Function at 0x4151f2
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 9
pop ecx
mov dword [ebp - 0xf4], eax
xor eax, eax
mov esi, 0x9c
push esi
lea edi, [ebp - 0x11c]
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00450230
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
mov dword [ebp - 0xf0], esi
call dword [sym.imp.___total_physical_size__lu_MB_GetVersionExA]
test eax, eax
je 0x41590c
push ebx
mov ebx, dword [sym.imp.___total_physical_size__lu_MB_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetProcAddress]
test eax, eax
je 0x415277
lea ecx, [ebp - 0x11c]
push ecx
call eax
jmp 0x415284
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetSystemInfo]
cmp dword [ebp - 0xe0], 2
jne 0x415909
cmp dword [ebp - 0xec], 4
jb 0x415909
cmp dword [ebp - 0xec], 6
mov edi, dword [ebp - 0xf4]
mov byte [edi], 0
jne 0x4155c1
cmp dword [ebp - 0xe8], 0
jne 0x4152ee
dec edi
cmp byte [ebp - 0x56], 1
jne 0x4152db
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4152c4
mov esi, str.Windows_Vista
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x41535c
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4152db
push 5
pop ecx
mov esi, str.Windows_Server_2008
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe8], 1
jne 0x415325
mov edi, dword [ebp - 0xf4]
dec edi
cmp byte [ebp - 0x56], 1
jne 0x415313
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415304
mov esi, str.Windows_7
jmp 0x4152d2
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415313
push 6
pop ecx
mov esi, str.Windows_Server_2008_R2
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xe8], 2
jne 0x41535d
mov edi, dword [ebp - 0xf4]
dec edi
cmp byte [ebp - 0x56], 1
jne 0x41534a
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41533b
mov esi, str.Windows_8
jmp 0x4152d2
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41534a
push 5
pop ecx
mov esi, str.Windows_Server_2012
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push str.GetProductInfo
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetProcAddress]
lea ecx, [ebp - 0xf8]
push ecx
push 0
push 0
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
call eax
mov eax, dword [ebp - 0xf8]
cmp eax, 0xa
ja 0x41548f
je 0x41547b
dec eax
cmp eax, 8
ja case.0x4153a8.5
jmp dword [eax*4 + 0x41591e]
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4153b6
mov esi, str.Ultimate
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x415580
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4153d1
mov esi, str.Home_Premium
movsd dword es:[edi], dword [esi]
jmp 0x4153c3
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4153e8
mov esi, str.Home_Basic
jmp 0x41557c
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415401
mov esi, str.Enterprise
jmp 0x41557c
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41541a
mov esi, str.Business
jmp 0x4153c3
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415430
mov esi, str.Datacenter_Edition
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x41557c
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41544b
push 5
pop ecx
mov esi, str.Small_Business_Server
rep movsd dword es:[edi], dword [esi]
jmp 0x4154f1
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415469
mov esi, str.Standard
jmp 0x4153c3
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415482
jmp 0x415409
cmp eax, 0xf
ja 0x41552b
je 0x415510
sub eax, 0xb
je 0x4154f8
dec eax
je 0x4154d9
dec eax
je 0x4154c2
dec eax
jne case.0x4153a8.5
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4154b3
mov esi, str.Enterprise__core_
jmp 0x4154ed
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4154c9
mov esi, str.Standard__core_
movsd dword es:[edi], dword [esi]
jmp 0x41554c
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4154e0
mov esi, str.Datacenter__core_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp case.0x4153a8.5
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4154ff
mov esi, str.Starter
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp case.0x4153a8.5
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415517
push 6
pop ecx
mov esi, str.Enterprise_Edition_IA64
rep movsd dword es:[edi], dword [esi]
jmp case.0x4153a8.5
sub eax, 0x11
je 0x415568
dec eax
je 0x41554f
sub eax, 7
jne case.0x4153a8.5
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41553f
mov esi, str.SBS_Premium
movsd dword es:[edi], dword [esi]
jmp 0x41550c
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415556
mov esi, str.Cluster_Server
jmp 0x41543e
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41556f
mov esi, str.Web_Server
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp word [ebp - 0x11c], 9
jne 0x4155a1
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415592
mov esi, str._64_bit
jmp 0x4155bf
cmp word [ebp - 0x11c], 0
jne 0x4155c1
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4155b2
