Function at 0x40dbd3
Capabilities:
Check os version

Disassembly:
push 0x1f4
mov eax, 0x41ab1c
call fcn.0041a007
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x200], ebx
mov dword [ebp - 0x1fc], edi
mov dword [ebp - 0x1f8], ebx
lea eax, [ebp - 0x1f4]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov dword [ebp - 4], ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1f4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40dcce
mov eax, dword [ebp - 0x1f4]
push 0xc8
mov dword [ebp - 0x1f8], eax
lea eax, [ebp - 0xda]
push ebx
push eax
mov word [ebp - 0xdc], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push str.ProductName
lea eax, [ebp - 0x1f8]
push eax
lea esi, [ebp - 0x200]
lea edi, [ebp - 0xdc]
mov dword [ebp - 0x200], 0x64
call fcn.0040f2ae
cmp dword [ebp - 0x1f4], ebx
je 0x40dc8f
push dword [ebp - 0x1f4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1f8], ebx
cmp word [ebp - 0xdc], bx
je 0x40dcc8
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0xdc]
call fcn.0040453a
cmp dword [ebp - 0x1f8], ebx
je 0x40dcbd
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1fc]
jmp 0x40de8a
mov edi, dword [ebp - 0x1fc]
mov eax, dword [0x428220]
mov ecx, 0x428220
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1f4], eax
push 0x110
lea eax, [ebp - 0x1ec]
push ebx
mov byte [ebp - 4], 1
push eax
mov dword [ebp - 0x1f0], 0x114
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x1e0]
sub eax, ebx
je 0x40de47
dec eax
je 0x40ddbc
dec eax
jne 0x40de58
cmp dword [ebp - 0x1ec], 4
ja 0x40dd43
push str.Microsoft_Windows_NT
jmp 0x40de4c
cmp dword [ebp - 0x1ec], 5
jne 0x40dd84
cmp dword [ebp - 0x1e8], ebx
jne 0x40dd5e
push str.Microsoft_Windows_2000
jmp 0x40de4c
cmp dword [ebp - 0x1e8], 1
jne 0x40dd71
push str.Microsoft_Windows_XP
jmp 0x40de4c
cmp dword [ebp - 0x1e8], 2
jne 0x40ddb2
push str.Microsoft_Windows_Server_2003
jmp 0x40de4c
cmp dword [ebp - 0x1ec], 6
jne 0x40ddb2
cmp dword [ebp - 0x1e8], ebx
jne 0x40dd9f
push str.Microsoft_Windows_Vista
jmp 0x40de4c
cmp dword [ebp - 0x1e8], 1
jne 0x40ddb2
push str.Microsoft_Windows_Longhorn_Server
jmp 0x40de4c
push str.Microsoft_Windows_Vista_Later
jmp 0x40de4c
cmp dword [ebp - 0x1ec], 4
jne 0x40de40
cmp dword [ebp - 0x1e8], ebx
jne 0x40ddf9
push str.Microsoft_Windows_95
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040146d
cmp word [ebp - 0x1da], 0x43
je 0x40ddf2
cmp word [ebp - 0x1da], 0x42
jne 0x40de58
push str._OSR2
jmp 0x40de22
cmp dword [ebp - 0x1e8], 0xa
jne 0x40de30
push str.Microsoft_Windows_98
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040146d
cmp word [ebp - 0x1da], 0x41
jne 0x40de58
push 0x422764
lea eax, [ebp - 0x1f4]
push eax
call fcn.004045ef
jmp 0x40de58
cmp dword [ebp - 0x1e8], 0x5a
jne 0x40de40
push str.Microsoft_Windows_Me
jmp 0x40de4c
push str.Microsoft_Windows_Me_later
jmp 0x40de4c
push str.Microsoft_Win32s
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040146d
mov esi, dword [ebp - 0x1f4]
add esi, 0xfffffff0
mov eax, esi
call fcn.00404f3d
add eax, 0x10
mov dword [edi], eax
mov eax, esi
call fcn.004016a7
cmp dword [ebp - 0x1f8], ebx
je 0x40de88
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.0041a08a
ret