Function at 0x42d280
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xb78
mov eax, dword [0x463858]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0xb28]
mov dword [ebp - 0xb34], eax
xor eax, eax
push 0x400
push str.OS_t____:
mov dword [ebp - method.TMTStrStatic_1024_.virtual_0], vtable.CMTStr.0
mov dword [ebp - 0xb30], 0
mov dword [ebp - 0xb2c], 0x400
mov word [ebp - 0xb28], ax
call fcn.00430e4f
mov edi, eax
mov eax, dword [ebp - 0xb2c]
add esp, 8
cmp edi, eax
jb 0x42d2fc
lea edi, [eax - 1]
lea esi, [edi + edi]
push esi
push str.OS_t____:
push dword [ebp - 0xb34]
call fcn.00434630
mov eax, dword [ebp - 0xb34]
xor ecx, ecx
mov dword [ebp - 0xb30], edi
mov word [esi + eax], cx
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0xb70]
push eax
mov dword [ebp - method.TMTStrStatic_1024_.virtual_0], vtable.TMTStrStatic_1024_.0
movdqa xmmword [ebp - 0xb70], xmm0
movdqa xmmword [ebp - 0xb60], xmm0
mov dword [ebp - 0xb50], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
jmp 0x42d360
movzx eax, word [ecx + 0x45b4b8]
mov word [ebp + ecx - 0x208], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x42d360
push 0x11c
lea eax, [ebp - 0x328]
push 0
push eax
call fcn.004368a0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
mov dword [ebp - 0x328], 0x11c
call esi
test eax, eax
jne 0x42d3d2
push 0x11c
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.004368a0
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
mov dword [ebp - 0x328], 0x114
call esi
mov eax, dword [ebp - 0x318]
cmp eax, 1
jne 0x42d50b
cmp dword [ebp - 0x324], 4
jne 0x42d4e0
mov eax, dword [ebp - 0x320]
test eax, eax
jne 0x42d441
lea ecx, [ebp - 0x208]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x42d401
mov eax, dword [str.Windows_95]
mov dword [ecx], eax
mov eax, dword [0x45bba0]
mov dword [ecx + 4], eax
mov eax, dword [0x45bba4]
mov dword [ecx + 8], eax
mov eax, dword [0x45bba8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x45bbac]
mov dword [ecx + 0x10], eax
mov eax, dword [0x45bbb0]
mov dword [ecx + 0x14], eax
jmp 0x42d73e
cmp eax, 0xa
jne 0x42d490
lea ecx, [ebp - 0x208]
add ecx, 0xfffffffe
nop
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x42d450
mov eax, dword [str.Windows_98]
mov dword [ecx], eax
mov eax, dword [0x45bbb8]
mov dword [ecx + 4], eax
mov eax, dword [0x45bbbc]
mov dword [ecx + 8], eax
mov eax, dword [0x45bbc0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x45bbc4]
mov dword [ecx + 0x10], eax
mov eax, dword [0x45bbc8]
mov dword [ecx + 0x14], eax
jmp 0x42d73e
cmp eax, 0x5a
jne 0x42d4e0
lea ecx, [ebp - 0x208]
add ecx, 0xfffffffe
mov edi, edi
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x42d4a0
mov eax, dword [str.Windows_ME]
mov dword [ecx], eax
mov eax, dword [0x45bbd0]
mov dword [ecx + 4], eax
mov eax, dword [0x45bbd4]
mov dword [ecx + 8], eax
mov eax, dword [0x45bbd8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x45bbdc]
mov dword [ecx + 0x10], eax
mov eax, dword [0x45bbe0]
mov dword [ecx + 0x14], eax
jmp 0x42d73e
lea edi, [ebp - 0x208]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d4f0
mov ecx, 0xa
mov esi, str.Unknown_Windows_OS
jmp 0x42d73c
cmp eax, 2
jne 0x42d71d
mov eax, dword [ebp - 0x324]
cmp eax, 4
jne 0x42d550
cmp dword [ebp - 0x320], 0
jne 0x42d6fc
lea edi, [ebp - 0x208]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d535
mov ecx, 8
mov esi, str.Windows_NT_4.0
jmp 0x42d73c
cmp eax, 5
jne 0x42d68f
mov eax, dword [ebp - 0x320]
test eax, eax
