Function at 0x444000
Capabilities:
Check os version

Disassembly:
push 0x138
mov eax, 0x4765f5
call fcn.00472eab
mov ebx, ecx
and dword [ebp - 0x13c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x140], 0xe
cmp eax, 1
je 0x444089
cmp eax, 2
je 0x444089
cmp eax, 3
je 0x444089
cmp eax, 4
je 0x444089
cmp eax, 5
je 0x444089
mov eax, dword [ebx + 0x2c]
mov edi, 0x80070057
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d838]
lea ecx, [ebx + 0x2c]
call esi
test eax, eax
je 0x44436c
push 0x713
mov eax, dword [ebx + 0x2c]
push 0x411624
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d838]
lea ecx, [ebx + 0x2c]
call esi
mov edx, edi
mov ecx, eax
call fcn.0044829d
jmp 0x44436c
mov eax, dword [ebx]
lea ecx, [ebp - 0x144]
push ecx
mov esi, dword [eax + 0x5c]
mov ecx, esi
call dword [0x47d838]
mov ecx, ebx
call esi
mov edi, eax
mov dword [ebp - 0x130], edi
test edi, edi
jns 0x4440cf
mov ecx, dword [ebx + 0x2c]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x47d838]
lea ecx, [ebx + 0x2c]
call esi
test eax, eax
je 0x44436c
push 0x717
jmp 0x444063
push 0x118
lea eax, [ebp - 0x128]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
jne 0x444153
and dword [ebp - 0x130], eax
mov esi, dword [ebp + 8]
mov eax, esi
push 0x20
pop ecx
push 2
pop edx
mov dword [ebp - 0x134], edx
push 5
pop edi
mov dword [ebp - 0x138], edi
sub eax, edx
je 0x4441c4
sub eax, 1
je 0x4441bd
sub eax, 1
je 0x4441a7
sub eax, 1
jne 0x4441da
mov ecx, 0x8000
mov dword [ebp - 0x134], 3
jmp 0x4441da
lea edx, [ebp - 0x130]
mov ecx, eax
call fcn.00427484
test eax, eax
jne 0x444106
mov eax, dword [ebx + 0x2c]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d838]
lea ecx, [ebx + 0x2c]
call esi
test eax, eax
je 0x444313
push 0x71d
mov eax, dword [ebx + 0x2c]
push 0x411624
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d838]
lea ecx, [ebx + 0x2c]
call esi
mov edi, dword [ebp - 0x130]
jmp 0x44407b
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x138], 3
jmp 0x4441d5
mov ecx, 0x80
jmp 0x444144
and dword [ebp - 0x134], 0
mov dword [ebp - 0x138], 1
mov ecx, 0x4000
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
jne 0x444220
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov edi, eax
mov eax, dword [ebx + 0x2c]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d838]
lea ecx, [ebx + 0x2c]
call esi
test eax, eax
je 0x44436c
push 0x74b
jmp 0x444063
cmp dword [ebp - 0x128], 6
jb 0x44431b
cmp esi, 3
je 0x444236
cmp esi, edi
jne 0x44427b
push 1
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x13c]
call fcn.00424bc3
mov edi, eax
mov dword [ebp - 0x130], edi
test edi, edi
jns 0x44427b
mov eax, dword [ebx + 0x2c]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d838]
lea ecx, [ebx + 0x2c]
call esi
test eax, eax
je 0x44436c
push 0x756
jmp 0x444063
push 4
lea eax, [ebp - 0x134]
push eax
push 0x21
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
test eax, eax
jne 0x4442e1
and dword [ebp - 0x130], eax
push 4
lea eax, [ebp - 0x138]
push eax
push 0x27
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
test eax, eax
je 0x44431b
lea edx, [ebp - 0x130]
mov ecx, eax
call fcn.00427484
test eax, eax
jne 0x44431b
mov eax, dword [ebx + 0x2c]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d838]
lea ecx, [ebx + 0x2c]
call esi
test eax, eax
je 0x444313
push 0x765
jmp 0x444184
lea edx, [ebp - 0x130]
mov ecx, eax
call fcn.00427484
test eax, eax
jne 0x444298
mov eax, dword [ebx + 0x2c]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d838]
lea ecx, [ebx + 0x2c]
call esi
test eax, eax
je 0x444313
push 0x75e
jmp 0x444184
mov edi, dword [ebp - 0x130]
jmp 0x44436c
mov eax, dword [ebx]
push esi
mov esi, dword [eax + 0x94]
mov ecx, esi
call dword [0x47d838]
mov ecx, ebx
call esi
mov edi, eax
test edi, edi
jns 0x444357
mov eax, dword [ebx + 0x2c]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x47d838]
lea ecx, [ebx + 0x2c]
call esi
test eax, eax
je 0x44436c
push 0x76a
jmp 0x444063
cmp dword [ebx + 0x1f0], 0
jne 0x44436c
mov eax, dword [ebp - 0x144]
mov dword [ebx + 0x1f0], eax
mov ecx, edi
call fcn.0042757e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x13c]
call fcn.004276f7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x13c]
call fcn.004276f7
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.00472e69
ret 4