Function at 0x402780
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x402c1b
mov eax, dword [esp + 0x14]
cmp eax, 5
jne 0x402856
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4027e9
mov edi, str.Microsoft_Windows_2000
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0xac]
push str.Microsoft_Windows_2000
call fcn.00409720
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x94
ret
cmp eax, 1
jne 0x40281c
mov edi, str.Microsoft_Windows_XP
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0xac]
push str.Microsoft_Windows_XP
call fcn.00409720
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x94
ret
cmp eax, 2
jne 0x402bd7
mov edi, str.Microsoft_Windows_Server_2003
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0xac]
push str.Microsoft_Windows_Server_2003
call fcn.00409720
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x94
ret
cmp eax, 6
jne 0x402bd7
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4028dd
mov edi, str.Microsoft_Windows_Server_2008
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0xa8]
not ecx
mov edx, dword [ebx + 8]
dec ecx
mov esi, ecx
mov ecx, dword [0x425254]
sub ecx, edx
cmp ecx, esi
ja 0x402891
call fcn.0040a869
test esi, esi
jbe 0x4028cd
mov ebp, dword [ebx + 8]
push 0
add ebp, esi
mov ecx, ebx
push ebp
call fcn.004098a0
test al, al
je 0x4028cd
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ecx, esi
add edi, edx
mov edx, ecx
mov esi, str.Microsoft_Windows_Server_2008
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00409880
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x94
ret
cmp eax, 1
jne 0x4029db
cmp dword [esp + 0x1c], 0x1db0
jne 0x402964
mov edi, str.Microsoft_Windows_7
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa8]
repne scasb al, byte es:[edi]
mov eax, dword [0x425254]
mov edx, dword [ebx + 8]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x40291b
call fcn.0040a869
test esi, esi
jbe 0x402957
mov ebp, dword [ebx + 8]
push 0
add ebp, esi
mov ecx, ebx
push ebp
call fcn.004098a0
test al, al
je 0x402957
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ecx, esi
add edi, edx
mov edx, ecx
mov esi, str.Microsoft_Windows_7
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00409880
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x94
ret
mov edi, str.Microsoft_Windows_Server_2008_R2
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa8]
repne scasb al, byte es:[edi]
mov eax, dword [0x425254]
mov edx, dword [ebx + 8]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x40298f
call fcn.0040a869
test esi, esi
jbe 0x4029cb
mov ebp, dword [ebx + 8]
push 0
add ebp, esi
mov ecx, ebx
push ebp
call fcn.004098a0
test al, al
je 0x4029cb
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ecx, esi
add edi, edx
mov edx, ecx
mov esi, str.Microsoft_Windows_Server_2008_R2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00409880
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x94
ret
cmp eax, 2
jne 0x402ad9
cmp dword [esp + 0x1c], 0x23f0
jne 0x402a62
mov edi, str.Microsoft_Windows_8
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa8]
repne scasb al, byte es:[edi]
mov eax, dword [0x425254]
mov edx, dword [ebx + 8]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x402a19
call fcn.0040a869
test esi, esi
jbe 0x402a55
mov ebp, dword [ebx + 8]
push 0
add ebp, esi
mov ecx, ebx
push ebp
call fcn.004098a0
test al, al
je 0x402a55
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ecx, esi
add edi, edx
mov edx, ecx
mov esi, str.Microsoft_Windows_8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00409880
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x94
ret
mov edi, str.Microsoft_Windows_Server_2012
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa8]
repne scasb al, byte es:[edi]
mov eax, dword [0x425254]
mov edx, dword [ebx + 8]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x402a8d
call fcn.0040a869
test esi, esi
jbe 0x402ac9
mov ebp, dword [ebx + 8]
push 0
add ebp, esi
mov ecx, ebx
push ebp
call fcn.004098a0
test al, al
je 0x402ac9
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ecx, esi
add edi, edx
mov edx, ecx
mov esi, str.Microsoft_Windows_Server_2012
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00409880
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x94
ret
cmp eax, 3
jne 0x402bd7
cmp dword [esp + 0x1c], 0x2580
jne 0x402b60
mov edi, str.Microsoft_Windows_8.1
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa8]
repne scasb al, byte es:[edi]
mov eax, dword [0x425254]
mov edx, dword [ebx + 8]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x402b17
call fcn.0040a869
test esi, esi
jbe 0x402b53
mov ebp, dword [ebx + 8]
push 0
add ebp, esi
mov ecx, ebx
push ebp
call fcn.004098a0
test al, al
je 0x402b53
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ecx, esi
add edi, edx
mov edx, ecx
mov esi, str.Microsoft_Windows_8.1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00409880
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x94
ret
mov edi, str.Microsoft_Windows_Server_2012_R2
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa8]
repne scasb al, byte es:[edi]
mov eax, dword [0x425254]
mov edx, dword [ebx + 8]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x402b8b
call fcn.0040a869
test esi, esi
jbe 0x402bc7
mov ebp, dword [ebx + 8]
push 0
add ebp, esi
mov ecx, ebx
push ebp
call fcn.004098a0
test al, al
je 0x402bc7
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ecx, esi
add edi, edx
mov edx, ecx
mov esi, str.Microsoft_Windows_Server_2012_R2
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00409880
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x94
ret
mov edi, 0x42b170
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa8]
repne scasb al, byte es:[edi]
mov eax, dword [0x425254]
mov edx, dword [ebx + 8]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x402c02
call fcn.0040a869
test esi, esi
jbe 0x402c82
mov ebp, dword [ebx + 8]
push 0
add ebp, esi
mov ecx, ebx
push ebp
call fcn.004098a0
test al, al
je 0x402c82
jmp 0x402c5d
mov edi, 0x42b170
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0xa8]
repne scasb al, byte es:[edi]
mov eax, dword [0x425254]
mov edx, dword [ebx + 8]
not ecx
dec ecx
sub eax, edx
mov esi, ecx
cmp eax, esi
ja 0x402c46
call fcn.0040a869
test esi, esi
jbe 0x402c82
mov ebp, dword [ebx + 8]
push 0
add ebp, esi
mov ecx, ebx
push ebp
call fcn.004098a0
test al, al
je 0x402c82
mov edi, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov ecx, esi
add edi, edx
mov edx, ecx
mov esi, 0x42b170
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00409880
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 0x94
ret