jne 0x42d58b
lea edi, [ebp - 0x208]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d570
mov ecx, 7
mov esi, str.Windows_2000
jmp 0x42d73c
cmp eax, 1
jne 0x42d5e0
lea ecx, [ebp - 0x208]
add ecx, 0xfffffffe
lea esp, [esp]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x42d5a0
mov eax, dword [str.Windows_XP]
mov dword [ecx], eax
mov eax, dword [0x45bc4c]
mov dword [ecx + 4], eax
mov eax, dword [0x45bc50]
mov dword [ecx + 8], eax
mov eax, dword [0x45bc54]
mov dword [ecx + 0xc], eax
mov eax, dword [0x45bc58]
mov dword [ecx + 0x10], eax
mov eax, dword [0x45bc5c]
mov dword [ecx + 0x14], eax
jmp 0x42d73e
cmp eax, 2
jne 0x42d6fc
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x42d61b
lea edi, [ebp - 0x208]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d600
mov ecx, 0xc
mov esi, str.Windows_Server_2003_R2
jmp 0x42d73c
cmp byte [ebp - 0x20e], 1
jne 0x42d65f
cmp word [ebp - 0xb70], 9
jne 0x42d65f
lea edi, [ebp - 0x208]
add edi, 0xfffffffe
jmp 0x42d640
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d640
mov ecx, 0x12
mov esi, str.Windows_XP_Professional_x64_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x42d73e
lea edi, [ebp - 0x208]
add edi, 0xfffffffe
jmp 0x42d670
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d670
mov ecx, 0xa
mov esi, str.Windows_Server_2003
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x42d73e
cmp eax, 6
jne 0x42d6fc
mov eax, dword [ebp - 0x320]
test eax, eax
jne 0x42d6cc
lea edi, [ebp - 0x208]
add edi, 0xfffffffe
jmp 0x42d6b0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d6b0
mov ecx, 7
mov esi, str.Windows_Vista
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x42d73e
cmp eax, 1
jne 0x42d6fc
lea edi, [ebp - 0x208]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d6e0
mov ecx, 7
mov esi, str.Windows_Seven
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x42d73e
lea edi, [ebp - 0x208]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d705
mov ecx, 9
mov esi, str.Unknown_WinNT_OS
jmp 0x42d73c
lea edi, [ebp - 0x208]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d726
mov ecx, 0xd
mov esi, str.Unknown_Operating_System
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x314]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x42d746
lea edi, [ebp - 0x208]
sub edx, esi
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x42d760
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0xb34]
test ecx, ecx
je 0x42d83e
lea esi, [ebp - 0x208]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x42d791
sub esi, edx
sar esi, 1
mov edx, dword [ebp - 0xb30]
je 0x42d7f0
lea eax, [esi + edx]
cmp eax, dword [ebp - 0xb2c]
jae 0x42d7f0
lea eax, [esi + esi]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ecx + edx*2]
push eax
call fcn.00434630
mov ecx, dword [ebp - 0xb30]
mov eax, dword [ebp - 0xb34]
add ecx, esi
add esp, 0xc
mov dword [ebp - 0xb30], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov edx, dword [ebp - 0xb30]
mov ecx, dword [ebp - 0xb34]
test ecx, ecx
je 0x42d83e
lea eax, [edx + 0xe]
cmp eax, dword [ebp - 0xb2c]
jae 0x42d83e
push 0x1c
lea eax, [ecx + edx*2]
push str._Win32_version
push eax
call fcn.00434630
mov eax, dword [ebp - 0xb34]
mov ecx, dword [ebp - 0xb30]
add esp, 0xc
xor edx, edx
mov word [eax + ecx*2 + 0x1c], dx
mov eax, dword [ebp - 0xb34]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f36b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042f36b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret