Function at 0x471e40
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x5626d2
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x651788]
xor eax, esp
mov dword [esp + 0x148], eax
push esi
push edi
mov eax, dword [0x651788]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov esi, dword [esp + 0x168]
lea eax, [esp + 0x14]
xor edi, edi
push eax
mov dword [esp + 0x164], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea ecx, [esp + 0x3c]
push edi
push ecx
call fcn.004afb50
add esp, 0xc
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0x5a6624
mov ecx, esi
mov word [esi + 4], di
call fcn.00402120
mov eax, dword [esp + 0x3c]
add eax, 0xfffffffc
cmp eax, 6
mov ecx, 1
mov dword [esp + 0x160], edi
mov dword [esp + 0xc], ecx
ja case.0x471efd.7
jmp dword [eax*4 + 0x4720d8]
mov eax, dword [esp + 0x40]
cmp eax, edi
je 0x471f3c
cmp eax, 0xa
je 0x471f2b
cmp eax, 0x5a
jne 0x4720ae
push str.Microsoft_Windows_Me
mov ecx, esi
call fcn.00403a70
jmp 0x4720ae
push str.Microsoft_Windows_98
mov ecx, esi
call fcn.00403a70
jmp 0x4720ae
mov eax, dword [esp + 0x48]
cmp eax, 2
jne 0x471f56
push str.Microsoft_Windows_NT_4.0
mov ecx, esi
call fcn.00403a70
jmp 0x4720ae
cmp eax, ecx
jne 0x4720ae
push str.Microsoft_Windows_95
mov ecx, esi
call fcn.00403a70
jmp 0x4720ae
mov eax, dword [esp + 0x40]
sub eax, edi
je 0x471fc7
sub eax, ecx
je 0x471fb6
sub eax, ecx
jne 0x4720ae
cmp byte [esp + 0x152], cl
jne 0x471fa5
cmp word [esp + 0x14], 9
jne 0x471fa5
push str.Microsoft_Windows_XP_Professional_x64_Edition
mov ecx, esi
call fcn.00403a70
jmp 0x4720ae
push str.Microsoft_Windows_Server_2003
mov ecx, esi
call fcn.00403a70
jmp 0x4720ae
push str.Microsoft_Windows_XP
mov ecx, esi
call fcn.00403a70
jmp 0x4720ae
push str.Microsoft_Windows_2000
mov ecx, esi
call fcn.00403a70
jmp 0x4720ae
mov eax, dword [esp + 0x40]
sub eax, edi
je 0x47205a
sub eax, ecx
je 0x472037
sub eax, ecx
je 0x472011
cmp byte [esp + 0x152], cl
mov ecx, esi
jne 0x472002
push str.Microsoft_Windows_8.1
call fcn.00403a70
jmp 0x4720ae
push str.Microsoft_Windows_Server_2012_R2
call fcn.00403a70
jmp 0x4720ae
cmp byte [esp + 0x152], cl
mov ecx, esi
jne 0x47202b
push str.Microsoft_Windows_8
call fcn.00403a70
jmp 0x4720ae
push str.Microsoft_Windows_Server_2012
call fcn.00403a70
jmp 0x4720ae
cmp byte [esp + 0x152], cl
mov ecx, esi
jne 0x47204e
push str.Microsoft_Windows_7
call fcn.00403a70
jmp 0x4720ae
push str.Microsoft_Windows_Server_2008_R2
call fcn.00403a70
jmp 0x4720ae
cmp byte [esp + 0x152], cl
mov ecx, esi
jne 0x472071
push str.Microsoft_Windows_Vista
call fcn.00403a70
jmp 0x4720ae
push str.Microsoft_Windows_Server_2008
call fcn.00403a70
jmp 0x4720ae
cmp byte [esp + 0x152], cl
mov ecx, esi
jne 0x472094
push str.Microsoft_Windows_10_Insider_Preview
call fcn.00403a70
jmp 0x4720ae
push str.Microsoft_Windows_Server_Technical_Preview
call fcn.00403a70
jmp 0x4720ae
push 0x18
push 0x582018
mov ecx, esi
call fcn.00402120
mov eax, esi
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.004aeca3
add esp, 0x158
ret