Function at 0x422dba
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push 0x24
push 0
lea eax, [ebp - 0xd0]
push eax
call fcn.0048a490
add esp, 0xc
push 0x9c
push 0
lea ecx, [ebp - 0xa4]
push ecx
call fcn.0048a490
add esp, 0xc
mov dword [ebp - 0xa4], 0x9c
lea edx, [ebp - 0xa4]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jne 0x422e1c
mov eax, 1
jmp 0x423551
push str.GetNativeSystemInfo
push 0x4f1a80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x422e51
lea eax, [ebp - 0xd0]
push eax
call dword [ebp - 0xa8]
jmp 0x422e5e
lea ecx, [ebp - 0xd0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x94], 2
jne 0x423539
cmp dword [ebp - 0xa0], 4
jbe 0x423539
push str.Microsoft
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.004235c0
cmp dword [ebp - 0xa0], 6
jne case.0x422f72.4
cmp dword [ebp - 0x9c], 0
jne 0x422ed6
mov eax, dword [ebp - 0xa]
and eax, 0xff
cmp eax, 1
jne 0x422ec3
push str.Windows_Vista__Ver_6.0_
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp 0x422ed6
push str.Windows_Server_2008__Ver_6.0_
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
cmp dword [ebp - 0x9c], 1
jne 0x422f14
mov eax, dword [ebp - 0xa]
and eax, 0xff
cmp eax, 1
jne 0x422f01
push str.Windows_7__Ver_6.1_
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp 0x422f14
push str.Windows_Server_2008_R2__Ver_6.1_
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x9c]
push ecx
mov edx, dword [ebp - 0xa0]
push edx
call dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
sub ecx, 1
mov dword [ebp - 0x124], ecx
cmp dword [ebp - 0x124], 0x18
ja case.0x422f72.4
mov edx, dword [ebp - 0x124]
jmp dword [edx*4 + 0x423555]
push str.Ultimate_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp case.0x422f72.4
push str.Home_Premium_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp case.0x422f72.4
push str.Home_Basic_Edition
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
jmp case.0x422f72.4
push 0x4f1b74
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp case.0x422f72.4
push str.Business_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp case.0x422f72.4
push str.Starter_Edition
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
jmp case.0x422f72.4
push str.Cluster_Server_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp case.0x422f72.4
push 0x4f1bc4
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp case.0x422f72.4
push str.Datacenter_Edition__core_installation_
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
jmp case.0x422f72.4
push 0x4f1c00
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp case.0x422f72.4
push str.Enterprise_Edition__core_installation_
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp case.0x422f72.4
push 0x4f1c3c
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
jmp case.0x422f72.4
push str.Small_Business_Server
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp case.0x422f72.4
push str.Small_Business_Server_Premium_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp case.0x422f72.4
push 0x4f1cac
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
jmp case.0x422f72.4
push str.Standard_Edition__core_installation_
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp case.0x422f72.4
push str.Web_Server_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
cmp dword [ebp - 0xa0], 5
jne 0x423360
cmp dword [ebp - 0x9c], 2
jne 0x423360
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x423138
push str.Windows_Server_2003_R2__Ver_5.2__
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
jmp 0x4231c9
mov eax, dword [ebp - 0xc]
and eax, 0xffff
cmp eax, 0x2000
jne 0x42315c
push str.Windows_Storage_Server_2003__Ver_5.2_
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp 0x4231c9
mov edx, dword [ebp - 0xc]
and edx, 0xffff
cmp edx, 0x8000
jne 0x423182
push str.Windows_Home_Server__Ver_5.2_
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp 0x4231c9
mov ecx, dword [ebp - 0xa]
and ecx, 0xff
cmp ecx, 1
jne 0x4231b6
mov edx, dword [ebp - 0xd0]
and edx, 0xffff
cmp edx, 9
jne 0x4231b6
push str.Windows_XP_Professional_x64_Edition__Ver_5.2_
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp 0x4231c9
