Function at 0x44e080
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x134]
push ebx
sub esp, 0x15c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x134], 0x11c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
sub esp, 4
test eax, eax
je 0x525dcc
mov edx, dword [ebp - 0x130]
lea eax, [ebx + 8]
cmp edx, 6
je 0x44e208
cmp edx, 0xa
je 0x44e140
cmp edx, 5
je 0x44e100
mov dword [ebx], eax
mov edx, 0x776f
mov dword [ebx + 8], 0x6e6b6e55
mov word [eax + 4], dx
mov byte [eax + 6], 0x6e
mov dword [ebx + 4], 7
mov byte [ebx + 0xf], 0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x12c]
mov dword [ebx], eax
cmp edx, 1
je 0x44e330
cmp edx, 2
je 0x44e290
test edx, edx
jne 0x44e0d1
mov dword [ebx + 8], 0x646e6957
mov dword [eax + 4], 0x2073776f
mov dword [eax + 8], 0x30303032
mov dword [ebx + 4], 0xc
mov byte [ebx + 0x14], 0
jmp 0x44e0f0
mov ecx, dword [ebp - 0x12c]
test ecx, ecx
je 0x44e218
cmp ecx, 2
je 0x44e4a0
ja 0x44e1b0
test ecx, ecx
je 0x44e410
cmp byte [ebp - 0x1a], 1
je 0x44e360
mov dword [ebx], eax
lea eax, [ebp - 0x14c]
mov ecx, ebx
mov esi, str.Windows_Server_2008_R2
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x14c], 0x16
call fcn.004f4f10
mov edx, dword [ebp - 0x14c]
mov dword [ebx], eax
sub esp, 8
mov dword [ebx + 8], edx
mov edx, 0x16
jmp 0x44e376
cmp ecx, 3
jne 0x44e0cf
cmp byte [ebp - 0x1a], 1
je 0x44e3a8
mov dword [ebx], eax
lea eax, [ebp - 0x14c]
mov ecx, ebx
mov esi, str.Windows_Server_2012_R2
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x14c], 0x16
call fcn.004f4f10
mov edx, dword [ebp - 0x14c]
mov dword [ebx], eax
sub esp, 8
mov dword [ebx + 8], edx
mov edx, 0x16
jmp 0x44e3be
mov ecx, dword [ebp - 0x12c]
jmp 0x44e14e
cmp byte [ebp - 0x1a], 1
je 0x44e3f0
mov dword [ebx], eax
lea eax, [ebp - 0x14c]
mov ecx, ebx
mov edi, str.Windows_Server_2016
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x14c], 0x13
call fcn.004f4f10
mov edx, dword [ebp - 0x14c]
mov dword [ebx], eax
sub esp, 8
mov dword [ebx + 8], edx
mov edx, 0x13
mov ecx, dword [edi]
lea esi, [eax + 4]
and esi, 0xfffffffc
mov dword [eax], ecx
mov ecx, dword [edi + edx - 4]
mov dword [eax + edx - 4], ecx
sub eax, esi
xor ecx, ecx
add edx, eax
sub edi, eax
and edx, 0xfffffffc
mov eax, dword [edi + ecx]
mov dword [esi + ecx], eax
add ecx, 4
cmp ecx, edx
jb 0x44e27b
jmp 0x44e30e
lea eax, [ebp - 0x14c]
mov ecx, ebx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x14c], 0x2a
call fcn.004f4f10
mov edx, dword [ebp - 0x14c]
mov ecx, 0x3252
mov dword [ebx], eax
sub esp, 8
mov dword [ebx + 8], edx
mov dword [eax], 0x646e6957
mov dword [eax + 4], 0x2073776f
mov dword [eax + 8], 0x76726553
mov dword [eax + 0xc], 0x32207265
mov dword [eax + 0x10], 0x2f333030
mov dword [eax + 0x14], 0x646e6957
mov dword [eax + 0x18], 0x2073776f
mov dword [eax + 0x1c], 0x76726553
mov dword [eax + 0x20], 0x32207265
mov dword [eax + 0x24], 0x20333030
mov word [eax + 0x28], cx
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebx]
mov dword [ebx + 4], eax
mov byte [edx + eax], 0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x5058
mov dword [ebx + 8], 0x646e6957
mov dword [eax + 4], 0x2073776f
mov word [eax + 8], si
mov dword [ebx + 4], 0xa
mov byte [ebx + 0x12], 0
