Function at 0x411330
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x4bf370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x80
push 0
mov dword [ebp - 0x140], esi
lea edi, [esi + 0x1304]
push edi
call fcn.00440690
push 0x80
lea eax, [esi + 0x1404]
push 0
push eax
mov dword [ebp - 0x138], eax
call fcn.00440690
push 0x98
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.00440690
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0xa0]
add esp, 0x24
mov dword [ebp - 0xa0], 0x9c
push eax
call ebx
test eax, eax
jne 0x4113c0
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x94
push eax
call ebx
mov eax, dword [ebp - 0x9c]
mov ebx, dword [ebp - 0x98]
push str.RtlGetVersion
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x94]
push str.ntdll.dll
mov dword [ebp - 0x148], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x144], eax
test eax, eax
je 0x41144a
push 0x90
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.00440690
add esp, 0xc
mov dword [ebp - 0x134], 0x94
lea eax, [ebp - 0x134]
push eax
call dword [ebp - 0x144]
mov eax, dword [ebp - 0x130]
mov ebx, dword [ebp - 0x12c]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x148], eax
push 0x46e4b0
push 0x46e4c0
mov byte [ebp - 0x13c], 0
mov dword [ebp - 0x144], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c05f0], eax
test eax, eax
je 0x411493
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x4c05f0]
test eax, eax
je 0x4114b0
mov eax, dword [ebp - 0x13c]
mov ecx, 1
cmp dword [ebp - 0x144], ecx
movzx eax, al
cmove eax, ecx
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x411bf2
sub eax, 1
je 0x4114de
sub eax, 1
je 0x4115ed
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x1384]
test ebx, ebx
je 0x41158e
cmp ebx, 0xa
je 0x411532
cmp ebx, 0x5a
je 0x411514
push str.Windows_9x
push eax
call fcn.00406660
push str.Windows_9x
push edi
call fcn.00406660
add esp, 0x10
jmp 0x4115ed
push str.Windows_Me
push eax
call fcn.00406660
push str.Windows_Me
push edi
call fcn.00406660
add esp, 0x10
jmp 0x4115ed
push str.Windows_98
push eax
call fcn.00406660
mov ecx, dword [ebp - 0x94]
mov eax, 0x7ce
add esp, 8
cmp cx, ax
jne 0x41155b
mov eax, str.Windows_98
push eax
jmp 0x4115e4
mov eax, 0x8ae
cmp cx, ax
jb 0x41156d
mov eax, str.Windows_98_SE
push eax
jmp 0x4115e4
mov dword [ebp - 0x144], 0x7d0
mov eax, str.Windows_98_SP1
cmp cx, word [ebp - 0x144]
mov edx, str.Windows_98
cmovb eax, edx
push eax
jmp 0x4115e4
push str.Windows_95
push eax
call fcn.00406660
mov eax, dword [ebp - 0x94]
mov ecx, 0x3e8
add esp, 8
cmp ax, cx
jb 0x4115df
mov ecx, 0x4be
cmp ax, cx
jb 0x4115bd
push str.Windows_95_OSR2.5
jmp 0x4115e4
mov ecx, 0x4bc
cmp ax, cx
jb 0x4115ce
push str.Windows_95_OSR2.1
jmp 0x4115e4
mov ecx, 0x457
cmp ax, cx
jne 0x4115df
push str.Windows_95_OSR2
jmp 0x4115e4
push str.Windows_95
push edi
call fcn.00406660
add esp, 8
lea eax, [esi + 0x1404]
push str.No_Service_Pack
push eax
call fcn.00406660
lea ecx, [ebp - 0x8c]
add esp, 8
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411610
sub ecx, edx
je 0x411636
lea eax, [ebp - 0x8c]
push eax
lea eax, [esi + 0x1404]
push 0x49efac
push eax
call fcn.00406660
add esp, 0xc
mov eax, dword [ebp - 0x14c]
add eax, 0xfffffffd
cmp eax, 8
ja case.0x411648.7
jmp dword [eax*4 + 0x411c24]
lea eax, [esi + 0x1384]
push str.Windows_NT3.x
push eax
call fcn.00406660
lea eax, [esi + 0x1404]
