Function at 0x561560
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x63f070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
push str.RtlGetVersion
push 0x5d8f48
mov dword [ebp - 0x220], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x110
mov esi, eax
lea eax, [ebp - 0x330]
push 0
push eax
call fcn.0057a870
add esp, 0xc
mov dword [ebp - 0x334], 0x114
lea eax, [ebp - 0x334]
push eax
call esi
push 0x18
push str.unknown_OperatingSystem.
mov ecx, edi
mov esi, eax
call fcn.0055e870
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je case.0x561658.7
test esi, esi
jne case.0x561658.7
push 0x100
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.0057a870
push dword [ebp - 0x218]
lea eax, [ebp - 0x104]
push dword [ebp - 0x21c]
push str._d__d
push eax
call fcn.0041aef0
lea eax, [ebp - 0x104]
push eax
call fcn.00476460
mov eax, dword [ebp - 0x330]
add esp, 0x20
add eax, 0xfffffffc
cmp eax, 6
ja case.0x561658.7
mov esi, 0x5d9090
mov ecx, 0x5d909c
jmp dword [eax*4 + 0x5618b0]
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x56168f
cmp eax, 0xa
je 0x561683
cmp eax, 0x5a
jne case.0x561658.7
push 0x14
push 0x5d8fc4
jmp 0x561897
push 0x14
push str.Microsoft_Windows_98
jmp 0x561897
mov eax, dword [ebp - 0x210]
cmp eax, 2
jne 0x5616a6
push 0x18
push str.Microsoft_Windows_NT_4.0
jmp 0x561897
cmp eax, 1
jne case.0x561658.7
push 0x14
push str.Microsoft_Windows_95
jmp 0x561897
mov eax, dword [ebp - 0x32c]
sub eax, 0
je 0x561731
sub eax, 1
je 0x561725
sub eax, 1
jne case.0x561658.7
cmp byte [ebp - 0x106], 1
jne 0x5616f3
cmp word [ebp - 0x474], 9
jne 0x5616f3
push 0x23
push 0x5d8ff8
jmp 0x561897
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x56170d
push 0x13
push 0x5d901c
jmp 0x561897
push 0x59
call esi
test eax, eax
je case.0x561658.7
push 0x16
push 0x5d9030
jmp 0x561897
push 0xa
push 0x5d8fec
jmp 0x561897
push 0xc
push 0x5d8fdc
jmp 0x561897
mov eax, dword [ebp - 0x32c]
cmp eax, 3
ja case.default.0x56174c
jmp dword [eax*4 + 0x5618cc]
cmp byte [ebp - 0x106], 1
jne 0x56176d
mov ecx, 0xd
mov eax, 0x5d9048
push ecx
push eax
jmp 0x561860
mov ecx, 0x13
mov eax, 0x5d9058
push ecx
push eax
jmp 0x561860
cmp byte [ebp - 0x106], 1
jne 0x561798
mov ecx, 9
mov eax, 0x5d906c
push ecx
push eax
jmp 0x561860
mov ecx, 0x16
mov eax, 0x5d9078
push ecx
push eax
jmp 0x561860
cmp byte [ebp - 0x106], 1
jne 0x561839
push 0x118
lea eax, [ebp - 0x44c]
push 0
push eax
call fcn.0057a870
add esp, 0xc
mov dword [ebp - 0x450], 0x11c
push str.RtlGetVersion
push 0x5d8f34
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x6456ec], eax
test eax, eax
je 0x56182b
lea ecx, [ebp - 0x450]
push ecx
call eax
test eax, eax
jne 0x56182b
cmp dword [ebp - 0x44c], 0xa
ja 0x56180e
jb 0x56182b
cmp dword [ebp - 0x328], 0x55f0
mov ecx, 0x5d909c
mov eax, esi
cmovb eax, ecx
mov ecx, 0xa
push ecx
push eax
jmp 0x561860
mov ecx, 9
mov eax, 0x5d90a8
push ecx
push eax
jmp 0x561860
mov ecx, 0x13
mov eax, 0x5d90b4
push ecx
push eax
jmp 0x561860
cmp byte [ebp - 0x106], 1
jne 0x561859
push 0xb
push 0x5d90c8
jmp 0x561860
push 0x16
push str.Windows_Server_2012_R2
mov ecx, edi
call fcn.0055e870
mov ecx, 0x5d909c
cmp dword [ebp - 0x32c], 0
jne case.0x561658.7
cmp byte [ebp - 0x106], 1
jne 0x561890
cmp dword [ebp - 0x328], 0x55f0
push 0xa
cmovb esi, ecx
push esi
jmp 0x561897
push 0x25
push str.Windows_Server_2016_Technical_Preview
mov ecx, edi
call fcn.0055e870
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a6edb
mov esp, ebp
pop ebp
ret 4