push str.Windows_Server_2003_
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
mov edx, dword [ebp - 0xa]
and edx, 0xff
cmp edx, 1
je 0x423360
mov eax, dword [ebp - 0xd0]
and eax, 0xffff
cmp eax, 6
jne 0x42323a
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
and ecx, 0x80
test ecx, ecx
je 0x423213
push str.Datacenter_Edition_for_Itanium_based_Systems
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
jmp 0x423235
mov eax, dword [ebp - 0xc]
and eax, 0xffff
and eax, 2
test eax, eax
je 0x423235
push str.Enterprise_Edition_for_Itanium_based_Systems
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp 0x423360
mov edx, dword [ebp - 0xd0]
and edx, 0xffff
cmp edx, 9
jne 0x4232ae
mov eax, dword [ebp - 0xc]
and eax, 0xffff
and eax, 0x80
test eax, eax
je 0x423271
push str.Datacenter_x64_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp 0x4232a9
mov edx, dword [ebp - 0xc]
and edx, 0xffff
and edx, 2
test edx, edx
je 0x423296
push str.Enterprise_x64_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp 0x4232a9
push str.Standard_x64_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp 0x423360
mov edx, dword [ebp - 0xc]
and edx, 0xffff
and edx, 0x4000
test edx, edx
je 0x4232d9
push str.Compute_Cluster_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp 0x423360
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
and ecx, 0x80
test ecx, ecx
je 0x423301
push str.Datacenter_Edition
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
jmp 0x423360
mov eax, dword [ebp - 0xc]
and eax, 0xffff
and eax, 2
test eax, eax
je 0x423325
push str.Enterprise_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp 0x423360
mov edx, dword [ebp - 0xc]
and edx, 0xffff
and edx, 0x400
test edx, edx
je 0x42334d
push str.Web_Edition
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp 0x423360
push str.Standard_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
cmp dword [ebp - 0xa0], 5
jne 0x4233be
cmp dword [ebp - 0x9c], 1
jne 0x4233be
push str.Windows_XP__Ver_5.1_
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
mov eax, dword [ebp - 0xc]
and eax, 0xffff
and eax, 0x200
test eax, eax
je 0x4233ab
push str.Home_Edition
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp 0x4233be
push 0x4f1ee0
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
cmp dword [ebp - 0xa0], 5
jne 0x42346c
cmp dword [ebp - 0x9c], 0
jne 0x42346c
push str.Windows_2000__Ver_5.0_
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
mov ecx, dword [ebp - 0xa]
and ecx, 0xff
cmp ecx, 1
jne 0x42340e
push str.Professional
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
jmp 0x42346c
mov eax, dword [ebp - 0xc]
and eax, 0xffff
and eax, 0x80
test eax, eax
je 0x423434
push str.Datacenter_Server
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
jmp 0x42346c
mov edx, dword [ebp - 0xc]
and edx, 0xffff
and edx, 2
test edx, edx
je 0x423459
push str.Advanced_Server
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
jmp 0x42346c
push str.Server
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
lea edx, [ebp - 0x90]
push edx
call fcn.0048a4f0
add esp, 4
test eax, eax
jbe 0x4234a7
push 0x4f1f44
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
lea ecx, [ebp - 0x90]
push ecx
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
mov eax, dword [ebp - 0x98]
push eax
push str.__build__d_
push 0x50
lea ecx, [ebp - 0x120]
push ecx
call fcn.00423640
add esp, 0x10
lea edx, [ebp - 0x120]
push edx
push 0x100
mov eax, dword [ebp + 8]
push eax
call fcn.00423600
cmp dword [ebp - 0xa0], 6
jb 0x42352a
mov ecx, dword [ebp - 0xd0]
and ecx, 0xffff
cmp ecx, 9
jne 0x423508
push str.__64_bit
push 0x100
mov edx, dword [ebp + 8]
push edx
call fcn.00423600
jmp 0x42352a
mov eax, dword [ebp - 0xd0]
and eax, 0xffff
test eax, eax
jne 0x42352a
push str.__32_bit
push 0x100
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423600
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov eax, 1
jmp 0x423551
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
push str.This_sample_does_not_support_this_version_of_Windows._n
call fcn.0048a56b
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret