Function at 0x409040
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x198
mov eax, dword [0x419060]
xor eax, esp
mov dword [esp + 0x194], eax
push ebp
mov ebp, dword [esp + 0x1a0]
xor eax, eax
push esi
push edi
push 0x11c
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x3c]
push eax
call fcn.00410d00
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x4090d2
lea edx, [esp + 0x10]
push edx
call eax
jmp 0x4090dd
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x44], 2
jne 0x409c46
mov eax, dword [esp + 0x38]
cmp eax, 4
jbe 0x409c46
mov ecx, dword [str.Microsoft]
mov dword [ebp], ecx
mov edx, dword [0x417304]
mov dword [ebp + 4], edx
mov cx, word [0x417308]
mov word [ebp + 8], cx
mov dl, byte [0x41730a]
mov byte [ebp + 0xa], dl
cmp eax, 6
jne case.0x409279.5
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4091c2
mov eax, ebp
dec eax
cmp byte [esp + 0x14e], 1
jne 0x409180
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409140
mov ecx, dword [str.Windows_Vista]
mov dword [eax], ecx
mov edx, dword [0x417310]
mov dword [eax + 4], edx
mov ecx, dword [0x417314]
mov dword [eax + 8], ecx
mov dx, word [0x417318]
mov word [eax + 0xc], dx
mov cl, byte [0x41731a]
mov byte [eax + 0xe], cl
jmp 0x409240
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409180
mov edx, dword [str.Windows_Server_2008]
mov dword [eax], edx
mov ecx, dword [0x417320]
mov dword [eax + 4], ecx
mov edx, dword [0x417324]
mov dword [eax + 8], edx
mov ecx, dword [0x417328]
mov dword [eax + 0xc], ecx
mov edx, dword [0x41732c]
mov dword [eax + 0x10], edx
mov cl, byte [0x417330]
mov byte [eax + 0x14], cl
jmp 0x409240
cmp eax, 1
jne 0x409240
mov eax, ebp
dec eax
cmp byte [esp + 0x14e], 1
jne 0x409203
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4091d4
mov edx, dword [str.Windows_7]
mov dword [eax], edx
mov ecx, dword [0x417338]
mov dword [eax + 4], ecx
mov dx, word [0x41733c]
mov word [eax + 8], dx
mov cl, byte [0x41733e]
mov byte [eax + 0xa], cl
jmp 0x409240
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409203
mov edx, dword [str.Windows_Server_2008_R2]
mov dword [eax], edx
mov ecx, dword [0x417344]
mov dword [eax + 4], ecx
mov edx, dword [0x417348]
mov dword [eax + 8], edx
mov ecx, dword [0x41734c]
mov dword [eax + 0xc], ecx
mov edx, dword [0x417350]
mov dword [eax + 0x10], edx
mov ecx, dword [0x417354]
mov dword [eax + 0x14], ecx
push str.GetProductInfo
push str.kernel32.dll
call esi
push eax
call edi
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x3c]
push 0
push 0
push ecx
push edx
call eax
mov eax, dword [esp + 0xc]
dec eax
cmp eax, 0x2f
ja case.0x409279.5
movzx eax, byte [eax + 0x409cbc]
jmp dword [eax*4 + 0x409c70]
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409283
mov ecx, dword [str.Ultimate_Edition]
mov dword [eax], ecx
mov edx, dword [0x41736c]
mov dword [eax + 4], edx
mov ecx, dword [0x417370]
mov dword [eax + 8], ecx
mov edx, dword [0x417374]
mov dword [eax + 0xc], edx
mov cl, byte [0x417378]
mov byte [eax + 0x10], cl
jmp case.0x409279.5
mov eax, ebp
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4092c0
mov edx, dword [str.Professional]
mov dword [eax], edx
mov ecx, dword [0x417380]
mov dword [eax + 4], ecx
mov edx, dword [0x417384]
mov dword [eax + 8], edx
mov cl, byte [0x417388]
mov byte [eax + 0xc], cl
jmp case.0x409279.5
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4092f3
mov edx, dword [str.Home_Premium_Edition]
mov dword [eax], edx
mov ecx, dword [0x417390]
mov dword [eax + 4], ecx
mov edx, dword [0x417394]
mov dword [eax + 8], edx
mov ecx, dword [0x417398]
mov dword [eax + 0xc], ecx
mov edx, dword [0x41739c]
mov dword [eax + 0x10], edx
mov cl, byte [0x4173a0]
mov byte [eax + 0x14], cl
jmp case.0x409279.5
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409338
mov edx, dword [str.Home_Basic_Edition]
mov dword [eax], edx
mov ecx, dword [0x4173a8]
mov dword [eax + 4], ecx
mov edx, dword [0x4173ac]
mov dword [eax + 8], edx
mov ecx, dword [0x4173b0]
mov dword [eax + 0xc], ecx
mov dx, word [0x4173b4]
mov word [eax + 0x10], dx
mov cl, byte [0x4173b6]
jmp 0x40964c
mov eax, ebp
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409380
