Function at 0x419d30
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x4721cd
mov eax, dword fs:[0]
push eax
sub esp, 0x304
mov eax, dword [0x4aaeb0]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4aaeb0]
xor eax, esp
push eax
lea eax, [esp + 0x318]
mov dword fs:[0], eax
xor eax, eax
xor esi, esi
push 0x11c
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
lea eax, [esp + 0xd8]
push esi
push eax
mov dword [esp + 0x2c], esi
xor ebx, ebx
call fcn.0045a220
add esp, 0xc
lea ecx, [esp + 0xd4]
push ecx
mov dword [esp + 0xd8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, esi
jne 0x419e5d
push 0x4d
push str.._srcutil_npWinVersionUtil.cpp_1139__:__npz::cmn::npWinVersionUtil::checkup_
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], esi
mov word [esp + 0x30], si
call fcn.00401540
mov dword [esp + 0x320], esi
mov dword [esp + 0x18], esi
push 0xffffffffffffffff
lea esi, [esp + 0x1c]
mov byte [esp + 0x324], 1
call fcn.00417410
mov ebx, dword [esp + 0x2c]
mov edi, 8
add esp, 4
cmp dword [esp + 0x3c], edi
jae 0x419e25
lea ebx, [esp + 0x28]
mov esi, dword [esp + 0x18]
push esi
mov ecx, 2
call fcn.0041aaa0
add esp, 4
push esi
call fcn.0045332d
add esp, 4
cmp dword [esp + 0x3c], edi
jb 0x419e53
mov edx, dword [esp + 0x28]
push edx
call fcn.00452ad1
add esp, 4
mov eax, 1
jmp 0x41a6c9
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, esi
mov dword [esp + 0x1c], eax
je 0x419e7e
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
sub esp, 0x11c
mov ecx, 0x47
lea esi, [esp + 0x1f0]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00419310
add esp, 0x11c
test eax, eax
je 0x419edd
mov ecx, 0x47
lea esi, [esp + 0xd4]
lea edi, [esp + 0x1f4]
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0xd4]
call fcn.00419390
test eax, eax
je 0x419edd
mov ecx, 0x47
lea esi, [esp + 0x1f4]
lea edi, [esp + 0xd4]
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x1ee]
mov ecx, dword [esp + 0xe4]
mov esi, dword [esp + 0xdc]
mov edi, dword [esp + 0xd8]
movzx ebp, word [esp + 0xe0]
mov byte [esp + 0x17], al
lea eax, [esp + 0xe8]
mov dword [0x4af3d4], ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419f15
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0xec]
push edx
mov ecx, 0x4ac3ac
call fcn.00401540
test ebx, ebx
movzx eax, word [esp + 0x1e8]
mov dword [0x4af3d8], eax
je 0x419f51
lea ecx, [esp + 0x40]
push ecx
call ebx
jmp 0x419f5c
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [esp + 0x40]
push ebp
push esi
push edi
push str._u._u._u
mov ebx, 0x4ac374
mov dword [esp + 0x28], eax
call fcn.004184c0
mov eax, dword [0x4af3d4]
mov ebx, 2
add esp, 0x10
cmp eax, ebx
jne 0x41a539
cmp edi, 4
jbe case.0x41a1a0.4
cmp edi, 6
jne 0x41a2e7
cmp esi, 1
jne 0x41a017
cmp byte [esp + 0x17], 1
jne 0x419ff9
mov eax, dword [esp + 0x18]
cmp ax, 9
jne 0x419fd2
push 0x4ac390
mov edx, str.Microsoft_Windows_7_64Bit
mov dword [0x4af3d0], 0x11
call fcn.00403640
jmp case.0x41a1a0.4
test ax, ax
jne case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_7_32Bit
mov dword [0x4af3d0], 0x10
call fcn.00403640
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_Server_2008_R2
mov dword [0x4af3d0], 0xf
call fcn.00403640
jmp case.0x41a1a0.4
cmp esi, ebx
jne 0x41a08f
cmp byte [esp + 0x17], 1
jne 0x41a071
mov eax, dword [esp + 0x18]
cmp ax, 9
jne 0x41a04a
push 0x4ac390
mov edx, str.Microsoft_Windows_8_64Bit
mov dword [0x4af3d0], 0x14
call fcn.00403640
jmp case.0x41a1a0.4
test ax, ax