mov esi, str._32_bit
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xec], 5
jne 0x41585f
cmp dword [ebp - 0xe8], 2
jne 0x415791
push 0x59
call dword [sym.imp.e_to_open__s_GetSystemMetrics]
mov edx, dword [ebp - 0x58]
test eax, eax
je 0x415606
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4155f1
push 6
pop ecx
mov esi, str.Windows_Server_2003_R2_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x415676
mov eax, 0x2000
cmp dx, ax
jne 0x41562b
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415617
push 7
pop ecx
mov esi, str.Windows_Storage_Server_2003
rep movsd dword es:[edi], dword [esi]
jmp 0x415676
cmp byte [ebp - 0x56], 1
jne 0x41565b
cmp word [ebp - 0x11c], 9
jne 0x41565b
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415642
push 7
pop ecx
mov esi, str.Windows_XP_Professional_x64_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x415782
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415662
push 5
pop ecx
mov esi, str.Windows_Server_2003_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x56], 1
je 0x415782
push 6
pop ecx
cmp word [ebp - 0x11c], cx
jne 0x4156c8
test dl, dl
jns 0x4156a9
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415697
mov esi, str.Datacenter_Edition_IA64
jmp 0x41572d
test dl, 2
je 0x415782
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4156b9
mov esi, str.Enterprise_Edition_IA64
jmp 0x41572d
mov edi, dword [ebp - 0xf4]
dec edi
cmp word [ebp - 0x11c], 9
jne 0x415718
test dl, dl
jns 0x4156f4
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4156dd
mov esi, str.Datacenter_x64
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x415781
test dl, 2
je 0x415708
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4156f9
mov esi, str.Enterprise_x64
jmp 0x4156ea
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415708
mov esi, str.Standard_x64
movsd dword es:[edi], dword [esi]
jmp 0x41577f
test edx, 0x4000
je 0x415731
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415720
mov esi, str.Compute_Cluster_Edition
rep movsd dword es:[edi], dword [esi]
jmp 0x415782
test dl, dl
jns 0x415744
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415735
mov esi, str.Datacenter
jmp 0x4156eb
test dl, 2
je 0x415758
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415749
mov esi, str.Enterprise
jmp 0x4156eb
test edx, 0x400
je 0x415772
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415760
mov esi, str.Web_Edition
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x415782
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415772
mov esi, str.Standard
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xec], 5
jne 0x41585f
jmp 0x415794
mov edx, dword [ebp - 0x58]
cmp dword [ebp - 0xe8], 1
mov ebx, dword [ebp - 0xf4]
mov ecx, str.Professional
jne 0x4157e6
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4157ab
mov esi, str.Windows_XP
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx - 1]
test edx, 0x200
je 0x4157d8
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4157c6
mov esi, str.Home
jmp 0x41587e
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4157d8
mov esi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xe8], 0
jne 0x415880
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4157f6
cmp byte [ebp - 0x56], 1
mov esi, str.Windows_2000
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebx - 1]
jne 0x41581d
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415811
mov esi, ecx
jmp 0x41587c
test dl, dl
jns 0x415836
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415821
mov esi, str.Datacenter_Server
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x415880
test dl, 2
je 0x41584e
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41583b
mov esi, str.Advanced_Server
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x415880
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41584e
mov esi, str.Server
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xec], 4
jne 0x415880
mov edi, dword [ebp - 0xf4]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41586f
mov esi, str.Windows_NT4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp - 0xf4]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x415889
mov esi, 0x46bac0
lea eax, [ebp - 0xdc]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4158a0
sub eax, edx
lea edi, [ebx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4158ac
push dword [ebp - 0xe4]
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x54]
and ecx, 3
push str.___d_
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00450c76
lea eax, [ebp - 0x54]
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4158e0
sub eax, ecx
mov esi, ecx
lea edi, [ebx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4158ee
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
inc eax
jmp 0x41590b
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00450b32
leave
ret 4