Function at 0x4c4150
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50050d
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x541a34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x47c], ecx
lea ecx, [ebp - 0x330]
call fcn.004c3040
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], eax
push 0x11c
push 0
lea ecx, [ebp - 0x32c]
push ecx
call fcn.004d6720
add esp, 0xc
mov dword [ebp - 0x32c], 0x11c
lea edx, [ebp - 0x32c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
jne 0x4c421e
mov dword [ebp - 0x32c], 0x114
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x510858
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x31c]
mov dword [ebp - 0x334], edx
cmp dword [ebp - 0x334], 0
je 0x4c4f0c
cmp dword [ebp - 0x334], 1
je 0x4c4d90
cmp dword [ebp - 0x334], 2
je 0x4c4276
jmp 0x4c4f20
cmp dword [ebp - 0x328], 6
jne 0x4c42be
cmp dword [ebp - 0x324], 0
jne 0x4c42be
movzx eax, byte [ebp - 0x212]
cmp eax, 1
jne 0x4c42aa
push str.Windows_Vista
lea ecx, [ebp - 0x330]
push ecx
call fcn.004c33f0
add esp, 8
jmp 0x4c42be
push str.Windows_Server__Longhorn_
lea edx, [ebp - 0x330]
push edx
call fcn.004c33f0
add esp, 8
cmp dword [ebp - 0x328], 5
jne 0x4c4334
cmp dword [ebp - 0x324], 2
jne 0x4c4334
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4c42f2
push str.Microsoft_Windows_Server_2003__R2_
lea eax, [ebp - 0x330]
push eax
call fcn.004c33f0
add esp, 8
jmp 0x4c4334
movzx ecx, byte [ebp - 0x212]
cmp ecx, 1
jne 0x4c4320
movzx edx, word [ebp - 0x478]
cmp edx, 9
jne 0x4c4320
push str.Microsoft_Windows_XP_Professional_x64_Edition
lea eax, [ebp - 0x330]
push eax
call fcn.004c33f0
add esp, 8
jmp 0x4c4334
push str.Microsoft_Windows_Server_2003_
lea ecx, [ebp - 0x330]
push ecx
call fcn.004c33f0
add esp, 8
cmp dword [ebp - 0x328], 5
jne 0x4c435a
cmp dword [ebp - 0x324], 1
jne 0x4c435a
push str.Microsoft_Windows_XP
lea edx, [ebp - 0x330]
push edx
call fcn.004c33f0
add esp, 8
cmp dword [ebp - 0x328], 5
jne 0x4c4380
cmp dword [ebp - 0x324], 0
jne 0x4c4380
push str.Microsoft_Windows_2000
lea eax, [ebp - 0x330]
push eax
call fcn.004c33f0
add esp, 8
cmp dword [ebp - 0x328], 4
ja 0x4c439d
push str.Microsoft_Windows_NT
lea ecx, [ebp - 0x330]
push ecx
call fcn.004c33f0
add esp, 8
cmp dword [ebp - 0x33c], 0
je 0x4c4aa4
movzx edx, word [ebp - 0x218]
push edx
push str.Service_Pack__d
mov eax, dword [ebp + 0xc]
push eax
call fcn.004c33f0
add esp, 0xc
movzx ecx, byte [ebp - 0x212]
cmp ecx, 1
jne 0x4c44fd
movzx edx, word [ebp - 0x478]
cmp edx, 9
je 0x4c44fd
cmp dword [ebp - 0x328], 4
jne 0x4c4443
push str.Workstation_4.0
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x348]
push ecx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x414], eax
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x450], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x450]
push eax
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x348]
call fcn.00457f30
jmp 0x4c44f8
movzx ecx, word [ebp - 0x214]
and ecx, 0x200
je 0x4c44a6
push str.Home_Edition
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x354]
push eax
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x34c], eax
mov ecx, dword [ebp - 0x34c]
mov dword [ebp - 0x350], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x350]
push edx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x354]
call fcn.00457f30
jmp 0x4c44f8
push str.Professional
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x360]
push ecx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x358], eax
mov edx, dword [ebp - 0x358]
mov dword [ebp - 0x35c], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x35c]
push eax
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x360]
call fcn.00457f30
jmp 0x4c4a9f
movzx ecx, byte [ebp - 0x212]
cmp ecx, 3
je 0x4c4519
movzx edx, byte [ebp - 0x212]
cmp edx, 2
jne 0x4c4a9f
cmp dword [ebp - 0x328], 5
jne 0x4c48b7
cmp dword [ebp - 0x324], 2
jne 0x4c48b7
movzx eax, word [ebp - 0x478]
cmp eax, 6
jne 0x4c4609
movzx ecx, word [ebp - 0x214]
and ecx, 0x80
je 0x4c45a6
push str.Datacenter_Edition_for_Itanium_based_Systems
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x36c]
