Function at 0x4e2074
Capabilities:
Check os version

Disassembly:
push 0x610
mov eax, 0x55581f
call fcn.00513ea1
and dword [ebp - 0x604], 0
lea edi, [ebp - 0x314]
push 0x3e
pop ecx
mov esi, str.n9imoLa6BYUSEGHJR19JVVmuuomsY7a9sm5T6zm9w3V5aX8HZnGrjTVNVfvxvu4loSz3mo7xsCtiQLij7RWNwrhrVYAVradIIRUSf7AFCLiwTJ2Zc1CmGkDPHFXbHR9aQ3FdQQwc0N5tHQfwu7nA2QgahLKmzP10MZQxkr6WHK3NUwxEcBHDLTw4O1QkU1KxK3AGFQxuAUH6Ki14n4RvwpC2TILFOhMD1y0WOKPwyOu8fD2TiG1gWOhVhE
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x68
pop ecx
mov dword [ebp - 0x61c], ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.abX04WnbiKTHdDaszlSjqFvlVabnN7yElRgsFwprevvGlBmCEWmntDiZw6pFvH1BML9uaAwVcvE36zIVskWKMLJXTSx4WcUu1GQCVuzOM0apgVArBY4fr2OJdBBLDvoeY9FQoFdj9nCUnenP1qmtCl4i8LmnqV8Hmk6riU1sbZuTg210DdR4aUw7SgKc8TlgaYUTrH5KSGg7LYev86VF9zzGVmr5wdQdnisIbFdsxD3iEYtby9EOymnwfLk71eXqFNYRAZZiqR7XfTcQGnAvpkM4ygJ6ONdfdMQBK08KjvMTP895F3pCrVPnbDWp0WE3tn9Nc1YWQlSYCoMNir84jYrPKMu3vksyBXbiMaFiv8H7YgB0J2roha7PQ0OJj2cGKnwjRcj2Kx6KWc3yjJmyrCAqaLgmfW6T
lea edi, [ebp - 0x4b8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
mov dword [ebp - 0x618], esi
mov dword [ebp - 0x614], esi
mov dword [ebp - 0x610], esi
lea eax, [ebp - 0x314]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004057d0
lea eax, [ebp - 0x4d0]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x618]
call fcn.00408170
push esi
push 1
lea ecx, [ebp - 0x4d0]
mov byte [ebp - 4], 1
call fcn.004096c0
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.004057d0
lea eax, [ebp - 0x4d0]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x618]
call fcn.00408170
push esi
push 1
lea ecx, [ebp - 0x4d0]
mov byte [ebp - 4], 1
call fcn.004096c0
push 0x118
lea eax, [ebp - 0x5e8]
mov dword [ebp - 0x5ec], 0x11c
push esi
push eax
call fcn.004f0ae0
add esp, 0xc
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x656bb0
mov ecx, ebx
call fcn.004024f0
mov eax, dword [ebp - 0x5e8]
mov edi, dword [ebp - 0x5e0]
mov dword [ebp - 0x600], eax
movzx eax, byte [ebp - 0x4d2]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x5e4]
push str.ntdll.dll
mov dword [ebp - 0x604], 1
mov dword [ebp - 0x5f4], esi
mov dword [ebp - 0x5f8], esi
mov dword [ebp - 0x5f0], esi
mov dword [ebp - 0x5fc], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x608], eax
test eax, eax
je 0x4e221a
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4e220e
lea ecx, [ebp - 0x5f0]
push ecx
lea ecx, [ebp - 0x5f8]
push ecx
lea ecx, [ebp - 0x5f4]
push ecx
call eax
movzx eax, word [ebp - 0x5f0]
mov dword [ebp - 0x5f0], eax
push dword [ebp - 0x608]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x600]
cmp eax, 5
jne 0x4e2264
mov eax, dword [ebp - 0x5fc]
test eax, eax
je 0x4e2355
cmp eax, 1
jne 0x4e224e
push str.WindowsXP
call fcn.00500d29
pop ecx
push eax
push str.WindowsXP
jmp 0x4e234e
push str.WindowsServer2003
call fcn.00500d29
pop ecx
push eax
push str.WindowsServer2003
jmp 0x4e234e
cmp eax, 6
jne 0x4e2355
mov eax, dword [ebp - 0x5fc]
sub eax, esi
je 0x4e2321
sub eax, 1
je 0x4e230e
sub eax, 1
jne 0x4e2355
cmp edi, 0x1ebb
je 0x4e22a8
lea eax, [edi - 0x1ee6]
cmp eax, 0x25
jbe 0x4e22a8
cmp edi, 0x1f13
jne 0x4e22c4
mov esi, str.Windows8
push esi
call fcn.00500d29
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.00402650
xor esi, esi
jmp 0x4e2355
cmp dword [ebp - 0x5f4], 0xa
jne 0x4e22e9
cmp dword [ebp - 0x5f8], 0
jne 0x4e2355
push str.Windows10
call fcn.00500d29
pop ecx
push eax
push str.Windows10
jmp 0x4e234e
cmp dword [ebp - 0x5f4], 6
jne 0x4e2355
cmp dword [ebp - 0x5f8], 3
jne 0x4e2355
push str.Windows8.1
call fcn.00500d29
pop ecx
push eax
push str.Windows8.1
jmp 0x4e234e
push str.Windows7
call fcn.00500d29
pop ecx
push eax
push str.Windows7
jmp 0x4e234e
cmp dword [ebp - 0x60c], 1
jne 0x4e233d
push str.WindowsVista
call fcn.00500d29
pop ecx
push eax
push str.WindowsVista
jmp 0x4e234e
push str.WindowsServer2008
call fcn.00500d29
pop ecx
push eax
push str.WindowsServer2008
mov ecx, ebx
call fcn.00402650
push 0x656bb0
mov ecx, ebx
call fcn.0043a690
test eax, eax
jne 0x4e23c3
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.004f0ae0
mov eax, dword [ebp - 0x600]
push edi
push dword [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x218]
push str.Windows_d._d._d
push eax
call fcn.004081f0
add esp, 0x20
cmp word [ebp - 0x218], 0
jne 0x4e23a7
mov eax, esi
jmp 0x4e23b4
lea eax, [ebp - 0x218]
push eax
call fcn.00500d29
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.00402650
cmp dword [ebp + 0xc], 0
je 0x4e23f1
cmp word [ebp - 0x5d8], 0
je 0x4e23e2
lea eax, [ebp - 0x5d8]
push eax
call fcn.00500d29
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x5d8]
mov ecx, ebx
push eax
call fcn.00404240
lea ecx, [ebp - 0x618]
call fcn.0047920e
mov eax, ebx
call fcn.00513e4b
ret