Function at 0x401500
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x422ecb
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x42ea58]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push esi
push edi
mov eax, dword [0x42ea58]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
push str.CIniFile::GetOS
lea ecx, [esp + 0x14]
call fcn.00401120
xor ebx, ebx
push 0x9c
lea eax, [esp + 0x48]
push ebx
push eax
mov dword [esp + 0x104], ebx
mov dword [esp + 0x24], ebx
call fcn.00410d80
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], 0x9c
call esi
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x1c], edi
jne 0x4015bb
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x48], 0x94
call esi
test eax, eax
jne 0x4015bb
lea ecx, [esp + 0x10]
mov dword [esp + 0xf8], 0xffffffff
call fcn.004012d0
xor eax, eax
jmp 0x4018fd
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x4015f9
push str.IsWow64Process
push esi
call ebx
mov edi, eax
test edi, edi
je 0x4015ee
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x1c]
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
test eax, eax
je 0x401619
lea ecx, [esp + 0x20]
push ecx
call eax
jmp 0x401624
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x54]
sub eax, 2
je 0x40163c
mov dword [0x42fe50], 9
jmp 0x4018e1
mov ebx, 6
cmp dword [esp + 0x48], ebx
mov esi, 9
jne 0x4016df
cmp dword [esp + 0x4c], 0
jne 0x40179c
mov al, byte [esp + 0xde]
cmp al, 1
jne 0x401690
cmp dword [esp + 0x18], 0
je 0x40167f
push str.Microsoft_Windows_Vista_64
lea eax, [esp + 0x14]
mov dword [0x42fe50], ebx
push eax
jmp 0x4016d7
mov dword [0x42fe50], 5
push str.Microsoft_Windows_Vista_32
jmp 0x4016d2
cmp al, 3
jne 0x4016c7
cmp dword [esp + 0x18], 0
je 0x4016b1
push str.Microsoft_Windows_Server_2008_64
lea edx, [esp + 0x14]
mov dword [0x42fe50], 8
push edx
jmp 0x4016d7
push str.Microsoft_Windows_Server_2008_32
lea eax, [esp + 0x14]
mov dword [0x42fe50], 7
push eax
jmp 0x4016d7
mov dword [0x42fe50], esi
push str.Windows_Server__Longhorn_
lea ecx, [esp + 0x14]
push ecx
call fcn.00401410
add esp, 8
cmp dword [esp + 0x48], 5
jne 0x40179c
cmp dword [esp + 0x4c], 2
jne 0x40174f
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x40170f
push str.Microsoft_Windows_Server_2003__R2_
lea edx, [esp + 0x14]
mov dword [0x42fe50], esi
push edx
jmp 0x401740
cmp dword [esp + 0x18], 0
je 0x40172c
push str.Microsoft_Windows_XP_Professional_x64_Edition
lea eax, [esp + 0x14]
mov dword [0x42fe50], 4
push eax
jmp 0x401740
push str.Microsoft_Windows_Server_2003_
lea ecx, [esp + 0x14]
mov dword [0x42fe50], 3
push ecx
call fcn.00401410
add esp, 8
cmp dword [esp + 0x48], 5
jne 0x40179c
cmp dword [esp + 0x4c], 1
jne 0x401779
lea edx, [esp + 0x10]
push str.Microsoft_Windows_XP
push edx
mov dword [0x42fe50], 2
call fcn.00401410
add esp, 8
cmp dword [esp + 0x48], 5
jne 0x40179c
cmp dword [esp + 0x4c], 0
jne 0x40179c
lea eax, [esp + 0x10]
push str.Microsoft_Windows_2000
push eax
mov dword [0x42fe50], 1
call fcn.00401410
add esp, 8
test edi, edi
je 0x4018e1
mov al, byte [esp + 0xde]
cmp al, 1
jne 0x4017e0
cmp word [esp + 0x20], si
je 0x4018e1
test dword [esp + 0xdc], 0x200
je 0x4017d6
push str.Home_Edition
lea ecx, [esp + 0x14]
push ecx
jmp 0x4018d9
push str.Professional
jmp 0x4018d4
cmp al, 3
je 0x4017ec
cmp al, 2
jne 0x4018e1
cmp dword [esp + 0x48], 5
jne 0x4018e1
mov eax, dword [esp + 0x4c]
cmp eax, 2
jne 0x4018a4
cmp word [esp + 0x20], bx
mov eax, dword [esp + 0xdc]
jne 0x40183f
test al, al
jns 0x401822
push str.Datacenter_Edition_for_Itanium_based_Systems
lea eax, [esp + 0x14]
push eax
jmp 0x401830
test al, 2
je 0x40183f
push str.Enterprise_Edition_for_Itanium_based_Systems
lea ecx, [esp + 0x14]
push ecx
call fcn.00401410
mov eax, dword [esp + 0xe4]
add esp, 8
cmp dword [esp + 0x18], 0
je 0x401870
test al, al
jns 0x401854
push str.Datacenter_x64_Edition
jmp 0x4018d4
test al, 2
je 0x401864
push str.Enterprise_x64_Edition
lea eax, [esp + 0x14]
push eax
jmp 0x4018d9
push str.Standard_x64_Edition
lea ecx, [esp + 0x14]
push ecx
jmp 0x4018d9
test al, al
jns 0x40187b
push str.Datacenter_Edition
jmp 0x4018d4
test al, 2
je 0x40188b
push str.Enterprise_Edition
lea eax, [esp + 0x14]
push eax
jmp 0x4018d9
cmp ax, 0x400
jne 0x40189d
push str.Web_Edition
lea ecx, [esp + 0x14]
push ecx
jmp 0x4018d9
push str.Standard_Edition
jmp 0x4018d4
test eax, eax
jne 0x4018e1
mov al, byte [esp + 0xdc]
test al, al
jns 0x4018bf
push str.Datacenter_Server
lea eax, [esp + 0x14]
push eax
jmp 0x4018d9
test al, 2
je 0x4018cf
push str.Advanced_Server
lea ecx, [esp + 0x14]
push ecx
jmp 0x4018d9
push str.Server
lea edx, [esp + 0x14]
push edx
call fcn.00401410
add esp, 8
mov esi, dword [0x42fe50]
lea ecx, [esp + 0x10]
mov dword [esp + 0xf8], 0xffffffff
call fcn.004012d0
mov eax, esi
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.00410afa
mov esp, ebp
pop ebp
ret