Function at 0x412830
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x519ea4]
push esi
test eax, eax
jne 0x412b0d
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1c0], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xorps xmm0, xmm0
mov dword [ebp - 0x80], 0
push str.GetNativeSystemInfo
push 0x4e7060
movdqa xmmword [ebp - 0xa0], xmm0
movdqa xmmword [ebp - 0x90], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4128bb
lea ecx, [ebp - 0xa0]
push ecx
call eax
jmp 0x4128c8
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1b0]
xorps xmm0, xmm0
mov ecx, dword [ebp - 0x1b8]
mov edx, dword [ebp - 0x1bc]
movq qword [ebp - 0x1cc], xmm0
mov dword [ebp - 0x1c4], 0
sub eax, 0
je 0x412a41
dec eax
je 0x4129f7
dec eax
je 0x412911
mov dword [ebp - 0x1cc], str.Windows__unknown_
jmp 0x412a4b
cmp edx, 4
ja 0x412925
mov dword [ebp - 0x1cc], str.Windows_NT
jmp 0x412a4b
cmp edx, 5
jne 0x412986
mov eax, ecx
sub eax, 0
je 0x412977
dec eax
je 0x412959
dec eax
je 0x412946
mov dword [ebp - 0x1cc], str.Windows_NT__unknown_
jmp 0x412a4b
cmp byte [ebp - 0xa6], 1
jne 0x412968
cmp word [ebp - 0xa0], 9
jne 0x412968
mov dword [ebp - 0x1cc], str.Windows_XP
jmp 0x412a4b
mov dword [ebp - 0x1cc], str.Windows_2003
jmp 0x412a4b
mov dword [ebp - 0x1cc], str.Windows_2000
jmp 0x412a4b
cmp edx, 6
jne 0x412937
cmp byte [ebp - 0xa6], 1
mov eax, ecx
jne 0x4129cb
sub eax, 0
je 0x4129bc
dec eax
je 0x4129ad
mov dword [ebp - 0x1cc], str.Windows_NT__unknown_
jmp 0x412a4b
mov dword [ebp - 0x1cc], str.Windows_7
jmp 0x412a4b
mov dword [ebp - 0x1cc], str.Windows_Vista
jmp 0x412a4b
sub eax, 0
je 0x4129eb
dec eax
je 0x4129df
mov dword [ebp - 0x1cc], str.Windows_NT__unknown_
jmp 0x412a4b
mov dword [ebp - 0x1cc], str.Windows_Server_2008_R2
jmp 0x412a4b
mov dword [ebp - 0x1cc], str.Windows_Server_2008
jmp 0x412a4b
cmp edx, 4
jne 0x412a35
test ecx, ecx
je 0x412a29
cmp ecx, 0xa
je 0x412a1d
cmp ecx, 0x5a
mov eax, str.Windows_9X__unknown_
mov esi, str.Windows_Me
cmove eax, esi
mov dword [ebp - 0x1cc], eax
jmp 0x412a4b
mov dword [ebp - 0x1cc], str.Windows_98
jmp 0x412a4b
mov dword [ebp - 0x1cc], str.Windows_95
jmp 0x412a4b
mov dword [ebp - 0x1cc], str.Windows_9X__unknown_
jmp 0x412a4b
mov dword [ebp - 0x1cc], str.Windows_3.1
push ecx
push edx
lea eax, [ebp - 0x70]
push str._d._d
push eax
call fcn.00412b20
lea eax, [ebp - 0x70]
push eax
call fcn.0049750b
mov cx, word [ebp - 0xa0]
add esp, 0x14
mov esi, eax
cmp cx, 9
jne 0x412a82
mov dword [ebp - 0x1c8], str.amd64
jmp 0x412ac5
cmp cx, 6
jne 0x412a94
mov dword [ebp - 0x1c8], str.ia64
jmp 0x412ac5
cmp cx, 5
jne 0x412aa6
mov dword [ebp - 0x1c8], 0x4e7050
jmp 0x412ac5
test cx, cx
je 0x412abb
mov dword [ebp - 0x1c8], str.unknown
cmp cx, 0xa
jne 0x412ac5
mov dword [ebp - 0x1c8], 0x4e7054
push 0xc
call fcn.004952af
add esp, 4
test eax, eax
je 0x412af7
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
jmp 0x412af9
xor eax, eax
movq xmm0, qword [ebp - 0x1cc]
movq qword [eax], xmm0
mov dword [eax + 8], esi
mov dword [0x519ea4], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00494c10
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret