Function at 0x412e70
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xa8
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0xa4], eax
push ebx
push ebp
push esi
push edi
push 0x9c
xor ebx, ebx
push ebx
push 0x44c2a0
call fcn.004249d0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
push 0x44c2a0
mov dword [0x449ee8], ebx
mov dword [0x449eec], ebx
mov dword [0x449f00], ebx
mov dword [0x449f04], ebx
mov dword [0x449f08], ebx
mov dword [0x449f0c], ebx
mov dword [0x449ee0], ebx
mov dword [0x449ee4], ebx
mov dword [0x449ef0], ebx
mov dword [0x449ef4], ebx
mov dword [0x449ef8], ebx
mov dword [0x449efc], ebx
mov dword [0x44c2a0], 0x9c
mov byte [0x449f24], bl
call esi
mov dword [0x449efc], eax
cmp eax, ebx
jne 0x412f1c
push 0x44c2a0
mov dword [0x44c2a0], 0x94
call esi
push 0x44c260
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x44c2b0]
mov ebp, 1
sub eax, ebp
je 0x4134bc
sub eax, ebp
jne case.default.0x4133d6
mov dword [0x449f00], ebp
mov dword [0x449ef8], ebx
mov dword [0x449ef4], ebp
call fcn.00411670
push str.IsWow64Process
push str.KERNEL32.DLL
mov dword [0x449ee0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
xor eax, eax
mov dword [esp + 0x10], eax
cmp esi, ebx
je 0x412f92
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [esp + 0x10]
mov dword [0x449ef0], eax
cmp eax, ebx
je 0x412fb3
mov dword [0x449f04], ebp
mov dword [0x449f08], ebx
mov dword [0x449f0c], 0x100
jmp 0x412fda
cmp dword [0x449ee0], 3
jne 0x412fd4
mov dword [0x449f04], ebp
mov dword [0x449f08], 0x200
mov dword [0x449f0c], ebx
jmp 0x412fda
mov dword [0x449f00], ebp
mov eax, dword [0x44c2a4]
cmp eax, 5
ja case.default.0x412fe8
jmp dword [eax*4 + 0x4135a8]
mov dword [0x449ee4], ebx
jmp case.default.0x4133d6
cmp dword [0x44c2a8], 0x33
sbb ecx, ecx
and ecx, 0xffffff00
add ecx, 0x200
jmp 0x4134f7
mov dword [0x449ee4], 0x400
jmp case.default.0x4133d6
mov eax, dword [0x44c2a8]
cmp eax, ebx
je 0x413060
dec eax
cmp eax, ebp
ja 0x413051
cmp dword [0x449efc], ebx
je 0x413051
cmp byte [0x44c33a], 1
jne 0x413051
mov dword [0x449ee4], 0x1000
jmp case.default.0x4133d6
mov dword [0x449ee4], 0x2000
jmp case.default.0x4133d6
mov dword [0x449ee4], 0x800
jmp case.default.0x4133d6
push 0x80
mov eax, 0x44c2b4
push str.CSDVersion
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov edi, eax
mov byte [esp + 0x40], bl
call fcn.00411bd0
push 0x80
push str.CurrentBuildNumber
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov eax, 0x4364e7
lea edi, [esp + 0x4c]
call fcn.00411bd0
add esp, 0x18
cmp byte [esp + 0x34], bl
je 0x4130c7
push 0xa
mov edx, edi
push ebx
push edx
call fcn.004210d8
add esp, 0xc
mov dword [0x44c2ac], eax
push 0x20
push str.DisplayVersion
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov eax, 0x4364e7
mov edi, 0x449f24
call fcn.00411bd0
push 0x20
push str.ReleaseId
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov eax, 0x4364e7
lea edi, [esp + 0x2c]
call fcn.00411bd0
add esp, 0x18
cmp byte [esp + 0x14], bl
je 0x41312e
push 0xa
mov eax, edi
push ebx
push eax
call fcn.004210d8
push 0x43bcec
xor edi, edi
mov ecx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov dword [0x449ee8], eax
call fcn.00411d90
add esp, 0x10
mov dword [0x449eec], eax
push 0x80
push str.CurrentVersion
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov eax, 0x43bcf0
lea edi, [esp + 0x40]
call fcn.00411bd0
mov ecx, edi
push 0x2e
push ecx
call fcn.00420dc0
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x4133b9
mov edx, edi
push edx
mov byte [esi], bl
call fcn.00421407
inc esi
push esi
mov dword [0x44c2a4], eax
call fcn.00421407
mov ecx, dword [0x44c2a4]
add esp, 8
mov dword [0x44c2a8], eax
cmp ecx, 6
jne 0x4131ce
push str.CurrentMajorVersionNumber
xor edi, edi
mov ecx, str.SoftwareMicrosoftWindows_NTCurrentVersion
call fcn.00411d90
push str.CurrentMinorVersionNumber
mov ecx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov esi, eax
call fcn.00411d90
add esp, 8
cmp esi, ebx
je 0x4131c3
mov ecx, esi
mov dword [0x44c2a4], ecx
mov dword [0x44c2a8], eax
jmp 0x4131ce
mov eax, dword [0x44c2a8]
mov ecx, dword [0x44c2a4]
cmp ecx, 0xa
jne 0x41338c
cmp dword [0x449efc], ebx
