Function at 0x4004f030
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x400744e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x280
push ebx
push esi
push edi
push 0x118
lea eax, [ebp - 0x174]
mov dword [ebp - 0x5c], 0
mov edi, edx
mov dword [ebp - 0x178], 0x11c
mov ebx, ecx
mov dword [ebp - 0x20], edi
push 0
push eax
mov dword [ebp - 0x28], ebx
call fcn.40054740
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x178]
add esp, 0xc
push eax
call esi
test eax, eax
jne 0x4004f0d3
push 0x110
push eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x28c], 0x114
push eax
call fcn.40054740
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
call esi
mov ecx, 0x45
lea esi, [ebp - 0x28c]
lea edi, [ebp - 0x178]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x20]
cmp dword [ebp - 0x168], 2
jne 0x4004f7e1
cmp dword [ebp - 0x174], 4
jbe 0x4004f7e1
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call fcn.40001ce1
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4004f130
push 0x80004005
call fcn.40001ad1
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
call fcn.40001ce1
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4004f160
push 0x80004005
call fcn.40001ad1
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
call fcn.40001ce1
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4004f18d
push 0x80004005
call fcn.40001ad1
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
call fcn.40001ce1
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4004f1ba
push 0x80004005
call fcn.40001ad1
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 4
call fcn.40001ce1
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4004f1e7
push 0x80004005
call fcn.40001ad1
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x174]
cmp eax, 6
jne 0x4004f448
mov eax, dword [ebp - 0x170]
cmp eax, 3
jne 0x4004f2a4
cmp byte [ebp - 0x5e], 1
lea ecx, [ebp - 0x14]
jne 0x4004f226
push str.Windows_8.1
jmp 0x4004f22b
push str.Windows_Server_2012_R2
call fcn.40006a29
mov edx, dword [ebp - 0x170]
sub esp, 8
mov ecx, dword [ebp - 0x174]
call fcn.4004efe0
add esp, 8
cmp eax, 4
je case.0x4004f30c.4
cmp eax, 0x30
je 0x4004f271
cmp eax, 0x65
je 0x4004f26a
push eax
lea eax, [ebp - 0x10]
push str._edition_code:_0x_08X_
push eax
call fcn.40007b5a
add esp, 0xc
jmp case.0x4004f30c.5
push 0x4007c358
jmp 0x4004f27d
push 0x40085bec
jmp 0x4004f27d
push str.Enterprise_Edition
lea ecx, [ebp - 0x10]
call fcn.40006a29
mov eax, dword [ebp - 0x58]
cmp ax, 9
jne 0x4004f345
push str.64_bit
lea ecx, [ebp - 0x18]
call fcn.4000d55a
jmp 0x4004f56b
cmp eax, 2
jne 0x4004f2c6
cmp byte [ebp - 0x5e], 1
lea ecx, [ebp - 0x14]
jne 0x4004f2bc
push str.Windows_8
jmp 0x4004f22b
push str.Windows_Server_2012
jmp 0x4004f22b
cmp eax, 1
jne 0x4004f360
lea ecx, [ebp - 0x14]
cmp byte [ebp - 0x5e], al
jne 0x4004f2de
push str.Windows_7
jmp 0x4004f2e3
push str.Windows_Server_2008_R2
call fcn.40006a29
mov edx, dword [ebp - 0x170]
sub esp, 8
mov ecx, dword [ebp - 0x174]
call fcn.4004efe0
dec eax
add esp, 8
cmp eax, 0x2f
ja case.0x4004f30c.5
movzx eax, byte [eax + 0x4004f884]
jmp dword [eax*4 + 0x4004f868]
push str.Ultimate_Edition
jmp 0x4004f27d
push str.Home_Premium_Edition
jmp 0x4004f27d
push str.Home_Basic_Edition
jmp 0x4004f27d
push str.Professional_Edition
jmp 0x4004f27d
push str.Starter_Edition
jmp 0x4004f27d
test ax, ax
jne 0x4004f56b
push str.32_bit
lea ecx, [ebp - 0x18]
call fcn.4000d55a
jmp 0x4004f56b
test eax, eax
jne 0x4004f56b
cmp byte [ebp - 0x5e], 1
lea ecx, [ebp - 0x14]
jne 0x4004f378
push str.Windows_Vista
jmp 0x4004f37d
push str.Windows_Server_2008
call fcn.40006a29
mov edx, dword [ebp - 0x170]
sub esp, 8
mov ecx, dword [ebp - 0x174]
call fcn.4004efe0
dec eax
add esp, 8
cmp eax, 0x18
ja case.0x4004f39f.5
jmp dword [eax*4 + 0x4004f8b4]
push str.Ultimate_Edition
jmp 0x4004f414
push str.Home_Premium_Edition
jmp 0x4004f414
push str.Home_Basic_Edition
jmp 0x4004f414
push str.Enterprise_Edition
jmp 0x4004f414
push str.Business_Edition
jmp 0x4004f414
push str.Starter_Edition
jmp 0x4004f414
push str.Cluster_Server_Edition
jmp 0x4004f414
push str.Datacenter_Edition
jmp 0x4004f414
push str.Datacenter_Edition__core_installation_
jmp 0x4004f414
push str.Enterprise_Edition__core_installation_
jmp 0x4004f414
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x4004f414
push str.Small_Business_Server
jmp 0x4004f414
push str.Small_Business_Server_Premium_Edition
jmp 0x4004f414
push str.Standard_Edition
jmp 0x4004f414
push str.Standard_Edition__core_installation_
jmp 0x4004f414
push str.Web_Server_Edition
lea ecx, [ebp - 0x10]
call fcn.40006a29
mov eax, dword [ebp - 0x58]
cmp ax, 9
jne 0x4004f432
push str.64_bit
lea ecx, [ebp - 0x18]
jmp 0x4004f566
test ax, ax
jne 0x4004f56b
push str.32_bit
lea ecx, [ebp - 0x18]
jmp 0x4004f566
cmp eax, 5
jne 0x4004f56b
mov eax, dword [ebp - 0x170]
cmp eax, 2
jne 0x4004f53c
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4004f473
push str.Windows_Server_2003_R2
