Function at 0x40ae50
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44aa56
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x466910]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
test byte [0x46b260], 1
jne 0x40aeba
or dword [0x46b260], 1
push 0x455c0c
mov ecx, 0x46b25c
mov byte [ebp - 4], 1
call fcn.004014b0
push 0x44d9a0
call fcn.00433425
add esp, 4
mov byte [ebp - 4], 0
mov esi, dword [0x46b25c]
mov ecx, 0x455c0c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40aeed
cmp dx, di
je 0x40aee9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40aeed
add eax, 4
add ecx, 4
cmp dx, di
jne 0x40aec7
xor eax, eax
jmp 0x40aef2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
setne al
test al, al
je 0x40af22
lea eax, [esi - 0x10]
push eax
call fcn.00404770
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x30], vtable.CRegistry.0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov byte [ebp - 4], 2
call fcn.004163a8
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x40af50
push 0x80004005
call fcn.004017a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
mov bl, 3
mov byte [ebp - 4], bl
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x457b70
call fcn.004014b0
lea ecx, [ebp - 0x30]
call fcn.0040eed0
test al, al
je 0x40b02a
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x14]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Version
call fcn.004014b0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x457b70
mov byte [ebp - 4], 4
call fcn.004014b0
lea edx, [ebp - 0x30]
push edx
mov byte [ebp - 4], bl
call fcn.0040ec00
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], edi
jl 0x40b02a
push 0x457bd4
push esi
call fcn.0043343c
add esp, 8
cmp eax, edi
je 0x40b02a
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x40b02a
mov edi, dword [ebp + 0xc]
push str.Windows_98
mov ecx, edi
call fcn.004014b0
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b014
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
push 0x11c
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call fcn.00415923
mov ecx, dword [ebp + 8]
add esp, 4
push 0x11c
push edi
push eax
mov dword [ecx], eax
call fcn.00437170
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [edx], 0x11c
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40b0bd
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push eax
call fcn.00415952
mov eax, dword [0x46b25c]
add eax, 0xfffffff0
push eax
call fcn.00404770
mov edi, dword [ebp + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [esi - 0x10]
add esp, 8
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x40b008
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x40b0e4
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x40b0e4
lea ecx, [ebp - 0x54]
push ecx
call eax
jmp 0x40b0ee
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 0x10]
cmp ecx, 2
jne 0x40b2b4
mov cl, byte [eax + 0x11a]
cmp cl, 1
jne 0x40b1e4
mov ecx, dword [eax + 4]
cmp ecx, 6
jne 0x40b167
mov eax, dword [eax + 8]
cmp eax, edi
jne 0x40b131
push str.Windows_Vista
mov ecx, 0x46b25c
call fcn.004018e0
jmp 0x40b29c
cmp eax, 1
jne 0x40b14a
push str.Windows_7
mov ecx, 0x46b25c
call fcn.004018e0
jmp 0x40b29c
cmp eax, 2
jne 0x40b29c
push str.Windows_8
mov ecx, 0x46b25c
call fcn.004018e0
jmp 0x40b29c
cmp ecx, 5
jne 0x40b1da
mov eax, dword [eax + 8]
cmp eax, 2
jne 0x40b17e
push str.Windows_XP_64_bit
jmp 0x40b2d9
cmp eax, 1
jne 0x40b1c8
push str.Windows_XP
mov ecx, 0x46b25c
call fcn.004018e0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, 0x200
mov ecx, 0x46b25c
test word [edx + 0x118], ax
je 0x40b1b9
push str._Home_Edition
call fcn.0040b8c0
jmp 0x40b2e3
push str._Professional_Edition
call fcn.0040b8c0
jmp 0x40b2e3
cmp eax, edi
jne 0x40b2e3
push str.Windows_2000
jmp 0x40b2d9
push str.Windows_NT_4.0
jmp 0x40b2d9
cmp cl, bl
jne 0x40b2e3
mov ecx, dword [eax + 4]
cmp ecx, 6
jb 0x40b211
cmp dword [eax + 8], edi
jne 0x40b29c
push str.Windows_Vista
mov ecx, 0x46b25c
call fcn.004018e0
jmp 0x40b29c
cmp ecx, 5
mov ecx, 0x46b25c
jb 0x40b283
cmp dword [eax + 8], 2
jne 0x40b228
push str.Windows_.Net
jmp 0x40b22d
push str.Windows_2000
call fcn.004018e0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
movzx eax, word [ecx + 0x118]
test al, al
jns 0x40b249
push str._DataCenter_Server
jmp 0x40b292
test al, 2
je 0x40b266
cmp dword [ecx + 4], 4
mov ecx, 0x46b25c
jne 0x40b25f
push str._Advanced_Server
jmp 0x40b297
push str._Enterprise_Server
jmp 0x40b297
mov edx, 0x400
mov ecx, 0x46b25c
cmp ax, dx
jne 0x40b27c
push str._Web_Server
jmp 0x40b297
push str._Server
jmp 0x40b297
push str.Windows_NT_4.0
call fcn.004018e0
push str._Server
mov ecx, 0x46b25c
call fcn.0040b8c0
cmp word [ebp - 0x54], 9
jne 0x40b2e3
push str._64_bit
mov ecx, 0x46b25c
call fcn.0040b8c0
jmp 0x40b2e3
cmp ecx, 1
jne 0x40b2e3
mov eax, dword [eax + 8]
cmp eax, 0xa
jae 0x40b2c8
push str.Windows_95
jmp 0x40b2d9
cmp eax, 0x5a
jae 0x40b2d4
push str.Windows_98
jmp 0x40b2d9
push str.Windows_ME
mov ecx, 0x46b25c
call fcn.004018e0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.00415952
add esp, 4
mov ebx, 0x46b25c
call fcn.0040bcf0
mov ebx, eax
call fcn.0040bd70
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00404770
mov edi, dword [ebp + 0xc]
add esp, 4
add eax, 0x10
mov dword [edi], eax
jmp 0x40aff4