Function at 0x42b850
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x6051c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0x80
push 0
lea edi, [ebx + 0x1304]
push edi
call fcn.0044f220
push 0x80
lea eax, [ebx + 0x1404]
push 0
push eax
mov dword [ebp - 0x144], eax
call fcn.0044f220
push 0x98
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.0044f220
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0xa0]
add esp, 0x24
mov dword [ebp - 0xa0], 0x9c
push eax
call esi
test eax, eax
jne 0x42b8da
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x94
push eax
call esi
mov eax, dword [ebp - 0x9c]
mov esi, dword [ebp - 0x98]
push str.RtlGetVersion
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x94]
push str.ntdll.dll
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x13c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x140], eax
test eax, eax
je 0x42b970
push 0x90
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.0044f220
add esp, 0xc
mov dword [ebp - 0x134], 0x94
lea eax, [ebp - 0x134]
push eax
call dword [ebp - 0x140]
mov eax, dword [ebp - 0x130]
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x13c], eax
push 0x488c20
push 0x488c30
mov byte [ebp - 0x138], 0
mov dword [ebp - 0x140], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6522c8], eax
test eax, eax
je 0x42b9b9
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x6522c8]
test eax, eax
je 0x42b9d6
mov eax, dword [ebp - 0x138]
mov ecx, 1
cmp dword [ebp - 0x140], ecx
movzx eax, al
cmove eax, ecx
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x90]
sub eax, 0
je 0x42bf8c
sub eax, 1
je 0x42ba04
sub eax, 1
je 0x42bb13
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 0x1384]
test esi, esi
je 0x42bab4
cmp esi, 0xa
je 0x42ba58
cmp esi, 0x5a
je 0x42ba3a
push str.Windows_9x
push eax
call fcn.00405f60
push str.Windows_9x
push edi
call fcn.00405f60
add esp, 0x10
jmp 0x42bb13
push str.Windows_Me
push eax
call fcn.00405f60
push str.Windows_Me
push edi
call fcn.00405f60
add esp, 0x10
jmp 0x42bb13
push str.Windows_98
push eax
call fcn.00405f60
mov ecx, dword [ebp - 0x94]
mov eax, 0x7ce
add esp, 8
cmp cx, ax
jne 0x42ba81
mov eax, str.Windows_98
push eax
jmp 0x42bb0a
mov eax, 0x8ae
cmp cx, ax
jb 0x42ba93
mov eax, str.Windows_98_SE
push eax
jmp 0x42bb0a
mov dword [ebp - 0x140], 0x7d0
mov eax, str.Windows_98_SP1
cmp cx, word [ebp - 0x140]
mov edx, str.Windows_98
cmovb eax, edx
push eax
jmp 0x42bb0a
push str.Windows_95
push eax
call fcn.00405f60
mov eax, dword [ebp - 0x94]
mov ecx, 0x3e8
add esp, 8
cmp ax, cx
jb 0x42bb05
mov ecx, 0x4be
cmp ax, cx
jb 0x42bae3
push str.Windows_95_OSR2.5
jmp 0x42bb0a
mov ecx, 0x4bc
cmp ax, cx
jb 0x42baf4
push str.Windows_95_OSR2.1
jmp 0x42bb0a
mov ecx, 0x457
cmp ax, cx
jne 0x42bb05
push str.Windows_95_OSR2
jmp 0x42bb0a
push str.Windows_95
push edi
call fcn.00405f60
add esp, 8
lea eax, [ebx + 0x1404]
push str.No_Service_Pack
push eax
call fcn.00405f60
lea ecx, [ebp - 0x8c]
add esp, 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42bb30
sub ecx, edx
je 0x42bb56
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebx + 0x1404]
push 0x47a11c
push eax
call fcn.00405f60
add esp, 0xc
mov eax, dword [ebp - 0x148]
add eax, 0xfffffffd
cmp eax, 7
ja case.0x42bb68.7
jmp dword [eax*4 + 0x42bfbc]
lea eax, [ebx + 0x1384]
push str.Windows_NT3.x
push eax
call fcn.00405f60
lea eax, [ebx + 0x1404]
push eax
movzx eax, word [ebp - 0x94]
push eax
push dword [ebp - 0x98]
push str.Windows_NT3._d_build__d___s_
push edi
call fcn.00405f60
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 0x1384]
push str.Windows_NT4.x
push eax
call fcn.00405f60
lea eax, [ebx + 0x1404]
push eax
movzx eax, word [ebp - 0x94]
push eax
push dword [ebp - 0x98]
push str.Windows_NT4._d_build__d___s_
push edi
call fcn.00405f60
