Function at 0x41da40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e25d
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x495574]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
movzx edi, cx
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x12c], esi
call fcn.0043a63e
push ecx
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x144]
call fcn.00415b30
add esp, 4
test al, al
jne 0x41dacf
lea ecx, [ebp - 0x144]
mov dword [ebp - 4], 0xffffffff
call fcn.0043a655
jmp 0x41db48
mov edx, dword [ebp - 0x13c]
xor esi, esi
mov edi, dword [ebp - 0x140]
mov eax, 0x1000
xor ecx, ecx
test edx, edx
jle 0x41db12
test ecx, ecx
js 0x41defe
cmp ecx, edx
jge 0x41defe
mov eax, dword [edi + ecx*4]
shr eax, 0x10
and eax, 0xfff
cmp ax, si
je 0x41db0d
inc ecx
cmp ecx, edx
jl 0x41dae8
mov eax, 0x1000
cmp ecx, edx
je 0x41db1c
inc esi
cmp si, ax
jb 0x41dae2
mov eax, 0xfff
lea ecx, [ebp - 0x144]
cmp si, ax
jbe 0x41dbcc
mov dword [ebp - 4], 0xffffffff
call fcn.0043a655
mov esi, dword [ebp - 0x12c]
mov edi, dword [ebp - 0x128]
test esi, esi
je 0x41dbc5
mov edx, edi
lea ecx, [ebp - 0x128]
call fcn.0041bf10
mov dword [ebp - 4], 1
push dword [eax]
push str.Could_not_find_a_free_KLID_for_language__s_r_n_r_nAs_a_workaround__try_removing_one_or_more_existing_layouts_for_this_language
push esi
call fcn.00403a80
mov dword [ebp - 4], 0xffffffff
add esp, 0xc
mov ecx, dword [ebp - 0x128]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41dbc5
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x41df03
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41df03
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
jmp 0x41dee2
xor al, al
jmp 0x41dee2
and esi, eax
mov eax, dword [ebp - 0x128]
or esi, 0xffffb000
movzx eax, ax
shl esi, 0x10
or esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0043a655
lea ecx, [ebp - 0x160]
call fcn.004145e0
mov dword [ebp - 4], 2
mov dword [ebp - 0x160], esi
mov byte [ebp - 0x15c], 1
test ebx, ebx
jne 0x41dc15
xor ecx, ecx
jmp 0x41dc2f
mov ecx, ebx
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41dc20
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x158]
call fcn.004041d0
mov ebx, dword [ebp - 0x130]
test ebx, ebx
jne 0x41dc4a
xor ecx, ecx
jmp 0x41dc5f
mov ecx, ebx
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41dc50
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x154]
call fcn.004041d0
mov eax, dword [ebp - 0x160]
shr eax, 0x10
mov dword [ebp - 0x150], 0xffffffff
test eax, eax
je 0x41de54
push 0x110
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.0044e9c0
add esp, 0xc
mov dword [ebp - 0x124], 0x114
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 6
jne 0x41dd95
cmp dword [ebp - 0x11c], 2
jae 0x41dd9b
lea ecx, [ebp - 0x144]
call fcn.0043a63e
push ecx
xor edx, edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x144]
call fcn.00415b30
add esp, 4
test al, al
je 0x41ddbb
mov eax, dword [ebp - 0x13c]
xor ebx, ebx
xor edi, edi
test eax, eax
jle 0x41dd74
test edi, edi
js 0x41defe
cmp edi, eax
jge 0x41defe
mov eax, dword [ebp - 0x140]
lea ecx, [ebp - 0x184]
mov esi, dword [eax + edi*4]
call fcn.004145e0
push ecx
lea edx, [ebp - 0x184]
mov byte [ebp - 4], 4
mov ecx, esi
call fcn.00416370
add esp, 4
test al, al
je 0x41ddb0
mov ax, word [ebp - 0x170]
mov ecx, 0xffff
cmp ax, cx
je 0x41dd5a
cmp ax, bx
jbe 0x41dd5a
movzx ebx, ax
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 3
call fcn.004147f0
mov eax, dword [ebp - 0x13c]
inc edi
cmp edi, eax
jl 0x41dd04
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 2
call fcn.0043a655
mov eax, 0xfffe
cmp bx, ax
jae 0x41ddca
lea eax, [ebx + 1]
jmp 0x41de59
jbe 0x41dcce
lea ecx, [ebp - 0x14c]
call fcn.0041d610
test al, al
jne 0x41de60
jmp 0x41ddca
lea ecx, [ebp - 0x184]
call fcn.004147f0
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 2
call fcn.0043a655
mov esi, dword [ebp - 0x12c]
test esi, esi
je 0x41debd
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x160]
call fcn.00414a60
mov byte [ebp - 4], 5
push dword [eax]
push str.Cannot_allocate_Id_for_the_new_layout__s
push esi
call fcn.00403a80
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x130]
add esp, 0xc
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x41debd
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x471758
jne 0x41df0c
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41df0c
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor bl, bl
jmp 0x41ded5
mov eax, 0xffff
mov word [ebp - 0x14c], ax
push 0
push 0x47a2ec
lea ecx, [ebp - 0x148]
call fcn.004041d0
lea ecx, [ebp - 0x160]
call fcn.00415ff0
test al, al
jne 0x41dec1
mov esi, dword [ebp - 0x12c]
test esi, esi
je 0x41debd
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x160]
call fcn.00414a60
mov byte [ebp - 4], 6
push dword [eax]
push str.Cannot_create_new_layout___registry_entry_for__s_could_not_be_added._r_n_r_nThis_is_commonly_caused_by_interference_from_anti_virus_software.
push esi
call fcn.00403a80
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x164]
jmp 0x41de05
xor bl, bl
jmp 0x41ded5
mov ecx, dword [ebp - 0x168]
lea eax, [ebp - 0x160]
push eax
call fcn.00414940
mov bl, 1
lea ecx, [ebp - 0x160]
call fcn.004147f0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044c2a6
mov esp, ebp
pop ebp
ret
call fcn.00437e01
mov ecx, edx
call esi
jmp 0x41dbc5
mov ecx, edx
call esi
jmp 0x41debd