Function at 0x448f60
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e538
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x621810]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x188]
mov edi, ecx
xor ebx, ebx
push eax
mov dword [ebp - 0x158], edi
mov dword [ebp - 0x164], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x150]
push ecx
mov dword [ebp - 0x150], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x448ff3
xor edx, edx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
push 0x5fe734
mov word [edi], dx
call fcn.0048c5ca
add esp, 4
mov ecx, 0x5fe734
mov esi, edi
call fcn.00401834
jmp 0x449401
mov eax, dword [ebp - 0x14c]
cmp eax, 6
ja 0x449017
mov ecx, dword [ebp - 0x148]
mov edx, 1
jne 0x44916d
cmp ecx, edx
jbe 0x44916d
call fcn.00447f80
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
lea ebx, [ebp - 0x15c]
lea esi, [ebp - 0x160]
lea edi, [ebp - 0x164]
mov byte [ebp - 0x151], al
call fcn.00447ec0
test al, al
je 0x44915a
mov eax, dword [ebp - 0x164]
cmp eax, 6
je 0x4490bb
cmp eax, 0xa
jne 0x44915a
cmp dword [ebp - 0x160], 0
jne 0x44915a
cmp byte [ebp - 0x151], 0
mov esi, dword [ebp - 0x158]
jne 0x44909f
mov eax, dword [ebp - 0x15c]
push eax
push str.Microsoft_Windows_10_SP_d
push esi
call fcn.00445760
add esp, 0xc
mov eax, esi
jmp 0x449403
mov ecx, dword [ebp - 0x15c]
push ecx
push str.Microsoft_Windows_Server_Technical_Preview_SP_d
push esi
call fcn.00445760
add esp, 0xc
mov eax, esi
jmp 0x449403
mov eax, dword [ebp - 0x160]
sub eax, 2
je 0x449113
dec eax
jne 0x44915a
mov esi, dword [ebp - 0x158]
cmp byte [ebp - 0x151], al
jne 0x4490f7
mov edx, dword [ebp - 0x15c]
push edx
push str.Microsoft_Windows_8.1_SP_d
push esi
call fcn.00445760
add esp, 0xc
mov eax, esi
jmp 0x449403
mov eax, dword [ebp - 0x15c]
push eax
push str.Microsoft_Windows_Server_2012_R2_SP_d
push esi
call fcn.00445760
add esp, 0xc
mov eax, esi
jmp 0x449403
cmp byte [ebp - 0x151], 0
mov esi, dword [ebp - 0x158]
jne 0x44913e
mov ecx, dword [ebp - 0x15c]
push ecx
push str.Microsoft_Windows_8_SP_d
push esi
call fcn.00445760
add esp, 0xc
mov eax, esi
jmp 0x449403
mov edx, dword [ebp - 0x15c]
push edx
push str.Microsoft_Windows_Server_2012_SP_d
push esi
call fcn.00445760
add esp, 0xc
mov eax, esi
jmp 0x449403
mov edi, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x148]
mov edx, 1
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14c]
sub eax, 4
je 0x449310
sub eax, edx
je 0x449273
sub eax, edx
je 0x4491af
push 0x60a5bc
call fcn.0048c5ca
mov ecx, 0x60a5bc
jmp 0x44936f
cmp ecx, 3
ja case.default.0x4491b8
jmp dword [ecx*4 + 0x449420]
cmp byte [ebp - 0x36], dl
jne 0x4491d8
push str.Microsoft_Windows_Vista
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_Vista
jmp 0x44936f
push str.Microsoft_Windows_Server_2008
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_Server_2008
jmp 0x44936f
cmp byte [ebp - 0x36], dl
jne 0x449205
push str.Microsoft_Windows_7
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_7
jmp 0x44936f
push str.Microsoft_Windows_Server_2008_R2
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_Server_2008_R2
jmp 0x44936f
cmp byte [ebp - 0x36], dl
jne 0x449232
push str.Microsoft_Windows_8
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_8
jmp 0x44936f
push str.Microsoft_Windows_Server_2012
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_Server_2012
jmp 0x44936f
cmp byte [ebp - 0x36], dl
jne 0x44925f
push str.Microsoft_Windows_8.1
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_8.1
jmp 0x44936f
push str.Microsoft_Windows_Server_2012_R2
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_Server_2012_R2
jmp 0x44936f
mov eax, ecx
sub eax, ebx
je 0x4492ff
sub eax, edx
je 0x4492ee
sub eax, edx
jne case.default.0x4491b8
cmp byte [ebp - 0x36], dl
jne 0x4492ac
cmp word [ebp - 0x188], 9
jne 0x4492ac
push str.Microsoft_Windows_XP_Professional_x64_Edition
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x44936f
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x4492ce
push str.Microsoft_Windows_Server_2003
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_Server_2003
jmp 0x44936f
push 0x59
call esi
test eax, eax
je case.default.0x4491b8
push str.Microsoft_Windows_Server_2003_R2
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_Server_2003_R2
jmp 0x44936f
push str.Microsoft_Windows_XP
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_XP
jmp 0x44936f
push str.Microsoft_Windows_2000
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_2000
jmp 0x44936f
cmp ecx, ebx
je 0x449340
cmp ecx, 0xa
je 0x44932f
cmp ecx, 0x5a
jne case.default.0x4491b8
push str.Microsoft_Windows_Me
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_Me
jmp 0x44936f
push str.Microsoft_Windows_98
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_98
jmp 0x44936f
mov eax, dword [ebp - 0x140]
cmp eax, 2
jne 0x44935c
push str.Microsoft_Windows_NT_4.0
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_NT_4.0
jmp 0x44936f
cmp eax, edx
jne case.default.0x4491b8
push str.Microsoft_Windows_95
call fcn.0048c5ca
mov ecx, str.Microsoft_Windows_95
add esp, 4
lea esi, [ebp - 0x2c]
call fcn.00401834
xor ecx, ecx
lea edx, [ebp - 0x2c]
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], cx
cmp edi, edx
je 0x4493ef
mov esi, 8
cmp dword [edi + 0x14], esi
jb 0x4493a5
mov eax, dword [edi]
push eax
call fcn.0048bcc1
add esp, 4
xor ecx, ecx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], cx
cmp dword [ebp - 0x18], esi
jae 0x4493dc
mov edx, dword [ebp - 0x1c]
lea eax, [edx + edx + 2]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push edi
call fcn.0048bf90
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
add esp, 0xc
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
jmp 0x449401
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [edi], edx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
jmp 0x449401
cmp dword [ebp - 0x18], 8
jb 0x449401
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0048bcc1
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b951
mov esp, ebp
pop ebp
ret