Function at 0x411fc0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
mov eax, dword [0x440008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0xcc]
mov ecx, 0x24
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x411fe1
mov ecx, 0x11c
lea eax, [ebp - 0x1e8]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x411ff7
mov dword [ebp - 0x1e8], 0x11c
xor eax, eax
mov ecx, 0x458ae8
cmp dword [ecx], 0x1a
je 0x412032
inc eax
add ecx, 0x20
cmp eax, 0x1f
jb 0x412013
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041396d
mov esp, ebp
pop ebp
ret
shl eax, 5
mov al, byte [eax + 0x458b00]
test al, al
je 0x412021
xor eax, eax
mov ecx, 0x458ae8
cmp dword [ecx], 0x1a
je 0x4120e1
inc eax
add ecx, 0x20
cmp eax, 0x1f
jb 0x412046
xor eax, eax
lea ecx, [ebp - 0x1e8]
push ecx
call eax
xor eax, eax
mov ecx, 0x458ae8
nop word [eax + eax]
cmp dword [ecx], 4
je 0x4120fc
inc eax
add ecx, 0x20
cmp eax, 0x1f
jb 0x412070
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x1d8], 2
jne 0x412021
cmp dword [ebp - 0x1e4], 4
jbe 0x412021
push ecx
push str.Microsoft
push ecx
mov edx, 0x104
mov ecx, esi
call fcn.00412f70
cmp dword [ebp - 0x1e4], 0xa
jne 0x412186
cmp dword [ebp - 0x1e0], 0
jne case.0x41223c.5
cmp byte [ebp - 0xce], 1
jne 0x412152
push str.Windows_10
jmp 0x412462
shl eax, 5
cmp byte [eax + 0x458b00], 0
je 0x412058
mov eax, dword [eax + 0x458b04]
jmp 0x41205a
shl eax, 5
mov al, byte [eax + 0x458b00]
test al, al
je 0x412082
xor eax, eax
mov ecx, 0x458ae8
cmp dword [ecx], 4
je 0x412132
inc eax
add ecx, 0x20
cmp eax, 0x1f
jb 0x412114
lea ecx, [ebp - 0xcc]
xor eax, eax
push ecx
call eax
jmp 0x41208f
shl eax, 5
cmp byte [eax + 0x458b00], 0
je 0x412122
mov eax, dword [eax + 0x458b04]
lea ecx, [ebp - 0xcc]
push ecx
call eax
jmp 0x41208f
mov eax, dword [ebp - 0x1dc]
cmp eax, 0x4563
jbe 0x412169
push str.Windows_Server_20XX
jmp 0x412462
mov ecx, esi
cmp eax, 0x3839
jbe 0x41217c
push str.Windows_Server_2019
jmp 0x412464
push str.Windows_Server_2016
jmp 0x412464
cmp dword [ebp - 0x1e4], 6
jne 0x4122c5
cmp dword [ebp - 0x1e0], 0
jne 0x4121b8
cmp byte [ebp - 0xce], 1
mov ecx, esi
jne 0x4121ae
push str.Windows_Vista
jmp 0x4121b3
push str.Windows_Server_2008
call fcn.00412f10
cmp dword [ebp - 0x1e0], 1
jne 0x4121dd
cmp byte [ebp - 0xce], 1
mov ecx, esi
jne 0x4121d3
push str.Windows_7
jmp 0x4121d8
push str.Windows_Server_2008_R2
call fcn.00412f10
cmp dword [ebp - 0x1e0], 2
jne 0x412202
cmp byte [ebp - 0xce], 1
mov ecx, esi
jne 0x4121f8
push str.Windows_8
jmp 0x4121fd
push str.Windows_Server_2012
call fcn.00412f10
lea eax, [ebp - 0xa8]
mov ecx, 5
push eax
push 0
push 0
push dword [ebp - 0x1e0]
push dword [ebp - 0x1e4]
call fcn.004117b0
call eax
mov eax, dword [ebp - 0xa8]
dec eax
cmp eax, 0x2f
ja case.0x41223c.5
movzx eax, byte [eax + 0x412570]
jmp dword [eax*4 + 0x412528]
push str.Ultimate_Edition
jmp 0x412462
push str.Home_Premium_Edition
jmp 0x412462
push str.Home_Basic_Edition
jmp 0x412462
push str.Business_Edition
jmp 0x412462
push str.Starter_Edition
jmp 0x412462
push str.Cluster_Server_Edition
jmp 0x412462
push str.Datacenter_Edition__core_installation_
jmp 0x412462