jne case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_8_32Bit
mov dword [0x4af3d0], 0x13
call fcn.00403640
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_Server_2012
mov dword [0x4af3d0], 0x15
call fcn.00403640
jmp case.0x41a1a0.4
cmp esi, 3
jne 0x41a108
cmp byte [esp + 0x17], 1
jne 0x41a0ea
mov eax, dword [esp + 0x18]
cmp ax, 9
jne 0x41a0c3
push 0x4ac390
mov edx, str.Microsoft_Windows_8.1_64Bit
mov dword [0x4af3d0], 0x17
call fcn.00403640
jmp case.0x41a1a0.4
test ax, ax
jne case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_8.1_32Bit
mov dword [0x4af3d0], 0x16
call fcn.00403640
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_Server_2012_R2
mov dword [0x4af3d0], 0x18
call fcn.00403640
jmp case.0x41a1a0.4
test esi, esi
jne case.0x41a1a0.4
cmp byte [esp + 0x17], 1
jne 0x41a148
mov eax, dword [esp + 0x18]
cmp ax, 9
jne 0x41a132
mov dword [0x4af3d0], 0xd
mov edx, str.Microsoft_Windows_Vista_64Bit
jmp 0x41a157
test ax, ax
jne 0x41a161
mov dword [0x4af3d0], 0xc
mov edx, str.Microsoft_Windows_Vista_32Bit
jmp 0x41a157
mov dword [0x4af3d0], 0xe
mov edx, str.Microsoft_Windows_Server_2008
push 0x4ac390
call fcn.00403640
mov ecx, dword [esp + 0x1c]
push str.GetProductInfo
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je case.0x41a1a0.4
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
push 6
mov dword [esp + 0x2c], 0
call eax
mov eax, dword [esp + 0x18]
add eax, 0xffffffff
cmp eax, 0x18
ja case.0x41a1a0.4
jmp dword [eax*4 + 0x41a6f4]
push 0x4ac390
mov edx, str._Ultimate_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Home_Premium_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Home_Basic_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Enterprise_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Business_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Starter_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Cluster_Server_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Datacenter_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Datacenter_Edition__core_installation_
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Enterprise_Edition__core_installation_
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Enterprise_Edition_for_Itanium_based_Systems
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Small_Business_Server
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Small_Business_Server_Premium_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Standard_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Standard_Edition__core_installation_
call fcn.0040dfc0
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str._Web_Server_Edition
call fcn.0040dfc0
jmp case.0x41a1a0.4
cmp edi, 5
jne 0x41a509
sub esi, 0
je 0x41a399
sub esi, 1
je 0x41a35f
sub esi, 1
jne case.0x41a1a0.4
mov al, byte [esp + 0x17]
cmp al, 1
jne 0x41a339
cmp word [esp + 0x18], 9
jne case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_XP_Professional_x64_Edition
mov dword [0x4af3d0], 0xa
call fcn.00403640
jmp case.0x41a1a0.4
cmp al, 3
jne case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_.NET_Server_2003_family
mov dword [0x4af3d0], 0xb
call fcn.00403640
jmp case.0x41a1a0.4
test dword [esp + 0x1ec], 0x200
mov dword [0x4af3d0], 9
push 0x4ac390
je 0x41a38a
mov edx, str.Microsoft_Windows_XP_Home_Edition
call fcn.00403640
jmp case.0x41a1a0.4
mov edx, str.Microsoft_Windows_XP_Professional
call fcn.00403640
