Function at 0x41d830
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bc5d6
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x669404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x9c
push eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x234]
mov esi, ecx
push eax
mov dword [ebp - 0x238], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x234]
push ecx
mov dword [ebp - 0x234], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41de02
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x41d8fc
lea edx, [ebp - 0x260]
push edx
call eax
jmp 0x41d909
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x224], 2
jne 0x41de02
cmp dword [ebp - 0x230], 4
jbe 0x41de02
lea eax, [ebp - 0x110]
mov esi, str.Microsoft
mov ecx, eax
mov edx, 0x100
sub esi, ecx
jmp 0x41d940
lea ecx, [edx + 0x7ffffefe]
test ecx, ecx
je 0x41d959
mov cl, byte [esi + eax]
test cl, cl
je 0x41d959
mov byte [eax], cl
inc eax
dec edx
jne 0x41d940
jmp 0x41d95d
test edx, edx
jne 0x41d95e
dec eax
cmp dword [ebp - 0x230], 6
mov byte [eax], 0
jne case.0x41da3e.5
mov eax, dword [ebp - 0x22c]
test eax, eax
jne 0x41d995
cmp byte [ebp - 0x19a], 1
lea esi, [ebp - 0x110]
jne 0x41d98e
push str.Windows_Vista
jmp 0x41d9f8
push str.Windows_Server_2008
jmp 0x41d9f8
cmp eax, 1
jne 0x41d9b6
lea esi, [ebp - 0x110]
cmp byte [ebp - 0x19a], al
jne 0x41d9af
push str.Windows_7
jmp 0x41d9f8
push str.Windows_Server_2008_R2
jmp 0x41d9f8
cmp eax, 2
jne 0x41d9d8
cmp byte [ebp - 0x19a], 1
lea esi, [ebp - 0x110]
jne 0x41d9d1
push str.Windows_8
jmp 0x41d9f8
push str.Windows_Server_2012
jmp 0x41d9f8
cmp eax, 3
jne 0x41d9fd
cmp byte [ebp - 0x19a], 1
lea esi, [ebp - 0x110]
jne 0x41d9f3
push str.Windows_9
jmp 0x41d9f8
push str.Windows_Server_9
call fcn.0041a560
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call ebx
mov ecx, dword [ebp - 0x22c]
lea edx, [ebp - 0x23c]
push edx
mov edx, dword [ebp - 0x230]
push 0
push 0
push ecx
push edx
call eax
mov eax, dword [ebp - 0x23c]
dec eax
cmp eax, 0x2f
ja case.0x41da3e.5
movzx eax, byte [eax + 0x41de78]
jmp dword [eax*4 + 0x41de30]
push str.Ultimate_Edition
jmp 0x41daba
push str.Professional
jmp 0x41daba
push str.Home_Premium_Edition
jmp 0x41daba
push str.Home_Basic_Edition
jmp 0x41daba
push str.Enterprise_Edition
jmp 0x41daba
push str.Business_Edition
jmp 0x41daba
push str.Starter_Edition
jmp 0x41daba
push str.Cluster_Server_Edition
jmp 0x41daba
push str.Datacenter_Edition
jmp 0x41daba
push str.Datacenter_Edition__core_installation_
jmp 0x41daba
push str.Enterprise_Edition__core_installation_
jmp 0x41daba
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x41daba
push str.Small_Business_Server
jmp 0x41daba
push str.Small_Business_Server_Premium_Edition
jmp 0x41daba
push str.Standard_Edition
jmp 0x41daba
push str.Standard_Edition__core_installation_
jmp 0x41daba
push str.Web_Server_Edition
lea esi, [ebp - 0x110]
call fcn.0041a560
mov edi, 5
cmp dword [ebp - 0x230], edi
jne 0x41dc9e
cmp dword [ebp - 0x22c], 2
jne 0x41dc0b
call fcn.0041b9f0
push 0x59
test eax, eax
je 0x41daf6
call dword [0x6792c0]
jmp 0x41dafc
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x41db07
push str.Windows_Server_2003_R2
jmp 0x41db48
mov eax, dword [ebp - 0x19c]
test eax, 0x2000
je 0x41db1b
push str.Windows_Storage_Server_2003
jmp 0x41db48
test eax, 0x8000
je 0x41db29
push str.Windows_Home_Server
jmp 0x41db48
cmp byte [ebp - 0x19a], 1
jne 0x41db43
cmp word [ebp - 0x260], 9
jne 0x41db43
