Function at 0x41b990
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf8
push ebx
push ebp
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x18]
push edi
lea ecx, [ebx + 0x18]
push 0x4573bc
mov byte [esp + 0x17], 1
call dword [eax + 4]
push 0x81
call fcn.00445d54
mov esi, eax
add esp, 4
test esi, esi
je 0x41ba03
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x9c
call edi
mov ebp, eax
test ebp, ebp
jne 0x41ba0d
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0x94
call edi
test eax, eax
jne 0x41ba0d
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, str.Microsoft
mov edi, 0x80
mov eax, esi
sub edx, esi
jmp 0x41ba20
mov cl, byte [edx + eax]
test cl, cl
je 0x41ba2f
mov byte [eax], cl
inc eax
dec edi
jne 0x41ba20
jmp 0x41ba33
test edi, edi
jne 0x41ba34
dec eax
mov byte [eax], 0
mov eax, dword [esp + 0x28]
sub eax, 0
je 0x41c0cf
dec eax
je 0x41bf76
dec eax
jne 0x41c0c8
mov eax, dword [esp + 0x1c]
cmp eax, 5
mov ecx, dword [esp + 0x20]
mov edi, 4
jne 0x41bb6e
cmp ecx, 2
jne 0x41bac3
mov ecx, 0x80
mov eax, esi
cmp byte [eax], 0
je 0x41ba90
inc eax
dec ecx
jne 0x41ba74
mov edx, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0x80
call dword [edx + 4]
jmp 0x41bbc8
test ecx, ecx
je 0x41bab0
mov eax, 0x80
sub eax, ecx
push str.Windows_Server_2003_family_
mov ecx, 0x80
sub ecx, eax
push ecx
add eax, esi
push eax
call fcn.0040eb10
mov edx, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0x80
call dword [edx + 4]
jmp 0x41bbc8
cmp ecx, 1
jne 0x41bb19
mov ecx, 0x80
mov eax, esi
nop
cmp byte [eax], 0
je 0x41bae9
inc eax
dec ecx
jne 0x41bad0
mov edx, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0x40
call dword [edx + 4]
jmp 0x41bbc8
test ecx, ecx
je 0x41bb09
mov eax, 0x80
sub eax, ecx
push str.Windows_XP
mov ecx, 0x80
sub ecx, eax
push ecx
add eax, esi
push eax
call fcn.0040eb10
mov edx, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0x40
call dword [edx + 4]
jmp 0x41bbc8
test ecx, ecx
jne 0x41bbc3
mov ecx, 0x80
mov eax, esi
cmp byte [eax], 0
je 0x41bb41
inc eax
dec ecx
jne 0x41bb28
mov edx, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0x20
call dword [edx + 4]
jmp 0x41bbc8
test ecx, ecx
je 0x41bb61
mov eax, 0x80
sub eax, ecx
push str.Windows_2000
mov ecx, 0x80
sub ecx, eax
push ecx
add eax, esi
push eax
call fcn.0040eb10
mov edx, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0x20
call dword [edx + 4]
jmp 0x41bbc8
cmp eax, edi
ja 0x41bbc3
mov ecx, 0x80
mov eax, esi
lea esp, [esp]
cmp byte [eax], 0
je 0x41bb96
inc eax
dec ecx
jne 0x41bb80
mov edx, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0x10
call dword [edx + 4]
jmp 0x41bbc8
test ecx, ecx
je 0x41bbb6
mov eax, 0x80
sub eax, ecx
push str.Windows_NT
mov ecx, 0x80
sub ecx, eax
push ecx
add eax, esi
push eax
call fcn.0040eb10
mov edx, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0x10
call dword [edx + 4]
jmp 0x41bbc8
mov byte [esp + 0x13], 0
test ebp, ebp
je 0x41be7d
mov al, byte [esp + 0xb2]
cmp al, 1
jne 0x41bc7f
cmp dword [esp + 0x1c], edi
mov ecx, 0x80
jne 0x41bc1f
mov eax, esi
lea esp, [esp]
cmp byte [eax], 0
je 0x41bbfe
inc eax
dec ecx
jne 0x41bbf0
jmp 0x41be87
test ecx, ecx
je 0x41be87
mov eax, 0x80
sub eax, ecx
mov ecx, 0x80
push str.Workstation_4.0
sub ecx, eax
push ecx
jmp 0x41be75
mov eax, dword [esp + 0xb0]
test ah, 2
mov eax, esi
je 0x41bc50
lea ecx, [ecx]
cmp byte [eax], 0
je 0x41bc3e
inc eax
dec ecx
jne 0x41bc30
jmp 0x41be7d
test ecx, ecx
je 0x41be7d
push str.Home_Edition
jmp 0x41be69
cmp byte [eax], 0
je 0x41bc5e
inc eax
dec ecx
jne 0x41bc50
jmp 0x41be7d
test ecx, ecx
je 0x41be7d
mov eax, 0x80
sub eax, ecx
mov ecx, 0x80
push str.Professional
sub ecx, eax
push ecx
jmp 0x41be75
cmp al, 3
jne 0x41be7d
cmp dword [esp + 0x1c], 5
jne 0x41be1f
mov eax, dword [esp + 0x20]
cmp eax, 2
jne 0x41bd95
mov eax, dword [esp + 0xb0]
test al, al
mov ecx, 0x80
jns 0x41bd10
mov eax, esi
cmp byte [eax], 0
je 0x41bd02
inc eax
dec ecx
jne 0x41bcb1
mov ecx, dword [esp + 0x24]
and ecx, 0xffff
push ecx
lea edx, [esp + 0x30]
push edx
push str._s__Build__d_
lea eax, [esp + 0xc4]
push 0x50
push eax
call fcn.00403f50
add esp, 0x14
mov ecx, 0x80
mov eax, esi
jmp 0x41bcf0
cmp byte [eax], 0
je 0x41bf52
inc eax
dec ecx
jne 0x41bcf0
jmp 0x41c10c
test ecx, ecx
je 0x41bcba
push str.Datacenter_Edition
jmp 0x41be69
test al, 2
je 0x41bd3e
mov eax, esi
cmp byte [eax], 0
je 0x41bd21
inc eax
dec ecx
jne 0x41bd16
jmp 0x41bcba
test ecx, ecx
je 0x41bcba
mov eax, 0x80
sub eax, ecx
mov ecx, 0x80
push str.Enterprise_Edition
sub ecx, eax
push ecx
jmp 0x41be75
cmp ax, 0x400
mov eax, esi
jne 0x41bd66
cmp byte [eax], 0
je 0x41bd54
inc eax
dec ecx
jne 0x41bd46
jmp 0x41bcba
test ecx, ecx
je 0x41bcba
push str.Web_Edition
jmp 0x41be69
cmp byte [eax], 0
je 0x41bd74
inc eax
dec ecx
jne 0x41bd66
jmp 0x41bcba
test ecx, ecx
je 0x41bcba
mov eax, 0x80
sub eax, ecx
mov ecx, 0x80
push str.Standard_Edition
sub ecx, eax
push ecx
jmp 0x41be75
test eax, eax
jne 0x41be1f
mov al, byte [esp + 0xb0]
test al, al
mov ecx, 0x80
jns 0x41bdd0
mov eax, esi
nop
cmp byte [eax], 0
je 0x41bdbe
inc eax
dec ecx
jne 0x41bdb0
jmp 0x41bcba
test ecx, ecx
je 0x41bcba
push str.Datacenter_Server
jmp 0x41be69
test al, 2
mov eax, esi
je 0x41be02
cmp byte [eax], 0
je 0x41bde4
inc eax
dec ecx
jne 0x41bdd6
jmp 0x41bcba
test ecx, ecx
je 0x41bcba
mov eax, 0x80
sub eax, ecx
mov ecx, 0x80
push str.Advanced_Server
sub ecx, eax
push ecx
jmp 0x41be75
cmp byte [eax], 0
je 0x41be10
inc eax
dec ecx
jne 0x41be02
jmp 0x41bcba
test ecx, ecx
je 0x41bcba
push str.Server
jmp 0x41be69
test byte [esp + 0xb0], 2
mov ecx, 0x80
mov eax, esi
je 0x41be55
cmp byte [eax], 0
je 0x41be3b
inc eax
dec ecx
jne 0x41be30
jmp 0x41be7d
test ecx, ecx
je 0x41be7d
mov eax, 0x80
sub eax, ecx
mov ecx, 0x80
push str.Server_4.0__Enterprise_Edition
sub ecx, eax
push ecx
jmp 0x41be75
cmp byte [eax], 0
je 0x41be60
inc eax
dec ecx
jne 0x41be55
jmp 0x41be7d
test ecx, ecx
je 0x41be7d
push str.Server_4.0
mov eax, 0x80
mov edx, eax
sub eax, ecx
sub edx, eax
push edx
add eax, esi
push eax
call fcn.0040eb10
cmp dword [esp + 0x1c], edi
jne 0x41bcba
push str.Service_Pack_6
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41bcba
lea ecx, [esp + 0x14]
push ecx
push 1
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
