Function at 0x422531
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x154]
sub esp, 0x1d4
mov eax, dword [0x597790]
xor eax, ebp
mov dword [ebp + 0x150], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, str.unknown
push esi
mov dword [ebp - 0x54], edi
call fcn.00401732
lea ecx, [edi + 4]
push esi
mov dword [ebp - 0x50], ecx
call fcn.00401732
lea ecx, [edi + 8]
push esi
mov dword [ebp - 0x5c], ecx
call fcn.00401732
lea ebx, [ebp - 0x58]
lea edi, [ebp - 0x4c]
call fcn.004224b3
test eax, eax
je 0x422997
lea esi, [ebp - 0x80]
call fcn.004224f9
mov eax, dword [ebp - 0x3c]
xor edi, edi
sub eax, edi
je 0x422967
dec eax
je 0x4228d5
dec eax
jne 0x422997
cmp dword [ebp - 0x48], 6
push 5
pop esi
jne 0x4225ff
cmp dword [ebp - 0x44], 1
jne 0x4225dc
cmp byte [ebp + 0x4e], 1
mov ecx, dword [ebp - 0x54]
jne 0x4225cc
push str.Microsoft_Windows_Seven
jmp 0x4225d1
push str.Windows_Server_2008_R2
call fcn.00401732
cmp dword [ebp - 0x48], 6
jne 0x4225ff
cmp dword [ebp - 0x44], edi
jne 0x422680
cmp byte [ebp + 0x4e], 1
mov ecx, dword [ebp - 0x54]
jne 0x4225f5
push str.Microsoft_Windows_Vista
jmp 0x4225fa
push str.Windows_Server_2008
call fcn.00401732
cmp dword [ebp - 0x48], esi
jne 0x42266d
cmp dword [ebp - 0x44], 2
jne 0x422643
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x42261d
push str.Microsoft_Windows_Server_2003__R2_
jmp 0x422636
cmp byte [ebp + 0x4e], 1
jne 0x422631
cmp word [ebp - 0x80], 9
jne 0x422631
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x422636
push str.Microsoft_Windows_Server_2003
mov ecx, dword [ebp - 0x54]
call fcn.00401732
cmp dword [ebp - 0x48], esi
jne 0x42266d
cmp dword [ebp - 0x44], 1
jne 0x42265b
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_XP
call fcn.00401732
cmp dword [ebp - 0x48], esi
jne 0x42266d
cmp dword [ebp - 0x44], edi
jne 0x422680
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_2000
call fcn.00401732
cmp dword [ebp - 0x48], 4
ja 0x422680
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_NT
call fcn.00401732
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x58], edi
je 0x4227c7
cmp byte [ebp + 0x4e], 1
jne 0x4226d0
cmp word [ebp - 0x80], 9
je 0x42286e
cmp dword [ebp - 0x48], 4
mov ecx, dword [ebp - 0x50]
jne 0x4226b3
push str.Workstation_4.0
jmp 0x4227bd
test dword [ebp + 0x4c], 0x200
je 0x4226c6
push str.Home_Edition
jmp 0x4227bd
push str.Professional
jmp 0x4227bd
cmp byte [ebp + 0x4e], 3
je 0x4226e0
cmp byte [ebp + 0x4e], 2
jne 0x42286e
cmp dword [ebp - 0x48], esi
jne 0x4227a8
cmp dword [ebp - 0x44], 2
jne 0x42277f
cmp word [ebp - 0x80], 6
jne 0x422718
test byte [ebp + 0x4c], 0x80
je 0x422707
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x422751
test byte [ebp + 0x4c], 2
je 0x4228c2
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x422751
cmp word [ebp - 0x80], 9
jne 0x422746
test byte [ebp + 0x4c], 0x80
mov ecx, dword [ebp - 0x50]
je 0x422732
push str.Datacenter_x64_Edition
jmp 0x4227bd
test byte [ebp + 0x4c], 2
je 0x42273f
push str.Enterprise_x64_Edition
jmp 0x4227bd
push str.Standard_x64_Edition
jmp 0x4227bd
test byte [ebp + 0x4c], 0x80
je 0x422756
push str.Datacenter_Edition
mov ecx, dword [ebp - 0x50]
jmp 0x4227bd
test byte [ebp + 0x4c], 2
mov ecx, dword [ebp - 0x50]
je 0x422766
push str.Enterprise_Edition
jmp 0x4227bd
