Function at 0x42e804
Capabilities:
Get system information on windows

Disassembly:
push 0x194
mov eax, 0x4c8fc2
call fcn.0043c4f3
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x17c]
push eax
mov dword [ebp - 0x17c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x42e845
push 0x4e8e02
mov ecx, edi
call fcn.00405c80
jmp 0x42eb61
cmp dword [ebp - 0x17c], 0
lea eax, [ebp - 0x1a0]
push eax
je 0x42e85d
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
jmp 0x42e863
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x4e8e02
lea ecx, [ebp - 0x28]
call fcn.00405c80
xor ebx, ebx
push str.ntdll.dll
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42eb51
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42eb51
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x174], 0x11c
push ecx
call eax
test eax, eax
jne 0x42eb51
mov eax, dword [ebp - 0x170]
push 1
pop ecx
push 9
pop edx
sub eax, 4
je 0x42e9f5
sub eax, ecx
je 0x42e981
sub eax, ecx
je 0x42e91a
sub eax, 4
je 0x42e8f3
push 0x4d3f48
call fcn.00472ad0
pop ecx
push eax
push 0x4d3f48
jmp 0x42ea41
cmp dword [ebp - 0x16c], ebx
jne 0x42e910
mov esi, str.Microsoft_Windows_10
mov eax, str.Microsoft_Windows_Server_2016
cmp byte [ebp - 0x5a], cl
cmovne esi, eax
jmp 0x42ea38
mov esi, 0x4d3f48
jmp 0x42ea38
mov eax, dword [ebp - 0x16c]
sub eax, ebx
je 0x42e968
sub eax, 1
je 0x42e95c
sub eax, 1
je 0x42e950
sub eax, 1
jne 0x42ea49
cmp byte [ebp - 0x5a], cl
jne 0x42e946
mov esi, str.Microsoft_Windows_8.1
jmp 0x42ea38
mov esi, str.Microsoft_Windows_Server_2012_R2
jmp 0x42ea38
mov esi, str.Microsoft_Windows_8
mov eax, str.Microsoft_Windows_Server_2012
jmp 0x42e905
mov esi, str.Microsoft_Windows_7
mov eax, str.Microsoft_Windows_Server_2008_R2
jmp 0x42e905
cmp byte [ebp - 0x5a], cl
jne 0x42e977
mov esi, str.Microsoft_Windows_Vista
jmp 0x42ea38
mov esi, str.Microsoft_Windows_Server_2008
jmp 0x42ea38
mov eax, dword [ebp - 0x16c]
sub eax, ebx
je 0x42e9ee
sub eax, 1
je 0x42e9e7
sub eax, 1
jne 0x42e8dd
cmp byte [ebp - 0x5a], cl
jne 0x42e9b1
cmp word [ebp - 0x1a0], dx
jne 0x42e9b1
mov esi, str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x42ea38
mov eax, 0x8000
cmp word [ebp - 0x5c], ax
jne 0x42e9c3
mov esi, str.Microsoft_Windows_Home_Server
jmp 0x42ea38
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x42e9d8
mov esi, str.Microsoft_Windows_Server_2003
jmp 0x42ea38
push 0x59
call esi
test eax, eax
je 0x42ea49
mov esi, str.Microsoft_Windows_Server_2003_R2
jmp 0x42ea38
mov esi, str.Microsoft_Windows_XP
jmp 0x42ea38
mov esi, str.Microsoft_Windows_2000
jmp 0x42ea38
mov eax, dword [ebp - 0x16c]
test eax, eax
je 0x42ea1b
cmp eax, 0xa
je 0x42ea14
cmp eax, 0x5a
jne 0x42e8dd
mov esi, str.Microsoft_Windows_Me
jmp 0x42ea38
mov esi, str.Microsoft_Windows_98
jmp 0x42ea38
cmp dword [ebp - 0x164], 2
jne 0x42ea2b
mov esi, str.Microsoft_Windows_NT_4.0
jmp 0x42ea38
cmp dword [ebp - 0x164], ecx
jne 0x42ea49
mov esi, str.Microsoft_Windows_95
push esi
call fcn.00472ad0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00406f50
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x4d3f48
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0048d8e0
pop ecx
pop ecx
test eax, eax
je 0x42eb3c
cmp dword [ebp - 0x168], ebx
je 0x42eb0b
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x178]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00412fb6
push dword [ebp - 0x168]
lea eax, [ebp - 0x178]
mov byte [ebp - 4], 1
push dword [ebp - 0x178]
push str._s._u
push eax
call fcn.00413459
add esp, 0x10
lea ecx, [ebp - 0x40]
push dword [ebp - 0x178]
call fcn.00404ed0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00412e32
mov esi, eax
lea eax, [ebp - 0x28]
pop ecx
pop ecx
cmp eax, esi
je 0x42eaea
mov ecx, eax
call fcn.00405ac0
push esi
lea ecx, [ebp - 0x28]
call fcn.00404d20
lea ecx, [ebp - 0x58]
call fcn.00405ac0
lea ecx, [ebp - 0x40]
call fcn.00406610
mov ecx, dword [ebp - 0x178]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.004136c2
push 9
pop eax
cmp word [ebp - 0x1a0], ax
je 0x42eb26
cmp word [ebp - 0x1a0], 6
mov esi, 0x4d4144
jne 0x42eb2b
mov esi, 0x4d4140
push esi
call fcn.00472ad0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00404ba0
lea eax, [ebp - 0x28]
mov dword [edi], ebx
push eax
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.00404d20
jmp 0x42eb59
push ebx
mov ecx, edi
call fcn.00405c80
lea ecx, [ebp - 0x28]
call fcn.00405ac0
mov eax, edi
call fcn.0043c4a2
ret