Function at 0x403bf0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x148
mov eax, dword [0x471050]
xor eax, esp
mov dword [esp + 0x144], eax
push esi
mov esi, ecx
push 0
mov eax, 0x45c064
call fcn.00402de0
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x404297
cmp dword [esp + 0x3c], 2
jne 0x404297
cmp dword [esp + 0x30], 5
jb 0x404297
push ebx
xor eax, eax
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x45c418
push str.kernel32.dll
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
test eax, eax
je 0x403c95
lea ecx, [esp + 0x14]
push ecx
call eax
jmp 0x403ca0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0xa
mov eax, str.Microsoft
call fcn.00402de0
mov eax, dword [esp + 0x3c]
mov ebx, 1
cmp eax, 6
jne 0x403fb1
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x403cde
push esi
cmp byte [esp + 0x156], bl
jne 0x403cd7
mov eax, str.Windows_Vista
jmp 0x403cf6
mov eax, str.Windows_Server_2008
jmp 0x403cf6
cmp eax, ebx
jne 0x403cfb
push esi
mov eax, str.Windows_7
cmp byte [esp + 0x156], bl
je 0x403cf6
mov eax, str.Windows_Server_2008_R2
call fcn.00406770
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call ebp
test eax, eax
je case.0x403d4a.5
movzx edx, word [esp + 0x14e]
lea ecx, [esp + 0x10]
push ecx
movzx ecx, word [esp + 0x150]
push edx
mov edx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push ecx
call eax
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 0x2f
ja case.0x403d4a.5
movzx edx, byte [eax + 0x4042f8]
jmp dword [edx*4 + 0x4042b0]
mov eax, str.Ultimate_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Professional
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Home_Premium_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Home_Basic_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Enterprise_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Business_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Starter_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Cluster_Server_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Datacenter_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Datacenter_Edition__core_installation_
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Enterprise_Edition__core_installation_
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Small_Business_Server
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Small_Business_Server_Premium_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Standard_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Standard_Edition__core_installation_
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Web_Server_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
cmp eax, 5
jne case.0x403d4a.5
mov eax, dword [esp + 0x40]
cmp eax, 2
jne 0x4041b4
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x403fda
mov eax, str.Windows_Server_2003_R2
jmp 0x404018
mov eax, dword [esp + 0x150]
test eax, 0x2000
je 0x403fef
mov eax, str.Windows_Storage_Server_2003
jmp 0x404018
test eax, 0x8000
je 0x403ffd
mov eax, str.Windows_Home_Server
jmp 0x404018
cmp byte [esp + 0x152], bl
jne 0x404013
cmp word [esp + 0x14], 9
mov eax, str.Windows_XP_Professional_x64_Edition
je 0x404018
mov eax, str.Windows_Server_2003
push esi
call fcn.00406770
cmp byte [esp + 0x152], bl
je case.0x403d4a.5
mov eax, dword [esp + 0x14]
cmp ax, 6
jne 0x404094
mov al, byte [esp + 0x150]
test al, al
jns 0x404066
mov eax, str.Datacenter_Edition_for_Itanium_based_Systems
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
test al, 2
je case.0x403d4a.5
mov eax, str.Enterprise_Edition_for_Itanium_based_Systems
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
cmp ax, 9
jne 0x40411e
mov al, byte [esp + 0x150]
test al, al
jns 0x4040cf
mov eax, str.Datacenter_x64_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
push esi
test al, 2
je 0x4040f9
mov eax, str.Enterprise_x64_Edition
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Standard_x64_Edition
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, dword [esp + 0x150]
test eax, 0x4000
je 0x404152
mov eax, str.Compute_Cluster_Edition
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
test al, al
js case.0x403d4a.8
test al, 2
jne case.0x403d4a.4
push esi
test eax, 0x400
je 0x40418f
mov eax, str.Web_Edition
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Standard_Edition
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
cmp eax, ebx
jne 0x40421b
push esi
mov eax, str.Windows_XP
call fcn.00406770
test dword [esp + 0x150], 0x200
push esi
je 0x4041f6
mov eax, str.Home_Edition
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov eax, str.Professional
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
test eax, eax
jne case.0x403d4a.5
push esi
mov eax, str.Windows_2000
call fcn.00406770
cmp byte [esp + 0x152], bl
je case.0x403d4a.48
mov al, byte [esp + 0x150]
test al, al
jns 0x404268
mov eax, str.Datacenter_Server
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
test al, 2
mov eax, str.Advanced_Server
jne 0x404276
mov eax, str.Server
push esi
call fcn.00406770
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0042c9e9
add esp, 0x148
ret
mov ecx, dword [esp + 0x148]
pop esi
xor ecx, esp
xor al, al
call fcn.0042c9e9
add esp, 0x148
ret