Function at 0x42ccd2
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4bb760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 9
pop eax
mov esi, ecx
lea edi, [ebp - 0x148]
mov ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, 0x11c
push edi
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00468320
add esp, 0xc
mov dword [ebp - 0x120], edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42cd2b
inc eax
jmp 0x42d338
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x42cd56
lea ecx, [ebp - 0x148]
push ecx
call eax
jmp 0x42cd63
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x42d274
cmp dword [ebp - 0x11c], 4
jbe 0x42d320
push str.Microsoft
call fcn.0040c2ec
pop ecx
push eax
push str.Microsoft
mov ecx, esi
call fcn.0040d798
cmp dword [ebp - 0x11c], 0xa
jne 0x42cded
cmp dword [ebp - 0x118], 0
jne 0x42cdd5
cmp byte [ebp - 6], 1
jne 0x42cdc2
push str.Windows_10_Insider_Preview
call fcn.0040c2ec
pop ecx
push eax
push str.Windows_10_Insider_Preview
jmp 0x42cde6
push str.Windows_Server_Technical_Preview
call fcn.0040c2ec
pop ecx
push eax
push str.Windows_Server_Technical_Preview
jmp 0x42cde6
push 0x4a49ec
call fcn.0040c2ec
pop ecx
push eax
push 0x4a49ec
mov ecx, esi
call fcn.0040d662
push 6
pop eax
cmp dword [ebp - 0x11c], eax
jne case.0x42cf41.5
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x42cec9
dec eax
je 0x42ce9d
dec eax
je 0x42ce71
dec eax
je 0x42ce3f
dec eax
jne 0x42cefa
cmp byte [ebp - 6], 1
jne 0x42cefa
push str.Windows_10
call fcn.0040c2ec
pop ecx
push eax
push str.Windows_10
jmp 0x42cef3
cmp byte [ebp - 6], 1
jne 0x42ce5b
push 0x4a4adc
call fcn.0040c2ec
pop ecx
push eax
push 0x4a4adc
jmp 0x42cef3
push 0x4a4af8
call fcn.0040c2ec
pop ecx
push eax
push 0x4a4af8
jmp 0x42cef3
cmp byte [ebp - 6], 1
jne 0x42ce8a
push 0x4a4a98
call fcn.0040c2ec
pop ecx
push eax
push 0x4a4a98
jmp 0x42cef3
push 0x4a4ab0
call fcn.0040c2ec
pop ecx
push eax
push 0x4a4ab0
jmp 0x42cef3
cmp byte [ebp - 6], 1
jne 0x42ceb6
push 0x4a4a50
call fcn.0040c2ec
pop ecx
push eax
push 0x4a4a50
jmp 0x42cef3
push 0x4a4a68
call fcn.0040c2ec
pop ecx
push eax
push 0x4a4a68
jmp 0x42cef3
cmp byte [ebp - 6], 1
jne 0x42cee2
push 0x4a4a04
call fcn.0040c2ec
pop ecx
push eax
push 0x4a4a04
jmp 0x42cef3
push 0x4a4a24
call fcn.0040c2ec
pop ecx
push eax
push 0x4a4a24
mov ecx, esi
call fcn.0040d662
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call ebx
lea ecx, [ebp - 0x124]
push ecx
push 0
push 0
push dword [ebp - 0x118]
push dword [ebp - 0x11c]
call eax
mov eax, dword [ebp - 0x124]
cmp eax, 0x19
ja 0x42d003
je 0x42cff9
dec eax
cmp eax, 0x11
ja case.0x42cf41.5
jmp dword [eax*4 + 0x42d34a]
mov edi, str.Starter_Edition
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
jmp 0x42d019
mov edi, str.Home_Premium_Edition
jmp 0x42cf4d
mov edi, str.Home_Basic_Edition
jmp 0x42cf4d
push str.Enterprise_Edition
call fcn.0040c2ec
pop ecx
push eax
push str.Enterprise_Edition
jmp 0x42d019
mov edi, str.Business_Edition
jmp 0x42cf4d
mov edi, str.Cluster_Server_Edition
jmp 0x42cf4d
push str.Datacenter_Edition
call fcn.0040c2ec
pop ecx
push eax
push str.Datacenter_Edition
jmp 0x42d019
mov edi, str.Datacenter_Edition__core_installation_
jmp 0x42cf4d
mov edi, str.Ultimate_Edition
jmp 0x42cf4d
mov edi, str.Enterprise_Edition__core_installation_
jmp 0x42cf4d
push str.Enterprise_Edition_for_Itanium_based_Systems
call fcn.0040c2ec
pop ecx
push eax
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x42d019
mov edi, str.Small_Business_Server
jmp 0x42cf4d
mov edi, str.Standard_Edition__core_installation_
jmp 0x42cf4d
push str.Standard_Edition
call fcn.0040c2ec
pop ecx
push eax
push str.Standard_Edition
jmp 0x42d019
mov edi, str.Web_Server_Edition
jmp 0x42cf4d
mov edi, str.Small_Business_Server_Premium_Edition
jmp 0x42cf4d
cmp eax, 0x30
jne case.0x42cf41.5
push str.Professional
call fcn.0040c2ec
pop ecx
push eax
push str.Professional
mov ecx, esi
call fcn.0040d662
cmp dword [ebp - 0x11c], 5
jne 0x42d22f
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x42d1e7
dec eax
je 0x42d1af
dec eax
je 0x42d050
mov edi, str.Unsupported_version_of_Windows
jmp 0x42d325
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x42d063
mov edi, 0x4a4f64
jmp 0x42d081
test dword [ebp - 8], 0x2000
je 0x42d073
mov edi, 0x4a4f94
jmp 0x42d081
test dword [ebp - 8], 0x8000
je 0x42d096
mov edi, 0x4a4fd0
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
push 9
pop ebx
jmp 0x42d0c2
cmp byte [ebp - 6], 1
push 9
pop ebx
jne 0x42d0ad
mov edi, 0x4a4f30
cmp word [ebp - 0x148], bx
je 0x42d0b2
mov edi, 0x4a4ffc
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
cmp byte [ebp - 6], 1
push 6
pop edi
je 0x42d235
cmp word [ebp - 0x148], di
jne 0x42d118
test byte [ebp - 8], 0x80
je 0x42d0f8
mov edi, str.Datacenter_Edition_for_Itanium_based_Systems
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
jmp 0x42d232
test byte [ebp - 8], 2
je 0x42d235
push str.Enterprise_Edition_for_Itanium_based_Systems
call fcn.0040c2ec
pop ecx
push eax
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x42d1a3
cmp word [ebp - 0x148], bx
jne 0x42d142
test byte [ebp - 8], 0x80
je 0x42d12e
mov edi, str.Datacenter_x64_Edition
jmp 0x42d0e3
test byte [ebp - 8], 2
je 0x42d13b
mov edi, str.Enterprise_x64_Edition
jmp 0x42d0e3
mov edi, str.Standard_x64_Edition
jmp 0x42d0e3
mov eax, dword [ebp - 8]
test eax, 0x4000
je 0x42d153
mov edi, str.Compute_Cluster_Edition
jmp 0x42d0e3
test al, al
jns 0x42d16a
push str.Datacenter_Edition
call fcn.0040c2ec
pop ecx
push eax
push str.Datacenter_Edition
jmp 0x42d1a3
test al, 2
je 0x42d181
push str.Enterprise_Edition
call fcn.0040c2ec
pop ecx
push eax
push str.Enterprise_Edition
jmp 0x42d1a3
test eax, 0x400
je 0x42d192
mov edi, str.Web_Edition
jmp 0x42d0e3
push str.Standard_Edition
call fcn.0040c2ec
pop ecx
push eax
push str.Standard_Edition
mov ecx, esi
call fcn.0040d662
jmp 0x42d235
mov edi, 0x4a4f30
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
test dword [ebp - 8], 0x200
je 0x42d1d4
mov edi, str.Home_Edition
jmp 0x42d21f
push str.Professional
call fcn.0040c2ec
pop ecx
push eax
push str.Professional
jmp 0x42d228
mov edi, 0x4a4ec0
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
cmp byte [ebp - 6], 1
je 0x42d1d4
test byte [ebp - 8], 0x80
je 0x42d20f
mov edi, str.Datacenter_Server
jmp 0x42d21f
test byte [ebp - 8], 2
mov edi, str.Advanced_Server
jne 0x42d21f
mov edi, str.Server
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
push 9
pop ebx
push 6
pop edi
cmp dword [ebp - 0x11c], edi
jb 0x42d26c
cmp word [ebp - 0x148], bx
jne 0x42d24d
mov edi, str.__64_bit
jmp 0x42d25c
cmp word [ebp - 0x148], 0
jne 0x42d26c
mov edi, str.__32_bit
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
xor eax, eax
inc eax
jmp 0x42d337
cmp eax, 1
jne 0x42d317
cmp dword [ebp - 0x11c], 4
jne 0x42d335
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x42d2cd
mov edi, str.Microsoft_Windows_95
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
mov edi, str.OSR2
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
cmp dword [ebp - 0x11c], 4
jne 0x42d335
mov eax, dword [ebp - 0x118]
cmp eax, 0xa
jne 0x42d30b
mov edi, str.Microsoft_Windows_98
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
mov edi, 0x4a5224
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
cmp dword [ebp - 0x11c], 4
jne 0x42d335
mov eax, dword [ebp - 0x118]
cmp eax, 0x5a
jne 0x42d335
mov edi, str.Microsoft_Windows_ME
jmp 0x42d325
mov edi, str.Microsoft_Windows_Win32s
test eax, eax
je 0x42d325
mov edi, str.Unsupported_version_of_Windows.
push edi
call fcn.0040c2ec
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040d662
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00465956
mov esp, ebp
pop ebp
ret