Function at 0x48a07f
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0x15c
mov eax, 0x5d0f75
call fcn.00506dfb
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x168]
push 0x24
xor ebx, ebx
push ebx
push eax
call fcn.0056b050
mov esi, 0x11c
lea eax, [ebp - 0x12c]
push esi
push ebx
push eax
call fcn.0056b050
add esp, 0x18
mov dword [ebp - 0x12c], esi
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x48a9f5
push str.GetNativeSystemInfo
push 0x609e00
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48a0f9
lea ecx, [ebp - 0x168]
push ecx
call eax
jmp 0x48a106
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x11c], 2
jne 0x48a737
mov eax, dword [ebp - 0x128]
cmp eax, 4
jbe 0x48a6f1
push 0x5f1b30
mov ecx, edi
call fcn.0041421f
push 6
pop eax
mov esi, 0x5f1c18
cmp dword [ebp - 0x128], eax
jne case.0x48a32c.5
mov eax, dword [ebp - 0x124]
cmp eax, 2
jne 0x48a29e
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x5f1bf4
call fcn.00413f09
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x13c], esp
push esi
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 1
push 0x5f1b08
call fcn.00413f09
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x130]
push eax
call fcn.004346a7
add esp, 0x10
push 0x60c1a8
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 2
call fcn.0042e677
test eax, eax
jne 0x48a1c0
push 0x1b
pop ebx
push str.Windows_8
jmp 0x48a204
push 0x5f1c74
lea ecx, [ebp - 0x130]
call fcn.0042e677
test eax, eax
jne 0x48a1de
push 0x1e
pop ebx
push str.Windows_8.1
jmp 0x48a204
push 0x5f1c7c
lea ecx, [ebp - 0x130]
call fcn.0042e677
test eax, eax
jne 0x48a1fc
push 0x1f
pop ebx
push 0x60c1e4
jmp 0x48a204
push 0x20
pop ebx
push str.Windows
mov ecx, edi
call fcn.0042e473
push ecx
mov ecx, esp
mov dword [ebp - 0x140], esp
push 0x5f1c84
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push esi
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 2
call fcn.004347ec
add esp, 8
mov esi, eax
mov ecx, esp
mov dword [ebp - 0x140], esp
push str.CurrentMinorVersionNumber
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 4
push 0x5f1c18
call fcn.00413f09
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 2
call fcn.004347ec
add esp, 0xc
cmp esi, 0xa
jne 0x48a28a
test eax, eax
jne 0x48a28a
push 0x1f
pop ebx
push 0x60c1e4
mov ecx, edi
call fcn.0041421f
mov ecx, dword [ebp - 0x130]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00412ac4
jmp 0x48a2e1
cmp eax, 1
jne 0x48a2be
mov ecx, edi
cmp byte [ebp - 0x12], al
jne 0x48a2b4
push 0x17
pop ebx
push str.Windows_7
jmp 0x48a2dc
push 0x19
pop ebx
push str.Windows_Server_2008_R2
jmp 0x48a2dc
test eax, eax
jne 0x48a2e1
cmp byte [ebp - 0x12], 1
mov ecx, edi
jne 0x48a2d4
push 0x13
pop ebx
push str.Windows_Vista
jmp 0x48a2dc
push 0x15
pop ebx
push str.Windows_Server_2008
call fcn.0042e473
push str.GetProductInfo
push 0x609e00
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x144]
push ecx
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call eax
mov eax, dword [ebp - 0x144]
cmp eax, 0x19
ja 0x48a3a3
je 0x48a39c
dec eax
cmp eax, 0x11
ja case.0x48a32c.5
jmp dword [eax*4 + 0x48a9fb]
push 0x60c2f0
jmp 0x48a3ad
push str.Home_Premium_Edition
jmp 0x48a3ad
push str.Home_Basic_Edition
jmp 0x48a3ad
push str.Enterprise_Edition
jmp 0x48a3ad
push str.Business_Edition
jmp 0x48a3ad
push str.Starter_Edition
jmp 0x48a3ad
push str.HPC_Server_Edition
jmp 0x48a3ad
push str.Datacenter_Edition
jmp 0x48a3ad
push str.Datacenter_Edition__core_installation_
jmp 0x48a3ad
push str.Enterprise_Edition__core_installation_
jmp 0x48a3ad
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x48a3ad
push str.Small_Business_Server
jmp 0x48a3ad
push str.Standard_Edition
jmp 0x48a3ad
push str.Standard_Edition__core_installation_
jmp 0x48a3ad
push str.Web_Server_Edition
