Function at 0x417821
Capabilities:
Check os version
Get system information on windows
Identify system language via api

Disassembly:
push ebp
sub esp, 0x11c
lea ebp, [esp - 4]
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push 0x38
mov eax, 0x5b98f9
call fcn.0058f985
mov eax, dword [ebp + 0x128]
mov dword [ebp - 0x1c], eax
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x10]
call fcn.0040141e
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
push 0x24
lea eax, [ebp - 0x44]
push edi
push eax
mov byte [ebp - 4], 1
call fcn.0058fa90
mov esi, 0x11c
push esi
lea eax, [ebp]
push edi
push eax
call fcn.0058fa90
add esp, 0x18
lea eax, [ebp]
push eax
mov dword [ebp], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, edi
je 0x4180a5
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
mov ebx, str.kernel32.dll
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x4178cf
lea ecx, [ebp - 0x44]
push ecx
call eax
jmp 0x4178d9
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp + 0x10], 2
jne 0x4180a5
cmp dword [ebp + 4], 4
jbe 0x4180a5
push str.___Microsoft
lea ecx, [ebp - 0x10]
call fcn.00401287
cmp dword [ebp + 4], 6
jb case.default.0x4179f3
jne 0x417919
cmp dword [ebp + 8], 2
jne 0x417919
push str.Windows_8
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.GetProductInfo
push ebx
call esi
push eax
call edi
lea ecx, [ebp - 0x20]
push ecx
movzx ecx, word [ebp + 0x116]
push ecx
movzx ecx, word [ebp + 0x114]
push ecx
push dword [ebp + 8]
push dword [ebp + 4]
call eax
cmp dword [ebp - 0x20], 0x4a
jne 0x417960
push str.Beta_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.Beta
lea ecx, [ebp - 0x14]
call fcn.00401287
cmp dword [ebp + 4], 6
jne case.default.0x4179f3
cmp dword [ebp + 8], 0
jne 0x41798d
cmp byte [ebp + 0x11a], 1
lea ecx, [ebp - 0x10]
jne 0x417983
push str.Windows_Vista
jmp 0x417988
push str.Windows_Server_2008
call fcn.004022ca
cmp dword [ebp + 8], 1
jne 0x4179b0
cmp byte [ebp + 0x11a], 1
lea ecx, [ebp - 0x10]
jne 0x4179a6
push str.Windows_7
jmp 0x4179ab
push str.Windows_Server_2008_R2
call fcn.004022ca
push str.GetProductInfo
push ebx
call esi
push eax
call edi
lea ecx, [ebp - 0x20]
push ecx
movzx ecx, word [ebp + 0x116]
push ecx
movzx ecx, word [ebp + 0x114]
push ecx
push dword [ebp + 8]
push dword [ebp + 4]
call eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xd
ja 0x417b0e
je 0x417af7
dec eax
cmp eax, 0xb
ja case.default.0x4179f3
jmp dword [eax*4 + 0x4180e1]
push str.Ultimate_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.Ultimate
jmp 0x417c4e
push str.Home_Premium_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.HomePremium
jmp 0x417c4e
push str.Home_Basic_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.HomeBasic
jmp 0x417c4e
push str.Home_Basic_Edition_N
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.HomeBasicN
jmp 0x417c4e
push str.Enterprise_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.Enterprise
jmp 0x417c4e
push str.Business_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.Business
jmp 0x417c4e
push str.Starter_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.Starter
jmp 0x417c4e
push str.Datacenter_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.Datacenter
jmp 0x417c4e
push str.Datacenter_Edition__core_installation_
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.DatacenterCore
jmp 0x417c4e
push str.Small_Business_Server
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.SmallBusiness
jmp 0x417c4e
push str.Standard_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push 0x5dbc34
jmp 0x417c4e
push str.Standard_Edition__core_installation_
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.StandardCore
jmp 0x417c4e
