Function at 0x4037f1
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_memset]
push 0x24
lea eax, [ebp - 0xc4]
push 0
push eax
call edi
mov ebx, 0x9c
push ebx
lea eax, [ebp - 0xa0]
push 0
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x403b86
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x403868
lea ecx, [ebp - 0xc4]
push ecx
call eax
jmp 0x403875
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x90], 2
jne 0x403b75
cmp dword [ebp - 0x9c], 4
jbe 0x403b75
cmp dword [ebp - 0x9c], 6
jne case.0x403937.5
cmp dword [ebp - 0x98], 0
jne 0x4038c3
cmp byte [ebp - 6], 1
lea ecx, [esi + 0x185]
jne 0x4038b8
push str.WindowsVista
jmp 0x4038bd
push str.WindowsServer2008
call fcn.00405db8
pop ecx
mov eax, dword [ebp - 0x98]
cmp eax, 1
je 0x4038d3
cmp eax, 2
jne 0x403902
cmp byte [ebp - 6], 1
jne 0x4038f1
cmp eax, 1
jne 0x4038e5
push str.Windows7
jmp 0x4038f6
cmp eax, 2
jne 0x4038f1
push str.Windows8
jmp 0x4038f6
push str.WindowsServer2008R2
lea ecx, [esi + 0x185]
call fcn.00405db8
pop ecx
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call ebx
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
call eax
mov eax, dword [ebp - 4]
cmp eax, 0x19
ja 0x403992
je 0x40398b
dec eax
cmp eax, 0x11
ja case.0x403937.5
jmp dword [eax*4 + 0x403b8d]
push str.Ultimate
jmp 0x40399c
push str.HomePremium
jmp 0x40399c
push str.HomeBasic
jmp 0x40399c
push str.Enterprise
jmp 0x40399c
push str.Business
jmp 0x40399c
push str.Starter
jmp 0x40399c
push str.ClusterServer
jmp 0x40399c
push str.Datacenter
jmp 0x40399c
push str.SmallBusinessServer
jmp 0x40399c
push str.Standard
jmp 0x40399c
push str.WebServer
jmp 0x40399c
push str.SmallBusinessServerPremium
jmp 0x40399c
cmp eax, 0x30
jne case.0x403937.5
push str.Professional
lea ecx, [esi + 0x185]
call fcn.00405db8
pop ecx
cmp dword [ebp - 0x9c], 5
jne 0x403b58
cmp dword [ebp - 0x98], 2
jne 0x403ac2
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4039d5
push str.WindowsServer2003R2_
jmp 0x403a11
test dword [ebp - 8], 0x2000
je 0x4039e5
push str.WindowsStorageServer2003
jmp 0x403a11
test dword [ebp - 8], 0x8000
je 0x4039f5
push str.WindowsHomeServer
jmp 0x403a11
cmp byte [ebp - 6], 1
jne 0x403a0c
cmp word [ebp - 0xc4], 9
jne 0x403a0c
push str.WindowsXPProfessional
jmp 0x403a11
push str.WindowsServer2003
lea edi, [esi + 0x185]
mov ecx, edi
call fcn.00405db8
cmp byte [ebp - 6], 1
pop ecx
je 0x403ab5
cmp word [ebp - 0xc4], 6
jne 0x403a4d
test byte [ebp - 8], 0x80
je 0x403a40
push str.DatacenterforItanium_basedSystems
jmp 0x403aad
test byte [ebp - 8], 2
je 0x403ab5
push str.EnterpriseforItanium_basedSystems
jmp 0x403aad
cmp word [ebp - 0xc4], 9
jne 0x403a7a
test byte [ebp - 8], 0x80
je 0x403a64
push str.Datacenter
jmp 0x403aad
test byte [ebp - 8], 2
mov ecx, edi
je 0x403a73
push str.Enterprise
jmp 0x403aaf
push str.Standard
jmp 0x403aaf
mov eax, dword [ebp - 8]
test eax, 0x4000
je 0x403a8b
push str.ComputeCluster
jmp 0x403aad
test al, al
js 0x403a5d
test al, 2
je 0x403a9a
push str.Enterprise
jmp 0x403aad
test eax, 0x400
je 0x403aa8
push 0x408074
jmp 0x403aad
push str.Standard
mov ecx, edi
call fcn.00405db8
pop ecx
cmp dword [ebp - 0x9c], 5
jne 0x403b58
cmp dword [ebp - 0x98], 1
jne 0x403b06
push str.WindowsXP
lea ecx, [esi + 0x185]
call fcn.00405db8
test dword [ebp - 8], 0x200
pop ecx
lea ecx, [esi + 0x185]
je 0x403af2
push str.Home
jmp 0x403af7
push str.Professional
call fcn.00405db8
cmp dword [ebp - 0x9c], 5
pop ecx
jne 0x403b58
cmp dword [ebp - 0x98], 0
jne 0x403b58
push str.Windows2000
lea ecx, [esi + 0x185]
call fcn.00405db8
cmp byte [ebp - 6], 1
pop ecx
jne 0x403b2d
push str.Professional
jmp 0x403b4c
test byte [ebp - 8], 0x80
je 0x403b3a
push str.DatacenterServer
jmp 0x403b4c
test byte [ebp - 8], 2
je 0x403b47
push str.AdvancedServer
jmp 0x403b4c
push str.Server
lea ecx, [esi + 0x185]
call fcn.00405db8
pop ecx
call fcn.00402740
lea ecx, [esi + 0x185]
test al, al
je 0x403b6e
push str._x64_
jmp 0x403b80
push str._x32_
jmp 0x403b80
push str.Unknown
lea ecx, [esi + 0x185]
call fcn.00405db8
pop ecx
pop edi
pop ebx
leave
ret