Function at 0x403a92
Capabilities:
Get system information on windows

Disassembly:
push ebp
push ebx
mov edx, 0x54
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x403a99
call fcn.00429ae0
push dword [esp + 0x15c]
call fcn.00412380
lea ebp, [esp]
mov dword [ebp], 0x11c
mov eax, str.ntdll.dll
push eax
push 0xffffffff
call fcn.00416908
mov dword [esp + 0x140], eax
cmp dword [esp + 0x140], 0
je 0x403df0
mov eax, str.RtlGetVersion
push eax
push dword [esp + 0x144]
call fcn.00416962
mov dword [esp + 0x144], eax
cmp dword [esp + 0x144], 0
je 0x403b1b
lea eax, [esp]
push eax
push dword [esp + 0x148]
call fcn.004169be
jmp 0x403b49
push dword [esp + 0x140]
call fcn.00416848
mov edx, str.ERROR
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
pop eax
push eax
call fcn.00412350
pop edx
add eax, edx
jmp 0x403e19
push dword [esp + 0x140]
call fcn.00416848
lea eax, [esp + 0x11c]
push eax
call sub.KERNEL32.dll_GetSystemInfo
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
lea ebp, [esp + 8]
mov eax, dword [ebp + 4]
cdq
push edx
push eax
call fcn.00427b00
mov edx, 0x4b72b8
push edx
call fcn.00429a40
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
mov eax, dword [ebp + 8]
cdq
push edx
push eax
call fcn.00427b00
pop eax
lea eax, [esp + 0x14c]
push eax
call fcn.004299b0
push dword [esp + 0x148]
mov edx, 0x4b7e6a
mov ecx, dword [esp]
call fcn.00412310
je 0x403be1
mov edx, str.Windows_2000
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403dcc
mov edx, 0x4b7e82
mov ecx, dword [esp]
call fcn.00412310
je 0x403c06
mov edx, str.Windows_XP
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403dcc
mov edx, 0x4b7eb6
mov ecx, dword [esp]
call fcn.00412310
je 0x403c6c
lea ebp, [esp + 4]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x403c3d
lea ebp, [esp + 0x120]
lea eax, [ebp]
mov ebx, eax
cmp ebx, 9
jne 0x403c3d
mov eax, 1
jmp 0x403c3f
xor eax, eax
and eax, eax
je 0x403c56
mov edx, str.Windows_XP
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403c67
mov edx, 0x4b8b84
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403dcc
mov edx, 0x4b79c2
mov ecx, dword [esp]
call fcn.00412310
je 0x403cb4
lea ebp, [esp + 4]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x403c9e
mov edx, str.Windows_Vista
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403caf
mov edx, str.Windows_Server_2008
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403dcc
mov edx, 0x4b79ca
mov ecx, dword [esp]
call fcn.00412310
je 0x403cfc
lea ebp, [esp + 4]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x403ce6
mov edx, str.Windows_7
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403cf7
mov edx, str.Windows_Server_2008
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403dcc
mov edx, 0x4b7a3c
mov ecx, dword [esp]
call fcn.00412310
je 0x403d44
lea ebp, [esp + 4]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x403d2e
mov edx, str.Windows_8
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403d3f
mov edx, str.Windows_Server_2012
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403dcc
mov edx, 0x4b7a44
mov ecx, dword [esp]
call fcn.00412310
je 0x403d89
lea ebp, [esp + 4]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x403d76
mov edx, str.Windows_8
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403d87
mov edx, str.Windows_Server_2012
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403dcc
mov edx, str.10.0
mov ecx, dword [esp]
call fcn.00412310
je 0x403dcc
lea ebp, [esp + 4]
movsx ebx, byte [ebp + 0x11a]
cmp ebx, 1
jne 0x403dbb
mov edx, str.Windows_10
lea ecx, [esp + 0x150]
call fcn.00412008
jmp 0x403dcc
mov edx, str.Windows_Server_2016
lea ecx, [esp + 0x150]
call fcn.00412008
pop eax
mov edx, dword [esp + 0x14c]
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
pop eax
push eax
call fcn.00412350
pop edx
add eax, edx
jmp 0x403e19
mov edx, str.ERROR
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
pop eax
push eax
call fcn.00412350
pop edx
add eax, edx
jmp 0x403e19
push dword [esp + 0x148]
call fcn.00429b40
push dword [esp + 0x14c]
call fcn.00429b40
add esp, 0x150
pop ebx
pop ebp
ret