Function at 0x5afd10
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x906648]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push 0x505
push 0
push ebx
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
call sub.VCRUNTIME140.dll_memset
mov eax, dword [str.Win32]
add esp, 0xc
mov dword [ebx], eax
mov ax, word [0x72830c]
mov word [ebx + 4], ax
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x220], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x5afd93
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
push esi
push edi
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.0056d950
add esp, 0xc
test eax, eax
jne 0x5afe0f
mov edx, dword [ebp - 0x224]
cmp edx, 0x55f0
jb 0x5afdec
mov edi, 0xb
mov dword [ebp - 0x214], edx
xor esi, esi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], esi
jmp 0x5afe21
cmp edx, 0x2710
jbe 0x5afe0f
mov edi, 0xa
mov dword [ebp - 0x214], edx
xor esi, esi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], esi
jmp 0x5afe21
mov edx, dword [ebp - 0x214]
mov esi, dword [ebp - 0x218]
mov edi, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x210]
cmp eax, 2
jne 0x5b01d6
push 0x77
lea eax, [ebp - 0xfc]
mov dword [ebp - 0x104], 0x6e6b6e55
push 0
push eax
mov dword [ebp - 0x100], 0x6e776f
call sub.VCRUNTIME140.dll_memset
push 0x77
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x84], 0x6e6b6e55
push 0
push eax
mov dword [ebp - 0x80], 0x6e776f
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
cmp edi, 0xb
jne 0x5afe91
cmp byte [ebp - 0x106], 1
jne 0x5aff28
mov eax, str.Windows_11__d._d
jmp 0x5aff2d
cmp edi, 0xa
jne 0x5afead
cmp byte [ebp - 0x106], 1
jne 0x5aff28
mov eax, str.Windows_10__d._d
jmp 0x5aff2d
cmp edi, 6
jne 0x5aff02
cmp esi, 2
jne 0x5afecd
cmp byte [ebp - 0x106], 1
mov eax, str.Windows_8__d._d
mov ecx, str.Windows_Server_8__d._d
cmovne eax, ecx
jmp 0x5aff2d
cmp esi, 1
jne 0x5afee8
cmp byte [ebp - 0x106], 1
mov eax, str.Windows_7__d._d
mov ecx, str.Windows_2k8R2__d._d
cmovne eax, ecx
jmp 0x5aff2d
test esi, esi
jne 0x5aff28
cmp byte [ebp - 0x106], 1
mov eax, str.Windows_Vista__d._d
mov ecx, str.Windows_2k8__d._d
cmovne eax, ecx
jmp 0x5aff2d
cmp edi, 5
jne 0x5aff28
cmp esi, 2
jne 0x5aff13
mov eax, str.Windows_2k3__d._d
jmp 0x5aff2d
cmp esi, 1
jne 0x5aff1f
mov eax, str.Windows_XP__d._d
jmp 0x5aff2d
mov eax, str.Windows_2k__d._d
test esi, esi
je 0x5aff2d
mov eax, str.Unknown
push esi
push edi
push eax
lea eax, [ebx + 0x202]
push 0x101
push eax
call fcn.0063f929
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
lea eax, [ebx + 0x303]
push str.Build__d__s
push 0x101
push eax
call fcn.0063f929
movzx eax, word [ebp - 0x250]
add esp, 0x28
cmp eax, 0xffff
ja case.0x5aff88.4
je case.0x5aff88.4
cmp eax, 6
ja case.0x5aff88.4
jmp dword [eax*4 + 0x5b0424]
mov eax, dword [str.Intel]
mov dword [ebp - 0x104], eax
movzx eax, word [0x728400]
mov word [ebp - 0x100], ax
mov ax, word [ebp - 0x230]
cmp ax, 3
jne 0x5affcf
mov eax, dword [str.80386]
mov dword [ebp - 0x84], eax
mov ax, word [0x728408]
mov word [ebp - 0x80], ax
jmp 0x5b019c
cmp ax, 4
jne 0x5affef
mov eax, dword [str.80486]
mov dword [ebp - 0x84], eax
mov ax, word [0x728410]
mov word [ebp - 0x80], ax
jmp 0x5b019c
cmp ax, 5
jne 0x5b000b
mov dword [ebp - 0x84], 0x746e6550
mov dword [ebp - 0x80], 0x6d7569
jmp 0x5b019c
cmp ax, 6
jne 0x5b002e
movq xmm0, qword [str.Pentium_Pro]
mov eax, dword [0x72841c]
movq qword [ebp - 0x84], xmm0
mov dword [ebp - 0x7c], eax
jmp 0x5b019c
cmp ax, 7
jne 0x5b019c
mov ax, word [0x728428]
movq xmm0, qword [str.Pentium_II]
mov word [ebp - 0x7c], ax
mov al, byte [0x72842a]
movq qword [ebp - 0x84], xmm0
mov byte [ebp - 0x7a], al
jmp 0x5b019c
mov eax, dword [str.MIPS]
mov dword [ebp - 0x104], eax
mov al, byte [0x728430]
mov byte [ebp - 0x100], al
mov eax, dword [str.R4000]
mov dword [ebp - 0x84], eax
mov ax, word [0x728438]
mov word [ebp - 0x80], ax
