Function at 0x41cc30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x59536b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x9c
call esi
mov edi, eax
test edi, edi
jne 0x41cc8c
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x94
call esi
mov edi, eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0056c180
test edi, edi
je 0x41cfae
mov eax, dword [esp + 0x20]
sub eax, 0
je 0x41cfa2
dec eax
je 0x41cde0
dec eax
jne 0x41cfae
mov eax, dword [esp + 0x14]
sub eax, 3
je 0x41cd23
dec eax
je 0x41cd1c
dec eax
jne 0x41cd3d
mov eax, dword [esp + 0x18]
sub eax, 0
je 0x41cd02
dec eax
je 0x41ccdb
push str.Microsoft_Windows_2000___
jmp 0x41cd36
mov eax, dword [esp + 0xa8]
test ah, 2
je 0x41ccfb
test al, 2
mov ecx, esi
je 0x41ccf4
push str.Microsoft_Windows_Windows_.NET_Enterprise_Server
jmp 0x41cd38
push str.Microsoft_Windows_XP_Home_Edition
jmp 0x41cd38
push str.Microsoft_Windows_XP_Professional
jmp 0x41cd36
test byte [esp + 0xa8], 2
mov ecx, esi
je 0x41cd15
push str.Microsoft_Windows_2000_Advanced_Server
jmp 0x41cd38
push str.Microsoft_Windows_2000
jmp 0x41cd38
push str.Microsoft_Windows_NT_4.0
jmp 0x41cd36
cmp dword [esp + 0x18], 0x33
je 0x41cd31
push str.Microsoft_Windows_NT___
jmp 0x41cd36
push str.Microsoft_Windows_NT_3.51
mov ecx, esi
call fcn.0056bec0
mov al, byte [esp + 0xaa]
cmp al, 1
jne 0x41cd4f
push 0x5aef88
jmp 0x41cd63
cmp al, 3
jne 0x41cd5a
push str.Server
jmp 0x41cd63
cmp al, 2
jne 0x41cd6a
push str.DomainController
mov ecx, esi
call fcn.0056bfe0
lea ecx, [esp + 0xc]
call fcn.0056bc10
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
and edx, 0xffff
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push str.__d._d__s__Build__d_
push eax
mov dword [esp + 0xd4], 0
call fcn.0056c790
add esp, 0x18
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0056c040
lea ecx, [esp + 0xc]
mov dword [esp + 0xbc], 0xffffffff
call fcn.0056bd20
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x14]
cmp eax, 4
jne 0x41cf6d
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x41cecd
mov eax, dword [esp + 0x1c]
and eax, 0xffff
mov ecx, eax
sub ecx, 0x3b6
je 0x41cea0
sub ecx, 0xa1
je 0x41ce73
sub ecx, 0x65
je 0x41ce46
push eax
push 0
push 4
push str.Microsoft_Windows_95_xxx__d._d__Build__d_
push esi
call fcn.0056c790
add esp, 0x14
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x4bc
push 0
push 4
push str.Microsoft_Windows_95__d._d_OSR2.5_Build__d_
push esi
call fcn.0056c790
add esp, 0x14
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x457
push 0
push 4
push str.Microsoft_Windows_95__d._d_OSR2_2.1_Build__d_
push esi
call fcn.0056c790
add esp, 0x14
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x3b6
push 0
push 4
push str.Microsoft_Windows_95__d._d_95_95SP1_OSR1_Build__d_
push esi
call fcn.0056c790
add esp, 0x14
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 0xa
jne 0x41cf04
mov edx, dword [esp + 0x1c]
and edx, 0xffff
push edx
push eax
push 4
push str.Microsoft_Windows_98__d._d__Build__d_
push esi
call fcn.0056c790
add esp, 0x14
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x5a
jne 0x41cf3b
mov eax, dword [esp + 0x1c]
and eax, 0xffff
push eax
push 0x5a
push 4
push str.Microsoft_Windows_Me__d._d__Build__d_
push esi
call fcn.0056c790
add esp, 0x14
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x1c]
and ecx, 0xffff
push ecx
push eax
push 4
push str.Microsoft_Windows_9x__d._d__Build__d_
push esi
call fcn.0056c790
add esp, 0x14
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
and edx, 0xffff
push edx
push ecx
push eax
push str.Microsoft_Windows_9x_____d._d__Build__d_
push esi
call fcn.0056c790
add esp, 0x14
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.Microsoft_Win32s
mov ecx, esi
call fcn.0056bec0
mov ecx, dword [esp + 0xb4]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4