cmp eax, 0x2f
ja 0x417c23
je 0x417c0f
cmp eax, 0x12
ja 0x417bad
je 0x417b96
sub eax, 0xe
je 0x417b7f
dec eax
je 0x417b68
dec eax
je 0x417b51
dec eax
jne case.default.0x4179f3
push str.Web_Server_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.WebServer
jmp 0x417c4e
push str.Business_Edition_N
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.BusinessN
jmp 0x417c4e
push str.Enterprise_Edition_for_Itanium_based_Systems
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.EnterpriseItanium
jmp 0x417c4e
push str.Enterprise_Edition__core_installation_
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.EnterpriseCore
jmp 0x417c4e
push str.Cluster_Server_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.Cluster
jmp 0x417c4e
sub eax, 0x19
je 0x417bfb
dec eax
je 0x417be7
dec eax
je 0x417bd3
dec eax
jne case.default.0x4179f3
push str.Ultimate_Edition_N
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.UltimateN
jmp 0x417c4e
push str.Enterprise_Edition_N
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.EnterpriseN
jmp 0x417c4e
push str.Home_Premium_Edition_N
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.HomePremiumN
jmp 0x417c4e
push str.Small_Business_Server_Premium_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.SmallBusinessPremium
jmp 0x417c4e
push str.Starter_Edition_N
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.StarterN
jmp 0x417c4e
sub eax, 0x30
je 0x417c3f
dec eax
jne case.default.0x4179f3
push str.Professional_N
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.ProfessionalN
jmp 0x417c4e
mov esi, str.Professional
push esi
lea ecx, [ebp - 0x10]
call fcn.004022ca
push esi
lea ecx, [ebp - 0x14]
call fcn.00401287
cmp dword [ebp + 4], 5
jne 0x417eeb
cmp dword [ebp + 8], 2
mov esi, str.Server
jne 0x417e1f
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x417c8f
push str.Windows_Server_2003_R2_
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.ServerR2
jmp 0x417d01
test dword [ebp + 0x118], 0x2000
je 0x417caf
push str.Windows_Storage_Server_2003
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.StorageServer
jmp 0x417d01
test dword [ebp + 0x118], 0x8000
je 0x417ccf
push str.Windows_Home_Server
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.HomeServer
jmp 0x417d01
cmp byte [ebp + 0x11a], 1
jne 0x417cf3
cmp word [ebp - 0x44], 9
jne 0x417cf3
push str.Windows_XP_Professional_x64_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.Professional
jmp 0x417d01
push str.Windows_Server_2003_
lea ecx, [ebp - 0x10]
call fcn.004022ca
push esi
lea ecx, [ebp - 0x14]
call fcn.00401287
cmp byte [ebp + 0x11a], 1
je 0x417e15
cmp word [ebp - 0x44], 6
jne 0x417d61
test byte [ebp + 0x118], 0x80
je 0x417d3d
push str.Datacenter_Edition_for_Itanium_based_Systems
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.DatacenterItanium
jmp 0x417e0d
test byte [ebp + 0x118], 2
je 0x417e15
push str.Enterprise_Edition_for_Itanium_based_Systems
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.EnterpriseItanium
jmp 0x417e0d
cmp word [ebp - 0x44], 9
jne 0x417dac
test byte [ebp + 0x118], 0x80
je 0x417d88
push str.Datacenter_x64_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.Datacenter
jmp 0x417e0d
test byte [ebp + 0x118], 2
lea ecx, [ebp - 0x10]
je 0x417da5
push str.Enterprise_x64_Edition
call fcn.004022ca
push str.Enterprise
jmp 0x417e0d
push str.Standard_x64_Edition
jmp 0x417e03
mov eax, dword [ebp + 0x118]
test eax, 0x4000
je 0x417dcd
push str.Compute_Cluster_Edition
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.ComputeCluster
jmp 0x417e0d
test al, al
jns 0x417dd8
push str.Datacenter_Edition
jmp 0x417d76
lea ecx, [ebp - 0x10]
test al, 2
je 0x417de6
