Function at 0x4057a8
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x120
mov eax, dword [0x4243b0]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push esi
push edi
push 9
mov dword [ebp - 0x80], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
mov edi, 0x9c
push edi
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040e530
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x7c], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
test eax, eax
je 0x40581c
lea ecx, [ebp - 0xac]
push ecx
call eax
jmp 0x405829
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x6c], 2
jne 0x405b78
cmp dword [ebp - 0x78], 4
jbe 0x405b78
mov eax, dword [ebp - 0x80]
mov edx, str.Microsoft
push ebx
mov ebx, 0x100
sub edx, eax
lea ecx, [ebx + 0x7ffffefe]
test ecx, ecx
je 0x405864
mov cl, byte [edx + eax]
test cl, cl
je 0x405864
mov byte [eax], cl
inc eax
dec ebx
jne 0x40584d
test ebx, ebx
jne 0x405869
dec eax
cmp dword [ebp - 0x78], 6
mov byte [eax], 0
jne case.0x4058ef.5
cmp dword [ebp - 0x74], 0
jne 0x405896
cmp byte [ebp + 0x1e], 1
mov ebx, dword [ebp - 0x80]
jne 0x40588c
push str.Windows_Vista
jmp 0x405891
push str.Windows_Server_2008
call fcn.004056a0
cmp dword [ebp - 0x74], 1
jne 0x4058b6
cmp byte [ebp + 0x1e], 1
mov ebx, dword [ebp - 0x80]
jne 0x4058ac
push str.Windows_7
jmp 0x4058b1
push str.Windows_Server_2008_R2
call fcn.004056a0
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call esi
lea ecx, [ebp - 0x84]
push ecx
push 0
push 0
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call eax
mov eax, dword [ebp - 0x84]
cmp eax, 0xa
ja 0x405934
je case.0x4058ef.4
dec eax
cmp eax, 8
ja case.0x4058ef.5
jmp dword [eax*4 + 0x405b98]
push str.Ultimate_Edition
jmp 0x40598c
push str.Home_Premium_Edition
jmp 0x40598c
push str.Home_Basic_Edition
jmp 0x40598c
push str.Enterprise_Edition
jmp 0x40598c
push str.Business_Edition
jmp 0x40598c
push str.Datacenter_Edition
jmp 0x40598c
push str.Small_Business_Server
jmp 0x40598c
push str.Standard_Edition
jmp 0x40598c
cmp eax, 0xf
ja 0x40596c
je 0x405965
sub eax, 0xb
je 0x40595e
dec eax
je 0x405957
dec eax
je 0x405950
dec eax
jne case.0x4058ef.5
push str.Enterprise_Edition__core_installation_
jmp 0x40598c
push str.Standard_Edition__core_installation_
jmp 0x40598c
push str.Datacenter_Edition__core_installation_
jmp 0x40598c
push str.Starter_Edition
jmp 0x40598c
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x40598c
sub eax, 0x11
je 0x405987
dec eax
je 0x405980
sub eax, 7
jne case.0x4058ef.5
push str.Small_Business_Server_Premium_Edition
jmp 0x40598c
push str.Cluster_Server_Edition
jmp 0x40598c
push str.Web_Server_Edition
mov ebx, dword [ebp - 0x80]
call fcn.004056a0
cmp dword [ebp - 0x78], 5
jne 0x405b00
cmp dword [ebp - 0x74], 2
jne 0x405a8f
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4059bb
push str.Windows_Server_2003_R2_
jmp 0x4059e7
test dword [ebp + 0x1c], 0x2000
je 0x4059cb
push str.Windows_Storage_Server_2003
jmp 0x4059e7
cmp byte [ebp + 0x1e], 1
jne 0x4059e2
cmp word [ebp - 0xac], 9
jne 0x4059e2
push str.Windows_XP_Professional_x64_Edition
jmp 0x4059e7
push str.Windows_Server_2003_
mov ebx, dword [ebp - 0x80]
call fcn.004056a0
cmp byte [ebp + 0x1e], 1
je 0x405a87
cmp word [ebp - 0xac], 6
jne 0x405a1d
test byte [ebp + 0x1c], 0x80
je 0x405a10
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x405a82
test byte [ebp + 0x1c], 2
je 0x405a87
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x405a82
cmp word [ebp - 0xac], 9
jne 0x405a48
test byte [ebp + 0x1c], 0x80
je 0x405a34
push str.Datacenter_x64_Edition
jmp 0x405a82
test byte [ebp + 0x1c], 2
je 0x405a41
push str.Enterprise_x64_Edition
jmp 0x405a82
push str.Standard_x64_Edition
jmp 0x405a82
mov eax, dword [ebp + 0x1c]
test eax, 0x4000
je 0x405a59
push str.Compute_Cluster_Edition
jmp 0x405a82
test al, al
jns 0x405a64
push str.Datacenter_Edition
jmp 0x405a82
test al, 2
je 0x405a6f
push str.Enterprise_Edition
jmp 0x405a82
test eax, 0x400
je 0x405a7d
push str.Web_Edition
jmp 0x405a82
push str.Standard_Edition
call fcn.004056a0
cmp dword [ebp - 0x78], 5
jne 0x405b00
jmp 0x405a92
mov ebx, dword [ebp - 0x80]
cmp dword [ebp - 0x74], 1
mov esi, str.Professional
jne 0x405ac3
push str.Windows_XP
call fcn.004056a0
test dword [ebp + 0x1c], 0x200
je 0x405ab7
push str.Home_Edition
jmp 0x405ab8
push esi
call fcn.004056a0
cmp dword [ebp - 0x78], 5
jne 0x405b00
cmp dword [ebp - 0x74], 0
jne 0x405b00
push str.Windows_2000
call fcn.004056a0
cmp byte [ebp + 0x1e], 1
jne 0x405adc
push esi
jmp 0x405afb
test byte [ebp + 0x1c], 0x80
je 0x405ae9
push str.Datacenter_Server
jmp 0x405afb
test byte [ebp + 0x1c], 2
je 0x405af6
push str.Advanced_Server
jmp 0x405afb
push str.Server
call fcn.004056a0
lea eax, [ebp - 0x68]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405b06
sub eax, edx
je 0x405b27
mov ebx, dword [ebp - 0x80]
push 0x42113c
call fcn.004056a0
lea eax, [ebp - 0x68]
push eax
call fcn.004056a0
push dword [ebp - 0x70]
lea edi, [ebp + 0x20]
push str.__build__d_
push 0x50
pop ecx
call fcn.004056d6
mov ebx, dword [ebp - 0x80]
pop ecx
pop ecx
mov eax, edi
push eax
call fcn.004056a0
cmp dword [ebp - 0x78], 6
jb 0x405b72
cmp word [ebp - 0xac], 9
jne 0x405b5e
push str.__64_bit
jmp 0x405b6d
cmp word [ebp - 0xac], 0
jne 0x405b72
push str.__32_bit
call fcn.004056a0
xor eax, eax
inc eax
pop ebx
jmp 0x405b85
push str.This_sample_does_not_support_this_version_of_Windows._n
call fcn.0040acef
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x70]
pop edi
xor ecx, ebp
pop esi
call fcn.0040904e
add ebp, 0x74
leave
ret