push eax
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x364]
mov dword [ebp - 0x368], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x368]
push edx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x36c]
call fcn.00457f30
jmp 0x4c4604
movzx eax, word [ebp - 0x214]
and eax, 2
je 0x4c4604
push str.Enterprise_Edition_for_Itanium_based_Systems
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x378]
push edx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x374], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x374]
push ecx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x378]
call fcn.00457f30
jmp 0x4c48b2
movzx edx, word [ebp - 0x478]
cmp edx, 9
jne 0x4c4735
movzx eax, word [ebp - 0x214]
and eax, 0x80
je 0x4c467e
push str.Datacenter_x64_Edition
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x384]
push edx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x380], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x380]
push ecx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x384]
call fcn.00457f30
jmp 0x4c4730
movzx edx, word [ebp - 0x214]
and edx, 2
je 0x4c46de
push str.Enterprise_x64_Edition
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x390]
push ecx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x388], eax
mov edx, dword [ebp - 0x388]
mov dword [ebp - 0x38c], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x38c]
push eax
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x390]
call fcn.00457f30
jmp 0x4c4730
push str.Standard_x64_Edition
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x39c]
push edx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x398], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x398]
push ecx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x39c]
call fcn.00457f30
jmp 0x4c48b2
movzx edx, word [ebp - 0x214]
and edx, 0x80
je 0x4c479b
push str.Datacenter_Edition
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x3a8]
push ecx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x3a0], eax
mov edx, dword [ebp - 0x3a0]
mov dword [ebp - 0x3a4], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x3a4]
push eax
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3a8]
call fcn.00457f30
jmp 0x4c48b2
movzx ecx, word [ebp - 0x214]
and ecx, 2
je 0x4c47fe
push str.Enterprise_Edition
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x3b4]
push eax
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x3ac], eax
mov ecx, dword [ebp - 0x3ac]
mov dword [ebp - 0x3b0], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x3b0]
push edx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3b4]
call fcn.00457f30
jmp 0x4c48b2
movzx eax, word [ebp - 0x214]
and eax, 0x400
je 0x4c4860
push str.Web_Edition
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x3c0]
push edx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x3bc], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x3bc]
push ecx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c0]
call fcn.00457f30
jmp 0x4c48b2
push str.Standard_Edition
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x3cc]
push eax
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x3c4], eax
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp - 0x3c8], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x3c8]
push edx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3cc]
call fcn.00457f30
jmp 0x4c4a9f
cmp dword [ebp - 0x328], 5
jne 0x4c49ed
cmp dword [ebp - 0x324], 0
jne 0x4c49ed
movzx eax, word [ebp - 0x214]
and eax, 0x80
je 0x4c4936
push str.Datacenter_Server
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x3d8]
push edx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3d4], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x3d4]
push ecx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3d8]
call fcn.00457f30
jmp 0x4c49e8
movzx edx, word [ebp - 0x214]
and edx, 2
je 0x4c4996
push 0x510cf4
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x3e4]
push ecx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x3dc], eax
mov edx, dword [ebp - 0x3dc]
