Function at 0x4137e9
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
push ebx
push esi
push edi
push 0x24
lea eax, [ebp - 0x2c]
push 0
mov ebx, ecx
push eax
call sub.MSVCRT.dll_memset
mov esi, 0x11c
lea eax, [ebp - 0x148]
push esi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x413a66
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x413859
lea ecx, [ebp - 0x2c]
push ecx
call eax
jmp 0x413863
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x2c], 9
jne 0x41386e
mov byte [ebx + 0xc], 1
mov esi, dword [sym.imp.MSVCRT.dll_wcslen]
push str.Microsoft
lea edi, [ebx + 0x14]
call esi
pop ecx
lea eax, [eax*2 + str.Microsoft]
push eax
push str.Microsoft
mov ecx, edi
call fcn.00403495
mov eax, dword [ebp - 0x138]
sub eax, 0
je 0x41433b
dec eax
je 0x4141b2
dec eax
je 0x4138eb
push str.Unknown
call esi
pop ecx
lea eax, [eax*2 + str.Unknown]
push eax
push str.Unknown
mov ecx, edi
call fcn.00403495
mov edi, str.Unknown
push edi
call esi
pop ecx
lea eax, [eax*2 + str.Unknown]
push eax
push edi
lea ecx, [ebx + 0x20]
call fcn.00403495
and dword [ebx + 8], 0
jmp 0x414362
cmp dword [ebp - 0x144], 4
jbe 0x413a66
cmp dword [ebp - 0x144], 6
ja 0x41418a
jne case.0x413a89.5
cmp dword [ebp - 0x140], 2
ja 0x41418a
cmp dword [ebp - 0x140], 0
jne 0x413977
cmp byte [ebp - 0x2e], 1
jne 0x413950
push str.Windows_Vista
call esi
pop ecx
lea eax, [eax*2 + str.Windows_Vista]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_Vista
mov ecx, edi
call fcn.00403d63
mov dword [ebx + 8], 0xb
jmp 0x413977
push str.Windows_Server_2008
call esi
pop ecx
lea eax, [eax*2 + str.Windows_Server_2008]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_Server_2008
mov ecx, edi
call fcn.00403d63
mov dword [ebx + 8], 0xc
cmp dword [ebp - 0x140], 1
jne 0x4139d6
cmp byte [ebp - 0x2e], 1
jne 0x4139af
push str.Windows_7
call esi
pop ecx
lea eax, [eax*2 + str.Windows_7]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_7
mov ecx, edi
call fcn.00403d63
mov dword [ebx + 8], 0xd
jmp 0x4139d6
push str.Windows_Server_2008_R2
call esi
pop ecx
lea eax, [eax*2 + str.Windows_Server_2008_R2]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_Server_2008_R2
mov ecx, edi
call fcn.00403d63
mov dword [ebx + 8], 0xc
cmp dword [ebp - 0x140], 2
jne 0x413a35
cmp byte [ebp - 0x2e], 1
jne 0x413a0e
push str.Windows_8
call esi
pop ecx
lea eax, [eax*2 + str.Windows_8]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_8
mov ecx, edi
call fcn.00403d63
mov dword [ebx + 8], 0xe
jmp 0x413a35
push str.Windows_Server_8
call esi
pop ecx
lea eax, [eax*2 + str.Windows_Server_8]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_Server_8
mov ecx, edi
call fcn.00403d63
mov dword [ebx + 8], 0xf
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push dword [ebp - 0x140]
push dword [ebp - 0x144]
call eax
test eax, eax
jne 0x413a6d
xor al, al
jmp 0x414364
mov eax, dword [ebp - 8]
cmp eax, 0x19
ja 0x413cce
je 0x413cad
dec eax
cmp eax, 0x11
ja case.0x413a89.5
jmp dword [eax*4 + 0x414369]
push str.Ultimate_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Ultimate_Edition]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Ultimate_Edition
jmp 0x413cec
push str.Home_Premium_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Home_Premium_Edition]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Home_Premium_Edition
jmp 0x413cec
push str.Home_Basic_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Home_Basic_Edition]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Home_Basic_Edition
jmp 0x413cec
push str.Enterprise_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Enterprise_Edition]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Enterprise_Edition
jmp 0x413cec
push str.Business_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Business_Edition]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Business_Edition
jmp 0x413cec
push str.Starter_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Starter_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Starter_Edition
jmp 0x413ca4
push str.Cluster_Server_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Cluster_Server_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Cluster_Server_Edition
jmp 0x413ca4
push str.Datacenter_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Datacenter_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Datacenter_Edition
jmp 0x413ca4
push str.Datacenter_Edition__core_installation_
call esi
pop ecx
lea eax, [eax*2 + str.Datacenter_Edition__core_installation_]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Datacenter_Edition__core_installation_
jmp 0x413ca4
push str.Enterprise_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Enterprise_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Enterprise_Edition
jmp 0x413ca4
