Function at 0x416356
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x24
lea eax, [ebp - 0xd4]
push 0
push eax
call fcn.005117f0
add esp, 0xc
mov esi, 0x9c
push esi
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.005117f0
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4163c8
push str._GetLastError_
push str.:4:GetOSDescription___FAILED:_GetVersionEx___FAILED:__s
call fcn.004265da
pop ecx
pop ecx
mov eax, 0x5dce00
jmp 0x416946
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x4163f2
lea ecx, [ebp - 0xd4]
push ecx
call eax
jmp 0x4163ff
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, 0x5dce00
mov eax, edi
call fcn.004c3ab2
cmp dword [ebp - 0x98], 2
mov eax, dword [ebp - 0xa4]
jne 0x41685e
cmp eax, 4
jbe 0x416861
cmp eax, 0xa
jne 0x41647c
cmp dword [ebp - 0xa0], 0
jne 0x4167f5
and dword [ebp - 0xac], 0
cmp byte [ebp - 0xe], 1
jne 0x41644d
push str.Windows_10
jmp 0x416452
push str.Windows_Server_2016
push edi
call fcn.005123f0
pop ecx
pop ecx
lea ecx, [ebp - 0xac]
call fcn.00415cc5
cmp dword [ebp - 0xac], 0
je 0x416651
push str._UAC_Enabled
jmp 0x416656
cmp eax, 6
jne 0x41665e
cmp dword [ebp - 0xa0], 3
ja 0x4167f5
mov eax, dword [ebp - 0xa0]
and dword [ebp - 0xac], 0
test eax, eax
jne 0x4164c0
cmp byte [ebp - 0xe], 1
jne 0x4164b9
push str.Windows_Vista
push edi
call fcn.005123f0
jmp 0x41653c
push str.Windows_Server_2008
jmp 0x4164ae
cmp eax, 1
jne 0x4164e3
cmp byte [ebp - 0xe], 1
mov eax, 0x200
jne 0x4164dc
push str.Windows_7
call fcn.004c5375
jmp 0x41653d
push str.Windows_7_Server
jmp 0x4164d5
cmp eax, 2
jne 0x416501
cmp byte [ebp - 0xe], 1
mov eax, 0x200
jne 0x4164fa
push str.Windows_8
jmp 0x4164d5
push str.Windows_Server_2012
jmp 0x4164d5
cmp eax, 3
mov eax, 0x200
jne 0x41651f
cmp byte [ebp - 0xe], 1
jne 0x416518
push str.Windows_8.1
jmp 0x4164d5
push str.Windows_Server_2012_R2
jmp 0x4164d5
cmp byte [ebp - 0xe], 1
push dword [ebp - 0xa0]
jne 0x416532
push str.Unknown_Windows_Minor_ver__d
jmp 0x416537
push str.Unknown_Server_Minor_ver__d
call fcn.004c5375
pop ecx
pop ecx
push str.GetProductInfo
push str.kernel32.dll
call esi
push eax
call ebx
test eax, eax
jne 0x416559
mov dword [ebp - 0xb0], eax
jmp 0x416576
lea ecx, [ebp - 0xb0]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
call eax
mov eax, dword [ebp - 0xb0]
cmp eax, 0xa
ja 0x4165c5
je case.0x416580.4
dec eax
cmp eax, 8
ja case.0x416580.5
jmp dword [eax*4 + 0x416956]
push str.Ultimate_Edition
jmp 0x41661d
push str.Home_Premium_Edition
jmp 0x41661d
push str.Home_Basic_Edition
jmp 0x41661d
push str.Enterprise_Edition
jmp 0x41661d
push str.Business_Edition
jmp 0x41661d
push str.Datacenter_Edition
jmp 0x41661d
push str.Small_Business_Server
jmp 0x41661d
push str.Standard_Edition
jmp 0x41661d
cmp eax, 0xf
ja 0x4165fd
je 0x4165f6
sub eax, 0xb
je 0x4165ef
dec eax
je 0x4165e8
dec eax
je 0x4165e1
dec eax
jne case.0x416580.5
push str.Enterprise_Edition__core_installation_
jmp 0x41661d
push str.Standard_Edition__core_installation_
jmp 0x41661d
push str.Datacenter_Edition__core_installation_
jmp 0x41661d
push str.Starter_Edition
jmp 0x41661d
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x41661d
sub eax, 0x11
je 0x416618
dec eax
je 0x416611
sub eax, 7
jne case.0x416580.5
push str.Small_Business_Server_Premium_Edition
jmp 0x41661d
push str.Cluster_Server_Edition
jmp 0x41661d
push str.Web_Server_Edition
push edi
call fcn.005123f0
pop ecx
pop ecx
cmp word [ebp - 0xd4], 9
jne 0x416639
push str.__64_bit
jmp 0x416452
cmp word [ebp - 0xd4], 0
jne 0x41645a
push str.__32_bit
jmp 0x416452
push str._No_UAC
push edi
call fcn.005123f0
pop ecx
pop ecx
cmp dword [ebp - 0xa4], 5
jne 0x4167f5
cmp dword [ebp - 0xa0], 2
jne 0x416773