jmp 0x44e0f0
mov dword [ebx], eax
mov esi, str.Windows_7
mov edx, 9
mov dword [ebp - 0x14c], 9
mov ecx, dword [esi]
mov dword [eax], ecx
mov ecx, dword [esi + edx - 4]
mov dword [eax + edx - 4], ecx
lea ecx, [eax + 4]
and ecx, 0xfffffffc
sub eax, ecx
sub esi, eax
add eax, edx
xor edx, edx
and eax, 0xfffffffc
mov edi, dword [esi + edx]
mov dword [ecx + edx], edi
add edx, 4
cmp edx, eax
jb 0x44e393
jmp 0x44e30e
mov dword [ebx], eax
mov esi, str.Windows_8.1
mov edx, 0xb
mov dword [ebp - 0x14c], 0xb
mov ecx, dword [esi]
mov dword [eax], ecx
mov ecx, dword [esi + edx - 4]
mov dword [eax + edx - 4], ecx
lea ecx, [eax + 4]
and ecx, 0xfffffffc
sub eax, ecx
sub esi, eax
add eax, edx
xor edx, edx
and eax, 0xfffffffc
mov edi, dword [esi + edx]
mov dword [ecx + edx], edi
add edx, 4
cmp edx, eax
jb 0x44e3db
jmp 0x44e30e
mov dword [ebx], eax
mov edi, str.Windows_10
mov dword [ebp - 0x14c], 0xa
jmp 0x44e25e
cmp byte [ebp - 0x1a], 1
je 0x44e458
mov dword [ebx], eax
lea eax, [ebp - 0x14c]
mov ecx, ebx
mov esi, str.Windows_Server_2008
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x14c], 0x13
call fcn.004f4f10
mov edx, dword [ebp - 0x14c]
mov dword [ebx], eax
sub esp, 8
mov dword [ebx + 8], edx
mov edx, 0x13
jmp 0x44e46e
mov dword [ebx], eax
mov esi, str.Windows_Vista
mov edx, 0xd
mov dword [ebp - 0x14c], 0xd
mov ecx, dword [esi]
mov dword [eax], ecx
mov ecx, dword [esi + edx - 4]
mov dword [eax + edx - 4], ecx
lea ecx, [eax + 4]
and ecx, 0xfffffffc
sub eax, ecx
sub esi, eax
add eax, edx
xor edx, edx
and eax, 0xfffffffc
mov edi, dword [esi + edx]
mov dword [ecx + edx], edi
add edx, 4
cmp edx, eax
jb 0x44e48b
jmp 0x44e30e
cmp byte [ebp - 0x1a], 1
je 0x44e4e8
mov dword [ebx], eax
lea eax, [ebp - 0x14c]
mov ecx, ebx
mov esi, str.Windows_Server_2012
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x14c], 0x13
call fcn.004f4f10
mov edx, dword [ebp - 0x14c]
mov dword [ebx], eax
sub esp, 8
mov dword [ebx + 8], edx
mov edx, 0x13
jmp 0x44e4fe
mov dword [ebx], eax
mov esi, str.Windows_8
mov edx, 9
mov dword [ebp - 0x14c], 9
mov ecx, dword [esi]
mov dword [eax], ecx
mov ecx, dword [esi + edx - 4]
mov dword [eax + edx - 4], ecx
lea ecx, [eax + 4]
and ecx, 0xfffffffc
sub eax, ecx
sub esi, eax
add eax, edx
xor edx, edx
and eax, 0xfffffffc
mov edi, dword [esi + edx]
mov dword [ecx + edx], edi
add edx, 4
cmp edx, eax
jb 0x44e51b
jmp 0x44e30e
mov dword [esp], 0x24
lea ebx, [ebp - 0x14c]
call fcn.00513c50
mov dword [esp], str.Cannot_get_OS_version_information
mov ecx, ebx
mov esi, eax
call fcn.00525c04
push eax
mov ecx, esi
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00412360
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 0x144]
push edi
push edi
cmp edx, eax
je 0x525e28
mov eax, dword [ebp - 0x144]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
mov dword [esp + 8], 0x40c850
mov dword [esp + 4], 0x5468b4
mov dword [esp], esi
call fcn.005142c0
mov ebx, eax
mov dword [esp], esi
call fcn.00513f00
mov dword [esp], ebx
call fcn.00461820
mov edx, dword [ebp - 0x14c]
mov ebx, eax
lea eax, [ebp - 0x144]
cmp edx, eax
je 0x525e42
mov eax, dword [ebp - 0x144]
mov dword [esp], edx
add eax, 1
mov dword [esp + 4], eax
call fcn.00513b70
jmp 0x525e42