Function at 0x405900
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x258
push ebx
push ebp
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xb0]
rep stosd dword es:[edi], eax
mov ecx, 0x27
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4060b4
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test eax, eax
je 0x405970
lea ecx, [esp + 0xb0]
push ecx
call eax
jmp 0x40597a
lea edx, [esp + 0xb0]
push edx
call edi
cmp dword [esp + 0x24], 2
jne 0x4060a7
cmp dword [esp + 0x18], 4
jbe 0x4060a7
push esi
mov esi, dword [esp + 0x26c]
push str.Microsoft
push pe_nt_image_headers32
push esi
call fcn.004057c0
cmp dword [esp + 0x1c], 6
jne case.0x405bef.18
lea eax, [esp + 0xd8]
push eax
call edi
mov ecx, 0x46
xor eax, eax
lea edi, [esp + 0x100]
mov dword [esp + 0xfc], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xfc]
push ecx
call fcn.00405770
add esp, 4
test al, al
je 0x405bb5
mov eax, dword [esp + 0x10c]
dec eax
je 0x405bb5
dec eax
jne 0x405bb5
mov eax, dword [esp + 0x100]
sub eax, 5
je 0x405b79
dec eax
je 0x405a53
sub eax, 4
jne 0x405bb5
mov eax, dword [esp + 0x104]
test eax, eax
jne 0x405bb5
cmp byte [esp + 0x216], 1
jne 0x405bb5
push str.Windows_10
push pe_nt_image_headers32
push esi
call fcn.00405810
jmp 0x405bb5
mov eax, dword [esp + 0x104]
test eax, eax
jne 0x405a92
cmp byte [esp + 0x216], 1
jne 0x405a7d
push str.Windows_Vista
push pe_nt_image_headers32
push esi
call fcn.00405810
jmp 0x405bb5
push str.Windows_Server_2008
push pe_nt_image_headers32
push esi
call fcn.00405810
jmp 0x405bb5
cmp eax, 1
jne 0x405aec
cmp byte [esp + 0x216], 1
jne 0x405ad7
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl 0x405bb5
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Windows_7
add eax, esi
push ecx
push eax
call fcn.004057c0
jmp 0x405bb5
push str.Windows_Server_2008_R2
push pe_nt_image_headers32
push esi
call fcn.00405810
jmp 0x405bb5
cmp eax, 2
jne 0x405b25
cmp byte [esp + 0x216], 1
jne 0x405b10
push str.Windows_8
push pe_nt_image_headers32
push esi
call fcn.00405810
jmp 0x405bb5
push str.Windows_Server_2012
push pe_nt_image_headers32
push esi
call fcn.00405810
jmp 0x405bb5
cmp eax, 3
jne 0x405bb5
cmp byte [esp + 0x216], 1
jne 0x405b67
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl 0x405bb5
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Windows_8.1
add eax, esi
push ecx
push eax
call fcn.004057c0
jmp 0x405bb5
push str.Windows_Server_2012_R2
push pe_nt_image_headers32
push esi
call fcn.00405810
jmp 0x405bb5
mov eax, dword [esp + 0x104]
test eax, eax
je 0x405bb5
cmp eax, 1
je 0x405bb5
cmp eax, 2
jne 0x405bb5
cmp byte [esp + 0x216], 1
jne 0x405ba3
cmp word [esp + 0xd8], 9
je 0x405bb5
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call edi
test eax, eax
je 0x405bb5
push 0x59
call edi
push str.GetProductInfo
push str.kernel32.dll
call ebp
push eax
call ebx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x20]
push 0
push 0
push ecx
push edx
call eax
mov eax, dword [esp + 0x14]
dec eax
cmp eax, 0x2f
ja case.0x405bef.18
xor ecx, ecx
mov cl, byte [eax + 0x406108]
jmp dword [ecx*4 + 0x4060c0]
push str.Ultimate_Edition
jmp 0x405d2e
push str.Professional
jmp 0x405d2e
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl case.0x405bef.18
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Home_Premium_Edition
add eax, esi
push ecx
push eax
call fcn.004057c0
jmp case.0x405bef.18
push str.Home_Basic_Edition
jmp 0x405d2e
push str.Business_Edition
jmp 0x405d2e
push str.Starter_Edition
jmp 0x405d2e
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl case.0x405bef.18
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Cluster_Server_Edition
add eax, esi
push ecx
push eax
call fcn.004057c0
jmp case.0x405bef.18
push str.Datacenter_Edition
jmp 0x405d2e
push str.Datacenter_Edition__core_installation_
jmp 0x405d2e
push str.Enterprise_Edition
jmp 0x405d2e
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl case.0x405bef.18
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Enterprise_Edition__core_installation_
add eax, esi
push ecx
push eax
call fcn.004057c0
jmp case.0x405bef.18
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x405d2e
push str.Small_Business_Server
jmp 0x405d2e
push str.Small_Business_Server_Premium_Edition
jmp 0x405d2e
push str.Standard_Edition
jmp 0x405d2e
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl case.0x405bef.18
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Standard_Edition__core_installation_
