Function at 0x4065d0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x98
xorps xmm0, xmm0
mov dword [ebp - 0x1cc], 0
lea eax, [ebp - 0x1c4]
mov esi, ecx
push 0
push eax
movups xmmword [ebp - 0x1ec], xmm0
movups xmmword [ebp - 0x1dc], xmm0
call fcn.004166e0
add esp, 0xc
mov dword [ebp - 0x1c8], 0x9c
lea eax, [ebp - 0x1c8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x406641
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x1b8], 2
jne 0x40696f
mov ebx, dword [ebp - 0x1c4]
cmp ebx, 4
jbe 0x40696f
push edi
mov edi, str.Microsoft
mov edx, 0x100
mov ecx, esi
sub edi, esi
nop word [eax + eax]
lea eax, [edx + 0x7ffffefe]
test eax, eax
je 0x406699
mov al, byte [edi + ecx]
test al, al
je 0x406699
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x406680
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
cmp ebx, 6
jne 0x406959
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x118
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004166e0
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.RtlGetVersion
push edi
call ebx
test eax, eax
je 0x406952
lea ecx, [ebp - 0x12c]
push ecx
call eax
push edi
test eax, eax
jne 0x406953
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x11c]
sub eax, 1
je 0x40688e
sub eax, 1
jne case.0x40673f.7
mov eax, dword [ebp - 0x128]
add eax, 0xfffffffd
cmp eax, 7
ja case.0x40673f.7
jmp dword [eax*4 + 0x406990]
push str.Windows_NT_3.51
jmp 0x4068b5
push str.Windows_NT_4.0
jmp 0x4068b5
mov eax, dword [ebp - 0x124]
test eax, eax
jne 0x40676e
push str.Windows_2000
jmp 0x4068b5
cmp eax, 1
jne 0x40678f
test byte [ebp - 0x14], 0x40
mov ecx, esi
je 0x406785
push str.Windows_XP_Embedded
jmp 0x4068b7
push str.Windows_XP
jmp 0x4068b7
cmp eax, 2
jne case.0x40673f.7
cmp byte [ebp - 0x12], 1
jne 0x4067b2
cmp word [ebp - 0x210], 9
jne 0x4067b2
push str.Windows_XP_Pro_x64_Edition
jmp 0x4068b5
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call edi
test eax, eax
jne 0x4067ca
push str.Windows_Server_2003
jmp 0x4068b5
push 0x59
call edi
test eax, eax
je case.0x40673f.7
push str.Windows_Server_2003_R2
jmp 0x4068b5
mov eax, dword [ebp - 0x124]
test eax, eax
jne 0x406806
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x4067fc
push str.Windows_Vista
jmp 0x4068b7
push str.Windows_Server_2008
jmp 0x4068b7
cmp eax, 1
jne 0x406826
mov ecx, esi
cmp byte [ebp - 0x12], al
jne 0x40681c
push str.Windows_7
jmp 0x4068b7
push str.Windows_Server_2008_R2
jmp 0x4068b7
cmp eax, 2
jne 0x406841
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x40683a
push str.Windows_8
jmp 0x4068b7
push str.Windows_Server_2012
jmp 0x4068b7
cmp eax, 3
jne case.0x40673f.7
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x406855
push str.Windows_8.1
jmp 0x4068b7
push str.Windows_Server_2012_R2
jmp 0x4068b7
cmp dword [ebp - 0x124], 0
jne case.0x40673f.7
cmp dword [ebp - 0x120], 0x55f0
jae 0x406887
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x406880
push str.Windows_10
jmp 0x4068b7
push str.Windows_2016
jmp 0x4068b7
push str.Windows_11
jmp 0x4068b5
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x4068b0
cmp eax, 0xa
je 0x4068a9
cmp eax, 0x5a
jne case.0x40673f.7
push str.Windows_Me
jmp 0x4068b5
push str.Windows_98
jmp 0x4068b5
push str.Windows_95
mov ecx, esi
call fcn.00406540
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
test eax, eax
je 0x4068f6
lea ecx, [ebp - 0x234]
push ecx
call eax
mov ax, word [ebp - 0x234]
cmp ax, 9
je 0x4068ef
cmp ax, 6
jne 0x4068f6
push str._64
jmp 0x4068fb
push str._32
mov ecx, esi
call fcn.00406540
push str._Build
mov ecx, esi
call fcn.00406540
push dword [ebp - 0x120]
lea eax, [ebp - 0x10]
push 0x43feb8
push eax
call fcn.00411020
add esp, 0xc
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00406540
push 0x43febc
mov ecx, esi
call fcn.00406540
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004137fd
mov esp, ebp
pop ebp
ret
push str.This_sample_does_not_support_this_version_of_Windows
mov ecx, esi
call fcn.00406540
mov ecx, dword [ebp - 4]
xor eax, eax
pop ebx
xor ecx, ebp
pop esi
call fcn.004137fd
mov esp, ebp
pop ebp
ret