Function at 0x4621c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517afd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1bc
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x2c], ebx
push edi
cmp dword [0x572ac8], ebx
je 0x46222d
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push ebx
mov word [esi], ax
push 0x572ab8
or eax, 0xffffffff
mov ecx, esi
call fcn.00411b10
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edi, 7
push 0xa
mov eax, str.Microsoft
lea esi, [ebp - 0x28]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], cx
call fcn.00412b10
mov dword [ebp - 4], 1
xor eax, eax
push 0x11c
lea edx, [ebp - 0x1c8]
push ebx
push edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c8]
push eax
mov dword [ebp - 0x1c8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
jne 0x4622f1
mov esi, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov word [esi], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4622b4
sub eax, edx
sar eax, 1
push eax
xor eax, eax
call fcn.00412b10
mov dword [ebp - 0x2c], 1
mov byte [ebp - 4], 0
cmp dword [ebp - 0x14], 8
jb 0x4622e9
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x18], ebx
jmp 0x46298c
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x534fac
push str.kernel32.dll
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x462318
lea ecx, [ebp - 0x54]
push ecx
call eax
jmp 0x462322
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x1b8], 2
jne 0x46293b
mov eax, dword [ebp - 0x1c4]
cmp eax, 4
jbe 0x46293b
cmp eax, 5
jne 0x46256f
mov eax, dword [ebp - 0x1c0]
test eax, eax
jne 0x4623b9
mov byte [0x15797cd], al
lea eax, [ebp - 0x28]
push eax
mov eax, 0x538838
mov dword [0x15797d0], 0x32
call fcn.0040fb70
cmp byte [ebp - 0xae], 1
jne 0x462385
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Professional
jmp 0x462747
mov al, byte [ebp - 0xb0]
test al, al
jns 0x462399
mov eax, str.Datacenter_Server
jmp 0x462743
test al, 2
je 0x4623ab
lea eax, [ebp - 0x28]
push eax
mov eax, str.Advanced_Server
jmp 0x462747
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Server
jmp 0x462747
cmp eax, 1
jne 0x4623f7
lea edx, [ebp - 0x28]
push edx
mov eax, 0x5388c4
mov byte [0x15797cd], 0
mov dword [0x15797d0], 0x33
call fcn.0040fb70
test dword [ebp - 0xb0], 0x200
je case.0x4626a0.48
lea eax, [ebp - 0x28]
push eax
mov eax, str.Home_Edition
jmp 0x462747
cmp eax, 2
jne case.0x4626a0.5
push 0x59
mov byte [0x15797cd], 0
mov dword [0x15797d0], 0x34
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x462428
lea edx, [ebp - 0x28]
push edx
mov eax, str.Windows_Server_2003_R2_
jmp 0x46247d
mov eax, dword [ebp - 0xb0]
test eax, 0x2000
je 0x462440
lea eax, [ebp - 0x28]
push eax
mov eax, str.Windows_Storage_Server_2003
jmp 0x46247d
test eax, 0x8000
je 0x462452
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Windows_Home_Server
jmp 0x46247d
cmp byte [ebp - 0xae], 1
jne 0x462474
cmp word [ebp - 0x54], 9
jne 0x462474
lea edx, [ebp - 0x28]
mov byte [0x15797cd], 1
push edx
mov eax, str.Windows_XP_Professional_x64_Edition
jmp 0x46247d
lea eax, [ebp - 0x28]
push eax
mov eax, str.Windows_Server_2003_
call fcn.0040fb70
cmp byte [ebp - 0xae], 1
je case.0x4626a0.5
mov eax, dword [ebp - 0x54]
