Function at 0x410850
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x3c8
mov eax, dword [0x483ca0]
xor eax, esp
mov dword [esp + 0x3c4], eax
push esi
push 0x11c
lea eax, [esp + 0x10]
mov byte [0x48b4a8], 0
push 0
push eax
call fcn.00438b10
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x18]
add esp, 0xc
mov dword [esp + 0xc], 0x11c
push eax
call esi
mov dword [esp + 4], eax
test eax, eax
jne 0x4108c8
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
call esi
test eax, eax
jne 0x4108c8
xor al, al
pop esi
mov ecx, dword [esp + 0x3c4]
xor ecx, esp
call fcn.004396df
add esp, 0x3c8
ret
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push edi
sub eax, 0
je 0x410e2d
dec eax
je 0x410cdd
dec eax
jne 0x410e66
mov edx, dword [esp + 0x1c]
mov ebx, 0x48b4a8
cmp edx, 4
ja 0x410932
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4108f7
mov eax, dword [str.Microsoft_Windows_NT]
mov dword [ecx], eax
mov eax, dword [0x4647a0]
mov dword [ecx + 4], eax
mov eax, dword [0x4647a4]
mov dword [ecx + 8], eax
mov eax, dword [0x4647a8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x4647ac]
mov dword [ecx + 0x10], eax
mov ax, word [0x4647b0]
mov word [ecx + 0x14], ax
mov ebp, dword [esp + 0x20]
cmp edx, 5
jne 0x4109eb
test ebp, ebp
jne 0x410984
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410946
mov eax, dword [str.Microsoft_Windows_2000]
mov dword [ecx], eax
mov eax, dword [0x4647b8]
mov dword [ecx + 4], eax
mov eax, dword [0x4647bc]
mov dword [ecx + 8], eax
mov eax, dword [0x4647c0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x4647c4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x4647c8]
mov dword [ecx + 0x14], eax
jmp 0x410a05
cmp ebp, 1
jne 0x4109cd
lea ecx, [ebx - 1]
lea esp, [esp]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410990
mov eax, dword [str.Microsoft_Windows_XP]
mov dword [ecx], eax
mov eax, dword [0x4647d0]
mov dword [ecx + 4], eax
mov eax, dword [0x4647d4]
mov dword [ecx + 8], eax
mov eax, dword [0x4647d8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x4647dc]
mov dword [ecx + 0x10], eax
mov ax, word [0x4647e0]
mov word [ecx + 0x14], ax
jmp 0x410a05
cmp ebp, 2
jne 0x410a05
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4109d5
mov ecx, 7
mov esi, str.Windows_Server_2003_family
rep movsd dword es:[edi], dword [esi]
jmp 0x410a05
jbe 0x410a05
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4109f0
mov ecx, 6
mov esi, str.Microsoft_Windows_Vista
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 0
je 0x410b3e
mov al, byte [esp + 0x132]
cmp al, 1
jne 0x410a88
test dword [esp + 0x130], 0x200
lea ecx, [ebx - 1]
je 0x410a58
jmp 0x410a30
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410a30
mov eax, dword [str.Personal]
mov dword [ecx], eax
mov eax, dword [0x464820]
mov dword [ecx + 4], eax
mov ax, word [0x464824]
mov word [ecx + 8], ax
jmp 0x410c49
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410a58
mov eax, dword [str.Professional]
mov dword [ecx], eax
mov eax, dword [0x46482c]
mov dword [ecx + 4], eax
mov eax, dword [0x464830]
mov dword [ecx + 8], eax
mov ax, word [0x464834]
mov word [ecx + 0xc], ax
jmp 0x410c49
cmp al, 3
jne 0x410c49
mov eax, dword [esp + 0x130]
lea ecx, [ebx - 1]
test al, al
jns 0x410ae0
mov edi, edi
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410aa0
mov eax, dword [str.DataCenter_Server]
mov dword [ecx], eax
mov eax, dword [0x46483c]
mov dword [ecx + 4], eax
mov eax, dword [0x464840]
mov dword [ecx + 8], eax
mov eax, dword [0x464844]
mov dword [ecx + 0xc], eax
mov ax, word [0x464848]
mov word [ecx + 0x10], ax
mov al, byte [0x46484a]
mov byte [ecx + 0x12], al
jmp 0x410c49
test al, 2
je 0x410b20
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410ae4
mov eax, dword [str.Advanced_Server]
mov dword [ecx], eax
mov eax, dword [0x464850]
mov dword [ecx + 4], eax
mov eax, dword [0x464854]
mov dword [ecx + 8], eax
mov eax, dword [0x464858]
mov dword [ecx + 0xc], eax
mov al, byte [0x46485c]
mov byte [ecx + 0x10], al
jmp 0x410c49
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410b20
mov eax, dword [str.Server]
mov dword [ecx], eax
mov eax, dword [0x464864]
mov dword [ecx + 4], eax
jmp 0x410c49
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x138]
push eax
