Function at 0x427f95
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
and dword [eax + 4], 0
lea esi, [eax + 8]
mov ecx, esi
call fcn.00426bf6
mov edi, 0x9c
lea eax, [ebp - 0xa4]
push edi
push 0
push eax
call fcn.00443c10
add esp, 0xc
mov dword [ebp - 0xa4], edi
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x42841f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
lea edi, [ebp - 0xc8]
push 9
pop eax
mov ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc8]
push eax
test edx, edx
je 0x42801f
call edx
jmp 0x428025
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x94], 2
jne 0x428416
cmp dword [ebp - 0xa0], 4
jb 0x428416
or edi, 0xffffffff
mov ecx, esi
push edi
push str.Microsoft
call fcn.00426d0e
push 6
pop eax
cmp dword [ebp - 0xa0], eax
jne case.0x4280f1.5
cmp dword [ebp - 0x9c], 0
jne 0x428081
cmp byte [ebp - 0xa], 1
mov ecx, esi
push edi
jne 0x428077
push str.Windows_Vista
jmp 0x42807c
push str.Windows_Server_2008
call fcn.00426d0e
cmp dword [ebp - 0x9c], 1
jne 0x4280a4
cmp byte [ebp - 0xa], 1
mov ecx, esi
push edi
jne 0x42809a
push str.Windows_7
jmp 0x42809f
push str.Windows_Server_2008_R2
call fcn.00426d0e
push str.GetProductInfo
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je case.0x4280f1.5
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push dword [ebp - 0x9c]
push dword [ebp - 0xa0]
call eax
mov eax, dword [ebp - 8]
cmp eax, 0x19
ja 0x42817b
je 0x428173
dec eax
cmp eax, 0x11
ja case.0x4280f1.5
jmp dword [eax*4 + 0x42842d]
push edi
push str.Ultimate_Edition
jmp 0x428186
push edi
push str.Home_Premium_Edition
jmp 0x428186
push edi
push str.Home_Basic_Edition
jmp 0x428186
push edi
push str.Enterprise_Edition
jmp 0x428186
push edi
push str.Business_Edition
jmp 0x428186
push edi
push str.Starter_Edition
jmp 0x428186
push edi
push str.Cluster_Server_Edition
jmp 0x428186
push edi
push str.Datacenter_Edition
jmp 0x428186
push edi
push str.Datacenter_Edition__core_installation_
jmp 0x428186
push edi
push str.Enterprise_Edition__core_installation_
jmp 0x428186
push edi
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x428186
push edi
push str.Small_Business_Server
jmp 0x428186
push edi
push str.Standard_Edition
jmp 0x428186
push edi
push str.Standard_Edition__core_installation_
jmp 0x428186
push edi
push str.Web_Server_Edition
jmp 0x428186
push edi
push str.Small_Business_Server_Premium_Edition
jmp 0x428186
cmp eax, 0x30
jne case.0x4280f1.5
push edi
push str.Professional
mov ecx, esi
call fcn.00426d0e
cmp dword [ebp - 0xa0], 5
jne 0x42834d
mov eax, dword [ebp - 0x9c]
cmp eax, 2
jne 0x4282c5
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4281bd
push edi
push str.Windows_Server_2003_R2_
jmp 0x4281dd
test dword [ebp - 0xc], 0x2000
je 0x4281ce
push edi
push str.Windows_Storage_Server_2003
jmp 0x4281dd
test dword [ebp - 0xc], 0x8000
je 0x4281e9
push edi
push str.Windows_Home_Server
mov ecx, esi
call fcn.00426d0e
push 9
pop ebx
jmp 0x428210
cmp byte [ebp - 0xa], 1
push 9