push str.Enterprise_Edition
jmp 0x417d99
test eax, 0x400
je 0x417dfe
push str.Web_Edition
call fcn.004022ca
push 0x5db570
jmp 0x417e0d
push str.Standard_Edition
call fcn.004022ca
push 0x5dbc34
lea ecx, [ebp - 0x14]
call fcn.00401287
cmp dword [ebp + 4], 5
jne 0x417eeb
cmp dword [ebp + 8], 1
jne 0x417e7b
push str.Windows_XP
lea ecx, [ebp - 0x10]
call fcn.004022ca
test dword [ebp + 0x118], 0x200
lea ecx, [ebp - 0x10]
je 0x417e5f
push str.Home_Edition
call fcn.004022ca
push str.Home
lea ecx, [ebp - 0x14]
call fcn.00401287
mov edi, str.Professional
jmp 0x417e73
mov edi, str.Professional
push edi
call fcn.004022ca
push edi
lea ecx, [ebp - 0x14]
call fcn.00401287
cmp dword [ebp + 4], 5
jne 0x417eeb
jmp 0x417e80
mov edi, str.Professional
cmp dword [ebp + 8], 0
jne 0x417eeb
push 0x5db514
lea ecx, [ebp - 0x10]
call fcn.004022ca
cmp byte [ebp + 0x11a], 1
lea ecx, [ebp - 0x10]
jne 0x417ea8
push edi
call fcn.004022ca
push edi
jmp 0x417ee3
test byte [ebp + 0x118], 0x80
je 0x417ec2
push str.Datacenter_Server
call fcn.004022ca
push str.Datacenter
jmp 0x417ee3
test byte [ebp + 0x118], 2
je 0x417edc
push str.Advanced_Server
call fcn.004022ca
push str.AdvancedServer
jmp 0x417ee3
push esi
call fcn.004022ca
push esi
lea ecx, [ebp - 0x14]
call fcn.00401287
lea eax, [ebp + 0x14]
push eax
call fcn.0058f15d
pop ecx
test eax, eax
jbe 0x417f12
push 0x5d4664
lea ecx, [ebp - 0x10]
call fcn.004022ca
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.004022ca
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x18]
call fcn.0040141e
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push str.__build__d_
push eax
mov byte [ebp - 4], 2
call fcn.00401518
mov eax, dword [ebp - 0x18]
add esp, 0xc
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040202a
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push 0x5db490
push eax
call fcn.00401518
mov esi, dword [ebp - 0x1c]
add esp, 0xc
add esi, 0x1b0
push str.OSBUILD
mov ecx, esi
call fcn.004a2b74
mov edi, dword [ebp - 0x18]
push edi
mov ecx, eax
call fcn.00401287
call fcn.00446344
lea ecx, [ebp - 0x10]
test eax, eax
je 0x417fa4
push str.__64_bit
call fcn.004022ca
push str.ARCHITECTURE
mov ecx, esi
call fcn.004a2b74
push 0x5db448
jmp 0x417fbf
push str.__32_bit
call fcn.004022ca
push str.ARCHITECTURE
mov ecx, esi
call fcn.004a2b74
push 0x5db42c
mov ecx, eax
call fcn.00401287
push dword [ebp - 0x10]
call fcn.004437b6
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
push str.___Display_Language_id:__ld
call fcn.004437b6
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
push str.___System_Locale_id:__ld
call fcn.004437b6
call fcn.0044638a
push eax
push str.___User_default_ANSI_code_page:__ld
call fcn.004437b6
call fcn.004463fd
push eax
push str.___User_default_OEM_code_page:__ld
call fcn.004437b6
mov eax, dword [ebp - 0x14]
add esp, 0x18
cmp dword [eax - 0xc], 0
jne 0x41803f
push str.WARNING:_This_edition_is_unknown__please_log_a_bug_to_test.
lea ecx, [ebp - 0x10]
call fcn.004022ca
push str.Unknown
lea ecx, [ebp - 0x14]
call fcn.00401287
push str.OSEDITION
mov ecx, esi
call fcn.004a2b74
push dword [ebp - 0x14]
mov ecx, eax
call fcn.00401287
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040141e
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push dword [ebp + 4]
mov byte [ebp - 4], 3
push str._d._d
push eax
call fcn.00401518
add esp, 0x10
push str.OSVERSION
mov ecx, esi
call fcn.004a2b74
mov esi, dword [ebp - 0x1c]
push esi
mov ecx, eax
call fcn.00401287
lea ecx, [esi - 0x10]
call fcn.00401019
lea ecx, [edi - 0x10]
call fcn.00401019
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401019
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.0058f976
add ebp, 0x120
leave
ret 4