Function at 0x411698
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1ec
mov eax, dword [0x4441c0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
push 9
pop ecx
xor eax, eax
mov esi, 0x11c
push esi
lea edi, [ebp - 0x174]
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x148]
push eax
call fcn.0041ca70
add esp, 0xc
lea eax, [ebp - 0x148]
push eax
mov dword [ebp - 0x148], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4116f1
xor eax, eax
inc eax
jmp 0x411ad8
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411719
lea ecx, [ebp - 0x174]
push ecx
call eax
jmp 0x411726
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x138], 2
jne 0x411acb
cmp dword [ebp - 0x144], 4
jbe 0x411acb
mov esi, 0x100
push SysReAllocString
mov eax, str.Microsoft
mov ecx, esi
mov edx, ebx
call fcn.004011b1
cmp dword [ebp - 0x144], 6
jne case.0x4117ee.5
cmp dword [ebp - 0x140], 0
jne 0x411788
cmp byte [ebp - 0x2e], 1
mov ecx, esi
jne 0x41177d
push str.Windows_Vista
jmp 0x411782
push str.Windows_Server_2008
push ebx
call fcn.004010b3
cmp dword [ebp - 0x140], 1
jne 0x4117ab
cmp byte [ebp - 0x2e], 1
mov ecx, esi
jne 0x4117a0
push str.Windows_7
jmp 0x4117a5
push str.Windows_Server_2008_R2
push ebx
call fcn.004010b3
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x14c]
push ecx
push 0
push 0
push dword [ebp - 0x140]
push dword [ebp - 0x144]
call eax
mov eax, dword [ebp - 0x14c]
cmp eax, 0xa
ja 0x411833
je case.0x4117ee.4
dec eax
cmp eax, 8
ja case.0x4117ee.5
jmp dword [eax*4 + 0x411aec]
push str.Ultimate_Edition
jmp 0x41188b
push str.Home_Premium_Edition
jmp 0x41188b
push str.Home_Basic_Edition
jmp 0x41188b
push str.Enterprise_Edition
jmp 0x41188b
push str.Business_Edition
jmp 0x41188b
push str.Datacenter_Edition
jmp 0x41188b
push str.Small_Business_Server
jmp 0x41188b
push str.Standard_Edition
jmp 0x41188b
cmp eax, 0xf
ja 0x41186b
je 0x411864
sub eax, 0xb
je 0x41185d
dec eax
je 0x411856
dec eax
je 0x41184f
dec eax
jne case.0x4117ee.5
push str.Enterprise_Edition__core_installation_
jmp 0x41188b
push str.Standard_Edition__core_installation_
jmp 0x41188b
push str.Datacenter_Edition__core_installation_
jmp 0x41188b
push str.Starter_Edition
jmp 0x41188b
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x41188b
sub eax, 0x11
je 0x411886
dec eax
je 0x41187f
sub eax, 7
jne case.0x4117ee.5
push str.Small_Business_Server_Premium_Edition
jmp 0x41188b
push str.Cluster_Server_Edition
jmp 0x41188b
push str.Web_Server_Edition
push ebx
mov ecx, esi
call fcn.004010b3
cmp dword [ebp - 0x144], 5
jne 0x411a35
cmp dword [ebp - 0x140], 2
jne 0x4119b2
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4118c0
push str.Windows_Server_2003_R2_
jmp 0x411900
mov eax, 0x2000
cmp word [ebp - 0x30], ax
jne 0x4118d2
push str.Windows_Storage_Server_2003
jmp 0x411900
mov eax, 0x8000
cmp word [ebp - 0x30], ax
jne 0x4118e4
push str.Windows_Home_Server
jmp 0x411900
cmp byte [ebp - 0x2e], 1
jne 0x4118fb
cmp word [ebp - 0x174], 9
jne 0x4118fb
push str.Windows_XP_Professional_x64_Edition
jmp 0x411900
push str.Windows_Server_2003_
push ebx
mov ecx, esi
call fcn.004010b3
cmp byte [ebp - 0x2e], 1
je 0x4119a5
cmp word [ebp - 0x174], 6
jne 0x411936
test byte [ebp - 0x30], 0x80
je 0x411929
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x41199d
test byte [ebp - 0x30], 2
je 0x4119a5
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x41199d
cmp word [ebp - 0x174], 9
jne 0x411963
test byte [ebp - 0x30], 0x80
je 0x41194d
push str.Datacenter_x64_Edition
jmp 0x41199d
test byte [ebp - 0x30], 2
mov ecx, esi
je 0x41195c
push str.Enterprise_x64_Edition
jmp 0x41199f
push str.Standard_x64_Edition
jmp 0x41199f
mov eax, dword [ebp - 0x30]
test eax, 0x4000
je 0x411974
push str.Compute_Cluster_Edition
jmp 0x41199d
test al, al
jns 0x41197f
push str.Datacenter_Edition
jmp 0x41199d
test al, 2
je 0x41198a
push str.Enterprise_Edition
jmp 0x41199d
test eax, 0x400
je 0x411998
push str.Web_Edition
jmp 0x41199d
push str.Standard_Edition
mov ecx, esi
push ebx
call fcn.004010b3
cmp dword [ebp - 0x144], 5
jne 0x411a35
cmp dword [ebp - 0x140], 1
mov edi, str.Professional
jne 0x4119ef
push str.Windows_XP
push ebx
mov ecx, esi
call fcn.004010b3
test dword [ebp - 0x30], 0x200
mov ecx, esi
je 0x4119df
push str.Home_Edition
jmp 0x4119e0
push edi
push ebx
call fcn.004010b3
cmp dword [ebp - 0x144], 5
jne 0x411a35
cmp dword [ebp - 0x140], 0
jne 0x411a35
push str.Windows_2000
push ebx
mov ecx, esi
call fcn.004010b3
cmp byte [ebp - 0x2e], 1
jne 0x411a0e
push edi
jmp 0x411a2d
test byte [ebp - 0x30], 0x80
je 0x411a1b
push str.Datacenter_Server
jmp 0x411a2d
test byte [ebp - 0x30], 2
je 0x411a28
push str.Advanced_Server
jmp 0x411a2d
push str.Server
push ebx
mov ecx, esi
call fcn.004010b3
lea eax, [ebp - 0x134]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x411a3e
sub eax, edx
sar eax, 1
je 0x411a6a
push 0x43b638
push ebx
mov ecx, esi
call fcn.004010b3
lea eax, [ebp - 0x134]
push eax
push ebx
mov ecx, esi
call fcn.004010b3
push dword [ebp - 0x13c]
lea edi, [ebp - 0x2c]
push str.__build__d_
push 0x50
pop ecx
call fcn.00401164
pop ecx
pop ecx
mov eax, edi
push eax
push ebx
mov ecx, esi
call fcn.004010b3
cmp dword [ebp - 0x144], 6
jb 0x4116e9
cmp word [ebp - 0x174], 9
jne 0x411aab
push str.__64_bit
jmp 0x411abe
cmp word [ebp - 0x174], 0
jne 0x4116e9
push str.__32_bit
push ebx
mov ecx, esi
call fcn.004010b3
jmp 0x4116e9
push str.This_sample_does_not_support_this_version_of_Windows._n
call fcn.0041c484
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.004195cf
add ebp, 0x78
leave
ret