Function at 0x501630
Capabilities:
Check os version
Get system information on windows

Disassembly:
push r13
mov eax, 0x2870
push r12
push rdi
push rsi
push rbx
call fcn.006ef990
sub rsp, rax
mov r8d, 0x2700
xor edx, edx
mov r12, rcx
lea rcx, [rsp + 0x170]
lea r13, [rsp + 0x40]
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x168], 0
call sym.memset
lea r8, [rsp + 0xc0]
xor eax, eax
mov ecx, 0x13
mov qword [rsp + 0x40], 0
mov rdi, r8
rep stosq qword [rdi], rax
mov rcx, r8
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0xc0], 0x9c
mov dword [rdi], 0
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x501750
lea rax, [r12 + 0x10]
lea r13, [rsp + 0x160]
mov qword [r12], rax
mov r8, r13
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x5016f6
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
cmove r8, rdx
mov esi, eax
add sil, al
sbb r8, 3
mov rdx, r13
xor r9d, r9d
mov rcx, r12
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
mov rax, r12
add rsp, 0x2870
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
lea rcx, str.kernel32.dll
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rsi
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call rbx
mov rcx, r13
test rax, rax
je 0x5017f0
call rax
cmp dword [rsp + 0xd0], 2
jne 0x501795
mov r9d, dword [rsp + 0xc4]
cmp r9d, 4
ja 0x501800
lea rcx, str.This_sample_does_not_support_this_version_of_Windows._n
lea r13, [rsp + 0x160]
call sym.printf_char_const__::_
lea rax, [r12 + 0x10]
mov r8, r13
mov qword [r12], rax
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x5017b5
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
cmove r8, rdx
mov ebx, eax
add bl, al
jmp 0x501728
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x50177d
lea r13, [rsp + 0x160]
lea rdx, str.Microsoft
mov ecx, 0x4d
mov rax, r13
jmp 0x50182b
movzx ecx, byte [rdx]
test cl, cl
je 0x5018e0
mov r8, rax
lea rdi, [rsp + 0x2870]
lea rax, [rax + 1]
add rdx, 1
mov byte [rax - 1], cl
cmp rax, rdi
jne 0x501820
mov byte [r8], 0
cmp r9d, 6
je 0x501968
cmp r9d, 5
je 0x5018f0
cmp byte [rsp + 0xd4], 0
jne 0x501c30
mov r9d, dword [rsp + 0xcc]
lea rbx, [rsp + 0x70]
mov edx, 0x50
lea r8, str.__build__d_
mov rcx, rbx
call sym.StringCchPrintfA
mov r8, rbx
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
cmp dword [rsp + 0xc4], 5
jbe 0x5018d0
movzx eax, word [rsp + 0x40]
cmp ax, 9
je 0x501c85
test ax, ax
jne 0x5018d0
lea r8, str.__32_bit
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
nop
mov rdx, r13
mov rcx, r12
call fcn.00500dd0
jmp 0x50173a
mov r8, rax
jmp 0x501846
mov eax, dword [rsp + 0xc8]
cmp eax, 2
je 0x501cee
cmp eax, 1
je 0x501c9e
test eax, eax
jne 0x50185e
lea r8, str.Windows_2000
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
cmp byte [rsp + 0x15a], 1
je 0x501e44
movzx eax, word [rsp + 0x158]
test al, 0x80
jne 0x501e2b
test al, 2
je 0x501e12
lea r8, str.Advanced_Server
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x50185e
mov eax, dword [rsp + 0xc8]
test eax, eax
jne 0x50199c
cmp byte [rsp + 0x15a], 1
je 0x501dc0
lea r8, str.Windows_Server_2008
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov eax, dword [rsp + 0xc8]
cmp eax, 1
je 0x501c5e
lea rcx, str.kernel32.dll
call rsi
lea rdx, str.GetProductInfo
mov rcx, rax
call rbx
lea rdx, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov ecx, dword [rsp + 0xc4]
mov edx, dword [rsp + 0xc8]
call rax
cmp dword [rsp + 0x3c], 0x30
ja case.0x5019f3.60
mov eax, dword [rsp + 0x3c]
lea rdx, [0x008a9148]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
lea r8, str.Web_Server_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
nop dword [rax]
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Enterprise_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Home_Premium_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Professional
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Home_Basic_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Ultimate_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Small_Business_Server
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Datacenter_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Standard_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Business_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Small_Business_Server_Premium_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Cluster_Server_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Enterprise_Edition__core_installation_
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Standard_Edition__core_installation_
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Datacenter_Edition__core_installation_
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
lea r8, str.Starter_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov r9d, dword [rsp + 0xc4]
jmp 0x501854
mov rcx, r13
lea r8, [0x008a8922]
mov edx, 0x2710
call sym.StringCatWorkerA
lea r8, [rsp + 0xd4]
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x50186c
cmp byte [rsp + 0x15a], 1
je 0x501de0
lea r8, str.Windows_Server_2008_R2
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x5019a5
lea r8, str.__64_bit
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x5018d0
lea r8, str.Windows_XP
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
test byte [rsp + 0x159], 2
je 0x501df9
lea r8, str.Home_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
cmp dword [rsp + 0xc4], 5
jne 0x50185e
mov eax, dword [rsp + 0xc8]
jmp 0x501909
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x501e5d
movzx eax, word [rsp + 0x158]
test ah, 0x20
jne 0x501e76
test ax, ax
js 0x501ee1
cmp byte [rsp + 0x15a], 1
jne 0x501d31
cmp word [rsp + 0x40], 9
je 0x501f90
lea r8, str.Windows_Server_2003_
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
cmp byte [rsp + 0x15a], 1
je 0x501da6
movzx edx, word [rsp + 0x40]
movzx eax, word [rsp + 0x158]
cmp dx, 6
je 0x501e8f
cmp dx, 9
je 0x501eb8
test ah, 0x40
jne 0x501efa
test al, 0x80
jne 0x501f13
test al, 2
jne 0x501fa9
test ah, 4
je 0x501f45
lea r8, str.Web_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
cmp dword [rsp + 0xc4], 5
jne 0x50185e
mov eax, dword [rsp + 0xc8]
jmp 0x501900
lea r8, str.Windows_Vista
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
mov eax, dword [rsp + 0xc8]
jmp 0x50199c
lea r8, str.Windows_7
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x5019a5
lea r8, str.Professional
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501cd4
lea r8, str.Server
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x50185e
lea r8, str.Datacenter_Server
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x50185e
lea r8, str.Professional
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x50185e
lea r8, str.Windows_Server_2003_R2_
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501d45
lea r8, str.Windows_Storage_Server_2003
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501d45
test al, 0x80
jne 0x501f2c
test al, 2
je 0x501da6
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501da6
test al, 0x80
jne 0x501f77
test al, 2
je 0x501f5e
lea r8, str.Enterprise_x64_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501da6
lea r8, str.Windows_Home_Server
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501d45
lea r8, str.Compute_Cluster_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501da6
lea r8, str.Datacenter_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501da6
lea r8, str.Datacenter_Edition_for_Itanium_based_Systems
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501da6
lea r8, str.Standard_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501da6
lea r8, str.Standard_x64_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501da6
lea r8, str.Datacenter_x64_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501da6
lea r8, str.Windows_XP_Professional_x64_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501d45
lea r8, str.Enterprise_Edition
mov edx, 0x2710
mov rcx, r13
call sym.StringCatWorkerA
jmp 0x501da6