mov edx, dword [str.Enterprise_Edition]
mov dword [eax], edx
mov ecx, dword [0x4173bc]
mov dword [eax + 4], ecx
mov edx, dword [0x4173c0]
mov dword [eax + 8], edx
mov ecx, dword [0x4173c4]
mov dword [eax + 0xc], ecx
mov dx, word [0x4173c8]
mov word [eax + 0x10], dx
mov cl, byte [0x4173ca]
jmp 0x40964c
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4093c4
mov edx, dword [str.Business_Edition]
mov dword [eax], edx
mov ecx, dword [0x4173d0]
mov dword [eax + 4], ecx
mov edx, dword [0x4173d4]
mov dword [eax + 8], edx
mov ecx, dword [0x4173d8]
mov dword [eax + 0xc], ecx
mov dl, byte [0x4173dc]
mov byte [eax + 0x10], dl
jmp case.0x409279.5
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409400
mov ecx, dword [str.Starter_Edition]
mov dword [eax], ecx
mov edx, dword [0x4173e4]
mov dword [eax + 4], edx
mov ecx, dword [0x4173e8]
mov dword [eax + 8], ecx
mov edx, dword [0x4173ec]
mov dword [eax + 0xc], edx
jmp case.0x409279.5
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409433
mov ecx, 5
mov esi, str.Cluster_Server_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x409279.5
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409452
mov ecx, dword [str.Datacenter_Edition]
mov dword [eax], ecx
mov edx, dword [0x41740c]
mov dword [eax + 4], edx
mov ecx, dword [0x417410]
mov dword [eax + 8], ecx
mov edx, dword [0x417414]
mov dword [eax + 0xc], edx
mov cx, word [0x417418]
mov word [eax + 0x10], cx
mov dl, byte [0x41741a]
mov byte [eax + 0x12], dl
jmp case.0x409279.5
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4094a0
mov ecx, 9
mov esi, str.Datacenter_Edition__core_installation_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x409279.5
mov eax, ebp
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4094c0
mov ecx, dword [str.Enterprise_Edition]
mov dword [eax], ecx
mov edx, dword [0x4173bc]
mov dword [eax + 4], edx
mov ecx, dword [0x4173c0]
mov dword [eax + 8], ecx
mov edx, dword [0x4173c4]
mov dword [eax + 0xc], edx
mov cx, word [0x4173c8]
mov word [eax + 0x10], cx
mov dl, byte [0x4173ca]
mov byte [eax + 0x12], dl
jmp case.0x409279.5
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409507
mov ecx, 9
mov esi, str.Enterprise_Edition__core_installation_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x409279.5
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409526
mov ecx, 0xb
mov esi, str.Enterprise_Edition_for_Itanium_based_Systems
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x409279.5
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409543
mov ecx, dword [str.Small_Business_Server]
mov dword [eax], ecx
mov edx, dword [0x4174a0]
mov dword [eax + 4], edx
mov ecx, dword [0x4174a4]
mov dword [eax + 8], ecx
mov edx, dword [0x4174a8]
mov dword [eax + 0xc], edx
mov ecx, dword [0x4174ac]
mov dword [eax + 0x10], ecx
mov dx, word [0x4174b0]
mov word [eax + 0x14], dx
jmp case.0x409279.5
mov edi, ebp
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409590
mov ecx, 9
mov esi, str.Small_Business_Server_Premium_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp case.0x409279.5
mov eax, ebp
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4095b0
mov ecx, dword [str.Standard_Edition]
mov dword [eax], ecx
mov edx, dword [0x4174e0]
mov dword [eax + 4], edx
mov ecx, dword [0x4174e4]
mov dword [eax + 8], ecx
mov edx, dword [0x4174e8]
mov dword [eax + 0xc], edx
mov cl, byte [0x4174ec]
mov byte [eax + 0x10], cl
jmp case.0x409279.5
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4095f0
mov ecx, 9
mov esi, str.Standard_Edition__core_installation_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x409279.5
mov eax, ebp
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409610
mov edx, dword [str.Web_Server_Edition]
mov dword [eax], edx
mov ecx, dword [0x41751c]
mov dword [eax + 4], ecx
mov edx, dword [0x417520]
mov dword [eax + 8], edx
mov ecx, dword [0x417524]
mov dword [eax + 0xc], ecx
mov dx, word [0x417528]
mov word [eax + 0x10], dx
mov cl, byte [0x41752a]
mov byte [eax + 0x12], cl
cmp dword [esp + 0x38], 5
jne 0x409b55
mov eax, dword [esp + 0x3c]
push ebx
cmp eax, 2
jne 0x409a30
