Function at 0x4067b4
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x4386b4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x432bec
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x12c]
push ecx
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x128]
push ecx
call eax
xor edi, edi
cmp dword [ebp - 0x128], 6
jne 0x406816
cmp dword [ebp - 0x124], 3
jne 0x406833
mov dword [esi + 0xc], str.Microsoft_Windows_8.1
jmp 0x4069e5
cmp dword [ebp - 0x128], 0xa
jne 0x406833
cmp dword [ebp - 0x124], edi
jne 0x406833
mov dword [esi + 0xc], str.Microsoft_Windows_10
jmp 0x4069e5
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
mov dword [esi + 0xc], str.unknown_OperatingSystem.
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4069e5
mov eax, dword [ebp - 0x11c]
sub eax, 4
je 0x406997
dec eax
je 0x40692d
dec eax
je 0x4068a6
sub eax, 4
jne 0x4069e5
cmp dword [ebp - 0x118], edi
jne 0x4069e5
cmp byte [ebp - 6], 1
je 0x406827
mov dword [esi + 0xc], str.Microsoft_Windows_Server_2016_Technical_Preview
jmp 0x4069e5
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x40690f
dec eax
je 0x4068f1
dec eax
je 0x4068d3
dec eax
jne 0x4069e5
cmp byte [ebp - 6], 1
je 0x40680a
mov dword [esi + 0xc], str.Microsoft_Windows_Server_2012_R2
jmp 0x4069e5
cmp byte [ebp - 6], 1
jne 0x4068e5
mov dword [esi + 0xc], str.Microsoft_Windows_8
jmp 0x4069e5
mov dword [esi + 0xc], str.Microsoft_Windows_Server_2012
jmp 0x4069e5
cmp byte [ebp - 6], 1
jne 0x406903
mov dword [esi + 0xc], str.Microsoft_Windows_7
jmp 0x4069e5
mov dword [esi + 0xc], str.Microsoft_Windows_Server_2008_R2
jmp 0x4069e5
cmp byte [ebp - 6], 1
jne 0x406921
mov dword [esi + 0xc], str.Microsoft_Windows_Vista
jmp 0x4069e5
mov dword [esi + 0xc], str.Microsoft_Windows_Server_2008
jmp 0x4069e5
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x40698e
dec eax
je 0x406985
dec eax
jne 0x4069e5
cmp byte [ebp - 6], 1
jne 0x40695d
cmp word [ebp - 0x150], 9
jne 0x40695d
mov dword [esi + 0xc], str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x4069e5
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call edi
test eax, eax
jne 0x406974
mov dword [esi + 0xc], str.Microsoft_Windows_Server_2003
jmp 0x4069e5
push 0x59
call edi
test eax, eax
je 0x4069e5
mov dword [esi + 0xc], str.Microsoft_Windows_Server_2003_R2
jmp 0x4069e5
mov dword [esi + 0xc], str.Microsoft_Windows_XP
jmp 0x4069e5
mov dword [esi + 0xc], str.Microsoft_Windows_2000
jmp 0x4069e5
cmp dword [ebp - 0x118], edi
je 0x4069c3
cmp dword [ebp - 0x118], 0xa
je 0x4069ba
cmp dword [ebp - 0x118], 0x5a
jne 0x4069e5
mov dword [esi + 0xc], str.Microsoft_Windows_Me
jmp 0x4069e5
mov dword [esi + 0xc], str.Microsoft_Windows_98
jmp 0x4069e5
cmp dword [ebp - 0x110], 2
jne 0x4069d5
mov dword [esi + 0xc], str.Microsoft_Windows_NT_4.0
jmp 0x4069e5
cmp dword [ebp - 0x110], 1
jne 0x4069e5
mov dword [esi + 0xc], str.Microsoft_Windows_95
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00411f09
leave
ret