push str.Enterprise_Edition__core_installation_
jmp 0x412462
push str.Small_Business_Server
jmp 0x412462
push str.Small_Business_Server_Premium_Edition
jmp 0x412462
push str.Standard_Edition
jmp 0x412462
push str.Standard_Edition__core_installation_
jmp 0x412462
push str.Web_Server_Edition
jmp 0x412462
cmp dword [ebp - 0x1e4], 5
jne case.0x41223c.5
mov eax, dword [ebp - 0x1e0]
cmp eax, 2
jne 0x4123f4
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4122f4
push str.Windows_Server_2003_R2_
jmp 0x412335
mov eax, dword [ebp - 0xd0]
test eax, 0x2000
je 0x412308
push str.Windows_Storage_Server_2003
jmp 0x412335
test eax, 0x8000
je 0x412316
push str.Windows_Home_Server
jmp 0x412335
cmp byte [ebp - 0xce], 1
jne 0x412330
cmp word [ebp - 0xcc], 9
jne 0x412330
push str.Windows_XP_Professional_x64_Edition
jmp 0x412335
push str.Windows_Server_2003_
mov ecx, esi
call fcn.00412f10
cmp byte [ebp - 0xce], 1
je case.0x41223c.5
mov ax, word [ebp - 0xcc]
cmp ax, 6
jne 0x41237c
mov eax, dword [ebp - 0xd0]
test al, al
jns 0x41236a
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x412462
test al, 2
je case.0x41223c.5
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x412462
cmp ax, 9
mov eax, dword [ebp - 0xd0]
jne 0x4123b0
test al, al
jns 0x412396
push str.Datacenter_x64_Edition
jmp 0x412462
mov ecx, esi
test al, 2
je 0x4123a6
push str.Enterprise_x64_Edition
jmp 0x412464
push str.Standard_x64_Edition
jmp 0x412464
test eax, 0x4000
je 0x4123c1
push str.Compute_Cluster_Edition
jmp 0x412462
test al, al
jns 0x4123cf
push str.Datacenter_Edition
jmp 0x412462
test al, 2
je 0x4123dd
push str.Enterprise_Edition
jmp 0x412462
mov ecx, esi
test eax, 0x400
je 0x4123ed
push str.Web_Edition
jmp 0x412464
push str.Standard_Edition
jmp 0x412464
cmp eax, 1
jne 0x412421
push str.Windows_XP
mov ecx, esi
call fcn.00412f10
test dword [ebp - 0xd0], 0x200
mov ecx, esi
je 0x41241a
push str.Home_Edition
jmp 0x412464
push str.Professional
jmp 0x412464
test eax, eax
jne case.0x41223c.5
push str.Windows_2000
mov ecx, esi
call fcn.00412f10
cmp byte [ebp - 0xce], 1
jne 0x412441
push str.Professional
jmp 0x412462
mov eax, dword [ebp - 0xd0]
test al, al
jns 0x412452
push str.Datacenter_Server
jmp 0x412462
test al, 2
je 0x41245d
push str.Advanced_Server
jmp 0x412462
push str.Server
mov ecx, esi
call fcn.00412f10
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x1d4]
call fcn.00412ec0
test eax, eax
js 0x4124a2
cmp dword [ebp - 0x1ec], 0
jbe 0x4124a2
push 0x43bb44
mov ecx, esi
call fcn.00412f10
lea eax, [ebp - 0x1d4]
mov ecx, esi
push eax
call fcn.00412f10
push dword [ebp - 0x1dc]
lea eax, [ebp - 0xa4]
push str.__build__u_
push 0x50
push eax
call fcn.00411a20
add esp, 0x10
lea eax, [ebp - 0xa4]
mov ecx, esi
push eax
call fcn.00412f10
cmp dword [ebp - 0x1e4], 6
jb 0x412513
mov ax, word [ebp - 0xcc]
cmp ax, 9
jne 0x412502
push str._64_bit
mov ecx, esi
call fcn.00412f10
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041396d
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x412513
push str._32_bit
mov ecx, esi
call fcn.00412f10
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0041396d
mov esp, ebp
pop ebp
ret