Function at 0x4116a2
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1ec
mov eax, dword [0x4431c0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
push 9
pop ecx
xor eax, eax
mov esi, 0x11c
push esi
lea edi, [ebp - 0x174]
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x148]
push eax
call fcn.0041c7e0
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
mov dword [ebp - 0x148], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4116fb
xor eax, eax
inc eax
jmp 0x411ae2
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411723
lea ecx, [ebp - 0x174]
push ecx
call eax
jmp 0x411730
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x138], 2
jne 0x411ad5
cmp dword [ebp - 0x144], 4
jbe 0x411ad5
mov esi, 0x100
push SysReAllocString
mov eax, str.Microsoft
mov ecx, esi
mov edx, ebx
call fcn.004011b1
cmp dword [ebp - 0x144], 6
jne case.0x4117f8.5
cmp dword [ebp - 0x140], 0
jne 0x411792
cmp byte [ebp - 0x2e], 1
mov ecx, esi
jne 0x411787
push str.Windows_Vista
jmp 0x41178c
push str.Windows_Server_2008
push ebx
call fcn.004010b3
cmp dword [ebp - 0x140], 1
jne 0x4117b5
cmp byte [ebp - 0x2e], 1
mov ecx, esi
jne 0x4117aa
push str.Windows_7
jmp 0x4117af
push str.Windows_Server_2008_R2
push ebx
call fcn.004010b3
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x14c]
push ecx
push 0
push 0
push dword [ebp - 0x140]
push dword [ebp - 0x144]
call eax
mov eax, dword [ebp - 0x14c]
cmp eax, 0xa
ja 0x41183d
je case.0x4117f8.4
dec eax
cmp eax, 8
ja case.0x4117f8.5
jmp dword [eax*4 + 0x411af6]
push str.Ultimate_Edition
jmp 0x411895
push str.Home_Premium_Edition
jmp 0x411895
push str.Home_Basic_Edition
jmp 0x411895
push str.Enterprise_Edition
jmp 0x411895
push str.Business_Edition
jmp 0x411895
push str.Datacenter_Edition
jmp 0x411895
push str.Small_Business_Server
jmp 0x411895
push str.Standard_Edition
jmp 0x411895
cmp eax, 0xf
ja 0x411875
je 0x41186e
sub eax, 0xb
je 0x411867
dec eax
je 0x411860
dec eax
je 0x411859
dec eax
jne case.0x4117f8.5
push str.Enterprise_Edition__core_installation_
jmp 0x411895
push str.Standard_Edition__core_installation_
jmp 0x411895
push str.Datacenter_Edition__core_installation_
jmp 0x411895
push str.Starter_Edition
jmp 0x411895
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x411895
sub eax, 0x11
je 0x411890
dec eax
je 0x411889
sub eax, 7
jne case.0x4117f8.5
push str.Small_Business_Server_Premium_Edition
jmp 0x411895
push str.Cluster_Server_Edition
jmp 0x411895
push str.Web_Server_Edition
push ebx
mov ecx, esi
call fcn.004010b3
cmp dword [ebp - 0x144], 5
jne 0x411a3f
cmp dword [ebp - 0x140], 2
jne 0x4119bc
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4118ca
push str.Windows_Server_2003_R2_
jmp 0x41190a
mov eax, 0x2000
cmp word [ebp - 0x30], ax
jne 0x4118dc
push str.Windows_Storage_Server_2003
jmp 0x41190a
mov eax, 0x8000
cmp word [ebp - 0x30], ax
jne 0x4118ee
push str.Windows_Home_Server
jmp 0x41190a
cmp byte [ebp - 0x2e], 1
jne 0x411905
cmp word [ebp - 0x174], 9
jne 0x411905
push str.Windows_XP_Professional_x64_Edition
jmp 0x41190a
push str.Windows_Server_2003_
push ebx
mov ecx, esi
call fcn.004010b3
cmp byte [ebp - 0x2e], 1
je 0x4119af
cmp word [ebp - 0x174], 6
jne 0x411940
test byte [ebp - 0x30], 0x80
je 0x411933
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x4119a7
test byte [ebp - 0x30], 2
je 0x4119af
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x4119a7
cmp word [ebp - 0x174], 9
jne 0x41196d
test byte [ebp - 0x30], 0x80
je 0x411957
push str.Datacenter_x64_Edition
jmp 0x4119a7
test byte [ebp - 0x30], 2
mov ecx, esi
je 0x411966
push str.Enterprise_x64_Edition
jmp 0x4119a9
push str.Standard_x64_Edition
jmp 0x4119a9
mov eax, dword [ebp - 0x30]
test eax, 0x4000
je 0x41197e
push str.Compute_Cluster_Edition
jmp 0x4119a7
test al, al
jns 0x411989
push str.Datacenter_Edition
jmp 0x4119a7
test al, 2
je 0x411994
push str.Enterprise_Edition
jmp 0x4119a7
test eax, 0x400
je 0x4119a2
push str.Web_Edition
jmp 0x4119a7
push str.Standard_Edition
mov ecx, esi
push ebx
call fcn.004010b3
cmp dword [ebp - 0x144], 5
jne 0x411a3f
cmp dword [ebp - 0x140], 1
mov edi, str.Professional
jne 0x4119f9
push str.Windows_XP
push ebx
mov ecx, esi
call fcn.004010b3
test dword [ebp - 0x30], 0x200
mov ecx, esi
je 0x4119e9
push str.Home_Edition
jmp 0x4119ea
push edi
push ebx
call fcn.004010b3
cmp dword [ebp - 0x144], 5
jne 0x411a3f
cmp dword [ebp - 0x140], 0
jne 0x411a3f
push str.Windows_2000
push ebx
mov ecx, esi
call fcn.004010b3
cmp byte [ebp - 0x2e], 1
jne 0x411a18
push edi
jmp 0x411a37
test byte [ebp - 0x30], 0x80
je 0x411a25
push str.Datacenter_Server
jmp 0x411a37
test byte [ebp - 0x30], 2
je 0x411a32
push str.Advanced_Server
jmp 0x411a37
push str.Server
push ebx
mov ecx, esi
call fcn.004010b3
lea eax, [ebp - 0x134]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x411a48
sub eax, edx
sar eax, 1
je 0x411a74
push 0x43a6e8
push ebx
mov ecx, esi
call fcn.004010b3
lea eax, [ebp - 0x134]
push eax
push ebx
mov ecx, esi
call fcn.004010b3
push dword [ebp - 0x13c]
lea edi, [ebp - 0x2c]
push str.__build__d_
push 0x50
pop ecx
call fcn.00401164
pop ecx
pop ecx
mov eax, edi
push eax
push ebx
mov ecx, esi
call fcn.004010b3
cmp dword [ebp - 0x144], 6
jb 0x4116f3
cmp word [ebp - 0x174], 9
jne 0x411ab5
push str.__64_bit
jmp 0x411ac8
cmp word [ebp - 0x174], 0
jne 0x4116f3
push str.__32_bit
push ebx
mov ecx, esi
call fcn.004010b3
jmp 0x4116f3
push str.This_sample_does_not_support_this_version_of_Windows._n
call fcn.0041c1f3
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.004195bf
add ebp, 0x78
leave
ret