push str.Windows_XP_Professional_x64_Edition
jmp 0x41db48
push str.Windows_Server_2003
lea esi, [ebp - 0x110]
call fcn.0041a560
cmp byte [ebp - 0x19a], 1
je 0x41dbff
mov eax, dword [ebp - 0x260]
cmp ax, 6
jne 0x41db88
mov al, byte [ebp - 0x19c]
test al, al
jns 0x41db7d
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x41dbf4
test al, 2
je 0x41dbff
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x41dbf4
cmp ax, 9
jne 0x41dbb7
mov al, byte [ebp - 0x19c]
test al, al
jns 0x41db9f
push str.Datacenter_x64_Edition
jmp 0x41dbf4
lea esi, [ebp - 0x110]
test al, 2
je 0x41dbb0
push str.Enterprise_x64_Edition
jmp 0x41dbfa
push str.Standard_x64_Edition
jmp 0x41dbfa
mov eax, dword [ebp - 0x19c]
test eax, 0x4000
je 0x41dbcb
push str.Compute_Cluster_Edition
jmp 0x41dbf4
test al, al
jns 0x41dbd6
push str.Datacenter_Edition
jmp 0x41dbf4
test al, 2
je 0x41dbe1
push str.Enterprise_Edition
jmp 0x41dbf4
test eax, 0x400
je 0x41dbef
push str.Web_Edition
jmp 0x41dbf4
push str.Standard_Edition
lea esi, [ebp - 0x110]
call fcn.0041a560
cmp dword [ebp - 0x230], edi
jne 0x41dc9e
cmp dword [ebp - 0x22c], 1
jne 0x41dc49
push str.Windows_XP
lea esi, [ebp - 0x110]
call fcn.0041a560
test dword [ebp - 0x19c], 0x200
je 0x41dc37
push str.Home_Edition
jmp 0x41dc3c
push str.Professional
call fcn.0041a560
cmp dword [ebp - 0x230], edi
jne 0x41dc9e
cmp dword [ebp - 0x22c], 0
jne 0x41dc9e
push str.Windows_2000
lea esi, [ebp - 0x110]
call fcn.0041a560
cmp byte [ebp - 0x19a], 1
jne 0x41dc72
push str.Professional
jmp 0x41dc93
mov al, byte [ebp - 0x19c]
test al, al
jns 0x41dc83
push str.Datacenter_Server
jmp 0x41dc93
test al, 2
je 0x41dc8e
push str.Advanced_Server
jmp 0x41dc93
push str.Server
lea esi, [ebp - 0x110]
call fcn.0041a560
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x41dccb
push 0x616b0c
lea esi, [ebp - 0x110]
call fcn.0041a560
lea edx, [ebp - 0x220]
push edx
call fcn.0041a560
mov eax, dword [ebp - 0x228]
push eax
push str.__build__d_
mov ecx, 0x50
lea edi, [ebp - 0x160]
call fcn.0041a5b0
add esp, 8
mov ecx, edi
push ecx
lea esi, [ebp - 0x110]
call fcn.0041a560
cmp dword [ebp - 0x230], 6
jb 0x41dd29
mov eax, dword [ebp - 0x260]
cmp ax, 9
jne 0x41dd14
push str._64_bit
jmp 0x41dd1e
test ax, ax
jne 0x41dd29
push str._32_bit
lea esi, [ebp - 0x110]
call fcn.0041a560
mov ebx, 0xf
lea eax, [ebp - 0x110]
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x16c], 0
mov byte [ebp - 0x17c], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41dd50
sub eax, edx
push eax
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x17c]
call fcn.00405f10
mov dword [ebp - 4], 0
lea edx, [ebp - 0x17c]
lea ecx, [ebp - 0x198]
call fcn.0041e290
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x238]
mov edi, eax
call fcn.00406850
mov byte [ebp - 4], 0
cmp dword [ebp - 0x184], 8
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
jb 0x41ddb4
mov eax, dword [ebp - 0x198]
push eax
call esi
add esp, 4
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x184], 7
mov dword [ebp - 0x188], edi
mov word [ebp - 0x198], cx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x168], 0x10
jb 0x41ddeb
mov edx, dword [ebp - 0x17c]
push edx
call esi
add esp, 4
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x16c], edi
mov byte [ebp - 0x17c], 0
mov al, 1
jmp 0x41de12
push 7
push 0x615ec4
mov ecx, esi
call fcn.00406180
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00546bdc
mov esp, ebp
pop ebp
ret