Function at 0x41b9c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e6dc
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x495580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
movzx esi, cx
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x154], eax
call fcn.00438f3a
push ecx
mov edx, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x168]
call fcn.004141b0
add esp, 4
test al, al
jne 0x41ba42
mov dword [ebp - 4], 0xffffffff
jmp 0x41baac
mov edx, dword [ebp - 0x160]
xor esi, esi
mov edi, dword [ebp - 0x164]
mov ecx, 0x1000
xor eax, eax
test edx, edx
jle 0x41ba8b
nop dword [eax + eax]
test eax, eax
js 0x41bd2f
cmp eax, edx
jge 0x41bd2f
mov ecx, dword [edi + eax*4]
shr ecx, 0x10
and ecx, 0xfff
cmp cx, si
je 0x41ba86
inc eax
cmp eax, edx
jl 0x41ba60
mov ecx, 0x1000
cmp eax, edx
je 0x41ba95
inc esi
cmp si, cx
jb 0x41ba55
mov eax, 0xfff
cmp si, ax
jbe 0x41bb04
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x128]
lea ecx, [ebp - 0x168]
call fcn.00438f51
test ebx, ebx
je 0x41bafd
mov edx, esi
lea ecx, [ebp - 0x128]
call fcn.0041a330
mov dword [ebp - 4], 1
push dword [eax]
push str.Could_not_find_a_free_KLID_for_language__s_r_n_r_nAs_a_workaround__try_removing_one_or_more_existing_layouts_for_this_language
push ebx
call fcn.00403530
mov edx, dword [ebp - 0x128]
add esp, 0xc
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41bafd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
jmp 0x41bd13
and esi, eax
lea ecx, [ebp - 0x168]
mov eax, dword [ebp - 0x128]
or esi, 0xffffb000
movzx eax, ax
shl esi, 0x10
or esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00438f51
lea ecx, [ebp - 0x148]
call fcn.00413220
mov dword [ebp - 4], 2
mov dword [ebp - 0x148], esi
mov esi, dword [ebp - 0x14c]
mov byte [ebp - 0x144], 1
test esi, esi
jne 0x41bb59
xor ecx, ecx
jmp 0x41bb6f
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41bb60
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x140]
call fcn.00403e20
mov esi, dword [ebp - 0x12c]
test esi, esi
jne 0x41bb8a
xor ecx, ecx
jmp 0x41bb9f
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41bb90
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x13c]
call fcn.00403e20
mov eax, dword [ebp - 0x148]
shr eax, 0x10
mov dword [ebp - 0x138], 0xffffffff
test eax, eax
je 0x41bc79
push pe_nt_image_headers32
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0044cff0
add esp, 0xc
mov dword [ebp - 0x124], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 6
jne 0x41bc4b
cmp dword [ebp - 0x11c], 2
jb 0x41bc4d
lea ecx, [ebp - 0x134]
call fcn.0041b470
test al, al
jne 0x41bc85
test ebx, ebx
je 0x41bcee
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x148]
call fcn.004133e0
mov byte [ebp - 4], 3
push dword [eax]
push str.Cannot_allocate_Id_for_the_new_layout__s
push ebx
call fcn.00403530
mov edx, dword [ebp - 0x12c]
jmp 0x41bcd3
ja 0x41bc06
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x128], 0
call fcn.004142d0
test al, al
je 0x41bc15
mov eax, dword [ebp - 0x128]
mov ecx, 0xfffe
cmp ax, cx
jae 0x41bc15
inc eax
jmp 0x41bc7e
mov eax, 0xffff
mov word [ebp - 0x134], ax
push 0
push 0x4792ac
lea ecx, [ebp - 0x130]
call fcn.00403e20
lea ecx, [ebp - 0x148]
call fcn.004145f0
test al, al
jne 0x41bcf2
test ebx, ebx
je 0x41bcee
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x148]
call fcn.004133e0
mov byte [ebp - 4], 4
push dword [eax]
push str.Cannot_create_new_layout___registry_entry_for__s_could_not_be_added._r_n_r_nThis_is_commonly_caused_by_interference_from_anti_virus_software.
push ebx
call fcn.00403530
mov edx, dword [ebp - 0x150]
or eax, 0xffffffff
add edx, 0xfffffff0
add esp, 0xc
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41bcee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor bl, bl
jmp 0x41bd06
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x148]
push eax
call fcn.00413380
mov bl, 1
lea ecx, [ebp - 0x148]
call fcn.00413320
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae3d
mov esp, ebp
pop ebp
ret
call fcn.00436600
int3