Function at 0x4e02b9
Capabilities:
Check os version
Get system information on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x694240]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 9
pop eax
mov esi, ecx
lea edi, [ebp - 0x118]
mov ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, 0x9c
push edi
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00572db0
add esp, 0xc
mov dword [ebp - 0xf0], edi
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4e071f
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
push 0x64fd5c
push 0x64fde4
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x4e033b
lea ecx, [ebp - 0x118]
push ecx
call eax
jmp 0x4e0348
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0xe0], 2
jne 0x4e0711
cmp dword [ebp - 0xec], 4
jbe 0x4e0711
push SysReAllocString
push str.Microsoft
push ecx
mov edx, 0x100
mov ecx, esi
call fcn.004e13b9
xor ecx, ecx
push 6
pop eax
inc ecx
cmp dword [ebp - 0xec], eax
jne case.0x4e0441.5
mov eax, dword [ebp - 0xe8]
test eax, eax
jne 0x4e03aa
cmp byte [ebp - 0x56], cl
mov ecx, esi
jne 0x4e03a3
push str.Windows_Vista
jmp 0x4e03f5
push str.Windows_Server_2008
jmp 0x4e03f5
cmp eax, ecx
jne 0x4e03c3
cmp byte [ebp - 0x56], cl
mov ecx, esi
jne 0x4e03bc
push str.Windows_7
jmp 0x4e03f5
push str.Windows_Server_2008_R2
jmp 0x4e03f5
cmp eax, 2
jne 0x4e03dd
cmp byte [ebp - 0x56], cl
mov ecx, esi
jne 0x4e03d6
push str.Windows_8
jmp 0x4e03f5
push str.Windows_Server_2012
jmp 0x4e03f5
cmp eax, 3
jne 0x4e03fa
cmp byte [ebp - 0x56], cl
mov ecx, esi
jne 0x4e03f0
push str.Windows_9
jmp 0x4e03f5
push str.Windows_Server_9
call fcn.004e137d
push str.GetProductInfo
push 0x64fe38
call edi
push eax
call ebx
lea ecx, [ebp - 0xf4]
push ecx
push 0
push 0
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
call eax
mov eax, dword [ebp - 0xf4]
cmp eax, 0x19
ja 0x4e04bf
je 0x4e04b8
dec eax
cmp eax, 0x11
ja case.0x4e0441.5
jmp dword [eax*4 + 0x4e0731]
push str.Ultimate_Edition
jmp 0x4e04c9
push str.Home_Premium_Edition
jmp 0x4e04c9
push str.Home_Basic_Edition
jmp 0x4e04c9
push 0x64ffb0
jmp 0x4e04c9
push str.Business_Edition
jmp 0x4e04c9
push str.Starter_Edition
jmp 0x4e04c9
push str.Cluster_Server_Edition
jmp 0x4e04c9
push 0x6500a0
jmp 0x4e04c9
push str.Datacenter_Edition__core_installation_
jmp 0x4e04c9
push 0x650040
jmp 0x4e04c9
push str.Enterprise_Edition__core_installation_
jmp 0x4e04c9
push 0x6501b0
jmp 0x4e04c9
push str.Small_Business_Server
jmp 0x4e04c9
push 0x6500d0
jmp 0x4e04c9
push str.Standard_Edition__core_installation_
jmp 0x4e04c9
push str.Web_Server_Edition
jmp 0x4e04c9
push str.Small_Business_Server_Premium_Edition
jmp 0x4e04c9
cmp eax, 0x30
jne case.0x4e0441.5
push 0x64fec8
mov ecx, esi
call fcn.004e137d
cmp dword [ebp - 0xec], 5
jne 0x4e0689
mov eax, dword [ebp - 0xe8]
cmp eax, 2
jne 0x4e0602
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4e04ff
push str.Windows_Server_2003_R2