add eax, esi
push ecx
push eax
call fcn.004057c0
jmp case.0x405bef.18
push str.Web_Server_Edition
push pe_nt_image_headers32
push esi
call fcn.00405810
mov eax, dword [esp + 0x1c]
mov edi, 5
cmp eax, edi
jne 0x405fd1
cmp dword [esp + 0x20], 2
jne 0x405eeb
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x405d68
push str.Windows_Server_2003_R2_
jmp 0x405dd0
mov eax, dword [esp + 0xb0]
test ah, 0x20
je 0x405d7b
push str.Windows_Storage_Server_2003
jmp 0x405dd0
test ah, 0x80
je 0x405d87
push str.Windows_Home_Server
jmp 0x405dd0
cmp byte [esp + 0xb2], 1
jne 0x405dcb
cmp word [esp + 0xb4], 9
jne 0x405dcb
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl 0x405ddb
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Windows_XP_Professional_x64_Edition
add eax, esi
push ecx
push eax
call fcn.004057c0
jmp 0x405ddb
push str.Windows_Server_2003
push pe_nt_image_headers32
push esi
call fcn.00405810
cmp byte [esp + 0xb2], 1
je 0x405ee1
mov ax, word [esp + 0xb4]
cmp ax, 6
jne 0x405e1e
mov al, byte [esp + 0xb0]
test al, 0x80
je 0x405e0c
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x405ed6
test al, 2
je 0x405ee1
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x405ed6
cmp ax, 9
jne 0x405e74
mov al, byte [esp + 0xb0]
test al, 0x80
je 0x405e62
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl 0x405ee1
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Datacenter_x64_Edition
add eax, esi
push ecx
push eax
call fcn.004057c0
jmp 0x405ee1
test al, 2
je 0x405e6d
push str.Enterprise_x64_Edition
jmp 0x405ed6
push str.Standard_x64_Edition
jmp 0x405ed6
mov eax, dword [esp + 0xb0]
test ah, 0x40
je 0x405e87
push str.Compute_Cluster_Edition
jmp 0x405ed6
test al, 0x80
je 0x405e92
push str.Datacenter_Edition
jmp 0x405ed6
test al, 2
je 0x405ec5
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl 0x405ee1
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Enterprise_Edition
add eax, esi
push ecx
push eax
call fcn.004057c0
jmp 0x405ee1
test ah, 4
je 0x405ed1
push str.Web_Edition
jmp 0x405ed6
push str.Standard_Edition
push pe_nt_image_headers32
push esi
call fcn.00405810
cmp dword [esp + 0x1c], edi
jne 0x405fd1
cmp dword [esp + 0x20], 1
jne 0x405f53
push str.Windows_XP
push pe_nt_image_headers32
push esi
call fcn.00405810
mov eax, dword [esp + 0xb0]
test ah, 2
je 0x405f20
push str.Home_Edition
push pe_nt_image_headers32
push esi
call fcn.00405810
jmp 0x405f4d
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl 0x405f4d
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Professional
add eax, esi
push ecx
push eax
call fcn.004057c0
cmp dword [esp + 0x1c], edi
jne 0x405fd1
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x405fd1
push str.Windows_2000
push pe_nt_image_headers32
push esi
call fcn.00405810
cmp byte [esp + 0xb2], 1
jne 0x405f7c
push str.Professional
jmp 0x405fc6
mov al, byte [esp + 0xb0]
test al, 0x80
je 0x405f8e
push str.Datacenter_Server
jmp 0x405fc6
test al, 2
je 0x405fc1
lea edx, [esp + 0x10]
push edx
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl 0x405fd1
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str.Advanced_Server
add eax, esi
push ecx
push eax
call fcn.004057c0
jmp 0x405fd1
push str.Server
push pe_nt_image_headers32
push esi
call fcn.00405810
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x406001
push 0x43180c
push pe_nt_image_headers32
push esi
call fcn.00405810
lea edx, [esp + 0x2c]
push edx
push pe_nt_image_headers32
push esi
call fcn.00405810
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x218]
push eax
push str.__build__d_
push 0x50
push ecx
call fcn.00406140
add esp, 0x10
lea edx, [esp + 0x218]
push edx
push pe_nt_image_headers32
push esi
call fcn.00405810
cmp dword [esp + 0x1c], 6
jb 0x406097
mov ax, word [esp + 0xb4]
cmp ax, 9
jne 0x406082
lea eax, [esp + 0x10]
push eax
push pe_nt_image_headers32
push esi
call fcn.004058b0
test eax, eax
jl 0x406097
mov eax, dword [esp + 0x10]
mov ecx, pe_nt_image_headers32
sub ecx, eax
push str._64_bit
add eax, esi
push ecx
push eax
call fcn.004057c0
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x258
ret
test ax, ax
jne 0x406097
push str._32_bit
push pe_nt_image_headers32
push esi
call fcn.00405810
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x258
ret
push str.This_sample_does_not_support_this_version_of_Windows._n
call fcn.00413cac
add esp, 4
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x258
ret