Function at 0x401390
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x46706c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x128], eax
mov esi, edx
test edi, edi
je 0x4016fd
test esi, esi
je 0x4016fd
test eax, eax
je 0x4016fd
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x454150
push edi
call ebx
lea eax, [ebp - 0x118]
mov dword [esi], 0
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40140b
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
movzx ecx, word [ebp - reloc.advapi32.dll_SetKernelObjectSecurity]
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 0x114]
push ecx
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x110]
push eax
push edx
push str._u._u._u
push dword [ebp - 0x128]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], ecx
call fcn.00401370
mov eax, dword [ebp - 0x12c]
add esp, 0x14
cmp eax, 1
jne 0x4015cf
cmp dword [ebp - 0x124], 4
jne 0x4016e7
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x120]
cmp ecx, 0xa
jae 0x40150f
cmp edx, 0x3b6
jne 0x4014af
push str.Windows_95
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 1
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
lea eax, [edx - 0x3b7]
cmp eax, 0x81
ja 0x4014e0
push str.Windows_95_SP1
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 2
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
cmp edx, 0x438
jbe 0x40150c
push str.Windows_95_OSR2
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 3
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
cmp ecx, 0xa
jne 0x4015a2
cmp edx, 0x7ce
jne 0x401541
push str.Windows_98
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 4
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
lea eax, [edx - 0x7cf]
cmp eax, 0xb7
ja 0x401572
push str.Windows_98_SP1
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 5
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
cmp edx, 0x887
jb 0x4016e7
push str.Windows_98_SE
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 6
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
cmp ecx, 0x5a
jne 0x4016e7
push str.Windows_ME
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 7
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x4016d4
mov eax, dword [ebp - 0x124]
cmp eax, 3
jne 0x401614
cmp dword [ebp - 0x11c], 0x33
jne 0x4016e7
push str.Windows_NT_3.51
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 0x65
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
cmp eax, 4
jne 0x40164b
mov ecx, dword [ebp - 0x11c]
test ecx, ecx
jne 0x4016e7
push str.Windows_NT_4
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 0x66
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x4016e7
mov eax, dword [ebp - 0x11c]
test eax, eax
jne 0x401682
push str.Windows_2000
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 0x67
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x4016ab
push str.Windows_XP
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 0x68
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x4016e7
push str.Windows_2003_Server
push edi
call ebx
pop ebx
pop edi
mov dword [esi], 0x69
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x4016e7
push str.Windows_CE
push edi
call ebx
mov dword [esi], 0xc9
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0042318e
mov esp, ebp
pop ebp
ret