Function at 0x401b80
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x544
mov eax, dword [0x421008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x428]
mov ebx, edx
push eax
mov esi, ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x544]
mov dword [ebp - 0x544], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401f60
push 0x400
lea eax, [ebp - 0x404]
push edi
push eax
call fcn.00408700
push dword [ebp - 0x53c]
lea eax, [ebp - 0x404]
push dword [ebp - 0x540]
push str.MajorVersion:_d__MinorVersion:_d
push eax
call fcn.00404d30
add esp, 0x1c
cmp word [ebp - 0x404], di
jne 0x401c07
xor ecx, ecx
jmp 0x401c1f
lea ecx, [ebp - 0x404]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401c10
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x404]
mov ecx, ebx
push eax
call fcn.00401870
mov eax, dword [ebp - 0x540]
add eax, 0xfffffffc
cmp eax, 6
ja case.0x401c40.7
jmp dword [eax*4 + 0x401f84]
mov eax, dword [ebp - 0x53c]
test eax, eax
je 0x401cbc
cmp eax, 0xa
je 0x401c9b
mov ecx, esi
cmp eax, 0x5a
je 0x401c7c
push str.Windows_UnKnow
call fcn.00401400
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push str.Windows_Me
call fcn.00401400
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push str.Windows_98
mov ecx, esi
call fcn.00401400
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x534]
cmp eax, 2
jne 0x401ce8
push str.Windows_NT_4.0
mov ecx, esi
call fcn.00401400
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x401cf9
push str.Windows_95
mov ecx, esi
call fcn.00401400
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x53c]
sub eax, 0
je 0x401e09
sub eax, 1
je 0x401dd7
sub eax, 1
je 0x401d4c
push str.Windows_unknow
mov ecx, esi
call fcn.00401400
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x42a], 1
jne 0x401d66
cmp word [ebp - 0x428], 9
jne 0x401d66
push str.Windows_XP_Professional_x64_Edition
jmp 0x401ddc
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call ebx
test eax, eax
jne 0x401d93
push str.Windows_Server_2003
mov ecx, esi
call fcn.00401400
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push 0x59
call ebx
mov ecx, esi
test eax, eax
je 0x401dba
push str.Windows_Server_2003_R2
call fcn.00401400
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push str.Windows_Server
call fcn.00401400
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push str.Windows_XP
mov ecx, esi
call fcn.00401400
cmp word [ebp - 0x430], 3
jb 0x401f4d
mov edi, 3
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push str.Windows_2000
mov ecx, esi
call fcn.00401400
mov edi, 2
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x53c]
mov edi, 3
mov ecx, esi
sub eax, 0
je 0x401ed6
sub eax, 1
je 0x401e8e
sub eax, 1
je 0x401e6c
push str.Windows_unknow
xor edi, edi
call fcn.00401400
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push str.Windows_8
call fcn.00401400
mov edi, 5
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x42a], 1
jne 0x401eb9
push 0x41d914
call fcn.00401400
mov edi, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push str.Windows_Server_2008_R2
call fcn.00401400
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x42a], 1
jne 0x401efc
push str.Windows_Vista
call fcn.00401400
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push str.Windows_Server_2008
call fcn.00401400
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push str.Windows_10
mov ecx, esi
mov edi, 6
call fcn.00401400
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push 0xe
push str.Windows_UnKnow
mov ecx, esi
xor edi, edi
call fcn.00401870
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040655e
mov esp, ebp
pop ebp
ret
push 0xe
push str.Windows_UnKnow
mov ecx, esi
call fcn.00401870
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040655e
mov esp, ebp
pop ebp
ret