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x150]
test eax, eax
je 0x40969c
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409682
mov ecx, 6
mov esi, str.Windows_Server_2003_R2_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40977f
test ebx, 0x2000
je 0x4096c0
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4096a7
mov ecx, 7
mov esi, str.Windows_Storage_Server_2003
rep movsd dword es:[edi], dword [esi]
jmp 0x40977f
test ebx, 0x8000
je 0x409706
mov eax, ebp
dec eax
jmp 0x4096d0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4096d0
mov ecx, dword [str.Windows_Home_Server]
mov dword [eax], ecx
mov ecx, dword [0x417568]
mov dword [eax + 4], ecx
mov ecx, dword [0x41756c]
mov dword [eax + 8], ecx
mov ecx, dword [0x417570]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x417574]
mov dword [eax + 0x10], ecx
jmp 0x40977f
cmp byte [esp + 0x152], 1
jne 0x409739
cmp dx, 9
jne 0x409739
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409720
mov ecx, 9
mov esi, str.Windows_XP_Professional_x64_Edition
rep movsd dword es:[edi], dword [esi]
jmp 0x4099b8
mov eax, ebp
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409740
mov ecx, dword [str.Windows_Server_2003_]
mov dword [eax], ecx
mov ecx, dword [0x4175a0]
mov dword [eax + 4], ecx
mov ecx, dword [0x4175a4]
mov dword [eax + 8], ecx
mov ecx, dword [0x4175a8]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x4175ac]
mov dword [eax + 0x10], ecx
mov cx, word [0x4175b0]
mov word [eax + 0x14], cx
cmp byte [esp + 0x152], 1
je 0x4099b8
cmp dx, 6
jne 0x4097e0
test bl, bl
jns 0x4097ba
mov edi, ebp
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4097a0
mov ecx, 0xb
mov esi, str.Datacenter_Edition_for_Itanium_based_Systems
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4099b8
test bl, 2
je 0x4099b8
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4097c6
mov ecx, 0xb
mov esi, str.Enterprise_Edition_for_Itanium_based_Systems
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4099b8
cmp dx, 9
jne 0x409876
test bl, bl
jns 0x40980d
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4097f1
mov ecx, 5
mov esi, str.Datacenter_x64_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4099b8
test bl, 2
je 0x409831
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x409815
mov ecx, 5
mov esi, str.Enterprise_x64_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4099b8
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409834
mov edx, dword [str.Standard_x64_Edition]
mov dword [eax], edx
mov ecx, dword [0x417618]
mov dword [eax + 4], ecx
mov edx, dword [0x41761c]
mov dword [eax + 8], edx
mov ecx, dword [0x417620]
mov dword [eax + 0xc], ecx
mov edx, dword [0x417624]
mov dword [eax + 0x10], edx
mov cl, byte [0x417628]
mov byte [eax + 0x14], cl
jmp 0x4099b8
mov eax, ebp
dec eax
test ebx, 0x4000
je 0x4098c3
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409881
mov edx, dword [str.Compute_Cluster_Edition]
mov dword [eax], edx
mov ecx, dword [0x417630]
mov dword [eax + 4], ecx
mov edx, dword [0x417634]
mov dword [eax + 8], edx
mov ecx, dword [0x417638]
mov dword [eax + 0xc], ecx
mov edx, dword [0x41763c]
mov dword [eax + 0x10], edx
mov ecx, dword [0x417640]
mov dword [eax + 0x14], ecx
jmp 0x4099b8
test bl, bl
jns 0x40990b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4098c7
mov edx, dword [str.Datacenter_Edition]
mov dword [eax], edx
mov ecx, dword [0x41740c]
mov dword [eax + 4], ecx
mov edx, dword [0x417410]
mov dword [eax + 8], edx
mov ecx, dword [0x417414]
mov dword [eax + 0xc], ecx
mov dx, word [0x417418]
mov word [eax + 0x10], dx
mov cl, byte [0x41741a]
mov byte [eax + 0x12], cl
jmp 0x4099b8
test bl, 2
je 0x409954
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409910
mov edx, dword [str.Enterprise_Edition]
mov dword [eax], edx
mov ecx, dword [0x4173bc]
mov dword [eax + 4], ecx
mov edx, dword [0x4173c0]
mov dword [eax + 8], edx
mov ecx, dword [0x4173c4]
mov dword [eax + 0xc], ecx
mov dx, word [0x4173c8]
mov word [eax + 0x10], dx
mov cl, byte [0x4173ca]
mov byte [eax + 0x12], cl
jmp 0x4099b8
test ebx, 0x400
je 0x409984
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409960
