Function at 0x48f957
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1ec
mov eax, dword [0x4d4028]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
push ebx
push esi
push edi
mov dword [ebp - 0x154], eax
mov eax, dword [ebp + 0x7c]
and dword [eax], 0
push 9
mov ebx, ecx
pop ecx
xor eax, eax
mov esi, 0x11c
push esi
lea edi, [ebp - 0x17c]
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x150]
push eax
call fcn.00491fe0
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
mov dword [ebp - 0x150], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x48f9c2
xor eax, eax
inc eax
jmp 0x48fdbc
movzx eax, word [ebp - 0x144]
push eax
push dword [ebp - 0x148]
mov esi, 0x100
push dword [ebp - 0x14c]
mov ecx, esi
push str._u._u._u
mov edi, ebx
call fcn.0048fe77
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x10
push str.GetNativeSystemInfo
push 0x4ae594
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48fa14
lea ecx, [ebp - 0x17c]
push ecx
call eax
jmp 0x48fa21
lea eax, [ebp - 0x17c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x140], 2
jne 0x48fdaa
cmp dword [ebp - 0x14c], 4
jbe 0x48fdaa
mov ecx, dword [ebp - 0x154]
push SysReAllocString
mov eax, str.Microsoft
mov edx, esi
call fcn.0048fe39
push 6
pop esi
cmp dword [ebp - 0x14c], esi
jne 0x48fbbd
cmp dword [ebp - 0x148], 1
jne 0x48fa93
cmp byte [ebp - 0x36], 1
mov edi, dword [ebp - 0x154]
jne 0x48fa7d
push str.Windows_7
jmp 0x48fa82
push str.Windows_Server_2008_R2
call fcn.0048fdf3
cmp dword [ebp - 0x14c], esi
jne 0x48fbbd
cmp dword [ebp - 0x148], 0
jne 0x48fd4c
cmp byte [ebp - 0x36], 1
mov edi, dword [ebp - 0x154]
jne 0x48fab3
push str.Windows_Vista
jmp 0x48fab8
push str.Windows_Server_2008
call fcn.0048fdf3
push str.GetProductInfo
push 0x4ae594
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x158]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push esi
call eax
mov eax, dword [ebp - 0x158]
cmp eax, 0xa
ja 0x48fb3b
je case.0x48faf6.4
dec eax
cmp eax, 8
ja case.0x48faf6.5
jmp dword [eax*4 + 0x48fdcf]
push str.Ultimate_Edition
jmp 0x48fb93
push str.Home_Premium_Edition
jmp 0x48fb93
push str.Home_Basic_Edition
jmp 0x48fb93
push str.Enterprise_Edition
jmp 0x48fb93
push str.Business_Edition
jmp 0x48fb93
push str.Datacenter_Edition
jmp 0x48fb93
push str.Small_Business_Server
jmp 0x48fb93
push str.Standard_Edition
jmp 0x48fb93
cmp eax, 0xf
ja 0x48fb73
je 0x48fb6c
sub eax, 0xb
je 0x48fb65
dec eax
je 0x48fb5e
dec eax
je 0x48fb57
dec eax
jne case.0x48faf6.5
push str.Enterprise_Edition__core_installation_
jmp 0x48fb93
push str.Standard_Edition__core_installation_
jmp 0x48fb93
push str.Datacenter_Edition__core_installation_
jmp 0x48fb93
push str.Starter_Edition
jmp 0x48fb93
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x48fb93
sub eax, 0x11
je 0x48fb8e
dec eax
je 0x48fb87
sub eax, 7
jne case.0x48faf6.5
push str.Small_Business_Server_Premium_Edition
jmp 0x48fb93
push str.Cluster_Server_Edition