je 0x413231
cmp byte [0x44c33a], 1
jne 0x413231
mov eax, dword [0x44c2ac]
cmp eax, 0x1869f
jb 0x41320d
mov dword [0x44c2a4], 0xc
mov dword [0x449ee4], 0x4000001
jmp case.default.0x4133d6
cmp eax, 0x55ec
jb 0x4134a4
mov dword [0x44c2a4], 0xb
mov dword [0x449ee4], 0x4000000
jmp case.default.0x4133d6
push 0x80
push 0x43b6bc
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov eax, 0x4364e7
lea edi, [esp + 0x40]
mov byte [esp + 0x40], bl
call fcn.00411bd0
add esp, 0xc
cmp byte [esp + 0x34], bl
je 0x4132f7
mov eax, edi
push 0x32
push eax
call fcn.00420dc0
add esp, 8
cmp eax, ebx
je 0x4132f7
push 0xa
push ebx
push eax
call fcn.004210d8
mov ecx, eax
add esp, 0xc
sub ecx, 0x7e0
je 0x4132e2
sub ecx, 3
je 0x4132cd
sub ecx, 3
je 0x4132b4
cmp eax, 0x7e9
jb 0x4132f7
mov dword [0x449ee4], 0x2000001
mov dword [0x44c2a8], 3
jmp case.default.0x4133d6
mov dword [0x449ee4], 0x2000000
mov dword [0x44c2a8], 2
jmp case.default.0x4133d6
mov dword [0x449ee4], 0x1000000
mov dword [0x44c2a8], ebp
jmp case.default.0x4133d6
mov dword [0x449ee4], 0x800000
mov dword [0x44c2a8], ebx
jmp case.default.0x4133d6
cmp dword [0x449ee4], ebx
jne case.default.0x4133d6
mov eax, dword [0x449ee8]
cmp eax, 0x7da
jb 0x413334
mov dword [0x449ee4], 0x2000001
cmp dword [0x44c2a8], ebx
jne case.default.0x4133d6
mov dword [0x44c2a8], 3
jmp case.default.0x4133d6
cmp eax, 0x76c
jb 0x413360
mov dword [0x449ee4], 0x2000000
cmp dword [0x44c2a8], ebx
jne case.default.0x4133d6
mov dword [0x44c2a8], 2
jmp case.default.0x4133d6
cmp eax, 0x70b
jb 0x4134b0
mov dword [0x449ee4], 0x1000000
cmp dword [0x44c2a8], ebx
jne case.default.0x4133d6
mov dword [0x44c2a8], ebp
jmp case.default.0x4133d6
cmp ecx, 0xc
jne 0x4133a0
mov dword [0x449ee4], 0x4000001
jmp case.default.0x4133d6
cmp ecx, 0xb
jne 0x4133b4
mov dword [0x449ee4], 0x4000000
jmp case.default.0x4133d6
cmp ecx, 0xa
jbe 0x4133c8
mov dword [0x449ee4], 0x10000000
jmp case.default.0x4133d6
cmp ecx, 6
jne 0x4133b9
cmp eax, 4
ja case.default.0x4133d6
jmp dword [eax*4 + 0x4135c0]
cmp dword [0x449efc], ebx
je 0x4133fd
cmp byte [0x44c33a], 1
jne 0x4133fd
mov dword [0x449ee4], 0x4000
jmp case.default.0x4133d6
mov dword [0x449ee4], 0x8000
jmp case.default.0x4133d6
cmp dword [0x449efc], ebx
je 0x41342c
cmp byte [0x44c33a], 1
jne 0x41342c
mov dword [0x449ee4], 0x20000
jmp case.default.0x4133d6
mov dword [0x449ee4], 0x10000
jmp case.default.0x4133d6
cmp dword [0x449efc], ebx
je 0x41345b
cmp byte [0x44c33a], 1
jne 0x41345b
mov dword [0x449ee4], 0x40000
jmp case.default.0x4133d6
mov dword [0x449ee4], 0x80000
jmp case.default.0x4133d6
cmp dword [0x449efc], ebx
je 0x413487
cmp byte [0x44c33a], 1
jne 0x413487
mov dword [0x449ee4], 0x100000
jmp case.default.0x4133d6
mov dword [0x449ee4], 0x200000
jmp case.default.0x4133d6
cmp dword [0x449efc], ebx
je 0x4134b0
cmp byte [0x44c33a], 1
jne 0x4134b0
mov dword [0x449ee4], 0x400000
jmp case.default.0x4133d6
mov dword [0x449ee4], 0x800000
jmp case.default.0x4133d6
mov eax, dword [0x44c2a8]
mov dword [0x449f00], ebp
mov dword [0x449ef4], ebx
mov dword [0x449ef8], ebp
mov dword [0x449ee0], ebp
mov dword [0x449ef0], ebx
cmp eax, ebx
jne 0x4134eb
mov dword [0x449ee4], ebp
jmp case.default.0x4133d6
xor ecx, ecx
cmp eax, 0xa
setne cl
lea ecx, [ecx + ecx + 2]
mov dword [0x449ee4], ecx
cmp dword [0x449efc], ebx
je 0x413514
cmp byte [0x44c33a], 1
mov dword [0x449f10], ebp
jne 0x41351a
mov dword [0x449f10], ebx
xor edx, edx
cmp dword [0x449ee0], 3
sete dl
mov dword [0x449f1c], edx
call fcn.00413c40
push str.NanoServer
xor edi, edi
mov ecx, str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
mov dword [0x449f20], eax
call fcn.00411d90
add esp, 4
neg eax
sbb eax, eax
neg eax
mov dword [0x449f14], eax
jne 0x413589
push str.ServerCore
mov ecx, str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
call fcn.00411d90
add esp, 4
test eax, eax
je 0x413589
push str.Server_Gui_Shell
mov ecx, str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
call fcn.00411d90
add esp, 4
mov dword [0x449f18], ebp
test eax, eax
je 0x41358f
mov dword [0x449f18], ebx
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041f826
add esp, 0xa8
ret