mov edx, dword [str.Web_Edition]
mov dword [eax], edx
mov ecx, dword [0x417648]
mov dword [eax + 4], ecx
mov edx, dword [0x41764c]
mov dword [eax + 8], edx
jmp 0x4099b8
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409984
mov ecx, dword [str.Standard_Edition]
mov dword [eax], ecx
mov edx, dword [0x4174e0]
mov dword [eax + 4], edx
mov ecx, dword [0x4174e4]
mov dword [eax + 8], ecx
mov edx, dword [0x4174e8]
mov dword [eax + 0xc], edx
mov cl, byte [0x4174ec]
mov byte [eax + 0x10], cl
cmp dword [esp + 0x3c], 5
jne 0x409b54
mov eax, dword [esp + 0x40]
cmp eax, 1
jne 0x409a4a
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4099d3
mov edx, dword [str.Windows_XP]
mov dword [eax], edx
mov ecx, dword [0x417654]
mov dword [eax + 4], ecx
mov edx, dword [0x417658]
mov dword [eax + 8], edx
mov eax, ebp
dec eax
test ebx, 0x200
je 0x409a40
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409a00
mov ecx, dword [str.Home_Edition]
mov dword [eax], ecx
mov edx, dword [0x417660]
mov dword [eax + 4], edx
mov ecx, dword [0x417664]
mov dword [eax + 8], ecx
mov dl, byte [0x417668]
mov byte [eax + 0xc], dl
jmp 0x409b54
mov ebx, dword [esp + 0x150]
jmp 0x4099c7
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409a40
jmp 0x409a98
test eax, eax
jne 0x409b54
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409a55
mov ecx, dword [str.Windows_2000]
mov dword [eax], ecx
mov edx, dword [0x417670]
mov dword [eax + 4], edx
mov ecx, dword [0x417674]
mov dword [eax + 8], ecx
mov dx, word [0x417678]
mov word [eax + 0xc], dx
mov eax, ebp
dec eax
cmp byte [esp + 0x152], 1
jne 0x409ac0
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409a90
mov ecx, dword [str.Professional]
mov dword [eax], ecx
mov edx, dword [0x417380]
mov dword [eax + 4], edx
mov ecx, dword [0x417384]
mov dword [eax + 8], ecx
mov dl, byte [0x417388]
mov byte [eax + 0xc], dl
jmp 0x409b54
test bl, bl
jns 0x409afc
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409ac4
mov ecx, dword [str.Datacenter_Server]
mov dword [eax], ecx
mov edx, dword [0x417680]
mov dword [eax + 4], edx
mov ecx, dword [0x417684]
mov dword [eax + 8], ecx
mov edx, dword [0x417688]
mov dword [eax + 0xc], edx
mov cx, word [0x41768c]
mov word [eax + 0x10], cx
jmp 0x409b54
test bl, 2
je 0x409b30
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409b01
mov edx, dword [str.Advanced_Server]
mov dword [eax], edx
mov ecx, dword [0x417694]
mov dword [eax + 4], ecx
mov edx, dword [0x417698]
mov dword [eax + 8], edx
mov ecx, dword [0x41769c]
mov dword [eax + 0xc], ecx
jmp 0x409b54
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409b30
mov edx, dword [str.Server]
mov dword [eax], edx
mov cx, word [0x4176a4]
mov word [eax + 4], cx
mov dl, byte [0x4176a6]
mov byte [eax + 6], dl
pop ebx
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x154]
push str.__build__d_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x15c]
add esp, 0xc
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409b80
mov edi, ebp
sub eax, ecx
mov esi, ecx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409b90
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [esp + 0x38], 6
rep movsb byte es:[edi], byte [esi]
jb 0x409c29
mov eax, dword [esp + 0x10]
cmp ax, 9
jne 0x409bff
dec ebp
mov eax, ebp
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409bc0
mov edx, dword [str.__64_bit]
mov dword [eax], edx
mov ecx, dword [0x4176b8]
mov dword [eax + 4], ecx
mov dl, byte [0x4176bc]
pop edi
pop esi
mov byte [eax + 8], dl
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0040b281
add esp, 0x198
ret
test ax, ax
jne 0x409c29
dec ebp
mov eax, ebp
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x409c07
mov ecx, dword [str.__32_bit]
mov dword [eax], ecx
mov edx, dword [0x4176c4]
mov dword [eax + 4], edx
mov cl, byte [0x4176c8]
mov byte [eax + 8], cl
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0040b281
add esp, 0x198
ret
push str.This_sample_does_not_support_this_version_of_Windows._n
call fcn.0040ba77
mov ecx, dword [esp + 0x1a4]
add esp, 4
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0040b281
add esp, 0x198
ret