jmp 0x48fb93
push str.Web_Server_Edition
call fcn.0048fdf3
cmp word [ebp - 0x17c], 9
jne 0x48fba9
push str.__64_bit
jmp 0x48fbb8
cmp word [ebp - 0x17c], 0
jne 0x48fbbd
push str.__32_bit
call fcn.0048fdf3
cmp dword [ebp - 0x14c], 5
jne 0x48fd4c
cmp dword [ebp - 0x148], 2
jne 0x48fcca
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x48fbea
push str.Windows_Server_2003_R2_
jmp 0x48fc15
cmp word [ebp - 0x38], 0x2000
jne 0x48fbf9
push str.Windows_Storage_Server_2003
jmp 0x48fc15
cmp byte [ebp - 0x36], 1
jne 0x48fc10
cmp word [ebp - 0x17c], 9
jne 0x48fc10
push str.Windows_XP_Professional_x64_Edition
jmp 0x48fc15
push str.Windows_Server_2003_
mov ebx, dword [ebp - 0x154]
mov edi, ebx
call fcn.0048fdf3
cmp byte [ebp - 0x36], 1
je 0x48fcbb
cmp word [ebp - 0x17c], si
jne 0x48fc4f
test byte [ebp - 0x38], 0x80
je 0x48fc42
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x48fcb4
test byte [ebp - 0x38], 2
je 0x48fcbb
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x48fcb4
cmp word [ebp - 0x17c], 9
jne 0x48fc7c
test byte [ebp - 0x38], 0x80
je 0x48fc66
push str.Datacenter_x64_Edition
jmp 0x48fcb4
test byte [ebp - 0x38], 2
mov edi, ebx
je 0x48fc75
push str.Enterprise_x64_Edition
jmp 0x48fcb6
push str.Standard_x64_Edition
jmp 0x48fcb6
mov eax, dword [ebp - 0x38]
test ax, 0x4000
je 0x48fc8c
push str.Compute_Cluster_Edition
jmp 0x48fcb4
test al, al
jns 0x48fc97
push str.Datacenter_Edition
jmp 0x48fcb4
test al, 2
je 0x48fca2
push str.Enterprise_Edition
jmp 0x48fcb4
test ax, 0x400
je 0x48fcaf
push str.Web_Edition
jmp 0x48fcb4
push str.Standard_Edition
mov edi, ebx
call fcn.0048fdf3
cmp dword [ebp - 0x14c], 5
jne 0x48fd52
jmp 0x48fcd0
mov ebx, dword [ebp - 0x154]
cmp dword [ebp - 0x148], 1
mov esi, str.Professional
jne 0x48fd08
push str.Windows_XP
mov edi, ebx
call fcn.0048fdf3
test word [ebp - 0x38], 0x200
je 0x48fcf9
push str.Home_Edition
jmp 0x48fcfa
push esi
call fcn.0048fdf3
cmp dword [ebp - 0x14c], 5
jne 0x48fd52
cmp dword [ebp - 0x148], 0
jne 0x48fd52
push str.Windows_2000
mov edi, ebx
call fcn.0048fdf3
cmp byte [ebp - 0x36], 1
jne 0x48fd26
push esi
jmp 0x48fd3e
test byte [ebp - 0x38], 0x80
je 0x48fd33
push str.Datacenter_Server
jmp 0x48fd3e
test byte [ebp - 0x38], 2
je 0x48fd45
push str.Advanced_Server
call fcn.0048fdf3
jmp 0x48fd52
push str.Server
jmp 0x48fd3e
mov ebx, dword [ebp - 0x154]
lea eax, [ebp - 0x13c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x48fd5b
sub eax, edx
sar eax, 1
je 0x48fd83
push 0x4a3d98
mov edi, ebx
call fcn.0048fdf3
lea eax, [ebp - 0x13c]
push eax
call fcn.0048fdf3
push dword [ebp - 0x144]
lea edi, [ebp - 0x34]
push str.__build__d_
push 0x50
pop ecx
call fcn.0048fe77
pop ecx
mov eax, edi
pop ecx
push eax
mov edi, ebx
call fcn.0048fdf3
jmp 0x48f9ba
mov edi, dword [ebp - 0x154]
push str.unkown_Version
call fcn.0048fdf3
xor eax, eax
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00490f79
add ebp, 0x70
leave
ret