Function at 0x41f570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x124
mov eax, dword [0x56d790]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, str.unknown
push esi
mov dword [ebp - 0x80], edi
call fcn.00401732
lea ecx, [edi + 4]
push esi
mov dword [ebp - 0x7c], ecx
call fcn.00401732
lea ecx, [edi + 8]
push esi
mov dword [ebp - 0x88], ecx
call fcn.00401732
lea ebx, [ebp - 0x84]
lea edi, [ebp - 0x78]
call fcn.0041f4f2
test eax, eax
je 0x41f9fe
lea esi, [ebp - 0xac]
call fcn.0041f538
mov eax, dword [ebp - 0x68]
xor edi, edi
sub eax, edi
je 0x41f9cb
dec eax
je 0x41f939
dec eax
jne 0x41f9fe
cmp dword [ebp - 0x74], 6
push 5
pop esi
jne 0x41f641
cmp dword [ebp - 0x70], 1
jne 0x41f61e
cmp byte [ebp + 0x22], 1
mov ecx, dword [ebp - 0x80]
jne 0x41f60e
push str.Microsoft_Windows_Seven
jmp 0x41f613
push str.Windows_Server_2008_R2
call fcn.00401732
cmp dword [ebp - 0x74], 6
jne 0x41f641
cmp dword [ebp - 0x70], edi
jne 0x41f6c5
cmp byte [ebp + 0x22], 1
mov ecx, dword [ebp - 0x80]
jne 0x41f637
push str.Microsoft_Windows_Vista
jmp 0x41f63c
push str.Windows_Server_2008
call fcn.00401732
cmp dword [ebp - 0x74], esi
jne 0x41f6b2
cmp dword [ebp - 0x70], 2
jne 0x41f688
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x41f65f
push str.Microsoft_Windows_Server_2003__R2_
jmp 0x41f67b
cmp byte [ebp + 0x22], 1
jne 0x41f676
cmp word [ebp - 0xac], 9
jne 0x41f676
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x41f67b
push str.Microsoft_Windows_Server_2003
mov ecx, dword [ebp - 0x80]
call fcn.00401732
cmp dword [ebp - 0x74], esi
jne 0x41f6b2
cmp dword [ebp - 0x70], 1
jne 0x41f6a0
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_XP
call fcn.00401732
cmp dword [ebp - 0x74], esi
jne 0x41f6b2
cmp dword [ebp - 0x70], edi
jne 0x41f6c5
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_2000
call fcn.00401732
cmp dword [ebp - 0x74], 4
ja 0x41f6c5
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_NT
call fcn.00401732
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x84], edi
je 0x41f818
cmp byte [ebp + 0x22], 1
jne 0x41f71b
cmp word [ebp - 0xac], 9
je 0x41f8c9
cmp dword [ebp - 0x74], 4
mov ecx, dword [ebp - 0x7c]
jne 0x41f6fe
push str.Workstation_4.0
jmp 0x41f80e
test dword [ebp + 0x20], 0x200
je 0x41f711
push str.Home_Edition
jmp 0x41f80e
push str.Professional
jmp 0x41f80e
cmp byte [ebp + 0x22], 3
je 0x41f72b
cmp byte [ebp + 0x22], 2
jne 0x41f8c9
cmp dword [ebp - 0x74], esi
jne 0x41f7f9
cmp dword [ebp - 0x70], 2
jne 0x41f7d0
cmp word [ebp - 0xac], 6
jne 0x41f766
test byte [ebp + 0x20], 0x80
je 0x41f755
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x41f7a2
test byte [ebp + 0x20], 2
je 0x41f926
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x41f7a2
cmp word [ebp - 0xac], 9
jne 0x41f797
test byte [ebp + 0x20], 0x80
mov ecx, dword [ebp - 0x7c]
je 0x41f783
push str.Datacenter_x64_Edition
jmp 0x41f80e
test byte [ebp + 0x20], 2
je 0x41f790
push str.Enterprise_x64_Edition
jmp 0x41f80e
push str.Standard_x64_Edition
jmp 0x41f80e
test byte [ebp + 0x20], 0x80
je 0x41f7a7
push str.Datacenter_Edition
mov ecx, dword [ebp - 0x7c]
jmp 0x41f80e
test byte [ebp + 0x20], 2
mov ecx, dword [ebp - 0x7c]
je 0x41f7b7
push str.Enterprise_Edition
