Function at 0x41dd65
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
mov edi, 0x94
xor ebx, ebx
push edi
lea eax, [ebp - 0xa4]
push ebx
mov esi, ecx
push eax
call fcn.00421740
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x41ddad
inc dword [0x47a1d0]
jmp 0x41e0ff
push 0x47a8ec
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00419e1f
push 9
mov ecx, esi
call fcn.00419e97
cmp dword [ebp - 0x94], ebx
mov edi, str._SP_d
jne 0x41dde4
push ebx
push str.Windows_32s
mov ecx, esi
call fcn.00419ee6
jmp 0x41df24
cmp dword [ebp - 0x94], 1
jne 0x41de4e
cmp dword [ebp - 0x9c], 0x5a
je 0x41de16
cmp dword [ebp - 0xa0], 4
jne 0x41de16
cmp dword [ebp - 0x9c], ebx
push ebx
jne 0x41de0f
push str.Windows_95
jmp 0x41de1c
push str.Windows_98
jmp 0x41de1c
push ebx
push str.Windows_ME
mov ecx, esi
call fcn.00419ee6
mov eax, dword [ebp - 0x98]
and eax, 0xffff
push eax
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push str.___d._d._d_
push esi
call fcn.0041a30f
add esp, 0x14
jmp 0x41df24
cmp dword [ebp - 0x94], 2
jne 0x41df24
cmp dword [ebp - 0xa0], 5
jne 0x41de93
cmp dword [ebp - 0x9c], ebx
jne 0x41de74
push ebx
push str.Windows_2000
jmp 0x41de83
cmp dword [ebp - 0x9c], 1
push ebx
jne 0x41de8c
push str.Windows_XP
mov ecx, esi
call fcn.00419ee6
jmp 0x41dead
push str.Windows_2003
jmp 0x41de83
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push str.Windows_NT__d._d
push esi
call fcn.0041a30f
add esp, 0x10
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ebx
push eax
push 1
push ebx
push str.SystemCurrentControlSetControlWindows
push 0x80000002
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41df24
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push str.CSDVersion
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41df06
mov eax, dword [ebp - 0xc]
cmp ax, 0xff
mov dword [ebp - 4], eax
jbe 0x41df06
xor ecx, ecx
mov cl, ah
movzx ax, cl
mov word [ebp - 4], ax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 4], bx
jbe 0x41df24
movzx eax, word [ebp - 4]
push eax
push edi
push esi
call fcn.0041a30f
add esp, 0xc
cmp dword [0x47a048], ebx
push ebx
jne 0x41df34
push 0x429950
jmp 0x41df39
push str._tWin
mov ecx, esi
call fcn.00419ee6
mov al, byte [0x47a048]
test al, 1
je 0x41df64
cmp dword [0x47a04c], 0x3e8
push ebx
jbe 0x41df5d
push str.95__OSR2__
jmp 0x41df8d
push 0x429938
jmp 0x41df8d
test al, 2
je 0x41df83
cmp dword [0x47a04c], 0x8ad
push ebx
jbe 0x41df7c
push str.98_SE_
jmp 0x41df8d
push 0x42992c
jmp 0x41df8d
test al, 8
je 0x41df94
push ebx
push 0x429928
mov ecx, esi
call fcn.00419ee6
test byte [0x47a048], 4
je 0x41e017
cmp dword [0x47a050], 5
jne 0x41dfcb
mov eax, dword [0x47a054]
cmp eax, ebx
jne 0x41dfbe
push ebx
push str.2000
mov ecx, esi
call fcn.00419ee6
jmp 0x41dff6
cmp eax, 1
jne 0x41dff6
push ebx
push 0x42991c
jmp 0x41dfb5
push ebx
push 0x429918
mov ecx, esi
call fcn.00419ee6
mov eax, dword [0x47a050]
cmp eax, ebx
je 0x41dff6
push dword [0x47a054]
push eax
push str.__d._d
push esi
call fcn.0041a30f
add esp, 0x10
mov eax, dword [0x47a058]
cmp eax, ebx
jbe 0x41e00a
push eax
push edi
push esi
call fcn.0041a30f
add esp, 0xc
push ebx
push 0x42990c
mov ecx, esi
call fcn.00419ee6
mov eax, dword [esi]
push 1
dec eax
mov ecx, esi
push eax
call fcn.0041a248
push 9
mov ecx, esi
call fcn.00419e97
mov eax, dword [0x47a048]
xor bl, bl
cmp dword [ebp - 0x94], 1
jne 0x41e07c
mov edx, dword [ebp - 0x98]
mov ecx, dword [0x47a04c]
test al, 1
je 0x41e05b
mov edi, edx
and edi, 0xffff
cmp edi, ecx
jb 0x41e05b
inc bl
test al, 2
je 0x41e0c4
and edx, 0xffff
cmp edx, 0x7ce
jb 0x41e0c4
cmp edx, ecx
jb 0x41e0c4
cmp dword [ebp - 0x9c], 1
jb 0x41e0c4
mov bl, 1
cmp dword [ebp - 0x94], 2
jne 0x41e0c4
mov ecx, dword [0x47a050]
mov edx, eax
and edx, 4
je 0x41e09a
cmp dword [ebp - 0xa0], ecx
ja 0x41e0c2
test edx, edx
je 0x41e0c4
cmp dword [ebp - 0xa0], ecx
jne 0x41e0c4
mov ecx, dword [0x47a054]
cmp dword [ebp - 0x9c], ecx
ja 0x41e0c2
jne 0x41e0c4
movzx ecx, word [ebp - 4]
cmp ecx, dword [0x47a058]
jb 0x41e0c4
mov bl, 1
test eax, eax
jne 0x41e0ca
mov bl, 1
test bl, bl
je 0x41e0d5
push 0x47a7cc
jmp 0x41e0e0
inc dword [0x47a1c8]
push 0x47a7b4
mov ecx, esi
call fcn.00419f64
mov ecx, esi
call fcn.0041ab9e
push eax
push 0
push 0x180
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
leave
ret