jmp 0x4e051d
test dword [ebp - 0x58], 0x2000
je 0x4e050f
push str.Windows_Storage_Server_2003
jmp 0x4e051d
test dword [ebp - 0x58], 0x8000
je 0x4e0529
push str.Windows_Home_Server
mov ecx, esi
call fcn.004e137d
push 9
pop edi
jmp 0x4e054e
cmp byte [ebp - 0x56], 1
push 9
pop edi
jne 0x4e0542
cmp word [ebp - 0x118], di
jne 0x4e0542
push str.Windows_XP_Professional_x64_Edition
jmp 0x4e0547
push str.Windows_Server_2003
mov ecx, esi
call fcn.004e137d
cmp byte [ebp - 0x56], 1
push 6
pop ebx
je 0x4e05ed
cmp word [ebp - 0x118], bx
jne 0x4e057e
test byte [ebp - 0x58], 0x80
je 0x4e0571
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x4e05c4
test byte [ebp - 0x58], 2
je 0x4e05ed
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x4e05c4
cmp word [ebp - 0x118], di
jne 0x4e05aa
test byte [ebp - 0x58], 0x80
mov ecx, esi
je 0x4e0596
push str.Datacenter_x64_Edition
jmp 0x4e05e8
test byte [ebp - 0x58], 2
je 0x4e05a3
push str.Enterprise_x64_Edition
jmp 0x4e05e8
push str.Standard_x64_Edition
jmp 0x4e05e8
mov eax, dword [ebp - 0x58]
test eax, 0x4000
je 0x4e05bb
push str.Compute_Cluster_Edition
jmp 0x4e05c4
test al, al
jns 0x4e05c8
push str.Datacenter_Edition
mov ecx, esi
jmp 0x4e05e8
mov ecx, esi
test al, 2
je 0x4e05d5
push str.Enterprise_Edition
jmp 0x4e05e8
test eax, 0x400
je 0x4e05e3
push str.Web_Edition
jmp 0x4e05e8
push str.Standard_Edition
call fcn.004e137d
cmp dword [ebp - 0xec], 5
jne 0x4e068f
mov eax, dword [ebp - 0xe8]
jmp 0x4e0608
push 9
pop edi
push 6
pop ebx
cmp eax, 1
jne 0x4e0644
push str.Windows_XP
mov ecx, esi
call fcn.004e137d
test dword [ebp - 0x58], 0x200
mov ecx, esi
je 0x4e062b
push str.Home_Edition
jmp 0x4e0630
push 0x650538
call fcn.004e137d
cmp dword [ebp - 0xec], 5
jne 0x4e068f
mov eax, dword [ebp - 0xe8]
test eax, eax
jne 0x4e068f
push str.Windows_2000
mov ecx, esi
call fcn.004e137d
cmp byte [ebp - 0x56], 1
mov ecx, esi
jne 0x4e0663
push str.Professional
jmp 0x4e067b
test byte [ebp - 0x58], 0x80
je 0x4e0670
push str.Datacenter_Server
jmp 0x4e067b
test byte [ebp - 0x58], 2
je 0x4e0682
push str.Advanced_Server
call fcn.004e137d
jmp 0x4e068f
push str.Server
jmp 0x4e067b
push 9
pop edi
push 6
pop ebx
lea eax, [ebp - 0xdc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4e06ba
push 0x64fee4
mov ecx, esi
call fcn.004e137d
lea eax, [ebp - 0xdc]
mov ecx, esi
push eax
call fcn.004e137d
push dword [ebp - 0xe4]
lea eax, [ebp - 0x54]
push str.__build__d_
push 0x50
push eax
call fcn.004e132a
add esp, 0x10
lea eax, [ebp - 0x54]
mov ecx, esi
push eax
call fcn.004e137d
cmp dword [ebp - 0xec], ebx
jb 0x4e070c
cmp word [ebp - 0x118], di
jne 0x4e06f6
push str._64_bit
jmp 0x4e0705
cmp word [ebp - 0x118], 0
jne 0x4e070c
push str._32_bit
mov ecx, esi
call fcn.004e137d
xor eax, eax
inc eax
jmp 0x4e071e
push str.This_sample_does_not_support_this_version_of_Windows._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005712ac
mov esp, ebp
pop ebp
ret