push eax
movzx eax, word [ebp - 0x94]
push eax
push dword [ebp - 0x98]
push str.Windows_NT3._d_build__d___s_
push edi
call fcn.00406660
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x1384]
push str.Windows_NT4.x
push eax
call fcn.00406660
lea eax, [esi + 0x1404]
push eax
movzx eax, word [ebp - 0x94]
push eax
push dword [ebp - 0x98]
push str.Windows_NT4._d_build__d___s_
push edi
call fcn.00406660
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x13c]
lea eax, [esi + 0x1384]
mov dword [ebp - 0x144], eax
movzx esi, dl
sub ebx, 0
je 0x4117f7
sub ebx, 1
je 0x4117b9
sub ebx, 1
je 0x41174f
inc esi
shl esi, 5
push esi
push str.Windows_post_XP__d_bit
push eax
call fcn.00406660
push dword [ebp - 0x138]
movzx eax, word [ebp - 0x94]
push eax
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
push esi
push str.Windows_post_XP__d_bit_ver._d._d_build__d___s_
push edi
call fcn.00406660
add esp, 0x28
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
inc esi
push 0x59
shl esi, 5
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push esi
test eax, eax
jne 0x411777
push str.Windows_Server_2003__d_bit
push dword [ebp - 0x144]
call fcn.00406660
mov eax, str.Windows_Server_2003__d_bit_build__d___s_
jmp 0x41178c
push str.Windows_Server_2003_R2__d_bit
push dword [ebp - 0x144]
call fcn.00406660
mov eax, str.Windows_Server_2003_R2__d_bit_build__d___s_
movzx ecx, word [ebp - 0x94]
add esp, 0xc
push dword [ebp - 0x138]
push ecx
push esi
push eax
push edi
call fcn.00406660
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
inc esi
shl esi, 5
push esi
push str.Windows_XP__d_bit
push eax
call fcn.00406660
push dword [ebp - 0x138]
movzx eax, word [ebp - 0x94]
push eax
push esi
push str.Windows_XP__d_bit_build__d___s_
push edi
call fcn.00406660
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
inc esi
shl esi, 5
push esi
push str.Windows_2000__d_bit
push eax
call fcn.00406660
push dword [ebp - 0x138]
movzx eax, word [ebp - 0x94]
push eax
push esi
push str.Windows_2000__d_bit_build__d___s_
push edi
call fcn.00406660
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
cmp ebx, 3
ja case.default.0x41183e
jmp dword [ebx*4 + 0x411c48]
mov edx, dword [ebp - 0x13c]
lea ecx, [esi + 0x1384]
mov eax, dword [ebp - 0x148]
movzx esi, dl
inc esi
movzx eax, ax
shl esi, 5
cmp byte [ebp - 6], 1
mov dword [ebp - 0x140], eax
jne 0x411879
mov ebx, str.Windows_Vista__d_bit_build__d___s_
mov eax, str.Windows_Vista__d_bit
jmp 0x411883
mov ebx, str.Windows_Server_2008__d_bit_build__d___s_
mov eax, str.Windows_Server_2008__d_bit
push esi
push eax
push ecx
call fcn.00406660
push dword [ebp - 0x138]
push dword [ebp - 0x140]
push esi
push ebx
push edi
call fcn.00406660
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x13c]
lea ecx, [esi + 0x1384]
mov eax, dword [ebp - 0x148]
movzx esi, dl
inc esi
movzx eax, ax
shl esi, 5
cmp byte [ebp - 6], 1
mov dword [ebp - 0x140], eax
jne 0x4118e7
mov ebx, str.Windows_7__d_bit_build__d___s_
mov eax, str.Windows_7__d_bit
jmp 0x4118f1
mov ebx, str.Windows_Server_2008_R2__d_bit_build__d___s_
mov eax, str.Windows_Server_2008_R2__d_bit
push esi
push eax
push ecx
call fcn.00406660
push dword [ebp - 0x138]
push dword [ebp - 0x140]
push esi
push ebx
push edi
call fcn.00406660
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x13c]
lea ecx, [esi + 0x1384]
mov eax, dword [ebp - 0x148]
movzx esi, dl
inc esi
movzx eax, ax
shl esi, 5
cmp byte [ebp - 6], 1
mov dword [ebp - 0x140], eax
jne 0x411955
mov ebx, str.Windows_8__d_bit_build__d
mov eax, str.Windows_8__d_bit
jmp 0x41195f
mov ebx, str.Windows_Server_2012__d_bit_build__d
mov eax, str.Windows_Server_2012__d_bit
push esi
push eax
push ecx
call fcn.00406660
push dword [ebp - 0x140]
push esi
push ebx
push edi
call fcn.00406660
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x13c]
lea ecx, [esi + 0x1384]
mov eax, dword [ebp - 0x148]
movzx esi, dl
inc esi
movzx eax, ax
shl esi, 5
cmp byte [ebp - 6], 1
mov dword [ebp - 0x140], eax
jne 0x4119bd
mov ebx, str.Windows_8.1__d_bit_build__d
mov eax, str.Windows_8.1__d_bit
jmp 0x4119c7
mov ebx, str.Windows_8.1_Server__d_bit_build__d
mov eax, str.Windows_8.1_Server__d_bit
push esi
push eax
push ecx
call fcn.00406660
push dword [ebp - 0x140]
push esi
push ebx
push edi
call fcn.00406660
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x140]
movzx esi, dl
add eax, 0x1384
inc esi
shl esi, 5
push esi
push str.Windows_post_Win8__d_bit
push eax
call fcn.00406660
mov eax, dword [ebp - 0x148]
movzx eax, ax
push eax
push ebx
push dword [ebp - 0x14c]
push esi
push str.Windows_post_Win8__d_bit_ver._d._d_build__d
push edi
call fcn.00406660
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x13c]
lea ecx, [esi + 0x1384]
mov eax, dword [ebp - 0x148]
movzx esi, dl
mov edx, 0x55f0
inc esi
movzx eax, ax
shl esi, 5
mov dword [ebp - 0x138], eax
push esi
cmp ax, dx
jae 0x411b1b
test ebx, ebx
je 0x411ab3
push str.Windows_10_or_greater__d_bit
push ecx
call fcn.00406660
push dword [ebp - 0x138]
push ebx
push dword [ebp - 0x14c]
push esi
push str.Windows_10_or_greater__d_bit_ver._d._d_build__d
push edi
call fcn.00406660
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 6], 1
jne 0x411aea
push str.Windows_10__d_bit
push ecx
call fcn.00406660
push dword [ebp - 0x138]
push esi
push str.Windows_10__d_bit_build__d
push edi
call fcn.00406660
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
push str.Windows_Server_10__d_bit
push ecx
call fcn.00406660
push dword [ebp - 0x138]
push esi
push str.Windows_Server_10__d_bit_build__d
push edi
call fcn.00406660
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x411b35
push str.Windows_11_or_greater__d_bit
push ecx
call fcn.00406660
push dword [ebp - 0x138]
jmp 0x411bcb
cmp byte [ebp - 6], 1
jne 0x411b6c
push str.Windows_11__d_bit
push ecx
call fcn.00406660
push dword [ebp - 0x138]
push esi
push str.Windows_11__d_bit_build__d
push edi
call fcn.00406660
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
push str.Windows_Server_11__d_bit
push ecx
call fcn.00406660
push dword [ebp - 0x138]
push esi
push str.Windows_Server_11__d_bit_build__d
push edi
call fcn.00406660
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x140]
movzx esi, dl
add eax, 0x1384
inc esi
shl esi, 5
push esi
push str.Windows_11_or_greater__d_bit
push eax
call fcn.00406660
mov eax, dword [ebp - 0x148]
movzx eax, ax
push eax
push ebx
push dword [ebp - 0x14c]
push esi
push str.Windows_11_or_greater__d_bit_ver._d._d_build__d
push edi
call fcn.00406660
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
push str.Windows_3.1x
push edi
call fcn.00406660
lea eax, [esi + 0x1384]
push str.Windows_3.1
push eax
call fcn.00406660
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret