Function at 0x41d786
Capabilities:
Check os version

Disassembly:
push 0x348
mov eax, 0x593dfe
call fcn.0056644b
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x330]
xor ebx, ebx
mov dword [ebp - 0x354], esi
push 0x118
push ebx
mov dword [ebp - 0x34c], ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x334], 0x11c
call fcn.0056c460
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x612278
mov ecx, esi
call fcn.00401650
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x338], eax
movzx eax, byte [ebp - 0x21a]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x328]
push str.ntdll.dll
mov dword [ebp - 0x34c], 1
mov dword [ebp - 0x348], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x41d877
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d870
lea ecx, [ebp - 0x33c]
push ecx
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x340]
push ecx
call eax
movzx eax, word [ebp - 0x33c]
mov dword [ebp - 0x33c], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 0x338]
cmp edi, 5
jne 0x41d8c1
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x41d9e7
cmp eax, 1
jne 0x41d8ab
push str.WindowsXP
call fcn.005780de
pop ecx
push eax
push str.WindowsXP
jmp 0x41d9b6
push str.WindowsServer2003
call fcn.005780de
pop ecx
push eax
push str.WindowsServer2003
jmp 0x41d9b6
cmp edi, 6
jne 0x41d9bf
mov eax, dword [ebp - 0x348]
sub eax, 0
je 0x41d989
sub eax, 1
je 0x41d976
sub eax, 1
jne 0x41d9e7
cmp ebx, 0x1ebb
jne 0x41d8fd
mov edi, str.Windows8
jmp 0x41d9d1
lea eax, [ebx - 0x1ee6]
cmp eax, 0x25
jbe 0x41d8f3
cmp ebx, 0x1f13
je 0x41d8f3
cmp dword [ebp - 0x340], 0xa
jne 0x41d949
cmp dword [ebp - 0x344], 0
jne 0x41d9e7
cmp dword [ebp - 0x33c], 0x4e20
jae 0x41d9cc
push str.Windows10
call fcn.005780de
pop ecx
push eax
push str.Windows10
jmp 0x41d9b6
cmp dword [ebp - 0x340], 6
jne 0x41d9e7
cmp dword [ebp - 0x344], 3
jne 0x41d9e7
push str.Windows8.1
call fcn.005780de
pop ecx
push eax
push str.Windows8.1
jmp 0x41d9b6
push str.Windows7
call fcn.005780de
pop ecx
push eax
push str.Windows7
jmp 0x41d9b6
cmp dword [ebp - 0x350], 1
jne 0x41d9a5
push str.WindowsVista
call fcn.005780de
pop ecx
push eax
push str.WindowsVista
jmp 0x41d9b6
push str.WindowsServer2008
call fcn.005780de
pop ecx
push eax
push str.WindowsServer2008
mov ecx, esi
call fcn.00401730
jmp 0x41d9e7
cmp edi, 0xa
jne 0x41d9e7
cmp ebx, 0x4e20
jb 0x41d9e7
mov edi, str.Windows11
push edi
call fcn.005780de
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00401730
mov edi, dword [ebp - 0x338]
push 0x612278
mov ecx, esi
call fcn.00412af9
test al, al
je 0x41da41
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056c460
push ebx
push dword [ebp - 0x348]
lea eax, [ebp - 0x218]
push edi
push str.Windows_d._d._d
push eax
call fcn.004078e0
lea eax, [ebp - 0x218]
push eax
call fcn.005780de
add esp, 0x24
mov ecx, esi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00401730
cmp dword [ebp + 0xc], 0
je 0x41da63
lea eax, [ebp - 0x320]
push eax
call fcn.005780de
pop ecx
push eax
lea eax, [ebp - 0x320]
mov ecx, esi
push eax
call fcn.00407000
mov eax, esi
call fcn.00566406
ret