Function at 0x40e6e8
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
mov eax, dword [0x42d008]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
mov ebx, ecx
xor eax, eax
push esi
push edi
push 0xf
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov byte [ebx + 8], al
pop edi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], edi
mov byte [ebx + 0x28], al
mov dword [ebx + 0x40], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
call fcn.0040e9bd
mov dword [ebx + 0x4c], eax
xor eax, eax
mov dword [ebx + 0x60], eax
push pe_nt_image_headers32
push eax
mov dword [ebx + 0x64], edi
mov byte [ebx + 0x50], al
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x74], 0x11c
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
and dword [ebx + 0x18], 0
push eax
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], eax
call fcn.0040ea00
mov dword [ebx], eax
lea ecx, [esp + 0x3c]
movzx eax, word [esp + 0x180]
add esp, 4
mov dword [ebx + 0x20], eax
movzx eax, word [esp + 0x17e]
mov dword [ebx + 0x24], eax
lea eax, [esp + 0x7c]
push eax
call fcn.00404130
lea edx, [esp + 0x38]
lea ecx, [esp + 0x50]
call fcn.0040d243
push eax
lea ecx, [ebx + 0x28]
call fcn.0040b485
lea ecx, [esp + 0x50]
call fcn.0040906a
lea ecx, [esp + 0x38]
call fcn.00404770
push 9
pop eax
mov ecx, eax
lea edi, [esp + 0x14]
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov cx, word [esp + 0x14]
xor esi, esi
push 2
pop edi
movzx eax, cx
inc esi
push 9
pop edx
test eax, eax
je 0x40e815
cmp eax, 6
je 0x40e810
cmp eax, edx
jne 0x40e819
mov dword [ebx + 0x40], esi
jmp 0x40e819
mov dword [ebx + 0x40], edi
jmp 0x40e819
and dword [ebx + 0x40], 0
cmp dword [esp + 0x6c], 6
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x44], eax
mov eax, dword [esp + 0x30]
mov dword [ebx + 0x48], eax
je 0x40e887
cmp dword [esp + 0x6c], 0xa
je 0x40e887
cmp dword [esp + 0x6c], 5
jne case.0x40e8c9.2
cmp dword [esp + 0x70], edi
jne 0x40e871
cmp byte [esp + 0x182], 1
jne 0x40e859
cmp cx, dx
je case.0x40e8c9.1
mov ax, word [esp + 0x180]
not ax
movzx eax, ax
shr eax, 0xe
and eax, edi
mov dword [ebx + 0x1c], eax
jmp 0x40e8ee
cmp dword [esp + 0x70], esi
jne case.0x40e8c9.2
mov eax, dword [esp + 0x180]
not eax
shr eax, 9
and eax, esi
jmp 0x40e86c
push str.GetProductInfo
push 0x427a14
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call eax
mov eax, dword [esp + 0x10]
cmp eax, 0x1b
ja 0x40e8d5
je case.0x40e8c9.4
dec eax
cmp eax, 0x18
ja case.0x40e8c9.2
movzx eax, byte [eax + 0x40e94c]
jmp dword [eax*4 + 0x40e93c]
mov dword [ebx + 0x1c], edi
jmp 0x40e8ee
cmp eax, 0x54
ja 0x40e90a
je case.0x40e8c9.4
sub eax, 0x30
je case.0x40e8c9.1
sub eax, 0x16
je case.0x40e8c9.4
sub eax, edi
je case.0x40e8c9.4
and dword [ebx + 0x1c], 0
mov ecx, dword [esp + 0x18c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00405160
mov esp, ebp
pop ebp
ret
mov dword [ebx + 0x1c], esi
jmp 0x40e8ee
cmp eax, 0x79
jb case.0x40e8c9.2
cmp eax, 0x7a
jbe 0x40e930
cmp eax, 0x7c
jbe case.0x40e8c9.2
cmp eax, 0x7e
jbe case.0x40e8c9.4
add eax, 0xffffff7f
cmp eax, esi
ja case.0x40e8c9.2
mov dword [ebx + 0x1c], 3
jmp 0x40e8ee
mov dword [ebx + 0x1c], 4
jmp 0x40e8ee