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x41668b
push str.Windows_Server_2003_R2_
jmp 0x4166c5
cmp word [ebp - 0x10], 0x2000
jne 0x41669a
push str.Windows_Storage_Server_2003
jmp 0x4166c5
cmp word [ebp - 0x10], 0x8000
jne 0x4166a9
push str.Windows_Home_Server
jmp 0x4166c5
cmp byte [ebp - 0xe], 1
jne 0x4166c0
cmp word [ebp - 0xd4], 9
jne 0x4166c0
push str.Windows_XP_Professional_x64_Edition
jmp 0x4166c5
push str.Windows_Server_2003_
push edi
call fcn.005123f0
cmp byte [ebp - 0xe], 1
pop ecx
pop ecx
je 0x416766
cmp word [ebp - 0xd4], 6
jne 0x4166fb
test byte [ebp - 0x10], 0x80
je 0x4166ee
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x41675e
test byte [ebp - 0x10], 2
je 0x416766
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x41675e
cmp word [ebp - 0xd4], 9
jne 0x416726
test byte [ebp - 0x10], 0x80
je 0x416712
push str.Datacenter_x64_Edition
jmp 0x41675e
test byte [ebp - 0x10], 2
je 0x41671f
push str.Enterprise_x64_Edition
jmp 0x41675e
push str.Standard_x64_Edition
jmp 0x41675e
mov eax, dword [ebp - 0x10]
test ax, 0x4000
je 0x416736
push str.Compute_Cluster_Edition
jmp 0x41675e
test al, al
jns 0x416741
push str.Datacenter_Edition
jmp 0x41675e
test al, 2
je 0x41674c
push str.Enterprise_Edition
jmp 0x41675e
test ax, 0x400
je 0x416759
push str.Web_Edition
jmp 0x41675e
push str.Standard_Edition
push edi
call fcn.005123f0
pop ecx
pop ecx
cmp dword [ebp - 0xa4], 5
jne 0x4167f5
cmp dword [ebp - 0xa0], 1
mov esi, str.Professional
jne 0x4167af
push str.Windows_XP
push edi
call fcn.005123f0
test word [ebp - 0x10], 0x200
pop ecx
pop ecx
je 0x41679d
push str.Home_Edition
jmp 0x41679e
push esi
push edi
call fcn.005123f0
cmp dword [ebp - 0xa4], 5
pop ecx
pop ecx
jne 0x4167f5
cmp dword [ebp - 0xa0], 0
jne 0x4167f5
push str.Windows_2000
push edi
call fcn.005123f0
cmp byte [ebp - 0xe], 1
pop ecx
pop ecx
jne 0x4167ce
push esi
jmp 0x4167ed
test byte [ebp - 0x10], 0x80
je 0x4167db
push str.Datacenter_Server
jmp 0x4167ed
test byte [ebp - 0x10], 2
je 0x4167e8
push str.Advanced_Server
jmp 0x4167ed
push str.Server
push edi
call fcn.005123f0
pop ecx
pop ecx
mov edx, edi
call fcn.004c3b34
test eax, eax
je 0x41681f
push dword [ebp - 0xa0]
push dword [ebp - 0xa4]
push str.UNKNOWN_OS__d__d
push 0x200
push edi
call fcn.004c53b7
add esp, 0x14
lea edx, [ebp - 0x94]
call fcn.004c3b34
test eax, eax
jne 0x416849
push 0x530248
push edi
call fcn.005123f0
lea eax, [ebp - 0x94]
push eax
push edi
call fcn.005123f0
add esp, 0x10
push dword [ebp - 0x9c]
mov eax, 0x200
push str.__build__d_
jmp 0x4168f7
cmp eax, 4
jne 0x4168a1
cmp dword [ebp - 0xa0], 0x5a
jne 0x416873
push str.Windows_Me
jmp 0x4168b4
cmp dword [ebp - 0xa0], 0xa
jne 0x416883
push str.Windows_98
jmp 0x4168b4
cmp dword [ebp - 0x98], 2
mov ecx, 0x200
mov eax, edi
jne 0x41689a
push str.Windows_NT
jmp 0x4168bb
push str.Windows_95
jmp 0x4168bb
cmp eax, 3
ja 0x4168c1
cmp dword [ebp - 0x98], 0
jne 0x4168c1
push str.Win32s_on_Windows_3.1
mov ecx, 0x200
mov eax, edi
call fcn.004c3b66
pop ecx
push dword [ebp - 0x9c]
mov esi, 0x200
push 0x53a610
mov eax, esi
call fcn.004c5375
pop ecx
pop ecx
lea edx, [ebp - 0x94]
call fcn.004c3b34
test eax, eax
jne 0x4168fe
lea eax, [ebp - 0x94]
push eax
push 0x53a614
mov eax, esi
call fcn.004c5375
pop ecx
pop ecx
mov edx, edi
call fcn.004c3b34
test eax, eax
je 0x416944
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
push dword [ebp - 0xa4]
push str.:LogResources___FAILED:_OS_Detection_FAILED:_Major_ver__u__Minor_ver__u__Build__u
call fcn.004265da
push dword [ebp - 0xa0]
push dword [ebp - 0xa4]
push str.UNKNOWNID_d__d
push 0x200
push edi
call fcn.004c53b7
add esp, 0x24
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret