Function at 0x4378f0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x48cb1b
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x4b5930]
xor eax, esp
mov dword [esp + 0xc4], eax
push ebp
push esi
mov eax, dword [0x4b5930]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xe4]
mov dword [esp + 0xc], 0
mov ecx, 0x9c
lea eax, [esp + 0x34]
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x437941
mov ecx, 0x24
lea eax, [esp + 0x10]
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x437955
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x437984
lea ecx, [esp + 0x10]
push ecx
call eax
jmp 0x43798f
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], 0x9c
call esi
test eax, eax
jne 0x4379cc
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], 0x94
call esi
test eax, eax
jne 0x4379cc
push 0x49adb9
mov ecx, ebp
call fcn.0040aea0
jmp 0x437e5d
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x57
call esi
push 0x59
call esi
push 0x58
call esi
push 0x56
call esi
call fcn.00457afe
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4379fc
push 0x80004005
call fcn.00405140
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push 0x11
push str.Microsoft_Windows
lea ecx, [esp + 0x14]
mov dword [esp + 0xe4], 0
call fcn.0040b1d0
mov eax, dword [esp + 0x44]
sub eax, 0
je 0x437e13
sub eax, 1
je 0x437d97
sub eax, 1
je 0x437a57
push 0xf
push str.Unknown_Windows
lea ecx, [esp + 0x14]
call fcn.0040b1d0
jmp 0x437e23
mov eax, dword [esp + 0x38]
cmp eax, 4
ja 0x437ab5
push 0x4a122c
lea ecx, [esp + 0x10]
call fcn.00414ee0
mov al, byte [esp + 0xce]
cmp al, 2
je 0x437a8f
cmp al, 3
je 0x437a8f
cmp al, 1
jne 0x437d76
push str._Workstation
jmp 0x437d6d
push str._Server
lea ecx, [esp + 0x10]
call fcn.00414ee0
test byte [esp + 0xcc], 2
je 0x437d76
push str._Enterprise_Edition
jmp 0x437d6d
cmp eax, 5
jne 0x437c9e
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x437b34
push str._2000
lea ecx, [esp + 0x10]
call fcn.00414ee0
mov al, byte [esp + 0xce]
cmp al, 2
je 0x437af5
cmp al, 3
je 0x437af5
cmp al, 1
jne 0x437d76
push str._Professional
jmp 0x437d6d
mov al, byte [esp + 0xcc]
test al, al
jns 0x437b18
push str._Datacenter
lea ecx, [esp + 0x10]
call fcn.00414ee0
push str._Server
jmp 0x437d6d
test al, 2
je 0x437b2a
push str._Advanced
lea ecx, [esp + 0x10]
call fcn.00414ee0
push str._Server
jmp 0x437d6d
cmp eax, 1
jne 0x437bb0
push 0x4a128c
lea ecx, [esp + 0x10]
call fcn.00414ee0
cmp byte [esp + 0xce], 1
jne 0x437d76
push 0x57
call esi
test eax, eax
je 0x437b67
push str._Media_Center_Edition
jmp 0x437d6d
push 0x56
call esi
test eax, eax
je 0x437b79
push str._Tablet_PC_Edition
jmp 0x437d6d
push 0x58
call esi
test eax, eax
je 0x437b8b
push str._Start_Edition
jmp 0x437d6d
test dword [esp + 0xcc], 0x200
lea ecx, [esp + 0xc]
je 0x437ba6
push str._Home_Edition
jmp 0x437d71
push str._Professional
jmp 0x437d71
cmp eax, 2
jne 0x437d76
mov al, byte [esp + 0xce]
cmp al, 2
je 0x437c67
cmp al, 3
je 0x437c67
cmp al, 1
jne 0x437d76
push str._Server_2003
lea ecx, [esp + 0x10]
call fcn.00414ee0
push 0x59
call esi
test eax, eax
je 0x437bfc
push 0x4a132c
lea ecx, [esp + 0x10]
call fcn.00414ee0
mov eax, dword [esp + 0xcc]
test al, al
jns 0x437c0e
push str._Datacenter
jmp 0x437c2b
test al, 2
je 0x437c19
push str._Enterprise
jmp 0x437c2b
cmp ax, 0x400
jne 0x437c26
push str._Web
jmp 0x437c2b
push str._Standard
lea ecx, [esp + 0x10]
call fcn.00414ee0
mov ax, word [esp + 0x10]
cmp ax, 6
jne 0x437c49
push str._Edition_for_Itanium_based_Systems
jmp 0x437d6d
cmp ax, 9
lea ecx, [esp + 0xc]
jne 0x437c5d
push str._x64_Edition
jmp 0x437d71
push str._Edition
jmp 0x437d71
push str._XP_Professional
lea ecx, [esp + 0x10]
call fcn.00414ee0
mov ax, word [esp + 0x10]
cmp ax, 6
jne 0x437c8a
push str._for_Itanium_based_Systems
jmp 0x437d6d
cmp ax, 9
jne 0x437d76
push str._x64_Edition
jmp 0x437d6d
cmp eax, 6
jne 0x437d76
cmp dword [esp + 0x3c], 0
jne 0x437d76
mov al, byte [esp + 0xce]
cmp al, 2
je 0x437d30
cmp al, 3
je 0x437d30
cmp al, 1
jne 0x437d76
push str._Vista
lea ecx, [esp + 0x10]
call fcn.00414ee0
push 0x57
call esi
test eax, eax
je 0x437cf3
test dword [esp + 0xcc], 0x200
je 0x437cf3
push str._Home_Premium
jmp 0x437d6d
push 0x57
call esi
test eax, eax
je 0x437d02
push str._Ultimate
jmp 0x437d6d
push 0x58
call esi
test eax, eax
je 0x437d11
push str._Start_Edition
jmp 0x437d6d
test dword [esp + 0xcc], 0x200
lea ecx, [esp + 0xc]
je 0x437d29
push str._Home_Basic
jmp 0x437d71
push str._Business
jmp 0x437d71
push str._Server_2008_Beta
lea ecx, [esp + 0x10]
call fcn.00414ee0
mov eax, dword [esp + 0xcc]
test al, al
jns 0x437d50
push str._Datacenter_Edition
jmp 0x437d6d
test al, 2
je 0x437d5b
push str._Enterprise_Edition
jmp 0x437d6d
cmp ax, 0x400
jne 0x437d68
push str._Web_Edition
jmp 0x437d6d
push str._Standard_Edition
lea ecx, [esp + 0x10]
call fcn.00414ee0
push 0x49fa3c
lea ecx, [esp + 0x10]
call fcn.00414ee0
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x10]
call fcn.00414ee0
jmp 0x437e23
cmp dword [esp + 0x38], 4
jne 0x437e23
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x437dd4
push 0x4a11e8
lea ecx, [esp + 0x10]
call fcn.00414ee0
mov al, byte [esp + 0x49]
cmp al, 0x43
je 0x437dc4
cmp al, 0x42
jne 0x437e23
push str._OEM_Service_Release_2
lea ecx, [esp + 0x10]
call fcn.00414ee0
jmp 0x437e23
cmp eax, 0xa
jne 0x437dfe
push 0x4a1204
lea ecx, [esp + 0x10]
call fcn.00414ee0
cmp byte [esp + 0x49], 0x41
jne 0x437e23
push str._Second_Edition
lea ecx, [esp + 0x10]
call fcn.00414ee0
jmp 0x437e23
cmp eax, 0x5a
jne 0x437e23
push str._Millennium_Edition
lea ecx, [esp + 0x10]
call fcn.00414ee0
jmp 0x437e23
push 5
push str._3.1x
lea ecx, [esp + 0x14]
call fcn.0040ef80
mov esi, dword [esp + 0xc]
add esi, 0xfffffff0
push esi
call fcn.0040ae10
add eax, 0x10
mov dword [ebp], eax
add esp, 4
mov dword [esp + 0xdc], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x437e5d
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, ebp
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.0046da06
add esp, 0xd4
ret