cmp ax, 6
jne 0x4624c9
mov al, byte [ebp - 0xb0]
mov byte [0x15797cd], 1
test al, al
jns 0x4624b7
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x462747
test al, 2
je case.0x4626a0.5
mov eax, str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x462743
cmp ax, 9
jne 0x46250a
mov al, byte [ebp - 0xb0]
mov byte [0x15797cd], 1
test al, al
jns 0x4624ee
lea eax, [ebp - 0x28]
push eax
mov eax, str.Datacenter_x64_Edition
jmp 0x462747
test al, 2
je 0x462500
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Enterprise_x64_Edition
jmp 0x462747
mov eax, str.Standard_x64_Edition
jmp 0x462743
mov eax, dword [ebp - 0xb0]
mov byte [0x15797cd], 0
test eax, 0x4000
je 0x46252c
lea eax, [ebp - 0x28]
push eax
mov eax, str.Compute_Cluster_Edition
jmp 0x462747
test al, al
jns 0x46253e
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Datacenter_Edition
jmp 0x462747
test al, 2
je 0x46254c
mov eax, str.Enterprise_Edition
jmp 0x462743
test eax, 0x400
je 0x462561
lea eax, [ebp - 0x28]
push eax
mov eax, str.Web_Edition
jmp 0x462747
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Standard_Edition
jmp 0x462747
cmp eax, 6
jne case.0x4626a0.5
mov eax, dword [ebp - 0x1c0]
test eax, eax
jne 0x4625ad
cmp byte [ebp - 0xae], 1
mov dword [0x15797d0], 0x3c
jne 0x46259f
mov eax, 0x538c0c
jmp 0x46265c
lea eax, [ebp - 0x28]
push eax
mov eax, 0x538c2c
jmp 0x462660
cmp eax, 1
jne 0x4625dc
mov dword [0x15797d0], 0x3d
cmp byte [ebp - 0xae], al
jne 0x4625d2
lea ecx, [ebp - 0x28]
push ecx
mov eax, 0x538c58
jmp 0x462660
mov eax, 0x538c70
jmp 0x46265c
cmp eax, 2
jne 0x46260a
cmp byte [ebp - 0xae], 1
mov dword [0x15797d0], 0x3e
jne 0x4625ff
lea eax, [ebp - 0x28]
push eax
mov eax, 0x538ca0
jmp 0x462660
lea ecx, [ebp - 0x28]
push ecx
mov eax, 0x538cb8
jmp 0x462660
cmp eax, 3
jne 0x462634
cmp byte [ebp - 0xae], 1
mov dword [0x15797d0], 0x3f
jne 0x462629
mov eax, 0x538ce4
jmp 0x46265c
lea eax, [ebp - 0x28]
push eax
mov eax, 0x538d00
jmp 0x462660
cmp eax, 4
jne 0x462665
cmp byte [ebp - 0xae], 1
mov dword [0x15797d0], 0x40
jne 0x462657
lea ecx, [ebp - 0x28]
push ecx
mov eax, 0x538d30
jmp 0x462660
mov eax, str.Windows_Server_2014
lea edx, [ebp - 0x28]
push edx
call fcn.0040fb70
push str.GetProductInfo
push str.kernel32.dll
call esi
push eax
call ebx
mov edx, dword [ebp - 0x1c0]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x1c4]
push 0
push 0
push edx
push ecx
call eax
mov eax, dword [ebp - 0x30]
dec eax
cmp eax, 0x2f
ja case.0x4626a0.5
movzx edx, byte [eax + 0x4629f0]
jmp dword [edx*4 + 0x4629a8]
lea eax, [ebp - 0x28]
push eax
mov eax, str.Ultimate_Edition
jmp 0x462747
mov eax, str.Home_Premium_Edition
jmp 0x462743
lea eax, [ebp - 0x28]
push eax
mov eax, str.Home_Basic_Edition
jmp 0x462747
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Enterprise_Edition
jmp 0x462747
mov eax, str.Business_Edition
jmp 0x462743
lea eax, [ebp - 0x28]
push eax
mov eax, str.Starter_Edition
jmp 0x462747
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Cluster_Server_Edition
jmp 0x462747
mov eax, str.Datacenter_Edition
jmp 0x462743
lea eax, [ebp - 0x28]
push eax
mov eax, str.Datacenter_Edition__core_installation_
jmp 0x462747
mov eax, str.Enterprise_Edition__core_installation_
