Function at 0x442350
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x114
push ebp
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov ecx, 0x27
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x442395
pop edi
mov eax, 1
pop ebp
add esp, 0x114
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x564300
push str.kernel32.dll
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
test eax, eax
je 0x4423bd
lea ecx, [esp + 0xc]
push ecx
call eax
jmp 0x4423c8
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x40], 2
jne 0x4427d3
mov eax, dword [esp + 0x34]
cmp eax, 4
jbe 0x4427d3
mov ecx, dword [esp + 0x124]
push ebx
push esi
mov esi, dword [esp + 0x128]
test ecx, ecx
je 0x442408
push 0x5642f4
push 0x100
push esi
call fcn.004428b0
mov eax, dword [esp + 0x3c]
cmp eax, 6
mov ebx, 1
jne 0x442571
mov eax, dword [esp + 0x40]
cmp eax, ebx
jne 0x442518
cmp byte [esp + 0xd2], bl
jne 0x442432
push 0x5642e8
jmp 0x442437
push 0x5642d0
push 0x100
push esi
call fcn.00442900
push 0x5642c0
push str.kernel32.dll
call edi
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
push 6
call eax
mov edx, dword [esp + 0x10]
lea eax, [edx - 1]
cmp eax, 0x18
ja case.0x44256a.5
jmp dword [eax*4 + 0x4427e0]
push 0x5642ac
jmp 0x4424e5
push 0x564294
jmp 0x4424e5
push 0x564280
jmp 0x4424e5
push 0x56426c
jmp 0x4424e5
push 0x56425c
jmp 0x4424e5
push str.TF_
jmp 0x4424e5
push 0x564230
jmp 0x4424e5
push 0x564208
jmp 0x4424e5
push 0x5641f4
jmp 0x4424e5
push 0x5641cc
jmp 0x4424e5
push 0x56419c
jmp 0x4424e5
push 0x564184
jmp 0x4424e5
push 0x56415c
jmp 0x4424e5
push 0x564148
jmp 0x4424e5
push 0x564120
jmp 0x4424e5
push 0x56410c
push 0x100
push esi
call fcn.00442900
mov eax, dword [esp + 0x134]
test eax, eax
je 0x442751
mov ax, word [esp + 0x14]
cmp ax, 9
jne 0x4426f4
push 0x564100
jmp 0x442746
test eax, eax
jne 0x442751
cmp byte [esp + 0xd2], bl
jne 0x442530
push 0x5640f0
jmp 0x442535
push 0x5640d8
push 0x100
push esi
call fcn.00442900
push 0x5642c0
push str.kernel32.dll
call edi
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
push 6
call eax
mov edx, dword [esp + 0x10]
lea eax, [edx - 1]
cmp eax, 0x18
ja case.0x44256a.5
jmp dword [eax*4 + 0x442844]
cmp eax, 5
jne 0x442751
mov eax, dword [esp + 0x40]
cmp eax, 2
jne 0x4426a0
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x44259a
push 0x5640bc
jmp 0x4425d8
mov eax, dword [esp + 0xd0]
cmp ax, 0x2000
jne 0x4425ae
push 0x5640a0
jmp 0x4425d8
cmp ax, 0x8000
jne 0x4425bb
push 0x56408c
jmp 0x4425d8
cmp byte [esp + 0xd2], bl
jne 0x4425d3
cmp word [esp + 0x14], 9
jne 0x4425d3
push 0x564068
jmp 0x4425d8
push 0x564050
push 0x100
push esi
call fcn.00442900
cmp byte [esp + 0xd2], bl
je 0x442751
mov ax, word [esp + 0x14]
cmp ax, 6
jne 0x442622
mov al, byte [esp + 0xd0]
test al, 0x80
je 0x442610
push 0x564020
jmp 0x442746
test al, 2
je 0x442751
push 0x56419c
jmp 0x442746
cmp ax, 9
jne 0x442655
mov al, byte [esp + 0xd0]
test al, 0x80
je 0x44263d
push 0x564008
jmp 0x442746
test al, 2
je 0x44264b
push str.Enterprise_x64_EJ_
jmp 0x442746
push str.Standard_x64_Edition
jmp 0x442746
mov eax, dword [esp + 0xd0]
test ah, 0x40
je 0x44266b
push str.Compute_Cluster_Edition
jmp 0x442746
test al, 0x80
je 0x442679
push 0x564230
jmp 0x442746
test al, 2
je 0x442687
push 0x5641f4
jmp 0x442746
test ah, 4
je 0x442696
push str.Web_Edition
jmp 0x442746
push 0x564148
jmp 0x442746
cmp eax, ebx
jne 0x442700
push str.Windows_XP
push 0x100
push esi
call fcn.00442900
mov eax, dword [esp + 0xd0]
test ah, 2
je 0x4426c7
push str.Home_Edition
jmp 0x4426cc
push str.Professional
push 0x100
push esi
call fcn.00442900
mov eax, dword [esp + 0x134]
test eax, eax
je 0x442751
mov ax, word [esp + 0x14]
cmp ax, 9
jne 0x4426f4
push 0x564100
jmp 0x442746
test ax, ax
jne 0x442751
push str.__32_bit
jmp 0x442746
test eax, eax
jne 0x442751
push str.Windows_2000
push 0x100
push esi
call fcn.00442900
cmp byte [esp + 0xd2], bl
jne 0x442724
push str.Professional
jmp 0x442746
mov al, byte [esp + 0xd0]
test al, 0x80
je 0x442736
push str.Datacenter_Server
jmp 0x442746
test al, 2
je 0x442741
push str.Advanced_Server
jmp 0x442746
push str.Server
push 0x100
push esi
call fcn.00442900
mov eax, dword [esp + 0x130]
test eax, eax
je 0x44278c
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x44278c
push 0x562af8
push 0x100
push esi
call fcn.00442900
lea eax, [esp + 0x4c]
push eax
push 0x100
push esi
call fcn.00442900
mov eax, dword [esp + 0x138]
test eax, eax
je 0x4427c6
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0xd4]
push ecx
push str.__Build__d_
push 0x50
push edx
call fcn.00431100
add esp, 0x10
lea eax, [esp + 0xd4]
push eax
push 0x100
push esi
call fcn.00442900
mov eax, ebx
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x114
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x114
ret