Function at 0x40318c
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
push ebx
push esi
push edi
push 0x24
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.0040c470
mov esi, 0x11c
lea eax, [ebp - 0x144]
push esi
push 0
push eax
call fcn.0040c470
add esp, 0x18
lea eax, [ebp - 0x144]
mov dword [ebp - 0x144], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x403556
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x4031fe
lea ecx, [ebp - 0x28]
push ecx
call eax
jmp 0x403208
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x134], 2
jne 0x403556
cmp dword [ebp - 0x140], 4
jbe 0x403556
mov esi, dword [ebp + 8]
push 0x421a38
push esi
call fcn.0040c40e
cmp dword [ebp - 0x140], 6
pop ecx
pop ecx
jne case.0x4032c2.5
cmp dword [ebp - 0x13c], 0
jne 0x403262
cmp byte [ebp - 0x2a], 1
jne 0x403255
push str.Windows_Vista
jmp 0x40325a
push str.Windows_Server_2008
push esi
call fcn.0040c3e4
pop ecx
pop ecx
cmp dword [ebp - 0x13c], 1
jne 0x403285
cmp byte [ebp - 0x2a], 1
jne 0x403278
push str.Windows_7
jmp 0x40327d
push str.Windows_Server_2008_R2
push esi
call fcn.0040c3e4
pop ecx
pop ecx
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call ebx
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
call eax
mov eax, dword [ebp - 4]
cmp eax, 0x19
ja 0x403339
je 0x403332
dec eax
cmp eax, 0x11
ja case.0x4032c2.5
jmp dword [eax*4 + 0x40355d]
push str.Ultimate_Edition
jmp 0x403343
push str.Home_Premium_Edition
jmp 0x403343
push str.Home_Basic_Edition
jmp 0x403343
push str.Business_Edition
jmp 0x403343
push str.Starter_Edition
jmp 0x403343
push str.Cluster_Server_Edition
jmp 0x403343
push str.Datacenter_Edition
jmp 0x403343
push str.Datacenter_Edition__core_installation_
jmp 0x403343
push str.Enterprise_Edition
jmp 0x403343
push str.Enterprise_Edition__core_installation_
jmp 0x403343
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x403343
push str.Small_Business_Server
jmp 0x403343
push str.Standard_Edition
jmp 0x403343
push str.Standard_Edition__core_installation_
jmp 0x403343
push str.Web_Server_Edition
jmp 0x403343
push str.Small_Business_Server_Premium_Edition
jmp 0x403343
cmp eax, 0x30
jne case.0x4032c2.5
push str.Professional
push esi
call fcn.0040c3e4
pop ecx
pop ecx
cmp dword [ebp - 0x140], 5
jne 0x4034d4
cmp dword [ebp - 0x13c], 2
jne 0x403451
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x403378
push str.Windows_Server_2003_R2_
jmp 0x4033ab
test byte [ebp - 0x2b], 0x20
je 0x403385
push str.Windows_Storage_Server_2003
jmp 0x4033ab
test byte [ebp - 0x2b], 0x80
je 0x403392
push str.Windows_Home_Server
jmp 0x4033ab
cmp byte [ebp - 0x2a], 1
jne 0x4033a6
cmp word [ebp - 0x28], 9
jne 0x4033a6
push str.Windows_XP_Professional_x64_Edition
jmp 0x4033ab
push str.Windows_Server_2003_
push esi
call fcn.0040c3e4
cmp byte [ebp - 0x2a], 1
pop ecx
pop ecx
je 0x403444
cmp word [ebp - 0x28], 6
jne 0x4033de
test byte [ebp - 0x2c], 0x80
je 0x4033d1
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x40343c
test byte [ebp - 0x2c], 2
je 0x403444
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x40343c
cmp word [ebp - 0x28], 9
jne 0x403406
test byte [ebp - 0x2c], 0x80
je 0x4033f2
push str.Datacenter_x64_Edition
jmp 0x40343c
test byte [ebp - 0x2c], 2
je 0x4033ff
push str.Enterprise_x64_Edition
jmp 0x40343c
push str.Standard_x64_Edition
jmp 0x40343c
mov eax, dword [ebp - 0x2c]
test ah, 0x40
je 0x403415
push str.Compute_Cluster_Edition
jmp 0x40343c
test al, 0x80
je 0x403420
push str.Datacenter_Edition
jmp 0x40343c
test al, 2
je 0x40342b
push str.Enterprise_Edition
jmp 0x40343c
test ah, 4
je 0x403437
push str.Web_Edition
jmp 0x40343c
push str.Standard_Edition
push esi
call fcn.0040c3e4
pop ecx
pop ecx
cmp dword [ebp - 0x140], 5
jne 0x4034d4
cmp dword [ebp - 0x13c], 1
jne 0x40348a
push str.Windows_XP
push esi
call fcn.0040c3e4
test byte [ebp - 0x2b], 2
pop ecx
pop ecx
je 0x403474
push str.Home_Edition
jmp 0x403479
push str.Professional
push esi
call fcn.0040c3e4
cmp dword [ebp - 0x140], 5
pop ecx
pop ecx
jne 0x4034d4
cmp dword [ebp - 0x13c], 0
jne 0x4034d4
push str.Windows_2000
push esi
call fcn.0040c3e4
cmp byte [ebp - 0x2a], 1
pop ecx
pop ecx
jne 0x4034ad
push str.Professional
jmp 0x4034cc
test byte [ebp - 0x2c], 0x80
je 0x4034ba
push str.Datacenter_Server
jmp 0x4034cc
test byte [ebp - 0x2c], 2
je 0x4034c7
push str.Advanced_Server
jmp 0x4034cc
push 0x421354
push esi
call fcn.0040c3e4
pop ecx
pop ecx
lea eax, [ebp - 0x130]
push eax
call fcn.0040cc7b
test eax, eax
pop ecx
jbe 0x403500
push 0x421350
push esi
call fcn.0040c3e4
lea eax, [ebp - 0x130]
push eax
push esi
call fcn.0040c3e4
add esp, 0x10
push dword [ebp - 0x138]
lea eax, [ebp - 0x1e4]
push str.__build__d_
push eax
call fcn.0040cc98
lea eax, [ebp - 0x1e4]
push eax
push esi
call fcn.0040c3e4
add esp, 0x14
cmp dword [ebp - 0x140], 6
jb 0x403552
cmp word [ebp - 0x28], 9
jne 0x40353e
push str.__64_bit
jmp 0x40354a
cmp word [ebp - 0x28], 0
jne 0x403552
push str.__32_bit
push esi
call fcn.0040c3e4
pop ecx
pop ecx
mov al, 1
jmp 0x403558
xor al, al
pop edi
pop esi
pop ebx
leave
ret