Function at 0x40bf5d
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, 0x454d20
call fcn.00454158
sub esp, 0xd4
push ebx
lea eax, [ebp - 0xe0]
push eax
mov dword [ebp - 0xe0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xdc]
mov dword [edi], eax
mov eax, dword [ebp - 0xd8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xd4]
mov dword [edi + 8], eax
lea eax, [ebp - 0xcc]
push eax
call fcn.004466d0
xor ebx, ebx
cmp eax, ebx
pop ecx
jg 0x40c0a1
mov byte [edi + 0xc], bl
cmp dword [ebp - 0xd0], 2
mov byte [edi + 0x10c], bl
mov byte [edi + 0x10d], bl
mov byte [edi + 0x120], bl
mov byte [edi + 0x10e], bl
mov byte [edi + 0x10f], bl
mov byte [edi + 0x114], bl
mov byte [edi + 0x115], bl
mov byte [edi + 0x110], bl
mov byte [edi + 0x111], bl
mov byte [edi + 0x116], bl
mov byte [edi + 0x117], bl
mov byte [edi + 0x118], bl
mov byte [edi + 0x119], bl
mov byte [edi + 0x112], bl
mov byte [edi + 0x113], bl
mov byte [edi + 0x11c], bl
mov byte [edi + 0x11d], bl
mov byte [edi + 0x11a], bl
mov byte [edi + 0x11b], bl
mov byte [edi + 0x11e], bl
mov byte [edi + 0x11f], bl
jne 0x40c179
mov eax, dword [edi]
sub eax, 4
mov byte [edi + 0x10c], 1
je 0x40c169
dec eax
je 0x40c105
dec eax
jne 0x40c1d0
mov eax, dword [edi + 4]
cmp eax, ebx
mov byte [edi + 0x10f], 1
jne 0x40c0d3
mov byte [edi + 0x115], 1
mov byte [edi + 0x111], 1
mov byte [edi + 0x119], 1
mov byte [edi + 0x118], 1
jmp 0x40c1d0
lea ecx, [ebp + eax - 0xcc]
cmp byte [ecx], 0x20
jne 0x40c0a6
mov byte [ecx], bl
dec eax
cmp eax, ebx
jg 0x40c093
xor ecx, ecx
cmp eax, ebx
jle 0x40c0bb
cmp byte [ebp + ecx - 0xcc], 0x20
jne 0x40c0bb
inc ecx
cmp ecx, eax
jl 0x40c0ac
lea eax, [ebp + ecx - 0xcc]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.00446250
pop ecx
pop ecx
jmp 0x40bfb9
cmp eax, 1
jne 0x40c1d0
mov byte [edi + 0x111], al
mov byte [edi + 0x117], al
mov byte [edi + 0x115], al
mov byte [edi + 0x119], al
mov byte [edi + 0x113], al
mov byte [edi + 0x112], al
jmp 0x40c1d0
mov eax, dword [edi + 4]
cmp eax, ebx
mov byte [edi + 0x10f], 1
jne 0x40c126
mov byte [edi + 0x115], 1
mov byte [edi + 0x114], 1
jmp 0x40c1d0
cmp eax, 1
jne 0x40c142
mov byte [edi + 0x115], al
mov byte [edi + 0x111], al
mov byte [edi + 0x110], al
jmp 0x40c1d0
cmp eax, 2
jb 0x40c1d0
mov byte [edi + 0x115], 1
mov byte [edi + 0x111], 1
mov byte [edi + 0x117], 1
mov byte [edi + 0x116], 1
jmp 0x40c1d0
mov byte [edi + 0x10f], 1
mov byte [edi + 0x10e], 1
jmp 0x40c1d0
movzx eax, word [ebp - 0xd4]
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
cmp eax, ebx
mov byte [edi + 0x10d], 1
mov byte [edi + 0x11d], 1
je 0x40c1c9
cmp eax, 0xa
je 0x40c1b9
cmp eax, 0x5a
jne 0x40c1d0
mov byte [edi + 0x11b], 1
mov byte [edi + 0x11f], 1
mov byte [edi + 0x11e], 1
jmp 0x40c1d0
mov byte [edi + 0x11b], 1
mov byte [edi + 0x11a], 1
jmp 0x40c1d0
mov byte [edi + 0x11c], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
lea eax, [ebp - 0x28]
call fcn.0040c2a8
call eax
cmp dword [ebp - 0x10], 1
jne 0x40c1fe
mov byte [edi + 0x120], 1
cmp byte [edi + 0x120], bl
je 0x40c23d
push esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
lea esi, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0040c2d4
cmp dword [ebp - 0x14], ebx
pop esi
je 0x40c22d
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1c]
call fcn.0040c2be
call eax
cmp dword [ebp - 0x1c], ebx
je 0x40c247
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40c247
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x4c]
cmp ax, bx
jne 0x40c25c
mov dword [edi + 0x124], 1
jmp 0x40c28b
cmp ax, 6
jne 0x40c26e
mov dword [edi + 0x124], 2
jmp 0x40c28b
cmp ax, 9
jne 0x40c280
mov dword [edi + 0x124], 3
jmp 0x40c28b
movzx eax, ax
neg eax
mov dword [edi + 0x124], eax
cmp dword [ebp - 0x28], ebx
pop ebx
je 0x40c29a
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov dword fs:[0], ecx
leave
ret