mov dword [ebp - 0x3e0], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x3e0]
push eax
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3e4]
call fcn.00457f30
jmp 0x4c49e8
push 0x510d18
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x3f0]
push edx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x3ec]
push ecx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3f0]
call fcn.00457f30
jmp 0x4c4a9f
movzx edx, word [ebp - 0x214]
and edx, 2
je 0x4c4a4d
push str.Server_4.0__Enterprise_Edition
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x3fc]
push ecx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x3f4], eax
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x3f8], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x3f8]
push eax
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3fc]
call fcn.00457f30
jmp 0x4c4a9f
push str.Server_4.0
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x408]
push edx
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x404], eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x404]
push ecx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x408]
call fcn.00457f30
jmp 0x4c4cca
mov dword [ebp - 0x344], 0x200
lea edx, [ebp - 0x340]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0
je 0x4c4ae7
lea eax, [ebp - 0x330]
push eax
mov ecx, dword [ebp + 8]
call fcn.004c3160
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x330]
call fcn.00457f30
jmp 0x4c4f41
cmp dword [ebp - 0x328], 4
jne 0x4c4d6a
push str.Service_Pack_6
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4c4d6a
lea ecx, [ebp - 0x434]
push ecx
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
jne 0x4c4d3a
mov edx, dword [ebp - 0x320]
and edx, 0xffff
push edx
push str.Service_Pack_6a__Build__d__n
lea eax, [ebp - 0x330]
push eax
call fcn.004c33f0
add esp, 0xc
jmp 0x4c4d5b
mov ecx, dword [ebp - 0x320]
and ecx, 0xffff
push ecx
lea edx, [ebp - 0x318]
push edx
push 0x510f88
call fcn.004c55e0
add esp, 0xc
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4c4d8b
mov ecx, dword [ebp - 0x320]
and ecx, 0xffff
push ecx
lea edx, [ebp - 0x318]
push edx
push str._s__Build__d__n
call fcn.004c55e0
add esp, 0xc
jmp 0x4c4f20
cmp dword [ebp - 0x328], 4
jne 0x4c4e3a
cmp dword [ebp - 0x324], 0
jne 0x4c4e3a
push str.Microsoft_Windows_95
lea eax, [ebp - 0x330]
push eax
call fcn.004c33f0
add esp, 8
mov ecx, 2
shl ecx, 0
movzx edx, word [ebp + ecx - 0x318]
cmp edx, 0x43
je 0x4c4de8
mov eax, 2
shl eax, 0
movzx ecx, word [ebp + eax - 0x318]
cmp ecx, 0x42
jne 0x4c4e3a
push str.OSR2
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x440]
push eax
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x454], eax
mov ecx, dword [ebp - 0x454]
mov dword [ebp - 0x43c], ecx
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x43c]
push edx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x440]
call fcn.00457f30
cmp dword [ebp - 0x328], 4
jne 0x4c4ee4
cmp dword [ebp - 0x324], 0xa
jne 0x4c4ee4
push str.Microsoft_Windows_98
lea eax, [ebp - 0x330]
push eax
call fcn.004c33f0
add esp, 8
mov ecx, 2
shl ecx, 0
movzx edx, word [ebp + ecx - 0x318]
cmp edx, 0x41
je 0x4c4e92
mov eax, 2
shl eax, 0
movzx ecx, word [ebp + eax - 0x318]
cmp ecx, 0x42
jne 0x4c4ee4
push 0x511024
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x44c]
push eax
call fcn.004c31a0
add esp, 0xc
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x444]
mov dword [ebp - 0x448], ecx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x448]
push edx
lea ecx, [ebp - 0x330]
call fcn.004c3160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44c]
call fcn.00457f30
cmp dword [ebp - 0x328], 4
jne 0x4c4f0a
cmp dword [ebp - 0x324], 0x5a
jne 0x4c4f0a
push str.Microsoft_Windows_Millennium_Edition_n
lea eax, [ebp - 0x330]
push eax
call fcn.004c33f0
add esp, 8
jmp 0x4c4f20
push str.Microsoft_Win32s_n
lea ecx, [ebp - 0x330]
push ecx
call fcn.004c33f0
add esp, 8
lea edx, [ebp - 0x330]
push edx
mov ecx, dword [ebp + 8]
call fcn.004c3160
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x330]
call fcn.00457f30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d219c
mov esp, ebp
pop ebp
ret 8