ebp - 0x310], 2
je 0x50c75c
jmp 0x50d2ad
cmp dword [ebp - 0x170], 6
jne 0x50c7a7
cmp dword [ebp - 0x16c], 1
jne 0x50c7a7
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50c789
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x314], ecx
jmp 0x50c793
mov dword [ebp - 0x314], 0
push str.Microsoft_Windows_7
mov edx, dword [ebp - 0x314]
push edx
call fcn.0041ee80
add esp, 8
cmp dword [ebp - 0x170], 6
jne 0x50c7f2
cmp dword [ebp - 0x16c], 0
jne 0x50c7f2
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50c7d4
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x318], ecx
jmp 0x50c7de
mov dword [ebp - 0x318], 0
push str.Microsoft_Windows_Vista
mov edx, dword [ebp - 0x318]
push edx
call fcn.0041ee80
add esp, 8
cmp dword [ebp - 0x170], 5
jne 0x50c83d
cmp dword [ebp - 0x16c], 2
jne 0x50c83d
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50c81f
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x31c], ecx
jmp 0x50c829
mov dword [ebp - 0x31c], 0
push str.Microsoft_Windows_Server_2003_
mov edx, dword [ebp - 0x31c]
push edx
call fcn.0041ee80
add esp, 8
cmp dword [ebp - 0x170], 5
jne 0x50c888
cmp dword [ebp - 0x16c], 1
jne 0x50c888
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50c86a
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x320], ecx
jmp 0x50c874
mov dword [ebp - 0x320], 0
push str.Microsoft_Windows_XP
mov edx, dword [ebp - 0x320]
push edx
call fcn.0041ee80
add esp, 8
cmp dword [ebp - 0x170], 5
jne 0x50c8d3
cmp dword [ebp - 0x16c], 0
jne 0x50c8d3
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50c8b5
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x324], ecx
jmp 0x50c8bf
mov dword [ebp - 0x324], 0
push str.Microsoft_Windows_2000
mov edx, dword [ebp - 0x324]
push edx
call fcn.0041ee80
add esp, 8
cmp dword [ebp - 0x170], 4
ja 0x50c915
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50c8f7
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x328], ecx
jmp 0x50c901
mov dword [ebp - 0x328], 0
push str.Microsoft_Windows_NT
mov edx, dword [ebp - 0x328]
push edx
call fcn.0041ee80
add esp, 8
cmp dword [ebp - 0x4c], 0
je 0x50cc9c
movzx eax, byte [ebp - 0x5a]
cmp eax, 1
jne 0x50c9f8
cmp dword [ebp - 0x170], 4
jne 0x50c973
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50c950
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x32c], edx
jmp 0x50c95a
mov dword [ebp - 0x32c], 0
push str.Workstation_4.0
mov eax, dword [ebp - 0x32c]
push eax
call fcn.0041ee80
add esp, 8
jmp 0x50c9f3
movzx ecx, word [ebp - 0x5c]
and ecx, 0x200
je 0x50c9ba
lea edx, [ebp - 0x21c]
test edx, edx
je 0x50c99a
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x330], eax
jmp 0x50c9a4
mov dword [ebp - 0x330], 0
push str.Home_Edition
mov ecx, dword [ebp - 0x330]
push ecx
call fcn.0041ee80
add esp, 8
jmp 0x50c9f3
lea edx, [ebp - 0x21c]
test edx, edx
je 0x50c9d5
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x334], eax
jmp 0x50c9df
mov dword [ebp - 0x334], 0
push str.Professional
mov ecx, dword [ebp - 0x334]
push ecx
call fcn.0041ee80
add esp, 8
jmp 0x50cc97
movzx edx, byte [ebp - 0x5a]
cmp edx, 3
je 0x50ca0e
movzx eax, byte [ebp - 0x5a]
cmp eax, 2
jne 0x50cc97
cmp dword [ebp - 0x170], 5
jne 0x50cb3a
cmp dword [ebp - 0x16c], 2
jne 0x50cb3a
movzx ecx, word [ebp - 0x5c]
and ecx, 0x80
je 0x50ca72
lea edx, [ebp - 0x21c]
test edx, edx
je 0x50ca4f
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x338], eax
jmp 0x50ca59
mov dword [ebp - 0x338], 0
push str.Datacenter_Edition
mov ecx, dword [ebp - 0x338]
push ecx
call fcn.0041ee80
add esp, 8
jmp 0x50cb35
movzx edx, word [ebp - 0x5c]
and edx, 2
je 0x50cab6
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50ca96
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x33c], ecx
jmp 0x50caa0
mov dword [ebp - 0x33c], 0
push str.Enterprise_Edition
mov edx, dword [ebp - 0x33c]
push edx
call fcn.0041ee80
add esp, 8
jmp 0x50cb35
movzx eax, word [ebp - 0x5c]
cmp eax, 0x400
jne 0x50cafc
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50cadc
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x340], edx
jmp 0x50cae6
mov dword [ebp - 0x340], 0
push str.Web_Edition
mov eax, dword [ebp - 0x340]
push eax
call fcn.0041ee80
add esp, 8
jmp 0x50cb35
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50cb17
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x344], edx
jmp 0x50cb21
mov dword [ebp - 0x344], 0
push str.Standard_Edition
mov eax, dword [ebp - 0x344]
push eax
call fcn.0041ee80
add esp, 8
jmp 0x50cc97
cmp dword [ebp - 0x170], 5
jne 0x50cc1a
cmp dword [ebp - 0x16c], 0
jne 0x50cc1a
movzx ecx, word [ebp - 0x5c]
and ecx, 0x80
je 0x50cb9b
lea edx, [ebp - 0x21c]
test edx, edx
je 0x50cb7b
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x348], eax
jmp 0x50cb85
mov dword [ebp - 0x348], 0
push str.Datacenter_Server
mov ecx, dword [ebp - 0x348]
push ecx
call fcn.0041ee80
add esp, 8
jmp 0x50cc18
movzx edx, word [ebp - 0x5c]
and edx, 2
je 0x50cbdf
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50cbbf
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x34c], ecx
jmp 0x50cbc9
mov dword [ebp - 0x34c], 0
push 0x544134
mov edx, dword [ebp - 0x34c]
push edx
call fcn.0041ee80
add esp, 8
jmp 0x50cc18
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50cbfa
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x350], ecx
jmp 0x50cc04
mov dword [ebp - 0x350], 0
push 0x544148
mov edx, dword [ebp - 0x350]
push edx
call fcn.0041ee80
add esp, 8
jmp 0x50cc97
movzx eax, word [ebp - 0x5c]
and eax, 2
je 0x50cc5e
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50cc3e
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x354], edx
jmp 0x50cc48
mov dword [ebp - 0x354], 0
push str.Server_4.0__Enterprise_Edition
mov eax, dword [ebp - 0x354]
push eax
call fcn.0041ee80
add esp, 8
jmp 0x50cc97
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50cc79
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x358], edx
jmp 0x50cc83
mov dword [ebp - 0x358], 0
push str.Server_4.0
mov eax, dword [ebp - 0x358]
push eax
call fcn.0041ee80
add esp, 8
jmp 0x50ce9e
mov dword [ebp - 0x2c4], 0x50
lea ecx, [ebp - 0x2c0]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
je 0x50cd05
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00422a60
mov eax, dword [ebp - 0x30c]
or eax, 1
mov dword [ebp - 0x30c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00422120
mov eax, dword [ebp + 8]
jmp 0x50d2dd
lea ecx, [ebp - 0x2c4]
push ecx
lea edx, [ebp - 0x2bc]
push edx
push 0
push 0
push str.ProductType
mov eax, dword [ebp - 0x2c0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
jne 0x50cd41
cmp dword [ebp - 0x2c4], 0x50
jbe 0x50cd76
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00422a60
mov edx, dword [ebp - 0x30c]
or edx, 1
mov dword [ebp - 0x30c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00422120
mov eax, dword [ebp + 8]
jmp 0x50d2dd
mov eax, dword [ebp - 0x2c0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2bc]
push ecx
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x50cdd2
lea edx, [ebp - 0x21c]
test edx, edx
je 0x50cdb4
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x35c], eax
jmp 0x50cdbe
mov dword [ebp - 0x35c], 0
push str.Workstation
mov ecx, dword [ebp - 0x35c]
push ecx
call fcn.0041ee80
add esp, 8
lea edx, [ebp - 0x2bc]
push edx
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x50ce21
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50ce03
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x360], ecx
jmp 0x50ce0d
mov dword [ebp - 0x360], 0
push str.Server
mov edx, dword [ebp - 0x360]
push edx
call fcn.0041ee80
add esp, 8
lea eax, [ebp - 0x2bc]
push eax
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x50ce70
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50ce52
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x364], edx
jmp 0x50ce5c
mov dword [ebp - 0x364], 0
push str.Advanced_Server
mov eax, dword [ebp - 0x364]
push eax
call fcn.0041ee80
add esp, 8
mov ecx, dword [ebp - 0x16c]
push ecx
push 0x544254
mov edx, dword [ebp - 0x170]
push edx
lea ecx, [ebp - 0x20c]
call fcn.004222c0
push eax
call fcn.0041ee80
add esp, 8
mov ecx, eax
call fcn.004222c0
cmp dword [ebp - 0x170], 4
jne 0x50d025
push 0x544258
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x50d025
lea ecx, [ebp - 0x2cc]
push ecx
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0
jne 0x50cf4f
lea edx, [ebp - 0x21c]
test edx, edx
je 0x50cf0a
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x368], eax
jmp 0x50cf14
mov dword [ebp - 0x368], 0
push 0x5442f0
mov ecx, dword [ebp - 0x168]
