Function at 0x40f290
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x41dddb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe0
mov al, byte [esp + 0x13]
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x14], al
call fcn.0040cc10
mov ecx, dword [0x401080]
push 0x4033f4
push ecx
mov dword [esp + 0x100], ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x24]
push edx
lea edx, [esp + 0x2c]
push ecx
push edx
call eax
mov eax, dword [esp + 0x28]
cmp eax, 6
jne 0x40f367
cmp dword [esp + 0x24], 3
jne 0x40f3d4
mov edi, 0x4048a4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4048a4
lea ecx, [esp + 0x18]
call fcn.0040cc60
mov esi, dword [esp + 0x100]
mov al, byte [esp + 0x10]
push ebp
mov ecx, esi
mov byte [esi], al
call fcn.0040cc10
mov ecx, dword [0x407740]
lea edx, [esp + 0x10]
push ecx
push ebp
push edx
mov ecx, esi
call fcn.0040c540
push 1
lea ecx, [esp + 0x14]
mov dword [esp + 0xfc], 0xffffffff
call fcn.0040cc10
jmp 0x40f8ac
cmp eax, 0xa
jne 0x40f3d4
cmp dword [esp + 0x24], ebp
jne 0x40f3d4
mov edi, 0x404898
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x404898
lea ecx, [esp + 0x18]
call fcn.0040cc60
mov esi, dword [esp + 0x100]
mov al, byte [esp + 0x10]
push ebp
mov ecx, esi
mov byte [esi], al
call fcn.0040cc10
mov ecx, dword [0x407740]
lea edx, [esp + 0x10]
push ecx
push ebp
push edx
mov ecx, esi
call fcn.0040c540
push 1
lea ecx, [esp + 0x14]
mov dword [esp + 0xfc], 0xffffffff
call fcn.0040cc10
jmp 0x40f8ac
lea eax, [esp + 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], 0x9c
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov ebx, 1
je 0x40f7c0
mov eax, dword [esp + 0x34]
sub eax, 4
je 0x40f717
dec eax
je 0x40f5ba
dec eax
je 0x40f442
mov edi, 0x404890
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
jmp 0x40f7e0
mov eax, dword [esp + 0x38]
sub eax, ebp
je 0x40f544
dec eax
je 0x40f4ce
dec eax
jne 0x40f803
cmp byte [esp + 0xca], bl
jne 0x40f49e
mov edi, 0x404884
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov eax, ecx
mov esi, 0x404884
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x40f7f4
mov edi, 0x404870
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov ecx, ebp
mov esi, 0x404870
jmp 0x40f7e7
cmp byte [esp + 0xca], bl
jne 0x40f514
mov edi, 0x404864
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov eax, ecx
mov esi, 0x404864
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x40f7f4
mov edi, 0x40484c
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov ecx, ebp
mov esi, 0x40484c
jmp 0x40f7e7
cmp byte [esp + 0xca], bl
jne 0x40f58a
mov edi, 0x40483c
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov eax, ecx
mov esi, 0x40483c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x40f7f4
mov edi, 0x404828
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov ecx, ebp
mov esi, 0x404828
jmp 0x40f7e7
mov eax, dword [esp + 0x38]
sub eax, ebp
je 0x40f6da
dec eax
je 0x40f6aa
dec eax
jne 0x40f803
cmp byte [esp + 0xca], bl
jne 0x40f625
cmp word [esp + 0xcc], 9
jne 0x40f625
mov edi, 0x404804
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov eax, ecx
mov esi, 0x404804
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x40f7f4
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x40f661
mov edi, 0x4047f0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov ecx, ebp
mov esi, 0x4047f0
jmp 0x40f7e7
push 0x59
call esi
test eax, eax
je 0x40f803
mov edi, 0x4047d8
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov eax, ecx
mov esi, 0x4047d8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x40f7f4
mov edi, 0x4047cc
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov ecx, ebp
mov esi, 0x4047cc
jmp 0x40f7e7
mov edi, 0x4047bc
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov eax, ecx
mov esi, 0x4047bc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x40f7f4
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x40f773
cmp eax, 0xa
je 0x40f750
cmp eax, 0x5a
jne 0x40f803
mov edi, 0x4047b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4047b0
lea ecx, [esp + 0x18]
call fcn.0040cc60
jmp 0x40f803
mov edi, 0x4047a4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4047a4
lea ecx, [esp + 0x18]
call fcn.0040cc60
jmp 0x40f803
mov eax, dword [esp + 0x40]
cmp eax, 2
jne 0x40f79c
mov edi, 0x404788
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x404788
lea ecx, [esp + 0x18]
call fcn.0040cc60
jmp 0x40f803
cmp eax, ebx
jne 0x40f803
mov edi, 0x40477c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x40477c
lea ecx, [esp + 0x18]
call fcn.0040cc60
jmp 0x40f803
mov edi, 0x404890
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
call fcn.0040cd20
test al, al
je 0x40f803
mov ecx, ebp
mov esi, 0x404890
mov edi, dword [esp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.0040cd00
mov edi, 0x404890
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
push ecx
push 0x404890
push eax
push 0
lea ecx, [esp + 0x20]
call fcn.0040cb20
mov esi, dword [esp + 0x100]
mov cl, byte [esp + 0x10]
test eax, eax
mov byte [esi], cl
push 0
mov ecx, esi
jne 0x40f86e
call fcn.0040cc10
mov edx, dword [0x407740]
lea eax, [esp + 0x10]
push edx
push 0
push eax
mov ecx, esi
call fcn.0040c540
push ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0xfc], 0xffffffff
call fcn.0040cc10
jmp 0x40f8ac
call fcn.0040cc10
mov edx, dword [0x407740]
lea eax, [esp + 0x10]
push edx
push 0
push eax
mov ecx, esi
call fcn.0040c540
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x40f8ac
mov al, byte [ecx - 1]
test al, al
je 0x40f8a2
cmp al, 0xff
je 0x40f8a2
dec al
mov byte [ecx - 1], al
jmp 0x40f8ac
dec ecx
push ecx
call fcn.00412d82
add esp, 4
mov ecx, dword [esp + 0xf0]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xec
ret