jmp 0x41f80e
mov eax, 0x400
cmp word [ebp + 0x20], ax
jne 0x41f7c9
push str.Web_Edition
jmp 0x41f80e
push str.Standard_Edition
jmp 0x41f80e
cmp dword [ebp - 0x70], edi
jne 0x41f7f9
test byte [ebp + 0x20], 0x80
mov ecx, dword [ebp - 0x7c]
je 0x41f7e5
push str.Datacenter_Server
jmp 0x41f80e
test byte [ebp + 0x20], 2
je 0x41f7f2
push str.Advanced_Server
jmp 0x41f80e
push str.Server
jmp 0x41f80e
test byte [ebp + 0x20], 2
mov ecx, dword [ebp - 0x7c]
je 0x41f809
push str.Server_4.0__Enterprise_Edition
jmp 0x41f80e
push str.Server_4.0
call fcn.00401732
jmp 0x41f8c9
push 0x50
pop esi
lea eax, [ebp - 0x80]
push eax
push 1
push edi
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x84], esi
call ebx
test eax, eax
jne 0x41f8ae
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp + 0x24]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x80]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x41f8ae
cmp dword [ebp - 0x84], esi
ja 0x41f8ae
lea eax, [ebp + 0x24]
push eax
push str.LANMANNT
call fcn.004dd96d
pop ecx
pop ecx
test eax, eax
jne 0x41f88d
mov ecx, dword [ebp - 0x7c]
push str.Server
call fcn.00401732
lea eax, [ebp + 0x24]
push eax
push str.SERVERNT
call fcn.004dd96d
pop ecx
pop ecx
test eax, eax
jne 0x41f8ae
mov ecx, dword [ebp - 0x7c]
push str.Advanced_Server
call fcn.00401732
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push str._d._d
push dword [ebp - 0x88]
call fcn.004042ff
add esp, 0x10
xor edi, edi
cmp dword [ebp - 0x74], 4
jne 0x41f926
lea eax, [ebp - 0x64]
push str.Service_Pack_6
push eax
call fcn.004dd96d
pop ecx
pop ecx
test eax, eax
jne 0x41f926
lea eax, [ebp - 0x84]
push eax
push 1
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
movzx eax, word [ebp - 0x6c]
push eax
jne 0x41f92b
push str.Service_Pack_6a__Build__d_
push dword [ebp - 0x88]
call fcn.004042ff
add esp, 0xc
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41f9fe
movzx eax, word [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push str._s__Build__d_
jmp 0x41f9f0
cmp dword [ebp - 0x74], 4
jne 0x41f9e5
mov esi, 0x51d067
cmp dword [ebp - 0x70], edi
jne 0x41f97c
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_95
call fcn.00401732
cmp byte [ebp - 0x63], 0x43
je 0x41f969
cmp byte [ebp - 0x63], 0x42
je 0x41f969
push esi
jmp 0x41f96e
push str.OSR2
mov ecx, dword [ebp - 0x7c]
call fcn.00401732
cmp dword [ebp - 0x74], 4
jne 0x41f9e5
cmp dword [ebp - 0x70], 0xa
jne 0x41f9b1
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_98
call fcn.00401732
cmp byte [ebp - 0x63], 0x41
je 0x41f99e
cmp byte [ebp - 0x63], 0x42
je 0x41f99e
push esi
jmp 0x41f9a3
push 0x523e50
mov ecx, dword [ebp - 0x7c]
call fcn.00401732
cmp dword [ebp - 0x74], 4
jne 0x41f9e5
cmp dword [ebp - 0x70], 0x5a
jne 0x41f9e5
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Windows_ME
call fcn.00401732
push str.Millennium_Edition
jmp 0x41f9dd
mov ecx, dword [ebp - 0x80]
push str.Microsoft_Win32s
call fcn.00401732
push 0x51d067
mov ecx, dword [ebp - 0x7c]
call fcn.00401732
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push str._d._d
push dword [ebp - 0x88]
call fcn.004042ff
add esp, 0x10
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dd215
add ebp, 0x78
leave
ret