pop ebx
jne 0x428203
cmp word [ebp - 0xc8], bx
jne 0x428203
push edi
push str.Windows_XP_Professional_x64_Edition
jmp 0x428209
push edi
push str.Windows_Server_2003_
mov ecx, esi
call fcn.00426d0e
cmp byte [ebp - 0xa], 1
je 0x4282b0
push 6
pop eax
cmp word [ebp - 0xc8], ax
jne 0x428242
test byte [ebp - 0xc], 0x80
je 0x428234
push edi
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x4282a9
test byte [ebp - 0xc], 2
je 0x4282b0
push edi
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x4282a9
push edi
cmp word [ebp - 0xc8], bx
jne 0x42826f
test byte [ebp - 0xc], 0x80
je 0x428259
push str.Datacenter_x64_Edition
jmp 0x4282a9
test byte [ebp - 0xc], 2
mov ecx, esi
je 0x428268
push str.Enterprise_x64_Edition
jmp 0x4282ab
push str.Standard_x64_Edition
jmp 0x4282ab
mov eax, dword [ebp - 0xc]
test eax, 0x4000
je 0x428280
push str.Compute_Cluster_Edition
jmp 0x4282a9
test al, al
jns 0x42828b
push str.Datacenter_Edition
jmp 0x4282a9
test al, 2
je 0x428296
push str.Enterprise_Edition
jmp 0x4282a9
test eax, 0x400
je 0x4282a4
push str.Web_Edition
jmp 0x4282a9
push str.Standard_Edition
mov ecx, esi
call fcn.00426d0e
cmp dword [ebp - 0xa0], 5
jne 0x428350
mov eax, dword [ebp - 0x9c]
jmp 0x4282c8
push 9
pop ebx
cmp eax, 1
jne 0x428306
push edi
push str.Windows_XP
mov ecx, esi
call fcn.00426d0e
test dword [ebp - 0xc], 0x200
mov ecx, esi
push edi
je 0x4282ed
push str.Home_Edition
jmp 0x4282f2
push str.Professional
call fcn.00426d0e
cmp dword [ebp - 0xa0], 5
jne 0x428350
mov eax, dword [ebp - 0x9c]
test eax, eax
jne 0x428366
push edi
push str.Windows_2000
mov ecx, esi
call fcn.00426d0e
cmp byte [ebp - 0xa], 1
mov ecx, esi
push edi
jne 0x428327
push str.Professional
jmp 0x42833f
test byte [ebp - 0xc], 0x80
je 0x428334
push str.Datacenter_Server
jmp 0x42833f
test byte [ebp - 0xc], 2
je 0x428346
push str.Advanced_Server
call fcn.00426d0e
jmp 0x428350
push str.Server
jmp 0x42833f
push 9
pop ebx
cmp dword [ebp - 0xa0], 4
jne 0x428366
push edi
push str.Windows_NT
mov ecx, esi
call fcn.00426d0e
lea ecx, [ebp - 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42836f
sub ecx, edx
je 0x428396
push edi
push 0x482a78
mov ecx, esi
call fcn.00426d0e
push edi
lea eax, [ebp - 0x90]
mov ecx, esi
push eax
call fcn.00426d0e
push 0xa
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x98]
call fcn.00441755
add esp, 0xc
mov ecx, esi
push edi
push str.__build
call fcn.00426d0e
push edi
lea eax, [ebp - 0xe8]
mov ecx, esi
push eax
call fcn.00426d0e
push edi
push 0x485350
mov ecx, esi
call fcn.00426d0e
push 6
pop eax
cmp dword [ebp - 0xa0], eax
jb 0x4283f7
cmp word [ebp - 0xc8], bx
jne 0x428404
push edi
push str.__64_bit
mov ecx, esi
call fcn.00426d0e
mov ecx, dword [ebp - 4]
pop ebx
mov eax, dword [ecx + 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0xc8], 0
jne 0x4283f7
push edi
push str.__32_bit
jmp 0x4283f0
push 0xffffffffffffffff
push str.Unsupported
jmp 0x4283f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
jmp 0x4283fb