lea eax, [esp + 0xb8]
jne 0x41bedf
mov edx, dword [esp + 0x24]
and edx, 0xffff
push edx
push str.Service_Pack_6a__Build__d_
push 0x50
push eax
call fcn.00403f50
add esp, 0x10
jmp 0x41beff
mov ecx, dword [esp + 0x24]
and ecx, 0xffff
push ecx
lea edx, [esp + 0x30]
push edx
push str._s__Build__d_
push 0x50
push eax
call fcn.00403f50
add esp, 0x14
mov ecx, 0x80
mov eax, esi
cmp byte [eax], 0
je 0x41bf1f
inc eax
dec ecx
jne 0x41bf06
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41c10c
test ecx, ecx
je 0x41bf42
mov eax, 0x80
sub eax, ecx
lea ecx, [esp + 0xb8]
push ecx
mov edx, 0x80
sub edx, eax
push edx
add eax, esi
push eax
call fcn.0040eb10
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41c10c
test ecx, ecx
je 0x41c10c
mov eax, 0x80
sub eax, ecx
lea ecx, [esp + 0xb8]
mov edx, 0x80
push ecx
sub edx, eax
push edx
jmp 0x41c104
mov eax, dword [esp + 0x1c]
mov edi, 4
cmp eax, edi
jne 0x41c0c8
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x41c016
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 1
call dword [eax + 4]
mov ecx, 0x80
mov eax, esi
cmp byte [eax], 0
je 0x41bfb0
inc eax
dec ecx
jne 0x41bfa5
jmp 0x41bfd0
test ecx, ecx
je 0x41bfd0
mov eax, 0x80
sub eax, ecx
push str.Windows_95
mov ecx, 0x80
sub ecx, eax
push ecx
add eax, esi
push eax
call fcn.0040eb10
mov al, byte [esp + 0x2d]
cmp al, 0x43
je 0x41bfe0
cmp al, 0x42
jne 0x41c10c
mov ecx, 0x80
mov eax, esi
cmp byte [eax], 0
je 0x41bff5
inc eax
dec ecx
jne 0x41bfe7
jmp 0x41c10c
test ecx, ecx
je 0x41c10c
mov eax, 0x80
sub eax, ecx
mov edx, 0x80
push str.OSR2
sub edx, eax
push edx
jmp 0x41c104
cmp eax, 0xa
jne 0x41c09c
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 2
call dword [eax + 4]
mov ecx, 0x80
mov eax, esi
cmp byte [eax], 0
je 0x41c03c
inc eax
dec ecx
jne 0x41c031
jmp 0x41c05c
test ecx, ecx
je 0x41c05c
mov eax, 0x80
sub eax, ecx
push str.Windows_98
mov ecx, 0x80
sub ecx, eax
push ecx
add eax, esi
push eax
call fcn.0040eb10
cmp byte [esp + 0x2d], 0x41
jne 0x41c10c
mov ecx, 0x80
mov eax, esi
mov edi, edi
cmp byte [eax], 0
je 0x41c07e
inc eax
dec ecx
jne 0x41c070
jmp 0x41c10c
test ecx, ecx
je 0x41c10c
mov eax, 0x80
sub eax, ecx
mov edx, 0x80
push 0x45a4f4
sub edx, eax
push edx
jmp 0x41c104
cmp eax, 0x5a
jne 0x41c0c8
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push edi
call dword [eax + 4]
mov ecx, 0x80
mov eax, esi
cmp byte [eax], 0
je 0x41c0bd
inc eax
dec ecx
jne 0x41c0b2
jmp 0x41c10c
test ecx, ecx
je 0x41c10c
push str.Windows_ME__Millennium_Edition_
jmp 0x41c0f5
mov byte [esp + 0x13], 0
jmp 0x41c10c
mov edx, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
call dword [edx + 4]
mov ecx, 0x80
mov eax, esi
cmp byte [eax], 0
je 0x41c0ec
inc eax
dec ecx
jne 0x41c0e1
jmp 0x41c10c
test ecx, ecx
je 0x41c10c
push str.Win32s__Unsupported_
mov eax, 0x80
sub eax, ecx
mov ecx, 0x80
sub ecx, eax
push ecx
add eax, esi
push eax
call fcn.0040eb10
mov edx, dword [ebx + 0x18]
lea ecx, [ebx + 0x18]
push esi
call dword [edx + 4]
mov al, byte [esp + 0x13]
pop edi
mov byte [ebx + 4], al
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret