Function at 0x542080
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x1ec
mov eax, dword [0x67f864]
xor eax, esp
mov dword [esp + 0x1e8], eax
xor eax, eax
push ebx
push esi
push edi
push 0x11c
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x40]
push eax
mov esi, ecx
call fcn.005d5de0
mov edx, str.Microsoft
add esp, 0xc
mov dword [esp + 0x38], 0x11c
mov edi, 0x100
mov eax, esi
sub edx, esi
mov ebx, 1
lea ecx, [ecx]
movzx ecx, word [edx + eax]
test cx, cx
je 0x542105
mov word [eax], cx
add eax, 2
sub edi, ebx
jne 0x5420f0
jmp 0x542109
test edi, edi
jne 0x54210c
sub eax, 2
lea ecx, [esp + 0x38]
push ecx
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x5423f6
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebp
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
test eax, eax
je 0x54214d
lea edx, [esp + 0x10]
push edx
call eax
jmp 0x542158
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x4c], 2
jne 0x5423f5
mov eax, dword [esp + 0x40]
cmp eax, 4
jbe 0x5423f5
cmp eax, 6
jne 0x542203
cmp dword [esp + 0x44], ebx
jne 0x5421a0
cmp byte [esp + 0x156], bl
jne 0x54218f
push str.Windows_7
jmp 0x542194
push str.Windows_Server_2008_R2
call fcn.00541fb0
cmp dword [esp + 0x40], 6
jne 0x542203
cmp dword [esp + 0x44], 0
jne 0x542396
cmp byte [esp + 0x156], bl
jne 0x5421bb
push str.Windows_Vista
jmp 0x5421c0
push str.Windows_Server_2008
call fcn.00541fb0
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call ebp
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0
push 6
call eax
mov eax, dword [esp + 0x10]
cmp ax, 9
jne 0x5421f4
push str.__64_bit
jmp 0x5421fe
test ax, ax
jne 0x542203
push str.__32_bit
call fcn.00541fb0
mov edi, 5
cmp dword [esp + 0x40], edi
jne 0x542396
cmp dword [esp + 0x44], 2
jne 0x54231a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x542230
push str.Windows_Server_2003_R2_
jmp 0x54226e
mov eax, dword [esp + 0x154]
cmp ax, 0x2000
jne 0x542244
push str.Windows_Storage_Server_2003
jmp 0x54226e
cmp ax, 0x8000
jne 0x542251
push str.Windows_Home_Server
jmp 0x54226e
cmp byte [esp + 0x156], bl
jne 0x542269
cmp word [esp + 0x10], 9
jne 0x542269
push str.Windows_XP_Professional_x64_Edition
jmp 0x54226e
push str.Windows_Server_2003_
call fcn.00541fb0
cmp byte [esp + 0x156], bl
je 0x542314
mov eax, dword [esp + 0x10]
cmp ax, 6
jne 0x5422a7
mov al, byte [esp + 0x154]
test al, al
jns 0x54229c
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x54230f
test al, 2
je 0x542314
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x54230f
cmp ax, 9
jne 0x5422d1
mov al, byte [esp + 0x154]
test al, al
jns 0x5422bf
push str.Datacenter_x64_Edition
jmp 0x54230f
test al, 2
je 0x5422ca
push str.Enterprise_x64_Edition
jmp 0x54230f
push str.Standard_x64_Edition
jmp 0x54230f
mov eax, dword [esp + 0x154]
test eax, 0x4000
je 0x5422e6
push str.Compute_Cluster_Edition
jmp 0x54230f
test al, al
jns 0x5422f1
push str.Datacenter_Edition
jmp 0x54230f
test al, 2
je 0x5422fc
push str.Enterprise_Edition
jmp 0x54230f
test eax, 0x400
je 0x54230a
push str.Web_Edition
jmp 0x54230f
push str.Standard_Edition
call fcn.00541fb0
cmp dword [esp + 0x40], edi
jne 0x542396
cmp dword [esp + 0x44], ebx
jne 0x54234e
push str.Windows_XP
call fcn.00541fb0
test dword [esp + 0x154], 0x200
je 0x54233e
push str.Home_Edition
jmp 0x542343
push str.Professional
call fcn.00541fb0
cmp dword [esp + 0x40], edi
jne 0x542396
cmp dword [esp + 0x44], 0
jne 0x542396
push str.Windows_2000
call fcn.00541fb0
cmp byte [esp + 0x156], bl
jne 0x54236f
push str.Professional
jmp 0x542391
mov al, byte [esp + 0x154]
test al, al
jns 0x542381
push str.Datacenter_Server
jmp 0x542391
test al, 2
je 0x54238c
push str.Advanced_Server
jmp 0x542391
push str.Server
call fcn.00541fb0
lea eax, [esp + 0x50]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5423a0
sub eax, edx
sar eax, 1
je 0x5423c5
push 0x63d180
call fcn.00541fb0
lea edx, [esp + 0x50]
push edx
call fcn.00541fb0
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push eax
push ecx
push edx
push str.___d._d_build__d_
mov eax, 0x50
lea edi, [esp + 0x168]
call fcn.00541f00
add esp, 0x10
mov eax, edi
push eax
call fcn.00541fb0
pop ebp
mov ecx, dword [esp + 0x1f4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005ce60a
add esp, 0x1ec
ret