Function at 0x416364
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x9c
push esi
push ebx
sub esp, 0x19c
lea ebx, [ebp - 0x158]
mov dword [ebp - 0x158], edi
mov dword [esp], ebx
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
test eax, eax
mov edi, eax
je 0x4164a5
mov dword [esp + 4], ebx
lea eax, [ebp - 0xb8]
mov esi, 0x94
mov dword [esp + 8], esi
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, 0x100
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00418900
test eax, eax
js 0x4165b9
mov eax, dword [ebp - 0xa8]
mov esi, 0x50b120
cmp eax, 2
je 0x4163f3
cmp eax, 3
mov esi, 0x50b123
je 0x4163f3
dec eax
je 0x416606
mov esi, 0x50b126
mov ebx, dword [ebp - 0xb0]
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0xb4]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, str.MINGW32__s__u._u
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
add eax, 0x100
mov dword [esp], eax
call fcn.00416340
mov eax, dword [ebp - 0xa8]
cmp eax, 2
je 0x416533
cmp eax, 3
je 0x4165d4
mov dword [esp + 8], esi
mov eax, str.Windows__s
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
add eax, 0x200
mov dword [esp], eax
call fcn.00416340
lea eax, [ebp - 0xa4]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
add eax, 0x300
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea eax, [ebp - 0x188]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [ebp - 0xa8]
sub esp, 4
sub eax, 2
cmp eax, 1
ja 0x4164d0
movzx eax, word [ebp - 0x188]
cmp eax, 0xa
ja case.0x41649e.8
jmp dword [eax*4 + 0x50b16c]
mov ecx, 0x94
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
test eax, eax
jne 0x4163b1
call fcn.00473504
nop
mov ecx, dword [ebp - 0x170]
cmp ecx, 0x898
je case.0x41649e.6
cmp ecx, 0x21d8
je case.0x41649e.9
mov eax, ecx
mov edx, 0x51eb851f
mul edx
mov eax, ecx
shr edx, 5
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
shl edx, 2
sub eax, edx
cmp eax, 0x56
je 0x4166ac
mov eax, dword [ebp + 8]
mov ecx, 0x6e6b6e75
mov edx, 0x6e776f
mov dword [eax + 0x400], ecx
mov dword [eax + 0x404], edx
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, 0x50b0a0
mov ebx, dword [ebp - 0xb0]
mov esi, dword [ebp - 0xb4]
mov eax, dword [edx]
cmp eax, esi
je 0x41655e
lea esi, [esi]
cmp eax, 0xffffffff
je 0x41655e
add edx, 0x10
mov eax, dword [edx]
cmp eax, esi
jne 0x416550
mov ecx, dword [edx + 4]
cmp ecx, ebx
je 0x41656a
cmp ecx, 0xffffffff
jne 0x416555
test edi, edi
je 0x41668b
cmp byte [ebp - 0xbe], 1
je 0x41668b
mov edi, dword [edx + 8]
add edi, dword [edx + 0xc]
inc eax
je 0x41658f
inc ecx
jne 0x416693
mov dword [esp + 0x10], ebx
mov eax, str._s__u._u
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
add eax, 0x200
mov dword [esp], eax
call fcn.00416340
jmp 0x416459
mov eax, dword [ebp + 8]
mov dword [eax], 0x61636f6c
mov dword [eax + 4], 0x736f686c
mov word [eax + 8], 0x74
jmp 0x4163cd
mov eax, dword [ebp - 0xb0]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xb4]
mov dword [esp + 8], eax
mov eax, str.Windows_CE__u._u
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
add eax, 0x200
mov dword [esp], eax
call fcn.00416340
jmp 0x416459
mov ebx, dword [ebp - 0xb0]
mov esi, 0x50b15d
cmp ebx, 0x5a
je 0x4163f9
ja 0x416637
test ebx, ebx
mov esi, 0x50b160
je 0x4163f9
cmp ebx, 0xa
mov esi, 0x50b163
je 0x4163f9
mov esi, 0x50b126
jmp 0x4163f9
mov eax, dword [ebp + 8]
mov esi, 0x34366169
mov dword [eax + 0x400], esi
mov byte [eax + 0x404], 0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov edi, 0x3436
mov edx, 0x5f363878
mov dword [eax + 0x400], edx
mov word [eax + 0x404], di
mov byte [eax + 0x406], 0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [edx + 0xc]
jmp 0x416585
mov dword [esp + 4], edi
mov eax, dword [ebp + 8]
add eax, 0x200
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
jmp 0x416459
mov dword [esp + 8], ecx
mov ebx, 0x50b166
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
add eax, 0x400
mov dword [esp], eax
call fcn.00416340
jmp 0x416529
mov eax, dword [ebp + 8]
mov edi, 0x36383369
mov dword [eax + 0x400], edi
mov byte [eax + 0x404], 0
mov eax, dword [ebp - 0x168]
cmp ax, 2
jbe 0x416529
cmp ax, 6
mov dl, 0x36
ja 0x416700
mov dl, al
add dl, 0x30
mov eax, dword [ebp + 8]
mov byte [eax + 0x401], dl
jmp 0x416529
mov eax, dword [ebp + 8]
mov ebx, 0x7370696d
mov dword [eax + 0x400], ebx
jmp 0x41664f
mov eax, dword [ebp + 8]
mov edi, 0x65776f70
mov esi, 0x637072
mov dword [eax + 0x400], edi
mov dword [eax + 0x404], esi
jmp 0x416529
mov eax, dword [ebp + 8]
mov ebx, 0x6873
mov word [eax + 0x400], bx
mov byte [eax + 0x402], 0
jmp 0x416529
mov eax, dword [ebp + 8]
mov ecx, 0x6d7261
mov dword [eax + 0x400], ecx
jmp 0x416529
mov eax, dword [ebp + 8]
mov ecx, 0x68706c61
mov edx, 0x61
mov dword [eax + 0x400], ecx
mov word [eax + 0x404], dx
jmp 0x416529
mov eax, dword [ebp + 8]
mov esi, 0x36383669
jmp 0x416649