jmp 0x5b019c
mov eax, dword [str.Alpha]
mov dword [ebp - 0x104], eax
mov ax, word [0x728440]
mov word [ebp - 0x100], ax
movzx eax, word [ebp - 0x230]
push eax
lea eax, [ebp - 0x84]
push 0x728444
push eax
call fcn.0063f881
add esp, 0xc
jmp 0x5b019c
mov ax, word [ebp - 0x230]
mov dword [ebp - 0x104], 0x435050
cmp ax, 1
jne 0x5b00ee
mov dword [ebp - 0x84], 0x313036
jmp 0x5b019c
cmp ax, 3
jne 0x5b0103
mov dword [ebp - 0x84], 0x333036
jmp 0x5b019c
cmp ax, 4
jne 0x5b0118
mov dword [ebp - 0x84], 0x343036
jmp 0x5b019c
cmp ax, 6
jne 0x5b0133
mov eax, dword [str.603]
mov dword [ebp - 0x84], eax
mov al, byte [0x72844c]
mov byte [ebp - 0x80], al
jmp 0x5b019c
cmp ax, 9
jne 0x5b014e
mov eax, dword [str.804]
mov dword [ebp - 0x84], eax
mov al, byte [0x728454]
mov byte [ebp - 0x80], al
jmp 0x5b019c
cmp ax, 0x14
jne 0x5b019c
mov dword [ebp - 0x84], 0x303236
jmp 0x5b019c
mov dword [ebp - 0x104], 0x6e617449
mov dword [ebp - 0x100], 0x6d7569
jmp 0x5b00a7
mov dword [ebp - 0x104], 0x4d5241
jmp 0x5b00a7
mov dword [ebp - 0x104], 0x6e6b6e55
mov dword [ebp - 0x100], 0x6e776f
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x728458
lea eax, [ebx + 0x404]
push 0x101
push eax
call fcn.0063f929
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x5b03b0
cmp edi, 4
jne 0x5b02b6
test esi, esi
jne 0x5b0240
cmp word [ebp - 0x20a], 0x43
lea ecx, [ebx + 0x202]
movq xmm0, qword [str.Windows_95]
movq qword [ecx], xmm0
mov ax, word [0x728468]
mov word [ecx + 8], ax
mov al, byte [0x72846a]
mov byte [ecx + 0xa], al
jne 0x5b02d0
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x5b0220
mov eax, dword [str._OSR2]
mov dword [ecx], eax
mov ax, word [0x728470]
mov word [ecx + 4], ax
jmp 0x5b02d0
cmp esi, 0xa
jne 0x5b0287
cmp word [ebp - 0x20a], 0x41
lea edi, [ebx + 0x202]
movq xmm0, qword [str.Windows_98]
movq qword [edi], xmm0
mov ax, word [0x72847c]
mov word [edi + 8], ax
mov al, byte [0x72847e]
mov byte [edi + 0xa], al
jne 0x5b02d0
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x5b0274
mov eax, dword [0x728480]
mov dword [edi], eax
jmp 0x5b02d0
cmp esi, 0x5a
jne 0x5b02b6
movq xmm0, qword [str.Windows_Me]
movq qword [ebx + 0x202], xmm0
mov ax, word [0x72848c]
mov word [ebx + 0x20a], ax
mov al, byte [0x72848e]
mov byte [ebx + 0x20c], al
jmp 0x5b02d0
mov ecx, 0x728304
mov esi, ebx
sub esi, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx + 0x201], al
test al, al
jne 0x5b02c0
movzx eax, dx
push eax
lea eax, [ebx + 0x303]
push 0x728444
push eax
call fcn.0063f881
mov eax, dword [ebp - 0x238]
lea edx, [ebx + 0x404]
add esp, 0xc
cmp eax, 0x182
jne 0x5b0322
movq xmm0, qword [str.Intel_80386]
pop edi
movq qword [edx], xmm0
mov eax, dword [0x728498]
pop esi
mov dword [edx + 8], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
cmp eax, 0x1e6
jne 0x5b0350
movq xmm0, qword [str.Intel_80486]
pop edi
movq qword [edx], xmm0
mov eax, dword [0x7284a4]
pop esi
mov dword [edx + 8], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
cmp eax, 0x24a
jne 0x5b0388
movq xmm0, qword [str.Intel_Pentium]
movq qword [edx], xmm0
mov eax, dword [0x7284b0]
mov dword [edx + 8], eax
mov ax, word [0x7284b4]
pop edi
pop esi
mov word [edx + 0xc], ax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
mov ecx, 0x728304
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x5b0390
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0063c972
mov esp, ebp
pop ebp
ret
mov ecx, 0x728304
mov edx, ebx
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx + 0x201], al
test al, al
jne 0x5b03c0
mov ecx, 0x728304
mov edx, ebx
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx + 0x302], al
test al, al
jne 0x5b03e0
mov ecx, 0x728304
sub ebx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ebx + ecx + 0x403], al
test al, al
jne 0x5b0400
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0063c972
mov esp, ebp
pop ebp
ret