Function at 0x406eb0
Capabilities:
Check os version
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x40b8
call fcn.004f2630
push ebx
push ebp
push esi
push edi
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x38]
mov dword [esp + 0x34], 0x94
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
xor ebp, ebp
push eax
xor esi, esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x40cc]
mov edi, 2
cmp eax, edi
jne 0x4070b9
mov eax, dword [esp + 0x38]
cmp eax, 5
jae 0x406fec
push eax
push str.This_os_is_nt_4.0_for_server_or_workstation_version::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov ecx, dword [esp + 0x38]
push ecx
push str.dwMajorVersion::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [esp + 0x3c]
mov ecx, 0xf558a0
push edx
push str.dwMinorVersion::
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov eax, dword [esp + 0x40]
mov ecx, 0xf558a0
push eax
push str.dwBuildNumber::
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], 1
cmp eax, edi
jne 0x4070b9
mov eax, dword [esp + 0x38]
cmp eax, 5
jb 0x4073ed
push eax
push str.This_os_is_above__win2000_version::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov ecx, dword [esp + 0x38]
push ecx
push str.dwMajorVersion::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [esp + 0x3c]
mov ecx, 0xf558a0
push edx
push str.dwMinorVersion::
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov eax, dword [esp + 0x40]
mov ecx, 0xf558a0
push eax
push str.dwBuildNumber::
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov eax, dword [esp + 0x44]
mov esi, 1
cmp eax, edi
je 0x40717e
push str.ThisdwMajorVersion_os_is_before_win9X_vesion::
mov ecx, 0xf558a0
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov ecx, dword [esp + 0x38]
push ecx
push str.dwMajorVersion::
mov ecx, 0xf558a0
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [esp + 0x3c]
mov ecx, 0xf558a0
push edx
push str.dwMinorVersion::
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov eax, dword [esp + 0x40]
mov ecx, 0xf558a0
push eax
push str.dwBuildNumber::
call fcn.004f0087
mov ecx, eax
call fcn.004f0509
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
cmp esi, 1
mov dword [esp + 0x1c], 1
jne 0x4073e2
push 0x40
call fcn.004f266a
push 0x100
mov dword [esp + 0x2c], eax
call fcn.004f266a
add esp, 8
lea ecx, [esp + 0x14]
xor edi, edi
mov ebp, eax
push ecx
push 8
push edi
push 0xc30c0c
push reloc.WS2_32.dll_closesocket
mov dword [esp + 0x40], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40733f
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea edx, [esp + 0x3c]
push 0
push edx
push ebp
push edi
push eax
mov dword [esp + 0x50], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, 0x103
je 0x40726a
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 8
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40725f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer_
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407254
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push eax
push ecx
push 0
push str.Logon_User_Name
push edx
mov dword [esp + 0x40], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40727c
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
cmp esi, 0x103
je 0x4073d5
jmp 0x4071c2
mov edi, dword [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x40cc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov ecx, 0xf558a0
push eax
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebx]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add edx, 0x100
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
add ecx, 0x100
push ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0x40b8
ret
mov edi, str.NO_LOGIN
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov ecx, 0xf558a0
push eax
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebx]
mov edi, str..DEFAULT
or ecx, 0xffffffff
xor eax, eax
add edx, 0x100
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
add ecx, 0x100
push ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
cmp dword [esp + 0x20], 1
jne 0x40751c
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc8]
push eax
push ecx
mov dword [esp + 0x18], ebp
call fcn.00406d40
mov eax, dword [esp + 0x18]
add esp, 8
cmp eax, 1
jle 0x407486
shl eax, 6
lea edx, [esp + eax + 0x88]
push edx
call fcn.004fa6c0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
push ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [esp + 0x10]
shl edx, 6
lea eax, [esp + edx + 0x88]
push eax
call fcn.004fa6c0
mov edx, dword [ebx]
add esp, 4
add edx, 0x100
mov edi, eax
jmp 0x4074d7
mov edi, str..DEFAULT
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov ecx, 0xf558a0
push eax
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebx]
mov edi, str..DEFAULT
add edx, 0x100
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
add ecx, 0x100
push ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
cmp dword [esp + 0x1c], 1
jne 0x40770e
lea edx, [esp + 0x10]
lea eax, [esp + 0xc8]
push edx
push eax
mov dword [esp + 0x18], ebp
call fcn.00406d40
mov eax, dword [esp + 0x18]
add esp, 8
cmp eax, 1
jle 0x407678
shl eax, 6
lea ecx, [esp + eax + 0x88]
push ecx
call fcn.004fa6c0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov ecx, 0xf558a0
push eax
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov ecx, dword [esp + 0x10]
shl ecx, 6
lea edx, [esp + ecx + 0x88]
push edx
call fcn.004fa6c0
mov edx, dword [ebx]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
add edx, 0x100
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
add ecx, 0x100
push ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebx]
push str.software
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x40770e
mov edi, str..DEFAULT
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx]
mov edi, str..DEFAULT
or ecx, 0xffffffff
add edx, 0x100
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40b8
ret
mov edi, str..DEFAULT
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov ecx, 0xf558a0
push eax
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebx]
mov edi, str..DEFAULT
or ecx, 0xffffffff
xor eax, eax
add edx, 0x100
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
add ecx, 0x100
push ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0x402150
push 0xa
mov ecx, eax
call fcn.004eff40
mov ecx, eax
call fcn.004016a0
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0x40b8
ret