push str.Enterprise_Edition__core_installation_
call esi
pop ecx
lea eax, [eax*2 + str.Enterprise_Edition__core_installation_]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Enterprise_Edition__core_installation_
jmp 0x413ca4
push str.Enterprise_Edition_for_Itanium_based_Systems
call esi
pop ecx
lea eax, [eax*2 + str.Enterprise_Edition_for_Itanium_based_Systems]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x413ca4
push str.Small_Business_Server
call esi
pop ecx
lea eax, [eax*2 + str.Small_Business_Server]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Small_Business_Server
jmp 0x413ca4
push str.Standard_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Standard_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Standard_Edition
jmp 0x413ca4
push str.Standard_Edition__core_installation_
call esi
pop ecx
lea eax, [eax*2 + str.Standard_Edition__core_installation_]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Standard_Edition__core_installation_
jmp 0x413ca4
push str.Web_Server_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Web_Server_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Web_Server_Edition
mov ecx, edi
call fcn.00401c49
jmp case.0x413a89.5
push str.Small_Business_Server_Premium_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Small_Business_Server_Premium_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Small_Business_Server_Premium_Edition
jmp 0x413ca4
cmp eax, 0x30
jne case.0x413a89.5
push str.Professional
call esi
pop ecx
lea eax, [eax*2 + str.Professional]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Professional
mov ecx, edi
call fcn.00403d63
cmp dword [ebp - 0x144], 5
jne 0x414117
cmp dword [ebp - 0x140], 2
jne 0x413fae
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x413d3d
push str.Windows_Server_2003_R2_
call esi
pop ecx
lea eax, [eax*2 + str.Windows_Server_2003_R2_]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_Server_2003_R2_
jmp 0x413de9
test byte [ebp - 0x2f], 0x20
je 0x413d67
push str.Windows_Storage_Server_2003
call esi
pop ecx
lea eax, [eax*2 + str.Windows_Storage_Server_2003]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_Storage_Server_2003
jmp 0x413de9
test byte [ebp - 0x2f], 0x80
je 0x413d8e
push str.Windows_Home_Server
call esi
pop ecx
lea eax, [eax*2 + str.Windows_Home_Server]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_Home_Server
jmp 0x413de9
cmp byte [ebp - 0x2e], 1
jne 0x413dca
cmp word [ebp - 0x2c], 9
jne 0x413dca
push str.Windows_XP_Professional_x64_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Windows_XP_Professional_x64_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_XP_Professional_x64_Edition
mov ecx, edi
call fcn.00401c49
mov dword [ebx + 8], 9
jmp 0x413df7
push str.Windows_Server_2003_
call esi
pop ecx
lea eax, [eax*2 + str.Windows_Server_2003_]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_Server_2003_
mov ecx, edi
call fcn.00401c49
mov dword [ebx + 8], 0xa
cmp byte [ebp - 0x2e], 1
je 0x413fa1
cmp word [ebp - 0x2c], 6
jne 0x413e60
test byte [ebp - 0x30], 0x80
je 0x413e32
push str.Datacenter_Edition_for_Itanium_based_Systems
call esi
pop ecx
lea eax, [eax*2 + str.Datacenter_Edition_for_Itanium_based_Systems]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x413f9a
test byte [ebp - 0x30], 2
je 0x413fa1
push str.Enterprise_Edition_for_Itanium_based_Systems
call esi
pop ecx
lea eax, [eax*2 + str.Enterprise_Edition_for_Itanium_based_Systems]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x413f9a
cmp word [ebp - 0x2c], 9
jne 0x413edf
test byte [ebp - 0x30], 0x80
je 0x413e91
push str.Datacenter_x64_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Datacenter_x64_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Datacenter_x64_Edition
jmp 0x413f9a
test byte [ebp - 0x30], 2
je 0x413ebb
push str.Enterprise_x64_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Enterprise_x64_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Enterprise_x64_Edition
jmp 0x413f9a
push str.Standard_x64_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Standard_x64_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Standard_x64_Edition
jmp 0x413f9a
mov eax, dword [ebp - 0x30]
test ah, 0x40
je 0x413f0b
push str.Compute_Cluster_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Compute_Cluster_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Compute_Cluster_Edition
jmp 0x413f9a
test al, 0x80
je 0x413f30
push str.Datacenter_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Datacenter_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Datacenter_Edition
jmp 0x413f9a
test al, 2
je 0x413f55
push str.Enterprise_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Enterprise_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Enterprise_Edition
jmp 0x413f9a
