Function at 0x41b530
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x4d1028]
mov esi, ecx
xor ebx, ebx
xor eax, ebp
mov dword [esp + 0x158], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov byte [ecx + 8], 0
mov dword [ecx + 0x3c], 0xf
mov dword [ecx + 0x38], 0
mov byte [ecx + 0x28], 0
mov dword [ecx + 0x40], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
push 0x490782
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov ecx, 0
je 0x41b5c7
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push ecx
push edi
call eax
xor edx, edx
cmp dword [esp + 0x3c], 0
mov ecx, 2
setne dl
test eax, eax
cmovne ecx, edx
mov eax, 0xf
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], eax
mov byte [esi + 0x50], 0
lea eax, [esp + 0x40]
push 0x118
push 0
push eax
call fcn.00472a40
add esp, 0xc
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x40]
lea edi, [esp + 0x10]
mov ecx, edi
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esi + 0x14], eax
call fcn.0041b230
mov ecx, edi
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call fcn.0041b250
test eax, eax
jne 0x41b65a
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
lea ecx, [esp + 0x10]
push eax
push 0x490fc8
call fcn.0041b300
mov ebx, dword [esp + 0xc]
lea edi, [esp + 0x10]
mov ecx, edi
call fcn.0041b2d0
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0xc]
test eax, eax
jle 0x41b68b
cmp edx, 5
jne 0x41b68b
xor ecx, ecx
cmp eax, 1
mov eax, 2
sete cl
sub eax, ecx
jmp 0x41b6fa
cmp edx, 0xa
je 0x41b6a5
cmp edx, 6
jne 0x41b6ed
cmp eax, 3
lea ecx, [eax + 3]
mov eax, 6
cmovb eax, ecx
jmp 0x41b6fa
mov eax, 7
cmp ecx, 0x295a
jl 0x41b6fa
mov eax, 8
cmp ecx, 0x3839
jl 0x41b6fa
mov eax, 9
cmp ecx, 0x3ad7
jl 0x41b6fa
mov eax, 0xa
cmp ecx, 0x3fab
jl 0x41b6fa
xor edx, edx
cmp ecx, 0x42ee
mov eax, 0xc
setl dl
sub eax, edx
jmp 0x41b6fa
xor ecx, ecx
cmp edx, 6
mov eax, 0xd
cmovle eax, ecx
mov dword [esi], eax
lea ebx, [esi + 0x28]
movzx eax, word [esp + 0x150]
mov dword [esi + 0x20], eax
movzx eax, word [esp + 0x152]
mov dword [esi + 0x24], eax
lea eax, [esp + 0x50]
cmp word [esp + 0x50], 0
je 0x41b73d
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax]
cmp word [esp + ecx*2 + 0x52], 0
lea ecx, [ecx + 1]
jne 0x41b730
jmp 0x41b73f
xor ecx, ecx
push ecx
push eax
push edi
call fcn.00412740
add esp, 0xc
cmp edi, ebx
je 0x41b7c0
mov eax, dword [esi + 0x3c]
cmp eax, 0x10
jb 0x41b789
mov ecx, dword [ebx]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x41b77b
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41b91b
add eax, 0x24
mov ecx, edx
mov edi, eax
push edi
push ecx
call fcn.0046d651
add esp, 8
lea edi, [esp + 0x10]
movsd xmm0, qword [esp + 0x20]
movsd qword [ebx + 0x10], xmm0
movsd xmm0, qword [esp + 0x10]
movsd xmm1, qword [esp + 0x18]
movsd qword [ebx + 8], xmm1
movsd qword [ebx], xmm0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
jmp 0x41b7fe
mov eax, dword [esp + 0x24]
cmp eax, 0x10
jb 0x41b7fe
mov ecx, dword [esp + 0x10]
mov ebx, edi
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x41b7f2
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x41b91b
add eax, 0x24
mov ecx, edx
mov edi, eax
push edi
push ecx
call fcn.0046d651
add esp, 8
mov edi, ebx
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push edi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [esp + 0x10]
test ax, ax
je 0x41b83e
cmp ax, 6
je 0x41b837
cmp ax, 9
jne 0x41b843
mov ecx, 1
jmp 0x41b840
mov ecx, 2
jmp 0x41b840
xor ecx, ecx
mov dword [esi + 0x40], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x44], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x48], ecx
mov ecx, dword [esp + 0x40]
cmp ecx, 5
je 0x41b8ae
cmp ecx, 0xa
je 0x41b868
cmp ecx, 6
jne case.0x41b89e.2
push 0x490782
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push dword [esp + 0x50]
push dword [esp + 0x50]
call eax
mov eax, dword [esp + 0xc]
dec eax
cmp eax, 0x81
ja case.0x41b89e.2
jmp dword [eax*4 + 0x490fd0]
mov dword [esi + 0x1c], 3
jmp 0x41b8fa
mov ecx, dword [esp + 0x44]
cmp ecx, 1
je 0x41b8e0
cmp ecx, 2
jne case.0x41b89e.2
cmp ax, 9
jne 0x41b8cc
cmp byte [esp + 0x156], 1
je case.0x41b89e.1
cmp word [esp + 0x154], 0
js case.0x41b89e.2
mov dword [esi + 0x1c], 2
jmp 0x41b8fa
test byte [esp + 0x155], 2
jne case.0x41b89e.2
mov dword [esi + 0x1c], 1
jmp 0x41b8fa
mov dword [esi + 0x1c], 0
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.0046d691
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x1c], 4
jmp 0x41b8fa
call fcn.004798ba