mov eax, 0x400
cmp word [ebp + 0x4c], ax
jne 0x422778
push str.Web_Edition
jmp 0x4227bd
push str.Standard_Edition
jmp 0x4227bd
cmp dword [ebp - 0x44], edi
jne 0x4227a8
test byte [ebp + 0x4c], 0x80
mov ecx, dword [ebp - 0x50]
je 0x422794
push str.Datacenter_Server
jmp 0x4227bd
test byte [ebp + 0x4c], 2
je 0x4227a1
push str.Advanced_Server
jmp 0x4227bd
push str.Server
jmp 0x4227bd
test byte [ebp + 0x4c], 2
mov ecx, dword [ebp - 0x50]
je 0x4227b8
push str.Server_4.0__Enterprise_Edition
jmp 0x4227bd
push str.Server_4.0
call fcn.00401732
jmp 0x42286e
lea eax, [ebp - 0x54]
push eax
push 1
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
mov esi, 0x100
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x58], esi
call ebx
test eax, eax
jne 0x422856
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + 0x50]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x54]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x422856
cmp dword [ebp - 0x58], esi
ja 0x422856
lea eax, [ebp + 0x50]
push eax
push str.LANMANNT
call fcn.004f55ed
pop ecx
pop ecx
test eax, eax
jne 0x422835
mov ecx, dword [ebp - 0x50]
push str.Server
call fcn.00401732
lea eax, [ebp + 0x50]
push eax
push str.SERVERNT
call fcn.004f55ed
pop ecx
pop ecx
test eax, eax
jne 0x422856
mov ecx, dword [ebp - 0x50]
push str.Advanced_Server
call fcn.00401732
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push str._d._d
push dword [ebp - 0x5c]
call fcn.00404420
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x48], 4
jne 0x4228c2
lea eax, [ebp - 0x38]
push str.Service_Pack_6
push eax
call fcn.004f55ed
pop ecx
pop ecx
test eax, eax
jne 0x4228c2
lea eax, [ebp - 0x58]
push eax
push 1
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
movzx eax, word [ebp - 0x40]
push eax
jne 0x4228c7
push str.Service_Pack_6a__Build__d_
push dword [ebp - 0x5c]
call fcn.00404420
add esp, 0xc
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x422997
movzx eax, word [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
push str._s__Build__d_
jmp 0x42298c
cmp dword [ebp - 0x48], 4
jne 0x422981
mov esi, 0x53e9ff
cmp dword [ebp - 0x44], edi
jne 0x422918
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_95
call fcn.00401732
cmp byte [ebp - 0x37], 0x43
je 0x422905
cmp byte [ebp - 0x37], 0x42
je 0x422905
push esi
jmp 0x42290a
push str.OSR2
mov ecx, dword [ebp - 0x50]
call fcn.00401732
cmp dword [ebp - 0x48], 4
jne 0x422981
cmp dword [ebp - 0x44], 0xa
jne 0x42294d
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_98
call fcn.00401732
cmp byte [ebp - 0x37], 0x41
je 0x42293a
cmp byte [ebp - 0x37], 0x42
je 0x42293a
push esi
jmp 0x42293f
push 0x545d70
mov ecx, dword [ebp - 0x50]
call fcn.00401732
cmp dword [ebp - 0x48], 4
jne 0x422981
cmp dword [ebp - 0x44], 0x5a
jne 0x422981
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Windows_ME
call fcn.00401732
push str.Millennium_Edition
jmp 0x422979
mov ecx, dword [ebp - 0x54]
push str.Microsoft_Win32s
call fcn.00401732
push 0x53e9ff
mov ecx, dword [ebp - 0x50]
call fcn.00401732
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push str._d._d
push dword [ebp - 0x5c]
call fcn.00404420
add esp, 0x10
mov ecx, dword [ebp + 0x150]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4e9c
add ebp, 0x154
leave
ret