test ah, 4
je 0x413f7b
push str.Web_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Web_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Web_Edition
jmp 0x413f9a
push str.Standard_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Standard_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Standard_Edition
mov ecx, edi
call fcn.00401c49
cmp dword [ebp - 0x144], 5
jne 0x414117
cmp dword [ebp - 0x140], 1
jne 0x414042
push str.Windows_XP
call esi
pop ecx
lea eax, [eax*2 + str.Windows_XP]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_XP
mov ecx, edi
call fcn.00401c49
test byte [ebp - 0x2f], 2
mov dword [ebx + 8], 9
je 0x41400f
push str.Home_Edition
call esi
pop ecx
lea eax, [eax*2 + str.Home_Edition]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Home_Edition
jmp 0x41402e
push str.Professional
call esi
pop ecx
lea eax, [eax*2 + str.Professional]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Professional
mov ecx, edi
call fcn.00401c49
cmp dword [ebp - 0x144], 5
jne 0x414117
cmp dword [ebp - 0x140], 0
jne 0x414117
push str.Windows_2000
call esi
pop ecx
lea eax, [eax*2 + str.Windows_2000]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_2000
mov ecx, edi
call fcn.00401c49
cmp byte [ebp - 0x2e], 1
mov dword [ebx + 8], 8
jne 0x4140a3
push str.Professional
call esi
pop ecx
lea eax, [eax*2 + str.Professional]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Professional
jmp 0x414110
test byte [ebp - 0x30], 0x80
je 0x4140ca
push str.Datacenter_Server
call esi
pop ecx
lea eax, [eax*2 + str.Datacenter_Server]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Datacenter_Server
jmp 0x414110
test byte [ebp - 0x30], 2
je 0x4140f1
push str.Advanced_Server
call esi
pop ecx
lea eax, [eax*2 + str.Advanced_Server]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Advanced_Server
jmp 0x414110
push str.Server
call esi
pop ecx
lea eax, [eax*2 + str.Server]
mov cl, byte [ebp - 1]
mov byte [ebp - 1], cl
lea ecx, [ebp - 1]
push ecx
push eax
push str.Server
mov ecx, edi
call fcn.00401c49
mov eax, dword [0x41fc78]
mov ecx, 0x81
mov dword [ebp - 0x350], eax
xor eax, eax
lea edi, [ebp - 0x34c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x13c]
and eax, 0xffff
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x350]
push dword [ebp - 0x140]
push dword [ebp - 0x144]
push str.Version__d._d__s__Build__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x350]
push eax
call esi
add esp, 0x1c
lea eax, [ebp + eax*2 - 0x350]
push eax
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebx + 0x20]
call fcn.00403495
jmp 0x414362
push str.Unknown_Windows_version__but_above_Windows_8
call esi
pop ecx
lea eax, [eax*2 + str.Unknown_Windows_version__but_above_Windows_8]
push eax
push str.Unknown_Windows_version__but_above_Windows_8
mov ecx, edi
call fcn.00403495
mov dword [ebx + 8], 0xe
jmp 0x414362
cmp dword [ebp - 0x144], 4
jne 0x4142d1
cmp dword [ebp - 0x140], 0
jne 0x414237
push str.Windows_95
call esi
pop ecx
lea eax, [eax*2 + str.Windows_95]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_95
mov ecx, edi
call fcn.00403d63
cmp word [ebp - 0x132], 0x43
mov dword [ebx + 8], 3
je 0x414203
cmp word [ebp - 0x132], 0x42
jne 0x41422a
push str._OSR2
call esi
pop ecx
lea eax, [eax*2 + str._OSR2]
lea ecx, [ebp - 1]
push ecx
push eax
push str._OSR2
mov ecx, edi
call fcn.00403d63
mov dword [ebx + 8], 4
cmp dword [ebp - 0x144], 4
jne 0x4142d1
cmp dword [ebp - 0x140], 0xa
jne 0x4142a1
push str.Windows_98
call esi
pop ecx
lea eax, [eax*2 + str.Windows_98]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_98
mov ecx, edi
call fcn.00403d63
cmp word [ebp - 0x132], 0x41
mov dword [ebx + 8], 5
jne 0x414298
push 0x41ed38
call esi
pop ecx
lea eax, [eax*2 + 0x41ed38]
lea ecx, [ebp - 1]
push ecx
push eax
push 0x41ed38
mov ecx, edi
call fcn.00403d63
mov dword [ebx + 8], 6
cmp dword [ebp - 0x144], 4
jne 0x4142d1
cmp dword [ebp - 0x140], 0x5a
jne 0x4142d1
push str.Windows_Me
call esi
pop ecx
lea eax, [eax*2 + str.Windows_Me]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Windows_Me
mov ecx, edi
call fcn.00403d63
mov dword [ebx + 8], 7
mov eax, dword [0x41fc78]
mov ecx, 0x81
mov dword [ebp - 0x350], eax
xor eax, eax
lea edi, [ebp - 0x34c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x13c]
and eax, 0xffff
push eax
lea eax, [ebp - 0x350]
push dword [ebp - 0x140]
push dword [ebp - 0x144]
push str.Version__d._d_Build__d__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x350]
push eax
call esi
add esp, 0x1c
lea eax, [ebp + eax*2 - 0x350]
push eax
lea eax, [ebp - 0x350]
jmp 0x41417c
push str.Win32s
call esi
pop ecx
lea eax, [eax*2 + str.Win32s]
lea ecx, [ebp - 1]
push ecx
push eax
push str.Win32s
mov ecx, edi
call fcn.00403d63
mov dword [ebx + 8], 1
mov al, 1
pop edi
pop esi
pop ebx
leave
ret