Function at 0x401760
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40daea
mov eax, dword fs:[0]
push eax
sub esp, 0x1f8
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x204], esi
mov dword [ebp - 0x200], edi
mov dword [ebp - 0x1fc], ebx
lea eax, [ebp - 0x1f8]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov dword [ebp - 4], 1
push 0x80000002
mov dword [ebp - 0x1f8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x40186e
mov ebx, dword [ebp - 0x1f8]
push 0xc8
lea ecx, [ebp - 0xda]
push esi
push ecx
mov dword [ebp - 0x1fc], ebx
mov word [ebp - 0xdc], si
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [ebp - 0x1fc]
push edx
lea edi, [ebp - 0x1f8]
lea esi, [ebp - 0xdc]
mov dword [ebp - 0x1f8], 0x64
call fcn.00404570
test ebx, ebx
je 0x401835
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x1fc], ebx
cmp word [ebp - 0xdc], 0
je 0x401866
mov esi, dword [ebp - 0x200]
lea eax, [ebp - 0xdc]
push eax
mov ecx, esi
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t__]
test ebx, ebx
je 0x40185f
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x401a23
mov edi, dword [ebp - 0x200]
xor esi, esi
lea ecx, [ebp - 0x1f4]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
push 0x110
lea ecx, [ebp - 0x1ec]
push esi
mov byte [ebp - 4], 2
push ecx
mov dword [ebp - 0x1f0], 0x114
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [ebp - 0x1f0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x1e0]
sub eax, esi
je 0x4019dc
sub eax, 1
je 0x401948
sub eax, 1
jne 0x4019ed
mov eax, dword [ebp - 0x1ec]
cmp eax, 4
ja 0x4018df
push str.Microsoft_Windows_NT
jmp 0x4019e1
cmp eax, 5
jne 0x401916
mov eax, dword [ebp - 0x1e8]
cmp eax, esi
jne 0x4018f8
push str.Microsoft_Windows_2000
jmp 0x4019e1
cmp eax, 1
jne 0x401907
push str.Microsoft_Windows_XP
jmp 0x4019e1
cmp eax, 2
jne 0x40193e
push str.Microsoft_Windows_Server_2003
jmp 0x4019e1
cmp eax, 6
jne 0x40193e
mov eax, dword [ebp - 0x1e8]
cmp eax, esi
jne 0x40192f
push str.Microsoft_Windows_Vista
jmp 0x4019e1
cmp eax, 1
jne 0x40193e
push str.Microsoft_Windows_Longhorn_Server
jmp 0x4019e1
push str.Microsoft_Windows_Vista_Later
jmp 0x4019e1
cmp dword [ebp - 0x1ec], 4
jne 0x4019d5
mov eax, dword [ebp - 0x1e8]
cmp eax, esi
jne 0x401996
push str.Microsoft_Windows_95
lea ecx, [ebp - 0x1f4]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
mov ax, word [ebp - 0x1da]
cmp ax, 0x43
je 0x401983
cmp ax, 0x42
jne 0x4019ed
push str._OSR2
lea ecx, [ebp - 0x1f4]
call dword [0x40f0e8]
jmp 0x4019ed
cmp eax, 0xa
jne 0x4019c9
push str.Microsoft_Windows_98
lea ecx, [ebp - 0x1f4]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
cmp word [ebp - 0x1da], 0x41
jne 0x4019ed
push 0x40f84c
lea ecx, [ebp - 0x1f4]
call dword [0x40f0e8]
jmp 0x4019ed
cmp eax, 0x5a
jne 0x4019d5
push str.Microsoft_Windows_Me
jmp 0x4019e1
push str.Microsoft_Windows_Me_later
jmp 0x4019e1
push str.Microsoft_Win32s
lea ecx, [ebp - 0x1f4]
call dword [sym.imp.Common.dll_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__]
lea eax, [ebp - 0x1f4]
push eax
mov ecx, edi
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x204], 1
mov byte [ebp - 4], 1
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
cmp ebx, esi
je 0x401a21
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c926
mov esp, ebp
pop ebp
ret