and ecx, 0xffff
push ecx
push str.Service_Pack_6a__Build
mov edx, dword [ebp - 0x368]
push edx
call fcn.0041ee80
add esp, 8
mov ecx, eax
call fcn.004222c0
push eax
call fcn.0041ee80
add esp, 8
jmp 0x50d013
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.0040ac70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50cf80
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x36c], edx
jmp 0x50cf8a
mov dword [ebp - 0x36c], 0
lea eax, [ebp - 0x2ec]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0051f360
add esp, 8
mov dword [ebp - 0x370], eax
mov edx, dword [ebp - 0x370]
mov dword [ebp - 0x374], edx
mov byte [ebp - 4], 3
push 0x54430c
mov eax, dword [ebp - 0x168]
and eax, 0xffff
push eax
push 0x544310
mov ecx, dword [ebp - 0x374]
push ecx
mov edx, dword [ebp - 0x36c]
push edx
call fcn.0041f160
add esp, 8
push eax
call fcn.0041ee80
add esp, 8
mov ecx, eax
call fcn.004222c0
push eax
call fcn.0041ee80
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.00402ab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2ec]
call fcn.00402c30
mov eax, dword [ebp - 0x2cc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x50d0ea
lea ecx, [ebp - 0x160]
push ecx
lea ecx, [ebp - 0x308]
call fcn.0040ac70
mov byte [ebp - 4], 4
lea edx, [ebp - 0x21c]
test edx, edx
je 0x50d056
lea eax, [ebp - 0x21c]
add eax, 0x10
mov dword [ebp - 0x378], eax
jmp 0x50d060
mov dword [ebp - 0x378], 0
lea ecx, [ebp - 0x308]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.0051f360
add esp, 8
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x380], eax
mov byte [ebp - 4], 5
push 0x54431c
mov ecx, dword [ebp - 0x168]
and ecx, 0xffff
push ecx
push str.__Build
mov edx, dword [ebp - 0x380]
push edx
mov eax, dword [ebp - 0x378]
push eax
call fcn.0041f160
add esp, 8
push eax
call fcn.0041ee80
add esp, 8
mov ecx, eax
call fcn.004222c0
push eax
call fcn.0041ee80
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48]
call fcn.00402ab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x308]
call fcn.00402c30
jmp 0x50d2ad
cmp dword [ebp - 0x170], 4
jne 0x50d193
cmp dword [ebp - 0x16c], 0
jne 0x50d193
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50d124
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x384], edx
jmp 0x50d12e
mov dword [ebp - 0x384], 0
push str.Microsoft_Windows_95
mov eax, dword [ebp - 0x384]
push eax
call fcn.0041ee80
add esp, 8
movzx ecx, word [ebp - 0x15e]
cmp ecx, 0x43
je 0x50d15a
movzx edx, word [ebp - 0x15e]
cmp edx, 0x42
jne 0x50d193
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50d175
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x388], ecx
jmp 0x50d17f
mov dword [ebp - 0x388], 0
push str.OSR2
mov edx, dword [ebp - 0x388]
push edx
call fcn.0041ee80
add esp, 8
cmp dword [ebp - 0x170], 4
jne 0x50d227
cmp dword [ebp - 0x16c], 0xa
jne 0x50d227
lea eax, [ebp - 0x21c]
test eax, eax
je 0x50d1c4
lea ecx, [ebp - 0x21c]
add ecx, 0x10
mov dword [ebp - 0x38c], ecx
jmp 0x50d1ce
mov dword [ebp - 0x38c], 0
push str.Microsoft_Windows_98
mov edx, dword [ebp - 0x38c]
push edx
call fcn.0041ee80
add esp, 8
movzx eax, word [ebp - 0x15e]
cmp eax, 0x41
jne 0x50d227
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50d209
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x390], edx
jmp 0x50d213
mov dword [ebp - 0x390], 0
push 0x544364
mov eax, dword [ebp - 0x390]
push eax
call fcn.0041ee80
add esp, 8
cmp dword [ebp - 0x170], 4
jne 0x50d272
cmp dword [ebp - 0x16c], 0x5a
jne 0x50d272
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50d254
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x394], edx
jmp 0x50d25e
mov dword [ebp - 0x394], 0
push str.Microsoft_Windows_Millennium_Edition
mov eax, dword [ebp - 0x394]
push eax
call fcn.0041ee80
add esp, 8
jmp 0x50d2ad
lea ecx, [ebp - 0x21c]
test ecx, ecx
je 0x50d28f
lea edx, [ebp - 0x21c]
add edx, 0x10
mov dword [ebp - 0x398], edx
jmp 0x50d299
mov dword [ebp - 0x398], 0
push str.Microsoft_Win32s
mov eax, dword [ebp - 0x398]
push eax
call fcn.0041ee80
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00422a60
mov edx, dword [ebp - 0x30c]
or edx, 1
mov dword [ebp - 0x30c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00422120
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490d41
mov esp, ebp
pop ebp
ret