push 0
push 0
push str.ProductType
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [esp + 0x134]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x410bcb
lea ecx, [ebx - 1]
lea ecx, [ecx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410ba0
mov eax, dword [str.Professional]
mov dword [ecx], eax
mov eax, dword [0x46482c]
mov dword [ecx + 4], eax
mov eax, dword [0x464830]
mov dword [ecx + 8], eax
mov ax, word [0x464834]
mov word [ecx + 0xc], ax
lea eax, [esp + 0x134]
push eax
push str.LANMANNT
call esi
test eax, eax
jne 0x410bfa
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410be1
mov eax, dword [str.Server]
mov dword [ecx], eax
mov eax, dword [0x464864]
mov dword [ecx + 4], eax
lea eax, [esp + 0x134]
push eax
push str.SERVERNT
call esi
test eax, eax
jne 0x410c41
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410c10
mov eax, dword [str.Advanced_Server]
mov dword [ecx], eax
mov eax, dword [0x464850]
mov dword [ecx + 4], eax
mov eax, dword [0x464854]
mov dword [ecx + 8], eax
mov eax, dword [0x464858]
mov dword [ecx + 0xc], eax
mov al, byte [0x46485c]
mov byte [ecx + 0x10], al
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
movzx eax, word [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1dc]
cmp edx, 4
ja 0x410c9a
push ebp
push edx
push str.version__d._d__s__Build__d_
push eax
call fcn.0043a459
lea edx, [esp + 0x1ec]
add esp, 0x18
mov esi, edx
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x410c80
sub edx, esi
dec ebx
lea ebx, [ebx]
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x410c90
jmp 0x410cc8
push str._s__Build__d_
push eax
call fcn.0043a459
lea edx, [esp + 0x1e4]
add esp, 0x10
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x410cb1
sub edx, esi
dec ebx
jmp 0x410cc0
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x410cc0
mov ecx, edx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x410e66
cmp dword [esp + 0x1c], 4
jne 0x410e66
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x410d72
mov ebx, 0x48b4a8
lea ecx, [ebx - 1]
lea esp, [esp]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410d00
mov eax, dword [str.Microsoft_Windows_95]
mov dword [ecx], eax
mov eax, dword [0x464944]
mov dword [ecx + 4], eax
mov eax, dword [0x464948]
mov dword [ecx + 8], eax
mov eax, dword [0x46494c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x464950]
mov dword [ecx + 0x10], eax
movzx eax, word [0x464954]
mov word [ecx + 0x14], ax
mov ax, word [esp + 0x2e]
cmp ax, 0x43
je 0x410d51
cmp ax, 0x42
jne 0x410e66
dec ebx
mov al, byte [ebx + 1]
lea ebx, [ebx + 1]
test al, al
jne 0x410d52
mov eax, dword [str.OSR2]
mov dword [ebx], eax
mov ax, word [0x46495c]
mov word [ebx + 4], ax
jmp 0x410e66
cmp eax, 0xa
jne 0x410dde
mov ebx, 0x48b4a8
lea ecx, [ebx - 1]
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410d80
cmp word [esp + 0x2e], 0x41
mov eax, dword [str.Microsoft_Windows_98]
mov dword [ecx], eax
mov eax, dword [0x464964]
mov dword [ecx + 4], eax
mov eax, dword [0x464968]
mov dword [ecx + 8], eax
mov eax, dword [0x46496c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x464970]
mov dword [ecx + 0x10], eax
mov ax, word [0x464974]
mov word [ecx + 0x14], ax
jne 0x410e66
dec ebx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x410dc8
mov eax, dword [0x464978]
mov edi, ebx
mov dword [edi], eax
jmp 0x410e66
cmp eax, 0x5a
jne 0x410e66
mov ecx, 0x48b4a8
dec ecx
lea ecx, [ecx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410df0
mov eax, dword [str.Microsoft_Windows_Me]
mov dword [ecx], eax
mov eax, dword [0x464980]
mov dword [ecx + 4], eax
mov eax, dword [0x464984]
mov dword [ecx + 8], eax
mov eax, dword [0x464988]
mov dword [ecx + 0xc], eax
mov eax, dword [0x46498c]
mov dword [ecx + 0x10], eax
mov ax, word [0x464990]
mov word [ecx + 0x14], ax
jmp 0x410e66
mov ecx, 0x48b4a8
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x410e33
mov eax, dword [str.Microsoft_Win32s]
mov dword [ecx], eax
mov eax, dword [0x464998]
mov dword [ecx + 4], eax
mov eax, dword [0x46499c]
mov dword [ecx + 8], eax
mov eax, dword [0x4649a0]
mov dword [ecx + 0xc], eax
mov ax, word [0x4649a4]
mov word [ecx + 0x10], ax
mov ecx, dword [esp + 0x3d4]
mov al, 1
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.004396df
add esp, 0x3c8
ret