Function at 0x401c7a
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push 0x9c
lea eax, [ebp - 0xac]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x24
lea eax, [ebp - 0xd0]
push eax
call sub.kernel32.dll_RtlZeroMemory
mov dword [ebp - 0xac], 0x9c
lea eax, [ebp - 0xac]
push eax
call sub.kernel32.dll_GetVersionExA
push 0x404abe
call sub.kernel32.dll_GetModuleHandleA
mov dword [ebp - 4], eax
push str.GetNativeSystemInfo
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401ce7
lea eax, [ebp - 0xd0]
push eax
call dword [ebp - 0xc]
jmp 0x401cf3
lea eax, [ebp - 0xd0]
push eax
call sub.kernel32.dll_GetSystemInfo
cmp dword [ebp - 0x9c], 2
jne 0x402221
cmp dword [ebp - 0xa8], 3
jbe 0x402221
push str.Microsoft
push dword [ebp + 8]
call sub.kernel32.dll_lstrcpyA
cmp dword [ebp - 0xa8], 6
jne 0x401f7b
cmp dword [ebp - 0xa4], 0
jne 0x401d54
cmp byte [ebp - 0x12], 1
jne 0x401d45
push str.Windows_Vista
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401d7f
push str.Windows_Server_2008
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401d7f
cmp dword [ebp - 0xa4], 1
jne 0x401d7f
cmp byte [ebp - 0x12], 1
jne 0x401d72
push str.Windows_7
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401d7f
push str.Windows_Server_2008_R2
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
push str.GetProductInfo
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp - 0xa4]
push dword [ebp - 0xa8]
call dword [ebp - 0x10]
cmp dword [ebp - 8], 1
jne 0x401dbe
push str.Ultimate_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 0x30
jne 0x401dd6
push 0x404b4f
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 3
jne 0x401dee
push str.Home_Premium_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 2
jne 0x401e06
push str.Home_Basic_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 4
jne 0x401e1e
push 0x404b84
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 6
jne 0x401e36
push str.Business_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 0xb
jne 0x401e4e
push str.Starter_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 0x12
jne 0x401e66
push str.Cluster_Server_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 8
jne 0x401e7e
push 0x404bcf
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 0xc
jne 0x401e96
push str.Datacenter_Edition__core_installation_
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 0xa
jne 0x401eae
push 0x404c09
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 0xe
jne 0x401ec3
push str.Enterprise_Edition__core_installation_
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 0xf
jne 0x401ed8
push 0x404c43
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 9
jne 0x401eed
push str.Small_Business_Server
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 0x19
jne 0x401f02
push str.Small_Business_Server_Premium_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 7
jne 0x401f17
push 0x404cac
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 0xd
jne 0x401f2c
push str.Standard_Edition__core_installation_
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401f3f
cmp dword [ebp - 8], 0x11
jne 0x401f3f
push str.Web_Server_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
cmp word [ebp - 0xd0], 9
jne 0x401f5b
push str.__64_bit
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
cmp word [ebp - 0xd0], 0
jne 0x4021c7
push str.__32_bit
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
cmp dword [ebp - 0xa8], 5
jne 0x4020f5
cmp dword [ebp - 0xa4], 2
jne 0x4020f5
push 0x59
call sub.user32.dll_GetSystemMetrics
or eax, eax
je 0x401faf
push str.Windows_Server_2003_R2_
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401ff2
cmp word [ebp - 0x14], 0x2000
jne 0x401fc6
push str.Windows_Storage_Server_2003
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401ff2
cmp byte [ebp - 0x12], 1
jne 0x401fe5
cmp word [ebp - 0xd0], 9
jne 0x401fe5
push str.Windows_XP_Professional_x64_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x401ff2
push str.Windows_Server_2003_
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
cmp byte [ebp - 0x12], 1
je 0x402037
cmp word [ebp - 0xd0], 6
jne 0x4021c7
test word [ebp - 0x14], 0x80
je 0x40201d
push str.Datacenter_Edition_for_Itanium_based_Systems
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x402032
test word [ebp - 0x14], 2
je 0x402032
push str.Enterprise_Edition_for_Itanium_based_Systems
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
cmp word [ebp - 0xd0], 9
jne 0x402087
test word [ebp - 0x14], 0x80
je 0x40205b
push str.Datacenter_x64_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
test word [ebp - 0x14], 2
je 0x402075
push str.Enterprise_x64_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
push str.Standard_x64_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
test word [ebp - 0x14], 0x4000
je 0x40209e
push str.Compute_Cluster_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4020f0
test word [ebp - 0x14], 0x80
je 0x4020b5
push str.Datacenter_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4020f0
test word [ebp - 0x14], 2
je 0x4020cc
push str.Enterprise_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4020f0
test word [ebp - 0x14], 0x400
je 0x4020e3
push str.Web_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4020f0
push str.Standard_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
cmp dword [ebp - 0xa8], 5
jne 0x402140
cmp dword [ebp - 0xa4], 1
jne 0x402140
push str.Windows_XP
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
test word [ebp - 0x14], 0x200
je 0x40212e
push str.Home_Edition
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
push 0x404e87
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
cmp dword [ebp - 0xa8], 5
jne 0x4021b1
cmp dword [ebp - 0xa4], 0
jne 0x4021b1
push str.Windows_2000
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
cmp byte [ebp - 0x12], 1
jne 0x402174
push str.Professional
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
test word [ebp - 0x14], 0x80
je 0x40218b
push str.Datacenter_Server
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021af
test word [ebp - 0x14], 2
je 0x4021a2
push str.Advanced_Server
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021af
push str.Server
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
jmp 0x4021c7
cmp dword [ebp - 0xa8], 4
jne 0x4021c7
push str.Windows_NT_4.0
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_lstrlenA
cmp eax, 0
jbe 0x4021f4
push 0x404ee7
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x98]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
push dword [ebp - 0xa0]
push str.__build__d_
lea eax, [ebp - 0xe0]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
lea eax, [ebp - 0xe0]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrcatA
xor eax, eax
jmp 0x402233
push str.This_program_does_not_support_Windows_versions_less_than_Windows_NT_4.0
push dword [ebp + 8]
call sub.kernel32.dll_lstrcpyA
mov eax, 1
leave
ret 4