Function at 0x49d170
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b98e2
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x649ffc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x278], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0xf
mov byte [esi + 0x28], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x40], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process
push str.kernel32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49d229
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x260], 0
push ecx
push edi
call eax
test eax, eax
jne 0x49d21e
mov eax, 2
jmp 0x49d229
xor eax, eax
cmp dword [ebp - 0x260], eax
setne al
mov dword [esi + 0x4c], eax
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0xf
mov byte [esi + 0x50], 0
push 0x100
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.00586790
push 0
push 0
push 0
push 0x80
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.0049d7e0
push 0x118
lea eax, [ebp - 0x258]
mov dword [ebp - 0x25c], 0x11c
push 0
push eax
call fcn.00586790
add esp, 0x3c
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp - 0x270]
mov eax, dword [ebp - 0x260]
mov edx, dword [ebp - 0x274]
mov dword [ebp - 0x254], ecx
mov dword [esi + 0x10], ecx
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x250], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], edx
call fcn.0049c7e0
push 1
push 0x5cda88
push reloc.WS2_32.dll_bind
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 2
call fcn.0049c910
lea ecx, [ebp - 0x26c]
test eax, eax
je 0x49d31f
mov byte [ebp - 4], 1
call fcn.0049c850
xor edi, edi
jmp 0x49d34f
lea eax, [ebp - 0x260]
mov dword [ebp - 0x260], 0
push eax
push 0x5cdae4
call fcn.0049ca90
mov edi, dword [ebp - 0x260]
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 1
call fcn.0049c850
push dword [esi + 0x14]
mov dword [esi + 0x18], edi
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.0049dab0
mov dword [esi], eax
lea ecx, [ebp - 0x110]
movzx eax, word [ebp - 0x148]
lea edx, [ecx + 2]
mov dword [esi + 0x20], eax
add esp, 0xc
movzx eax, word [ebp - 0x146]
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 7
mov word [ebp - 0x128], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49d3a0
sub ecx, edx
lea eax, [ebp - 0x110]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.00409cd1
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.004a6190
mov edi, eax
lea ecx, [esi + 0x28]
add esp, 8
cmp ecx, edi
je 0x49d40c
call fcn.00403cb7
movups xmm0, xmmword [edi]
movups xmmword [esi + 0x28], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x38], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [ebp - 0x12c]
cmp edx, 0x10
jb 0x49d446
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x49d43c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49d60d
push edx
push ecx
call fcn.0056e998
add esp, 8
mov edx, dword [ebp - 0x114]
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0xf
mov byte [ebp - 0x140], 0
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x49d4a5
mov ecx, dword [ebp - 0x128]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49d49b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49d612
push edx
push ecx
call fcn.0056e998
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x27c], 0
lea eax, [ebp - 0x29c]
push eax
movups xmmword [ebp - 0x29c], xmm0
movups xmmword [ebp - 0x28c], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov cx, word [ebp - 0x29c]
movzx eax, cx
test eax, eax
je 0x49d4f7
cmp eax, 6
je 0x49d4ee
cmp eax, 9
jne 0x49d4fe
mov dword [esi + 0x40], 1
jmp 0x49d4fe
mov dword [esi + 0x40], 2
jmp 0x49d4fe
mov dword [esi + 0x40], 0
mov eax, dword [ebp - 0x288]
mov dword [esi + 0x44], eax
mov eax, dword [ebp - 0x280]
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x258]
cmp eax, 6
je 0x49d579
cmp eax, 0xa
je 0x49d579
cmp eax, 5
jne case.0x49d5be.2
mov eax, dword [ebp - 0x254]
cmp eax, 2
jne 0x49d55d
cmp byte [ebp - 0x142], 1
jne 0x49d547
cmp cx, 9
je case.0x49d5be.1
mov eax, dword [ebp - 0x144]
shr eax, 0xe
not eax
and eax, 2
mov dword [esi + 0x1c], eax
jmp 0x49d5f0
cmp eax, 1
jne case.0x49d5be.2
mov eax, dword [ebp - 0x144]
shr eax, 9
not eax
and eax, 1
mov dword [esi + 0x1c], eax
jmp 0x49d5f0
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x264]
push ecx
push 0
push 0
push dword [ebp - 0x254]
push dword [ebp - 0x258]
call eax
mov eax, dword [ebp - 0x264]
dec eax
cmp eax, 0x81
ja case.0x49d5be.2
movzx eax, byte [eax + 0x49d62c]
jmp dword [eax*4 + 0x49d618]
mov dword [esi + 0x1c], 2
jmp 0x49d5f0
mov dword [esi + 0x1c], 1
jmp 0x49d5f0
mov dword [esi + 0x1c], 3
jmp 0x49d5f0
mov dword [esi + 0x1c], 4
jmp 0x49d5f0
mov dword [esi + 0x1c], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e987
mov esp, ebp
pop ebp
ret
call fcn.0058ac68
call fcn.0058ac68
nop
into
aad 73
add bh, dl
aad 0x49
add ch, al
aad 0x49
add al, ah
aad 0x49
add cl, ch
aad 0x49
add byte [eax], al
add al, 4
add dword [ecx + eax], eax
add al, byte [edx]
add al, byte [edx]
add al, 2
add al, byte [edx]
add al, byte [ecx]
add al, byte [edx]
add al, 4
add al, 4
add al, 4
add al, byte [ecx + eax]
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add byte [esp + eax], al
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 1
add al, 1
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 1
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add eax, dword [ebx]
add al, 4
add dword [ecx], eax
add al, 4
add dword [ecx], eax
int3