Function at 0x449b50
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c648
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x61e810]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x188]
mov edi, ecx
xor ebx, ebx
push eax
mov dword [ebp - 0x158], edi
mov dword [ebp - 0x164], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x150]
push ecx
mov dword [ebp - 0x150], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x449be3
xor edx, edx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
push 0x5fc63c
mov word [edi], dx
call fcn.0048aa3a
add esp, 4
mov ecx, 0x5fc63c
mov esi, edi
call fcn.00401741
jmp 0x449ff1
mov eax, dword [ebp - 0x14c]
cmp eax, 6
ja 0x449c07
mov ecx, dword [ebp - 0x148]
mov edx, 1
jne 0x449d5d
cmp ecx, edx
jbe 0x449d5d
call fcn.00448b90
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
lea ebx, [ebp - 0x15c]
lea esi, [ebp - 0x160]
lea edi, [ebp - 0x164]
mov byte [ebp - 0x151], al
call fcn.00448ad0
test al, al
je 0x449d4a
mov eax, dword [ebp - 0x164]
cmp eax, 6
je 0x449cab
cmp eax, 0xa
jne 0x449d4a
cmp dword [ebp - 0x160], 0
jne 0x449d4a
cmp byte [ebp - 0x151], 0
mov esi, dword [ebp - 0x158]
jne 0x449c8f
mov eax, dword [ebp - 0x15c]
push eax
push str.Microsoft_Windows_10_SP_d
push esi
call fcn.004466c0
add esp, 0xc
mov eax, esi
jmp 0x449ff3
mov ecx, dword [ebp - 0x15c]
push ecx
push str.Microsoft_Windows_Server_Technical_Preview_SP_d
push esi
call fcn.004466c0
add esp, 0xc
mov eax, esi
jmp 0x449ff3
mov eax, dword [ebp - 0x160]
sub eax, 2
je 0x449d03
dec eax
jne 0x449d4a
mov esi, dword [ebp - 0x158]
cmp byte [ebp - 0x151], al
jne 0x449ce7
mov edx, dword [ebp - 0x15c]
push edx
push str.Microsoft_Windows_8.1_SP_d
push esi
call fcn.004466c0
add esp, 0xc
mov eax, esi
jmp 0x449ff3
mov eax, dword [ebp - 0x15c]
push eax
push str.Microsoft_Windows_Server_2012_R2_SP_d
push esi
call fcn.004466c0
add esp, 0xc
mov eax, esi
jmp 0x449ff3
cmp byte [ebp - 0x151], 0
mov esi, dword [ebp - 0x158]
jne 0x449d2e
mov ecx, dword [ebp - 0x15c]
push ecx
push str.Microsoft_Windows_8_SP_d
push esi
call fcn.004466c0
add esp, 0xc
mov eax, esi
jmp 0x449ff3
mov edx, dword [ebp - 0x15c]
push edx
push str.Microsoft_Windows_Server_2012_SP_d
push esi
call fcn.004466c0
add esp, 0xc
mov eax, esi
jmp 0x449ff3
mov edi, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x148]
mov edx, 1
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14c]
sub eax, 4
je 0x449f00
sub eax, edx
je 0x449e63
sub eax, edx
je 0x449d9f
push 0x608664
call fcn.0048aa3a
mov ecx, 0x608664
jmp 0x449f5f
cmp ecx, 3
ja case.default.0x449da8
jmp dword [ecx*4 + 0x44a010]
cmp byte [ebp - 0x36], dl
jne 0x449dc8
push str.Microsoft_Windows_Vista
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_Vista
jmp 0x449f5f
push str.Microsoft_Windows_Server_2008
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_Server_2008
jmp 0x449f5f
cmp byte [ebp - 0x36], dl
jne 0x449df5
push str.Microsoft_Windows_7
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_7
jmp 0x449f5f
push str.Microsoft_Windows_Server_2008_R2
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_Server_2008_R2
jmp 0x449f5f
cmp byte [ebp - 0x36], dl
jne 0x449e22
push str.Microsoft_Windows_8
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_8
jmp 0x449f5f
push str.Microsoft_Windows_Server_2012
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_Server_2012
jmp 0x449f5f
cmp byte [ebp - 0x36], dl
jne 0x449e4f
push str.Microsoft_Windows_8.1
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_8.1
jmp 0x449f5f
push str.Microsoft_Windows_Server_2012_R2
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_Server_2012_R2
jmp 0x449f5f
mov eax, ecx
sub eax, ebx
je 0x449eef
sub eax, edx
je 0x449ede
sub eax, edx
jne case.default.0x449da8
cmp byte [ebp - 0x36], dl
jne 0x449e9c
cmp word [ebp - 0x188], 9
jne 0x449e9c
push str.Microsoft_Windows_XP_Professional_x64_Edition
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x449f5f
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x449ebe
push str.Microsoft_Windows_Server_2003
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_Server_2003
jmp 0x449f5f
push 0x59
call esi
test eax, eax
je case.default.0x449da8
push str.Microsoft_Windows_Server_2003_R2
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_Server_2003_R2
jmp 0x449f5f
push str.Microsoft_Windows_XP
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_XP
jmp 0x449f5f
push str.Microsoft_Windows_2000
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_2000
jmp 0x449f5f
cmp ecx, ebx
je 0x449f30
cmp ecx, 0xa
je 0x449f1f
cmp ecx, 0x5a
jne case.default.0x449da8
push str.Microsoft_Windows_Me
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_Me
jmp 0x449f5f
push str.Microsoft_Windows_98
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_98
jmp 0x449f5f
mov eax, dword [ebp - 0x140]
cmp eax, 2
jne 0x449f4c
push str.Microsoft_Windows_NT_4.0
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_NT_4.0
jmp 0x449f5f
cmp eax, edx
jne case.default.0x449da8
push str.Microsoft_Windows_95
call fcn.0048aa3a
mov ecx, str.Microsoft_Windows_95
add esp, 4
lea esi, [ebp - 0x2c]
call fcn.00401741
xor ecx, ecx
lea edx, [ebp - 0x2c]
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], cx
cmp edi, edx
je 0x449fdf
mov esi, 8
cmp dword [edi + 0x14], esi
jb 0x449f95
mov eax, dword [edi]
push eax
call fcn.0048a131
add esp, 4
xor ecx, ecx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], cx
cmp dword [ebp - 0x18], esi
jae 0x449fcc
mov edx, dword [ebp - 0x1c]
lea eax, [edx + edx + 2]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push edi
call fcn.0048a400
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
add esp, 0xc
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
jmp 0x449ff1
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [edi], edx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
jmp 0x449ff1
cmp dword [ebp - 0x18], 8
jb 0x449ff1
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0048a131
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489dc1
mov esp, ebp
pop ebp
ret