Function at 0x41ce10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov eax, dword [0x4d100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1a4], esi
push str.ntdll.dll
mov dword [ebp - 0x1a4], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x41cea2
push pe_nt_image_headers32
lea eax, [ebp - 0x19c]
push 0
push eax
call fcn.00452b60
add esp, 0xc
mov dword [ebp - 0x1a0], 0x114
lea eax, [ebp - 0x1a0]
push eax
call edi
test eax, eax
jne 0x41cea2
mov ecx, dword [ebp - 0x19c]
cmp ecx, 0xa
jb 0x41cedd
cmp dword [ebp - 0x194], 0x55f0
jb 0x41cedd
mov ecx, dword [ebp - 0x198]
or ecx, 0xb00
jmp 0x41cee6
push pe_nt_image_headers32
lea eax, [ebp - 0x19c]
push 0
push eax
call fcn.00452b60
add esp, 0xc
mov dword [ebp - 0x1a0], 0x114
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je case.default.0x41cf3c
mov ecx, dword [ebp - 0x19c]
shl ecx, 8
or ecx, dword [ebp - 0x198]
mov eax, ecx
shr eax, 8
add eax, 0xfffffffb
cmp eax, 6
ja case.default.0x41cf3c
jmp dword [eax*4 + 0x41d0f4]
movzx eax, cl
sub eax, 0
je 0x41cf28
sub eax, 1
je 0x41cf1c
sub eax, 1
jne case.default.0x41cf3c
push 0xc
push str.Windows_2003
jmp 0x41d0c1
push 0xa
push str.Windows_XP
jmp 0x41d0c1
push 0xc
push str.Windows_2000
jmp 0x41d0c1
movzx eax, cl
cmp eax, 3
ja case.default.0x41cf3c
jmp dword [eax*4 + 0x41d110]
push 0xd
push str.Windows_Vista
jmp 0x41d0c1
push 9
push str.Windows_7
jmp 0x41d0c1
push 9
push str.Windows_8
jmp 0x41d0c1
push 0xb
push str.Windows_8.1
jmp 0x41d0c1
push 0xa
push str.Windows_10
jmp 0x41d0c1
push 0xa
push str.Windows_11
jmp 0x41d0c1
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x41d036
push pe_nt_image_headers32
lea eax, [ebp - 0x19c]
push 0
push eax
call fcn.00452b60
add esp, 0xc
mov dword [ebp - 0x1a0], 0x114
lea eax, [ebp - 0x1a0]
push eax
call edi
test eax, eax
jne 0x41d036
push dword [ebp - 0x198]
lea eax, [ebp - 0x88]
push dword [ebp - 0x19c]
push str.Windows__d._d
push eax
call fcn.00401480
lea ecx, [ebp - 0x88]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0xf
add esp, 0x10
mov byte [esi], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d020
sub ecx, edx
lea eax, [ebp - 0x88]
push ecx
push eax
jmp 0x41d0d8
push pe_nt_image_headers32
lea eax, [ebp - 0x19c]
push 0
push eax
call fcn.00452b60
add esp, 0xc
mov dword [ebp - 0x1a0], 0x114
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41d0ba
push dword [ebp - 0x198]
lea eax, [ebp - 0x88]
push dword [ebp - 0x19c]
push str.Windows__d._d
push eax
call fcn.00401480
lea ecx, [ebp - 0x88]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0xf
add esp, 0x10
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d0a7
sub ecx, edx
lea eax, [ebp - 0x88]
push ecx
push eax
jmp 0x41d0d8
push 7
push 0x4c8108
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, esi
call fcn.00411c40
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00450db2
mov esp, ebp
pop ebp
ret