jmp case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_2000
mov dword [0x4af3d0], 8
call fcn.00403640
mov al, byte [esp + 0x17]
cmp al, 1
jne 0x41a41a
cmp word [esp + 0x18], 9
je case.0x41a1a0.4
test dword [esp + 0x1ec], 0x200
jne case.0x41a1a0.4
push 0x4ac390
mov ecx, str.Professional
lea edi, [esp + 0x28]
call fcn.0041a760
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, 0x4ac390
mov dword [esp + 0x32c], ebx
call fcn.004016a0
mov ecx, edi
mov dword [esp + 0x320], 0xffffffff
call fcn.00401510
jmp case.0x41a1a0.4
cmp al, 3
je 0x41a426
cmp al, bl
jne case.0x41a1a0.4
mov al, byte [esp + 0x1ec]
test al, al
push 0x4ac390
jns 0x41a47b
mov ecx, str.Datacenter_Server
lea edi, [esp + 0x84]
call fcn.0041a760
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, 0x4ac390
mov dword [esp + 0x32c], 3
call fcn.004016a0
mov ecx, edi
mov dword [esp + 0x320], 0xffffffff
call fcn.00401510
jmp case.0x41a1a0.4
test bl, al
je 0x41a4c4
mov ecx, str.Advanced_Server
lea edi, [esp + 0xa0]
call fcn.0041a760
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, 0x4ac390
mov dword [esp + 0x32c], 4
call fcn.004016a0
mov ecx, edi
mov dword [esp + 0x320], 0xffffffff
call fcn.00401510
jmp case.0x41a1a0.4
mov ecx, str.Server
lea edi, [esp + 0xbc]
call fcn.0041a760
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, 0x4ac390
mov dword [esp + 0x32c], 5
call fcn.004016a0
mov ecx, edi
mov dword [esp + 0x320], 0xffffffff
call fcn.00401510
jmp case.0x41a1a0.4
cmp edi, 3
jne case.0x41a1a0.4
cmp esi, 0x33
jne case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft__Server_3.51
mov dword [0x4af3d0], 6
call fcn.00403640
jmp case.0x41a1a0.4
cmp eax, 1
jne 0x41a639
cmp edi, 4
jne case.0x41a1a0.4
test esi, esi
jne 0x41a5b9
mov ax, word [esp + 0xea]
cmp ax, 0x43
je 0x41a589
lea ecx, [ebp - 0x3b6]
cmp ecx, 0x82
ja 0x41a589
push 0x4ac390
mov edx, str.Microsoft_Windows_95
mov dword [0x4af3d0], 1
call fcn.00403640
jmp case.0x41a1a0.4
cmp ebp, 0x438
jbe case.0x41a1a0.4
cmp ax, 0x43
jne case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_95_OSR2
mov dword [0x4af3d0], ebx
call fcn.00403640
jmp case.0x41a1a0.4
cmp esi, 0xa
jne 0x41a619
cmp word [esp + 0xea], 0x41
je 0x41a5f6
add ebp, 0xfffff832
cmp ebp, 0xb8
ja case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_98
mov dword [0x4af3d0], 3
call fcn.00403640
jmp case.0x41a1a0.4
cmp ebp, 0x887
jb case.0x41a1a0.4
push 0x4ac390
mov edx, str.Microsoft_Windows_98SE
mov dword [0x4af3d0], 4
call fcn.00403640
jmp case.0x41a1a0.4
cmp esi, 0x5a
jne case.0x41a1a0.4
push 0x4ac390
mov edx, str._Microsoft_Windows_Millennium_Edition
mov dword [0x4af3d0], 5
call fcn.00403640
jmp case.0x41a1a0.4
cmp eax, 3
jne case.0x41a1a0.4
push 0x12
push str.Microsoft_Win32_CE
mov ecx, 0x4ac390
mov dword [0x4af3d0], 0x12
call fcn.00401540
xor eax, eax
cmp dword [0x4af3d0], eax
jne 0x41a6c5
push 0x4d
push str.._srcutil_npWinVersionUtil.cpp_1463__:__npz::cmn::npWinVersionUtil::checkup_
lea ecx, [esp + 0x6c]
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], eax
mov word [esp + 0x70], ax
call fcn.00401540
push 0xffffffffffffffff
lea edx, [esp + 0x68]
push 1
push edx
mov dword [esp + 0x32c], 6
call fcn.004175f0
add esp, 0xc
cmp dword [esp + 0x7c], 8
jb 0x419e53
mov eax, dword [esp + 0x68]
push eax
call fcn.00452ad1
add esp, 4
mov eax, 1
jmp 0x41a6c9
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x318]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.00452816
add esp, 0x310
ret