jmp 0x48a3ad
push str.Small_Business_Server_Premium_Edition
jmp 0x48a3ad
cmp eax, 0x30
jne case.0x48a32c.5
push 0x60c2f8
mov ecx, edi
call fcn.0042e473
cmp dword [ebp - 0x128], 5
jne 0x48a5ac
mov eax, dword [ebp - 0x124]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 2
jne 0x48a4f2
push 0x59
call esi
test eax, eax
je 0x48a3e8
push 0x11
pop ebx
push str.Windows_Server_2003_R2_
jmp 0x48a432
test dword [ebp - 0x14], 0x2000
je 0x48a3fb
push 0xf
pop ebx
push str.Windows_Storage_Server_2003
jmp 0x48a432
test dword [ebp - 0x14], 0x8000
je 0x48a40e
push 0xf
pop ebx
push str.Windows_Home_Server_2003
jmp 0x48a432
cmp byte [ebp - 0x12], 1
jne 0x48a42a
push 9
pop eax
cmp word [ebp - 0x168], ax
jne 0x48a42a
push 0xe
pop ebx
push str.Windows_XP_Professional_x64_Edition
jmp 0x48a432
push 0xf
pop ebx
push str.Windows_Server_2003_
mov ecx, edi
call fcn.0042e473
cmp byte [ebp - 0x12], 1
je 0x48a4df
push 6
pop eax
cmp word [ebp - 0x168], ax
jne 0x48a46c
test byte [ebp - 0x14], 0x80
push 0x10
pop ebx
je 0x48a45f
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x48a4d8
test byte [ebp - 0x14], 2
je 0x48a4df
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x48a4d8
push 9
pop eax
cmp word [ebp - 0x168], ax
jne 0x48a49e
test byte [ebp - 0x14], 0x80
push 0x10
pop ebx
je 0x48a488
push str.Datacenter_x64_Edition
jmp 0x48a4d8
test byte [ebp - 0x14], 2
mov ecx, edi
je 0x48a497
push str.Enterprise_x64_Edition
jmp 0x48a4da
push str.Standard_x64_Edition
jmp 0x48a4da
mov eax, dword [ebp - 0x14]
test eax, 0x4000
je 0x48a4af
push str.Compute_Cluster_Edition
jmp 0x48a4d8
test al, al
jns 0x48a4ba
push str.Datacenter_Edition
jmp 0x48a4d8
test al, 2
je 0x48a4c5
push str.Enterprise_Edition
jmp 0x48a4d8
test eax, 0x400
je 0x48a4d3
push str.Web_Edition
jmp 0x48a4d8
push str.Standard_Edition
mov ecx, edi
call fcn.0042e473
cmp dword [ebp - 0x128], 5
jne 0x48a5ac
mov eax, dword [ebp - 0x124]
cmp eax, 1
jne 0x48a563
push 0xd
pop ebx
push str.Windows_XP
mov ecx, edi
call fcn.0042e473
test dword [ebp - 0x14], 0x200
mov ecx, edi
je 0x48a518
push str.Home_Edition
jmp 0x48a51d
push str.Professional
call fcn.0042e473
push 0x57
call esi
test eax, eax
je 0x48a531
push str.Media_Center_Edition
jmp 0x48a54d
push 0x58
call esi
test eax, eax
je 0x48a540
push str.Starter_Edition
jmp 0x48a54d
push 0x56
call esi
test eax, eax
je 0x48a554
push str.Tablet_PC_Edition
mov ecx, edi
call fcn.0042e473
cmp dword [ebp - 0x128], 5
jne 0x48a5ac
mov eax, dword [ebp - 0x124]
test eax, eax
jne 0x48a5ac
push str.Windows_2000
mov ecx, edi
call fcn.0042e473
cmp byte [ebp - 0x12], 1
jne 0x48a583
push 0xb
pop ebx
push str.Professional
jmp 0x48a5a5
test byte [ebp - 0x14], 0x80
push 0xc
pop ebx
je 0x48a593
push str.Datacenter_Server
jmp 0x48a5a5
test byte [ebp - 0x14], 2
je 0x48a5a0
push str.Advanced_Server
jmp 0x48a5a5
push str.Server
mov ecx, edi
call fcn.0042e473
lea eax, [ebp - 0x118]
push eax
call fcn.0057600b
pop ecx
test eax, eax
je 0x48a5d7
push 0x60c978
mov ecx, edi
call fcn.0042e473
lea eax, [ebp - 0x118]
mov ecx, edi
push eax
call fcn.0042e473
call fcn.0041279d
push eax
lea ecx, [ebp - 0x134]
call fcn.00411d94
push ecx
mov ecx, esp
mov dword [ebp - 0x140], esp
push 0x60c97c
mov dword [ebp - 4], 5
call fcn.00413f09
push 6
pop eax
push ecx
mov ecx, esp
mov dword [ebp - 0x13c], esp
push 0x5f1c18
mov byte [ebp - 4], al
call fcn.00413f09
push ecx
mov ecx, esp
mov byte [ebp - 4], 7
push 0x5f1b08
call fcn.00413f09
lea eax, [ebp - 0x138]
mov byte [ebp - 4], 5
push eax
call fcn.004346a7
add esp, 0x10
mov eax, dword [ebp - 0x138]
mov byte [ebp - 4], 8
cmp dword [eax - 0xc], 0
jne 0x48a65c
push dword [ebp - 0x120]
push str.__Build__d_
jmp 0x48a662
push eax
push str.__Build__s_
lea eax, [ebp - 0x134]
push eax
call fcn.00412690
add esp, 0xc
lea ecx, [ebp - 0x138]
push str.9431