jmp 0x4004f49e
mov eax, 0x2000
cmp word [ebp - 0x60], ax
jne 0x4004f485
push str.Windows_Storage_Server_2003
jmp 0x4004f49e
cmp byte [ebp - 0x5e], 1
jne 0x4004f499
cmp word [ebp - 0x58], 9
jne 0x4004f499
push str.Windows_XP_Professional_x64_Edition
jmp 0x4004f49e
push str.Windows_Server_2003
lea ecx, [ebp - 0x14]
call fcn.40006a29
cmp byte [ebp - 0x5e], 1
je 0x4004f56b
movzx eax, word [ebp - 0x58]
cmp eax, 6
je 0x4004f523
cmp eax, 9
mov eax, dword [ebp - 0x60]
je 0x4004f503
test eax, 0x4000
je 0x4004f4d2
push str.Compute_Cluster_Edition
jmp 0x4004f563
test al, al
jns 0x4004f4e0
push str.Datacenter_Edition
jmp 0x4004f563
test al, 2
je 0x4004f4eb
push str.Enterprise_Edition
jmp 0x4004f563
lea ecx, [ebp - 0x10]
test eax, 0x400
je 0x4004f4fc
push str.Web_Edition
jmp 0x4004f566
push str.Standard_Edition
jmp 0x4004f566
test al, al
jns 0x4004f50e
push str.Datacenter_x64_Edition
jmp 0x4004f563
lea ecx, [ebp - 0x10]
test al, 2
je 0x4004f51c
push str.Enterprise_x64_Edition
jmp 0x4004f566
push str.Standard_x64_Edition
jmp 0x4004f566
mov eax, dword [ebp - 0x60]
test al, al
jns 0x4004f531
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x4004f563
test al, 2
je 0x4004f56b
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x4004f563
cmp eax, 1
jne 0x4004f56b
push str.Windows_XP
lea ecx, [ebp - 0x14]
call fcn.40006a29
test dword [ebp - 0x60], 0x200
je 0x4004f55e
push str.Home_Edition
jmp 0x4004f563
push str.Professional
lea ecx, [ebp - 0x10]
call fcn.40006a29
lea eax, [ebp - 0x164]
push eax
call fcn.40054188
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.40007835
push dword [ebp - 0x16c]
lea eax, [ebp - 0x20]
push 0x4007ea28
push eax
call fcn.40007b5a
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp dword [eax - 0xc], 0
jne 0x4004f5ee
mov ecx, dword [ebp - 0x174]
movzx eax, word [ebp - 0x60]
cmp ecx, 6
jb 0x4004f5d0
mov edx, dword [ebp - 0x170]
sub esp, 8
call fcn.4004efe0
mov ecx, dword [ebp - 0x174]
add esp, 8
push eax
movzx eax, byte [ebp - 0x5e]
push eax
push dword [ebp - 0x170]
lea eax, [ebp - 0x14]
push ecx
push str.Windows:_lu._lu__ProductType:_u__Edition:_lu
push eax
call fcn.40007b5a
add esp, 0x18
test edi, edi
je 0x4004f5fd
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.400088ff
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4004f60d
lea eax, [ebp - 0x1c]
push eax
call fcn.400088ff
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
je 0x4004f624
push 0x40086368
push ecx
lea ecx, [ebp - 0x18]
call fcn.4004e9f0
mov esi, dword [ebp - 0x1c]
cmp dword [esi - 0xc], 0
je 0x4004f63e
push 0x4007e130
push ecx
lea ecx, [ebp - 0x1c]
call fcn.4004e9f0
mov esi, dword [ebp - 0x1c]
push 0x4007e130
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x30]
call fcn.40009e4c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
push ecx
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.40009deb
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
push ecx
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.40009deb
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
push ecx
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.40009deb
add esp, 0x10
mov byte [ebp - 4], 0xa
or ebx, 0xffffffff
mov edx, dword [ebp - 0x34]
mov eax, ebx
add edx, 0xfffffff0
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4004f6aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
mov ecx, ebx
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4004f6ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4004f6ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x24]
push edi
push str.__build__s_
push eax
call fcn.4000e7b4
mov ecx, dword [ebp - 0x24]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.400073ec
mov ecx, dword [ebp - 0x28]
add eax, 0x10
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov dword [ecx], eax
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4004f732
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 4
mov ecx, ebx
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4004f74f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 3
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4004f76c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov ecx, ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4004f78c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov ecx, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4004f7ac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4004f7cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.40001ce1
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4004f7fd
push 0x80004005
call fcn.40001ad1
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, 0x4007c358
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x4004f83a
movzx eax, ax
mov ecx, ebx
push eax
call fcn.40007342
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x4007c358
call fcn.40054188
add esp, 4
mov ecx, ebx
push eax
push 0x4007c358
call fcn.40007835
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret