Function at 0x448210
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
mov eax, dword [0x57a0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x11c
xorps xmm0, xmm0
mov dword [ebp - 0xac], 0
lea eax, [ebp - 0x1e8]
mov esi, ecx
push 0
push eax
movups xmmword [ebp - 0xcc], xmm0
movups xmmword [ebp - 0xbc], xmm0
call fcn.004f7830
add esp, 0xc
mov dword [ebp - 0x1e8], 0x11c
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x448283
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004927a4
mov esp, ebp
pop ebp
ret
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4482a9
lea ecx, [ebp - 0xcc]
push ecx
call eax
jmp 0x4482b6
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x1d8], 2
push ebx
jne 0x4486ec
mov ebx, dword [ebp - 0x1e4]
cmp ebx, 4
jbe 0x4486ec
push edi
mov edi, str.Microsoft
mov edx, 0x100
mov ecx, esi
sub edi, esi
lea eax, [edx + 0x7ffffefe]
test eax, eax
je 0x448300
movzx eax, word [edi + ecx]
test ax, ax
je 0x448300
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4482e2
test edx, edx
lea eax, [ecx - 2]
pop edi
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
cmp ebx, 0xa
jne 0x44833e
cmp dword [ebp - 0x1e0], ecx
jne case.0x44840d.5
cmp byte [ebp - 0xce], 1
mov ecx, esi
jne 0x448334
push str.Windows_10
jmp 0x448631
push str.Windows_Server_2016
jmp 0x448631
cmp ebx, 6
jne 0x448496
mov eax, dword [ebp - 0x1e0]
test eax, eax
jne 0x44836a
cmp byte [ebp - 0xce], 1
mov ecx, esi
jne 0x448363
push str.Windows_Vista
jmp 0x4483c1
push str.Windows_Server_2008
jmp 0x4483c1
cmp eax, 1
jne 0x448387
mov ecx, esi
cmp byte [ebp - 0xce], al
jne 0x448380
push str.Windows_7
jmp 0x4483c1
push str.Windows_Server_2008_R2
jmp 0x4483c1
cmp eax, 2
jne 0x4483a5
cmp byte [ebp - 0xce], 1
mov ecx, esi
jne 0x44839e
push str.Windows_8
jmp 0x4483c1
push str.Windows_Server_2012
jmp 0x4483c1
cmp eax, 3
jne 0x4483c6
cmp byte [ebp - 0xce], 1
mov ecx, esi
jne 0x4483bc
push str.Windows_8.1
jmp 0x4483c1
push str.Windows_Server_2012_R2
call fcn.004480d0
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0xa8]
push ecx
push 0
push 0
push dword [ebp - 0x1e0]
push dword [ebp - 0x1e4]
call eax
mov eax, dword [ebp - 0xa8]
dec eax
cmp eax, 0x2f
ja case.0x44840d.5
movzx eax, byte [eax + 0x448754]
jmp dword [eax*4 + 0x44870c]
push str.Ultimate_Edition
jmp 0x44862f
push str.Home_Premium_Edition
jmp 0x44862f
push str.Home_Basic_Edition
jmp 0x44862f
push str.Business_Edition
jmp 0x44862f
push str.Starter_Edition
jmp 0x44862f
push str.Cluster_Server_Edition
jmp 0x44862f
push str.Datacenter_Edition__core_installation_
jmp 0x44862f
push str.Enterprise_Edition__core_installation_
jmp 0x44862f
push str.Small_Business_Server
jmp 0x44862f
push str.Small_Business_Server_Premium_Edition
jmp 0x44862f
push str.Standard_Edition
jmp 0x44862f
push str.Standard_Edition__core_installation_
jmp 0x44862f
push str.Web_Server_Edition
jmp 0x44862f
cmp ebx, 5
jne case.0x44840d.5
mov eax, dword [ebp - 0x1e0]
cmp eax, 2
jne 0x4485c1
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4484c1
push str.Windows_Server_2003_R2_
jmp 0x448502
mov eax, dword [ebp - 0xd0]
test eax, 0x2000
je 0x4484d5
push str.Windows_Storage_Server_2003
jmp 0x448502
test eax, 0x8000
je 0x4484e3
push str.Windows_Home_Server
jmp 0x448502
cmp byte [ebp - 0xce], 1
jne 0x4484fd
cmp word [ebp - 0xcc], 9
jne 0x4484fd
push str.Windows_XP_Professional_x64_Edition
jmp 0x448502
push str.Windows_Server_2003_
mov ecx, esi
call fcn.004480d0
cmp byte [ebp - 0xce], 1
je case.0x44840d.5
mov ax, word [ebp - 0xcc]
cmp ax, 6
jne 0x448549
mov eax, dword [ebp - 0xd0]
test al, al
jns 0x448537
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x44862f
test al, 2
je case.0x44840d.5
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x44862f
cmp ax, 9
mov eax, dword [ebp - 0xd0]
jne 0x44857d
test al, al
jns 0x448563
push str.Datacenter_x64_Edition
jmp 0x44862f
mov ecx, esi
test al, 2
je 0x448573
push str.Enterprise_x64_Edition
jmp 0x448631
push str.Standard_x64_Edition
jmp 0x448631
test eax, 0x4000
je 0x44858e
push str.Compute_Cluster_Edition
jmp 0x44862f
test al, al
jns 0x44859c
push str.Datacenter_Edition
jmp 0x44862f
test al, 2
je 0x4485aa
push str.Enterprise_Edition
jmp 0x44862f
mov ecx, esi
test eax, 0x400
je 0x4485ba
push str.Web_Edition
jmp 0x448631
push str.Standard_Edition
jmp 0x448631
cmp eax, 1
jne 0x4485ee
push str.Windows_XP
mov ecx, esi
call fcn.004480d0
test dword [ebp - 0xd0], 0x200
mov ecx, esi
je 0x4485e7
push str.Home_Edition
jmp 0x448631
push str.Professional
jmp 0x448631
test eax, eax
jne case.0x44840d.5
push str.Windows_2000
mov ecx, esi
call fcn.004480d0
cmp byte [ebp - 0xce], 1
jne 0x44860e
push str.Professional
jmp 0x44862f
mov eax, dword [ebp - 0xd0]
test al, al
jns 0x44861f
push str.Datacenter_Server
jmp 0x44862f
test al, 2
je 0x44862a
push str.Advanced_Server
jmp 0x44862f
push str.Server
mov ecx, esi
call fcn.004480d0
lea ecx, [ebp - 0x1d4]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x448640
sub ecx, edx
sar ecx, 1
je 0x44866b
push 0x554f60
mov ecx, esi
call fcn.004480d0
lea eax, [ebp - 0x1d4]
mov ecx, esi
push eax
call fcn.004480d0
push dword [ebp - 0x1dc]
lea eax, [ebp - 0xa4]
push str.__build__d_
push 0x50
push eax
call fcn.00448140
add esp, 0x10
lea eax, [ebp - 0xa4]
mov ecx, esi
push eax
call fcn.004480d0
cmp dword [ebp - 0x1e4], 6
jb 0x4486da
mov ax, word [ebp - 0xcc]
cmp ax, 9
jne 0x4486c9
push str.__64_bit
mov ecx, esi
call fcn.004480d0
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004927a4
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x4486da
push str.__32_bit
mov ecx, esi
call fcn.004480d0
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004927a4
mov esp, ebp
pop ebp
ret
push str.This_sample_does_not_support_this_version_of_Windows._n
call fcn.004480a0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor al, al
pop ebx
pop esi
call fcn.004927a4
mov esp, ebp
pop ebp
ret