call fcn.0042e677
test eax, eax
jne 0x48a691
push str._Preview
mov ecx, edi
call fcn.0042e473
mov esi, dword [ebp - 0x134]
mov ecx, edi
push dword [esi - 0xc]
push esi
call fcn.00412114
push 6
pop eax
cmp dword [ebp - 0x128], eax
jb 0x48a6d6
push 9
pop eax
cmp word [ebp - 0x168], ax
jne 0x48a6c0
push str.__64_bit
jmp 0x48a6cf
cmp word [ebp - 0x168], 0
jne 0x48a6d6
push str.__32_bit
mov ecx, edi
call fcn.0042e473
mov ecx, dword [ebp - 0x138]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [esi - 0x10]
call fcn.00412ac4
jmp 0x48a9f3
jne 0x48a714
cmp dword [ebp - 0x124], ebx
jne 0x48a9f3
push 6
pop ebx
push str.Windows_NT4
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 3
jne 0x48a9f3
cmp dword [ebp - 0x124], 0x33
jne 0x48a9f3
push 5
pop ebx
push str.Windows_NT_3.51
jmp 0x48a9ec
cmp dword [ebp - 0x11c], 1
jne 0x48a7f8
cmp dword [ebp - 0x128], 4
jne 0x48a9f3
mov eax, dword [ebp - 0x124]
push 0xa
pop esi
cmp eax, 0x5a
jne 0x48a773
push str.Windows_Millennium_Edition
mov ecx, edi
mov ebx, esi
call fcn.0042e473
mov eax, dword [ebp - 0x124]
cmp eax, esi
jne 0x48a7b3
cmp dword [ebp - 0x120], 0x887
jb 0x48a79c
push 9
pop ebx
push str.Windows_98_Second_Edition
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x124]
cmp eax, esi
jne 0x48a7b3
push 8
pop ebx
push str.Windows_98
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x124]
cmp eax, esi
jae 0x48a7d6
cmp dword [ebp - 0x120], 0x438
jbe 0x48a7d6
push 4
pop ebx
push str.Windows_95_OEM_Service_Release_2
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x128], 4
jne 0x48a9f3
test eax, eax
jne 0x48a9f3
push 3
pop ebx
push str.Windows_95
jmp 0x48a9ec
cmp dword [ebp - 0x11c], 3
jne 0x48a9f3
mov eax, dword [ebp - 0x128]
push 7
pop ebx
cmp eax, 1
jne 0x48a832
cmp dword [ebp - 0x124], 0
jne 0x48a9f3
push str.Windows_CE_1.0
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 2
jne 0x48a8c1
mov eax, dword [ebp - 0x124]
test eax, eax
jne 0x48a862
push str.Windows_CE_2.0
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 2
jne 0x48a8c1
mov eax, dword [ebp - 0x124]
cmp eax, 1
jne 0x48a884
push str.Windows_CE_2.1
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 2
jne 0x48a8c1
mov eax, dword [ebp - 0x124]
cmp eax, 0xb
jne 0x48a8a6
push str.Windows_CE_2.11
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 2
jne 0x48a8c1
mov eax, dword [ebp - 0x124]
cmp eax, 0xc
jne 0x48a9f3
push str.Windows_CE_2.12
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 3
jne 0x48a8e5
cmp dword [ebp - 0x124], 0
jne 0x48a9f3
push str.Windows_CE_3.0
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 4
jne 0x48a974
mov eax, dword [ebp - 0x124]
test eax, eax
jne 0x48a915
push str.Windows_CE_4.0
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 4
jne 0x48a974
mov eax, dword [ebp - 0x124]
cmp eax, 1
jne 0x48a937
push str.Windows_CE_4.1
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 4
jne 0x48a974
mov eax, dword [ebp - 0x124]
cmp eax, 2
jne 0x48a959
push str.Windows_CE_4.2
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 4
jne 0x48a974
mov eax, dword [ebp - 0x124]
cmp eax, 0x15
jne 0x48a9f3
push str.Windows_CE_4.21
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 5
jne 0x48a9d9
mov eax, dword [ebp - 0x124]
test eax, eax
jne 0x48a9a0
push str.Windows_CE_5.0
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 5
jne 0x48a9d9
mov eax, dword [ebp - 0x124]
cmp eax, 1
jne 0x48a9c2
push str.Windows_CE_5.1
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 5
jne 0x48a9d9
mov eax, dword [ebp - 0x124]
cmp eax, 2
jne 0x48a9f3
push str.Windows_CE_5.2
mov ecx, edi
call fcn.0042e473
mov eax, dword [ebp - 0x128]
cmp eax, 6
jne 0x48a9f3
cmp dword [ebp - 0x124], 0
jne 0x48a9f3
push str.Windows_CE_6.0
mov ecx, edi
call fcn.0042e473
mov eax, ebx
call fcn.00506da5
ret