Function at 0x414760
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x57aa54]
xor eax, ebp
mov dword [ebp - 0x38], eax
push 0x24
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.0049ce00
add esp, 0xc
push 0x11c
push 0
lea ecx, [ebp - 0x158]
push ecx
call fcn.0049ce00
add esp, 0xc
mov dword [ebp - 0x158], 0x11c
lea edx, [ebp - 0x158]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4147c3
mov eax, 1
jmp 0x414e4c
push str.GetNativeSystemInfo
push 0x4c07e4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4147ec
lea eax, [ebp - 0x34]
push eax
call dword [ebp - 0x10]
jmp 0x4147f6
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x148], 2
jne 0x414e37
cmp dword [ebp - 0x154], 4
jbe 0x414e37
push str.Microsoft
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.004169e0
cmp dword [ebp - 0x154], 6
jne case.0x414902.4
cmp dword [ebp - 0x150], 0
jne 0x41486a
movzx eax, byte [ebp - 0x3e]
cmp eax, 1
jne 0x414857
push str.Windows_Vista
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp 0x41486a
push str.Windows_Server_2008
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
cmp dword [ebp - 0x150], 1
jne 0x4148a4
movzx eax, byte [ebp - 0x3e]
cmp eax, 1
jne 0x414891
push str.Windows_7
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp 0x4148a4
push str.Windows_Server_2008_R2
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
push str.GetProductInfo
push 0x4c0964
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x150]
push ecx
mov edx, dword [ebp - 0x154]
push edx
call dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1fc], eax
mov ecx, dword [ebp - 0x1fc]
sub ecx, 1
mov dword [ebp - 0x1fc], ecx
cmp dword [ebp - 0x1fc], 0x18
ja case.0x414902.4
mov edx, dword [ebp - 0x1fc]
jmp dword [edx*4 + 0x414e5c]
push str.Ultimate_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp case.0x414902.4
push str.Home_Premium_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp case.0x414902.4
push str.Home_Basic_Edition
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
jmp case.0x414902.4
push 0x4c09f8
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp case.0x414902.4
push str.Business_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp case.0x414902.4
push str.Starter_Edition
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
jmp case.0x414902.4
push str.Cluster_Server_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp case.0x414902.4
push 0x4c0a94
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp case.0x414902.4
push str.Datacenter_Edition__core_installation_
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
jmp case.0x414902.4
push 0x4c0b10
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp case.0x414902.4
push str.Enterprise_Edition__core_installation_
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp case.0x414902.4
push 0x4c0b88
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
jmp case.0x414902.4
push str.Small_Business_Server
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp case.0x414902.4
push str.Small_Business_Server_Premium_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp case.0x414902.4
push 0x4c0c5c
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
jmp case.0x414902.4
push str.Standard_Edition__core_installation_
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp case.0x414902.4
push str.Web_Server_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
cmp dword [ebp - 0x154], 5
jne 0x414c8b
cmp dword [ebp - 0x150], 2
jne 0x414c8b
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x414ac5
push str.Windows_Server_2003_R2_
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
jmp 0x414b40
movzx eax, word [ebp - 0x40]
cmp eax, 0x2000
jne 0x414ae5
push str.Windows_Storage_Server_2003
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp 0x414b40
movzx edx, word [ebp - 0x40]
cmp edx, 0x8000
jne 0x414b06
push str.Windows_Home_Server
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp 0x414b40
movzx ecx, byte [ebp - 0x3e]
cmp ecx, 1
jne 0x414b2d
movzx edx, word [ebp - 0x34]
cmp edx, 9
jne 0x414b2d
push str.Windows_XP_Professional_x64_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp 0x414b40
push str.Windows_Server_2003_
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
movzx edx, byte [ebp - 0x3e]
cmp edx, 1
je 0x414c8b
movzx eax, word [ebp - 0x34]
cmp eax, 6
jne 0x414b98
movzx ecx, word [ebp - 0x40]
and ecx, 0x80
je 0x414b77
push str.Datacenter_Edition_for_Itanium_based_Systems
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
jmp 0x414b93
movzx eax, word [ebp - 0x40]
and eax, 2
je 0x414b93
push str.Enterprise_Edition_for_Itanium_based_Systems
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp 0x414c8b
movzx edx, word [ebp - 0x34]
cmp edx, 9
jne 0x414bf7
movzx eax, word [ebp - 0x40]
and eax, 0x80
je 0x414bc1
push str.Datacenter_x64_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp 0x414bf2
movzx edx, word [ebp - 0x40]
and edx, 2
je 0x414bdf
push str.Enterprise_x64_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp 0x414bf2
push str.Standard_x64_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp 0x414c8b
movzx edx, word [ebp - 0x40]
and edx, 0x4000
je 0x414c18
push str.Compute_Cluster_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp 0x414c8b
movzx ecx, word [ebp - 0x40]
and ecx, 0x80
je 0x414c39
push str.Datacenter_Edition
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
jmp 0x414c8b
movzx eax, word [ebp - 0x40]
and eax, 2
je 0x414c57
push str.Enterprise_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp 0x414c8b
movzx edx, word [ebp - 0x40]
and edx, 0x400
je 0x414c78
push str.Web_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp 0x414c8b
push str.Standard_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
cmp dword [ebp - 0x154], 5
jne 0x414ce3
cmp dword [ebp - 0x150], 1
jne 0x414ce3
push str.Windows_XP
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
movzx eax, word [ebp - 0x40]
and eax, 0x200
je 0x414cd0
push str.Home_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp 0x414ce3
push 0x4c1034
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
cmp dword [ebp - 0x154], 5
jne 0x414d7f
cmp dword [ebp - 0x150], 0
jne 0x414d7f
push str.Windows_2000
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
movzx ecx, byte [ebp - 0x3e]
cmp ecx, 1
jne 0x414d2e
push str.Professional
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
jmp 0x414d7f
movzx eax, word [ebp - 0x40]
and eax, 0x80
je 0x414d4e
push str.Datacenter_Server
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
jmp 0x414d7f
movzx edx, word [ebp - 0x40]
and edx, 2
je 0x414d6c
push str.Advanced_Server
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
jmp 0x414d7f
push str.Server
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
lea edx, [ebp - 0x144]
push edx
call fcn.0049ca64
add esp, 4
test eax, eax
jbe 0x414dba
push 0x4c10dc
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
lea ecx, [ebp - 0x144]
push ecx
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
mov eax, dword [ebp - 0x14c]
push eax
push 0x4c10e0
push 0x50
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.00416a90
add esp, 0x10
lea edx, [ebp - 0x1f8]
push edx
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00416a30
cmp dword [ebp - 0x154], 6
jb 0x414e2e
movzx ecx, word [ebp - 0x34]
cmp ecx, 9
jne 0x414e13
push str.__64_bit
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
jmp 0x414e2e
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x414e2e
push str.__32_bit
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416a30
mov eax, 1
jmp 0x414e4c
push str.This_version_of_Windows_does_not_supported.
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00416a30
xor eax, eax
mov ecx, dword [ebp - 0x38]
xor ecx, ebp
call fcn.0049c63c
mov esp, ebp
pop ebp
ret