Function at 0x42e096
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x4bc760]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 9
pop eax
mov esi, ecx
lea edi, [ebp - 0x148]
mov ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, 0x11c
push edi
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00469150
add esp, 0xc
mov dword [ebp - 0x120], edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42e0f0
inc eax
jmp 0x42e5dc
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x42e519
cmp dword [ebp - 0x11c], 4
jbe 0x42e5c5
mov edi, str.Microsoft
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dec8
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x11c], 0xa
jne 0x42e16b
cmp dword [ebp - 0x118], 0
jne 0x42e156
cmp byte [ebp - 6], bl
jne 0x42e14f
mov edi, str.Windows_10_Insider_Preview
jmp 0x42e15b
mov edi, str.Windows_Server_Technical_Preview
jmp 0x42e15b
mov edi, 0x4a5af4
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
push 6
pop eax
cmp dword [ebp - 0x11c], eax
jne case.0x42e244.5
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x42e1d6
dec eax
je 0x42e1c3
dec eax
je 0x42e1b0
dec eax
je 0x42e19d
dec eax
jne 0x42e1f5
cmp byte [ebp - 6], bl
jne 0x42e1f5
mov edi, str.Windows_10
jmp 0x42e1e5
cmp byte [ebp - 6], bl
jne 0x42e1a9
mov edi, 0x4a5be4
jmp 0x42e1e5
mov edi, 0x4a5c00
jmp 0x42e1e5
cmp byte [ebp - 6], bl
jne 0x42e1bc
mov edi, 0x4a5ba0
jmp 0x42e1e5
mov edi, 0x4a5bb8
jmp 0x42e1e5
cmp byte [ebp - 6], bl
jne 0x42e1cf
mov edi, 0x4a5b58
jmp 0x42e1e5
mov edi, 0x4a5b70
jmp 0x42e1e5
mov edi, 0x4a5b0c
cmp byte [ebp - 6], bl
je 0x42e1e5
mov edi, 0x4a5b2c
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x124]
push ecx
push 0
push 0
push dword [ebp - 0x118]
push dword [ebp - 0x11c]
call eax
mov eax, dword [ebp - 0x124]
cmp eax, 0x19
ja 0x42e306
je 0x42e2fc
dec eax
cmp eax, 0x11
ja case.0x42e244.5
jmp dword [eax*4 + 0x42e5ee]
mov edi, str.Starter_Edition
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
jmp 0x42e31c
mov edi, str.Home_Premium_Edition
jmp 0x42e250
mov edi, str.Home_Basic_Edition
jmp 0x42e250
push str.Enterprise_Edition
call fcn.0040ca1c
pop ecx
push eax
push str.Enterprise_Edition
jmp 0x42e31c
mov edi, str.Business_Edition
jmp 0x42e250
mov edi, str.Cluster_Server_Edition
jmp 0x42e250
push str.Datacenter_Edition
call fcn.0040ca1c
pop ecx
push eax
push str.Datacenter_Edition
jmp 0x42e31c
mov edi, str.Datacenter_Edition__core_installation_
jmp 0x42e250
mov edi, str.Ultimate_Edition
jmp 0x42e250
mov edi, str.Enterprise_Edition__core_installation_
jmp 0x42e250
push str.Enterprise_Edition_for_Itanium_based_Systems
call fcn.0040ca1c
pop ecx
push eax
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x42e31c
mov edi, str.Small_Business_Server
jmp 0x42e250
mov edi, str.Standard_Edition__core_installation_
jmp 0x42e250
push str.Standard_Edition
call fcn.0040ca1c
pop ecx
push eax
push str.Standard_Edition
jmp 0x42e31c
mov edi, str.Web_Server_Edition
jmp 0x42e250
mov edi, str.Small_Business_Server_Premium_Edition
jmp 0x42e250
cmp eax, 0x30
jne case.0x42e244.5
push str.Professional
call fcn.0040ca1c
pop ecx
push eax
push str.Professional
mov ecx, esi
call fcn.0040dd92
cmp dword [ebp - 0x11c], 5
jne 0x42e4d5
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x42e48e
dec eax
je 0x42e462
dec eax
je 0x42e353
mov edi, str.Unsupported_version_of_Windows
jmp 0x42e5ca
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x42e366
mov edi, 0x4a6084
jmp 0x42e3a1
test dword [ebp - 8], 0x2000
je 0x42e376
mov edi, 0x4a60b4
jmp 0x42e3a1
test dword [ebp - 8], 0x8000
je 0x42e386
mov edi, 0x4a60f0
jmp 0x42e3a1
cmp byte [ebp - 6], bl
jne 0x42e39c
push 9
pop eax
mov edi, 0x4a6050
cmp word [ebp - 0x148], ax
je 0x42e3a1
mov edi, 0x4a611c
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
push 6
pop eax
cmp byte [ebp - 6], bl
je 0x42e4d8
cmp word [ebp - 0x148], ax
jne 0x42e3ea
test byte [ebp - 8], 0x80
je 0x42e3d6
mov edi, str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x42e4c5
test byte [ebp - 8], 2
je 0x42e4d8
mov edi, str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x42e4c5
push 9
pop eax
cmp word [ebp - 0x148], ax
jne 0x42e420
test byte [ebp - 8], 0x80
je 0x42e406
mov edi, str.Datacenter_x64_Edition
jmp 0x42e4c5
test byte [ebp - 8], 2
je 0x42e416
mov edi, str.Enterprise_x64_Edition
jmp 0x42e4c5
mov edi, str.Standard_x64_Edition
jmp 0x42e4c5
mov eax, dword [ebp - 8]
test eax, 0x4000
je 0x42e434
mov edi, str.Compute_Cluster_Edition
jmp 0x42e4c5
test al, al
jns 0x42e442
mov edi, str.Datacenter_Edition
jmp 0x42e4c5
test al, 2
je 0x42e44d
mov edi, str.Enterprise_Edition
jmp 0x42e4c5
test eax, 0x400
je 0x42e45b
mov edi, str.Web_Edition
jmp 0x42e4c5
mov edi, str.Standard_Edition
jmp 0x42e4c5
mov edi, 0x4a6050
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
test dword [ebp - 8], 0x200
je 0x42e487
mov edi, str.Home_Edition
jmp 0x42e4c5
mov edi, str.Professional
jmp 0x42e4c5
mov edi, 0x4a5fe0
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
cmp byte [ebp - 6], bl
je 0x42e487
test byte [ebp - 8], 0x80
je 0x42e4b5
mov edi, str.Datacenter_Server
jmp 0x42e4c5
test byte [ebp - 8], 2
mov edi, str.Advanced_Server
jne 0x42e4c5
mov edi, str.Server
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
push 6
pop eax
cmp dword [ebp - 0x11c], eax
jb 0x42e512
push 9
pop eax
cmp word [ebp - 0x148], ax
jne 0x42e4f3
mov edi, str.__64_bit
jmp 0x42e502
cmp word [ebp - 0x148], 0
jne 0x42e512
mov edi, str.__32_bit
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
mov eax, ebx
jmp 0x42e5dc
cmp eax, 1
jne 0x42e5bc
cmp dword [ebp - 0x11c], 4
jne 0x42e5da
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x42e572
mov edi, str.Microsoft_Windows_95
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
mov edi, str.OSR2
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
cmp dword [ebp - 0x11c], 4
jne 0x42e5da
mov eax, dword [ebp - 0x118]
cmp eax, 0xa
jne 0x42e5b0
mov edi, str.Microsoft_Windows_98
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
mov edi, 0x4a6344
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
cmp dword [ebp - 0x11c], 4
jne 0x42e5da
mov eax, dword [ebp - 0x118]
cmp eax, 0x5a
jne 0x42e5da
mov edi, str.Microsoft_Windows_ME
jmp 0x42e5ca
mov edi, str.Microsoft_Windows_Win32s
test eax, eax
je 0x42e5ca
mov edi, str.Unsupported_version_of_Windows.
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040dd92
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466746
mov esp, ebp
pop ebp
ret