Function at 0x401edb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
mov esi, 0x9c
push edi
lea eax, [ebp - 0xa8]
push esi
push eax
call fcn.0040e664
pop ecx
lea eax, [ebp - 0xa8]
pop ecx
mov dword [ebp - 0xa8], esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
push eax
call esi
xor ebx, ebx
mov edi, eax
cmp eax, ebx
jne 0x401f33
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], 0x94
push eax
call esi
cmp eax, ebx
je 0x4021cf
mov eax, 0x414444
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x98]
dec eax
je 0x40214a
dec eax
jne 0x401f6e
cmp dword [ebp - 0xa4], 3
jne 0x401fab
cmp dword [ebp - 0xa0], 0x33
jne 0x40210b
mov dword [ebp - 4], str.Microsoft_Windows_NT_3.51
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x9c]
and eax, 0xffff
push eax
push dword [ebp - 0xa0]
push dword [ebp - 0xa4]
push dword [ebp - 0xc]
push dword [ebp - 4]
push str._s__sversion__d._d._d__s
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
mov al, 1
jmp 0x4021df
cmp dword [ebp - 0xa4], 4
jne 0x4020e1
push ebx
push str.ProductType
mov esi, 0x80000002
push str.SYSTEMCurrentControlSetControlProductOptions
push esi
mov dword [ebp - 4], str.Microsoft_Windows_NT_4.0
call fcn.0040deaf
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x402028
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
push ebx
push str.WINNT
call edi
test eax, eax
jne 0x401ff9
mov dword [ebp - 0xc], str.Workstation
jmp 0x402021
push ebx
push str.SERVERNT
call edi
test eax, eax
jne 0x40200e
mov dword [ebp - 0xc], str.Server
jmp 0x402021
push ebx
push str.LANMANNT
call edi
test eax, eax
jne 0x402021
mov dword [ebp - 0xc], str.Server___Domain_controller
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push 0
push str.CSDVersion
push str.SYSTEMCurrentControlSetControlWindows
push esi
call fcn.0040deaf
mov edi, eax
add esp, 0x10
test edi, edi
je 0x401f6e
mov eax, dword [edi]
cmp eax, 0x100
je 0x4020cc
cmp eax, 0x200
je 0x4020c3
cmp eax, 0x300
je 0x4020ba
cmp eax, 0x400
je 0x4020b1
cmp eax, 0x500
je 0x4020a8
cmp eax, 0x600
jne 0x4020d3
push 0
push str.Installed
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push esi
mov dword [ebp - 8], str.Service_Pack_6
call fcn.0040deaf
add esp, 0x10
test eax, eax
je 0x4020d3
cmp dword [eax], 1
jne 0x40209f
mov dword [ebp - 8], str._Service_Pack_6a_
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
jmp 0x4020d3
mov dword [ebp - 8], str.Service_Pack_5
jmp 0x4020d3
mov dword [ebp - 8], str.Service_Pack_4
jmp 0x4020d3
mov dword [ebp - 8], str.Service_Pack_3
jmp 0x4020d3
mov dword [ebp - 8], str.Service_Pack_2
jmp 0x4020d3
mov dword [ebp - 8], str.Service_Pack_1
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
xor ebx, ebx
jmp 0x4021be
cmp dword [ebp - 0xa4], 5
jne 0x40210b
cmp dword [ebp - 0xa0], ebx
jne 0x4020fb
mov dword [ebp - 4], str.Microsoft_Windows_2000
jmp 0x40210b
cmp dword [ebp - 0xa0], 1
jne 0x40210b
mov dword [ebp - 4], str.Microsoft_Windows_XP
cmp edi, ebx
je 0x401f6e
cmp byte [ebp - 0xe], 1
jne 0x402125
mov dword [ebp - 0xc], str.Professional
jmp 0x401f6e
cmp byte [ebp - 0xe], 2
jne 0x402137
mov dword [ebp - 0xc], str.Domain_controller
jmp 0x401f6e
cmp byte [ebp - 0xe], 3
jne 0x401f6e
mov dword [ebp - 0xc], str.Server
jmp 0x4021be
cmp dword [ebp - 0xa4], 4
jne 0x401f6e
cmp dword [ebp - 0xa0], ebx
jne 0x402180
cmp byte [ebp - 0x93], 0x43
jne 0x402174
mov dword [ebp - 4], str.Microsoft_Windows_95_OSR2
jmp 0x401f6e
mov dword [ebp - 4], str.Microsoft_Windows_95
jmp 0x401f6e
cmp dword [ebp - 0xa0], 0xa
jne 0x4021aa
cmp byte [ebp - 0x93], 0x41
jne 0x40219e
mov dword [ebp - 4], str.Microsoft_Windows_98_SE
jmp 0x401f6e
mov dword [ebp - 4], str.Microsoft_Windows_98
jmp 0x401f6e
cmp dword [ebp - 0xa0], 0x5a
jne 0x401f6e
mov dword [ebp - 4], str.Microsoft_Windows_Me
cmp dword [ebp - 8], ebx
je 0x401f6e
push dword [ebp - 8]
jmp 0x401f75
push 0x414444
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4