jmp 0x462743
lea eax, [ebp - 0x28]
push eax
mov eax, str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x462747
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Small_Business_Server
jmp 0x462747
mov eax, str.Small_Business_Server_Premium_Edition
jmp 0x462743
lea eax, [ebp - 0x28]
push eax
mov eax, str.Standard_Edition
jmp 0x462747
lea ecx, [ebp - 0x28]
push ecx
mov eax, str.Standard_Edition__core_installation_
jmp 0x462747
mov eax, str.Web_Server_Edition
lea edx, [ebp - 0x28]
push edx
call fcn.0040fb70
lea eax, [ebp - 0x1b4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x462755
sub eax, edx
sar eax, 1
je 0x4627e1
lea eax, [ebp - 0x1b4]
lea ecx, [ebp - 0x70]
call fcn.0040fae0
mov byte [ebp - 4], 2
lea eax, [ebp - 0xa8]
push eax
mov ebx, 1
call fcn.004f09b0
add esp, 4
mov bl, 3
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x8c]
push edx
mov ecx, eax
call fcn.00413df0
add esp, 8
mov byte [ebp - 4], 4
push 0
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x28]
call fcn.00412830
mov byte [ebp - 4], bl
lea esi, [ebp - 0x8c]
call fcn.004150b0
mov byte [ebp - 4], 2
lea esi, [ebp - 0xa8]
call fcn.004150b0
mov byte [ebp - 4], 1
lea esi, [ebp - 0x70]
call fcn.004150b0
mov eax, dword [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.004ef4c0
mov byte [ebp - 4], 5
push eax
lea edx, [ebp - 0x8c]
push edx
mov edx, str.__build
call fcn.00413910
mov ebx, 6
mov byte [ebp - 4], bl
push 0x52f2b8
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.004139a0
add esp, 0x1c
mov byte [ebp - 4], 7
push 0
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x28]
call fcn.00412830
mov byte [ebp - 4], bl
lea esi, [ebp - 0xa8]
call fcn.004150b0
mov byte [ebp - 4], 5
lea esi, [ebp - 0x8c]
call fcn.004150b0
mov byte [ebp - 4], 1
lea esi, [ebp - 0x70]
call fcn.004150b0
cmp dword [ebp - 0x1c4], ebx
jb 0x46289a
mov eax, dword [ebp - 0x54]
cmp ax, 9
jne 0x462882
lea ecx, [ebp - 0x28]
mov byte [0x15797cd], 1
push ecx
mov eax, str.__64_bit
jmp 0x462895
test ax, ax
jne 0x46289a
lea edx, [ebp - 0x28]
mov byte [0x15797cd], al
push edx
mov eax, str.__32_bit
call fcn.0040fb70
mov eax, dword [0x15797d0]
cmp eax, 0x3c
je 0x4628bf
cmp eax, 0x3d
je 0x4628bf
cmp eax, 0x3e
je 0x4628bf
cmp eax, 0x3f
je 0x4628bf
mov byte [0x157977e], 0
cmp eax, 0x40
jne 0x4628c6
mov byte [0x157977e], 1
call fcn.00462f50
mov byte [0x157977f], al
call fcn.00463040
test al, al
je 0x4628dd
mov al, 1
jmp 0x4628f1
call fcn.004633f0
test al, al
je 0x4628ef
call fcn.004634f0
test al, al
jne 0x4628d9
xor al, al
mov ebx, dword [ebp + 8]
mov byte [0x15797cc], al
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
lea edi, [ebp - 0x28]
mov esi, ebx
mov word [ebx], ax
call fcn.00411aa0
mov dword [ebp - 0x2c], 1
mov byte [ebp - 4], 0
mov esi, edi
call fcn.004150b0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], eax
mov word [esi], cx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x462950
sub eax, edx
sar eax, 1
push eax
xor eax, eax
call fcn.00412b10
mov dword [ebp - 0x2c], 1
mov byte [ebp - 4], 0
cmp dword [ebp - 0x14], 8
jb 0x462985
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x14], edi
mov word [ebp - 0x28], ax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret