Function at 0x4f8be0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push r13
mov eax, 0x2870
push r12
push rdi
push rsi
push rbx
call fcn.006e6b70
sub rsp, rax
mov r8d, 0x2700
xor edx, edx
mov r12, rcx
lea rcx, [rsp + 0x170]
lea r13, [rsp + 0x40]
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x168], 0
call sym.memset
lea r8, [rsp + 0xc0]
xor eax, eax
mov ecx, 0x13
mov qword [rsp + 0x40], 0
mov rdi, r8
rep stosq qword [rdi], rax
mov rcx, r8
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0xc0], 0x9c
mov dword [rdi], 0
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4f8d00
lea rax, [r12 + 0x10]
lea r13, [rsp + 0x160]
mov qword [r12], rax
mov r8, r13
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4f8ca6
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
cmove r8, rdx
mov esi, eax
add sil, al
sbb r8, 3
mov rdx, r13
xor r9d, r9d
mov rcx, r12
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
mov rax, r12
add rsp, 0x2870
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
lea rcx, str.kernel32.dll
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rsi
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call rbx
mov rcx, r13
test rax, rax
je 0x4f8da0
call rax
cmp dword [rsp + 0xd0], 2
jne 0x4f8d45
mov r9d, dword [rsp + 0xc4]
cmp r9d, 4
ja 0x4f8db0
lea rcx, str.This_sample_does_not_support_this_version_of_Windows._n
lea r13, [rsp + 0x160]
call sym.printf_char_const__::_
lea rax, [r12 + 0x10]
mov r8, r13
mov qword [r12], rax
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4f8d65
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
cmove r8, rdx
mov ebx, eax
add bl, al
jmp 0x4f8cd8
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x4f8d2d
lea r13, [rsp + 0x160]
lea rdx, str.Microsoft
mov ecx, 0x4d
mov rax, r13
jmp 0x4f8ddb
movzx ecx, byte [rdx]
test cl, cl
je 0x4f8e90
mov r8, rax
lea rdi, [rsp + 0x2870]
lea rax, [rax + 1]
add rdx, 1
mov byte [rax - 1], cl
cmp rax, rdi
jne 0x4f8dd0
mov byte [r8], 0
cmp r9d, 6
je 0x4f8f18
cmp r9d, 5
je 0x4f8ea0
cmp byte [rsp + 0xd4], 0
jne 0x4f91e0
mov r9d, dword [rsp + 0xcc]
lea rbx, [rsp + 0x70]
mov edx, 0x50
lea r8, str.__build__d_
mov rcx, rbx
call sym.StringCchPrintfA
mov r8, rbx
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
cmp dword [rsp + 0xc4], 5
jbe 0x4f8e80
movzx eax, word [rsp + 0x40]
cmp ax, 9
je 0x4f9235
test ax, ax
jne 0x4f8e80
lea r8, str.__32_bit
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
nop
mov rdx, r13
mov rcx, r12
call fcn.004f8380
jmp 0x4f8cea
mov r8, rax
jmp 0x4f8df6
mov eax, dword [rsp + 0xc8]
cmp eax, 2
je 0x4f929e
cmp eax, 1
je 0x4f924e
test eax, eax
jne 0x4f8e0e
lea r8, str.Windows_2000
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
cmp byte [rsp + 0x15a], 1
je 0x4f93f4
movzx eax, word [rsp + 0x158]
test al, 0x80
jne 0x4f93db
test al, 2
je 0x4f93c2
lea r8, str.Advanced_Server
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f8e0e
mov eax, dword [rsp + 0xc8]
test eax, eax
jne 0x4f8f4c
cmp byte [rsp + 0x15a], 1
je 0x4f9370
lea r8, str.Windows_Server_2008
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov eax, dword [rsp + 0xc8]
cmp eax, 1
je 0x4f920e
lea rcx, str.kernel32.dll
call rsi
lea rdx, str.GetProductInfo
mov rcx, rax
call rbx
lea rdx, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov ecx, dword [rsp + 0xc4]
mov edx, dword [rsp + 0xc8]
call rax
cmp dword [rsp + 0x3c], 0x30
ja case.0x4f8fa3.60
mov eax, dword [rsp + 0x3c]
lea rdx, [0x008a1688]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
lea r8, str.Web_Server_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
nop dword [rax]
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Enterprise_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Home_Premium_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Professional
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Home_Basic_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Ultimate_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Small_Business_Server
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Datacenter_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Standard_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Business_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Small_Business_Server_Premium_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Cluster_Server_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Enterprise_Edition__core_installation_
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Standard_Edition__core_installation_
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Datacenter_Edition__core_installation_
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
lea r8, str.Starter_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x4f8e04
mov rcx, r13
lea r8, [0x008a0e62]
mov edx, 0x2710
call sym.StringCatWorkerA
lea r8, [rsp + 0xd4]
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f8e1c
cmp byte [rsp + 0x15a], 1
je 0x4f9390
lea r8, str.Windows_Server_2008_R2
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f8f55
lea r8, str.__64_bit
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f8e80
lea r8, str.Windows_XP
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
test byte [rsp + 0x159], 2
je 0x4f93a9
lea r8, str.Home_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
cmp dword [rsp + 0xc4], 5
jne 0x4f8e0e
mov eax, dword [rsp + 0xc8]
jmp 0x4f8eb9
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x4f940d
movzx eax, word [rsp + 0x158]
test ah, 0x20
jne 0x4f9426
test ax, ax
js 0x4f9491
cmp byte [rsp + 0x15a], 1
jne 0x4f92e1
cmp word [rsp + 0x40], 9
je 0x4f9540
lea r8, str.Windows_Server_2003_
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
cmp byte [rsp + 0x15a], 1
je 0x4f9356
movzx edx, word [rsp + 0x40]
movzx eax, word [rsp + 0x158]
cmp dx, 6
je 0x4f943f
cmp dx, 9
je 0x4f9468
test ah, 0x40
jne 0x4f94aa
test al, 0x80
jne 0x4f94c3
test al, 2
jne 0x4f9559
test ah, 4
je 0x4f94f5
lea r8, str.Web_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
cmp dword [rsp + 0xc4], 5
jne 0x4f8e0e
mov eax, dword [rsp + 0xc8]
jmp 0x4f8eb0
lea r8, str.Windows_Vista
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov eax, dword [rsp + 0xc8]
jmp 0x4f8f4c
lea r8, str.Windows_7
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f8f55
lea r8, str.Professional
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f9284
lea r8, str.Server
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f8e0e
lea r8, str.Datacenter_Server
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f8e0e
lea r8, str.Professional
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f8e0e
lea r8, str.Windows_Server_2003_R2_
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f92f5
lea r8, str.Windows_Storage_Server_2003
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f92f5
test al, 0x80
jne 0x4f94dc
test al, 2
je 0x4f9356
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f9356
test al, 0x80
jne 0x4f9527
test al, 2
je 0x4f950e
lea r8, str.Enterprise_x64_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f9356
lea r8, str.Windows_Home_Server
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f92f5
lea r8, str.Compute_Cluster_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f9356
lea r8, str.Datacenter_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f9356
lea r8, str.Datacenter_Edition_for_Itanium_based_Systems
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f9356
lea r8, str.Standard_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f9356
lea r8, str.Standard_x64_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f9356
lea r8, str.Datacenter_x64_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f9356
lea r8, str.Windows_XP_Professional_x64_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f92f5
lea r8, str.Enterprise_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x4f9356