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x138]
add ebx, 0x1384
movzx eax, al
sub esi, 0
je 0x42bd0a
sub esi, 1
je 0x42bcca
sub esi, 1
lea esi, [eax + 1]
je 0x42bc6b
shl esi, 5
push esi
push str.Windows_post_XP__d_bit
push ebx
call fcn.00405f60
push dword [ebp - 0x144]
movzx eax, word [ebp - 0x94]
push eax
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
push esi
push str.Windows_post_XP__d_bit_ver._d._d_build__d___s_
push edi
call fcn.00405f60
add esp, 0x28
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
push 0x59
shl esi, 5
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push esi
test eax, eax
jne 0x42bc8d
push str.Windows_Server_2003__d_bit
push ebx
call fcn.00405f60
mov eax, str.Windows_Server_2003__d_bit_build__d___s_
jmp 0x42bc9d
push str.Windows_Server_2003_R2__d_bit
push ebx
call fcn.00405f60
mov eax, str.Windows_Server_2003_R2__d_bit_build__d___s_
movzx ecx, word [ebp - 0x94]
add esp, 0xc
push dword [ebp - 0x144]
push ecx
push esi
push eax
push edi
call fcn.00405f60
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
lea esi, [eax + 1]
shl esi, 5
push esi
push str.Windows_XP__d_bit
push ebx
call fcn.00405f60
push dword [ebp - 0x144]
movzx eax, word [ebp - 0x94]
push eax
push esi
push str.Windows_XP__d_bit_build__d___s_
push edi
call fcn.00405f60
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
lea esi, [eax + 1]
shl esi, 5
push esi
push str.Windows_2000__d_bit
push ebx
call fcn.00405f60
push dword [ebp - 0x144]
movzx eax, word [ebp - 0x94]
push eax
push esi
push str.Windows_2000__d_bit_build__d___s_
push edi
call fcn.00405f60
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
cmp esi, 3
ja case.default.0x42bd53
jmp dword [esi*4 + 0x42bfdc]
mov eax, dword [ebp - 0x138]
lea ecx, [ebx + 0x1384]
movzx esi, al
inc esi
shl esi, 5
cmp byte [ebp - 6], 1
jne 0x42bd7f
mov edi, str.Windows_Vista__d_bit_build__d___s_
mov eax, str.Windows_Vista__d_bit
jmp 0x42bd89
mov edi, str.Windows_Server_2008__d_bit_build__d___s_
mov eax, str.Windows_Server_2008__d_bit
push esi
push eax
push ecx
call fcn.00405f60
mov ecx, dword [ebp - 0x13c]
lea eax, [ebx + 0x1404]
push eax
movzx eax, cx
push eax
push esi
lea eax, [ebx + 0x1304]
push edi
push eax
call fcn.00405f60
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x138]
lea ecx, [ebx + 0x1384]
movzx esi, al
inc esi
shl esi, 5
cmp byte [ebp - 6], 1
jne 0x42bde9
mov edi, str.Windows_7__d_bit_build__d___s_
mov eax, str.Windows_7__d_bit
jmp 0x42bd89
mov edi, str.Windows_Server_2008_R2__d_bit_build__d___s_
mov eax, str.Windows_Server_2008_R2__d_bit
jmp 0x42bd89
mov eax, dword [ebp - 0x138]
lea ecx, [ebx + 0x1384]
movzx esi, al
add ebx, 0x1304
inc esi
shl esi, 5
cmp byte [ebp - 6], 1
jne 0x42be20
mov edi, str.Windows_8__d_bit_build__d
mov eax, str.Windows_8__d_bit
jmp 0x42be2a
mov edi, str.Windows_Server_2012__d_bit_build__d
mov eax, str.Windows_Server_2012__d_bit
push esi
push eax
push ecx
call fcn.00405f60
mov ecx, dword [ebp - 0x13c]
movzx eax, cx
push eax
push esi
push edi
push ebx
call fcn.00405f60
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x138]
lea ecx, [ebx + 0x1384]
movzx esi, al
add ebx, 0x1304
inc esi
shl esi, 5
cmp byte [ebp - 6], 1
jne 0x42be83
mov edi, str.Windows_8.1__d_bit_build__d
mov eax, str.Windows_8.1__d_bit
jmp 0x42be2a
mov edi, str.Windows_8.1_Server__d_bit_build__d
mov eax, str.Windows_8.1_Server__d_bit
jmp 0x42be2a
mov eax, dword [ebp - 0x138]
movzx esi, al
lea eax, [ebx + 0x1384]
inc esi
shl esi, 5
push esi
push str.Windows_post_Win8__d_bit
push eax
call fcn.00405f60
mov eax, dword [ebp - 0x13c]
movzx eax, ax
push eax
push dword [ebp - 0x14c]
push dword [ebp - 0x148]
push esi
push str.Windows_post_Win8__d_bit_ver._d._d_build__d
push edi
call fcn.00405f60
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x13c]
lea ecx, [ebx + 0x1384]
movzx ebx, ax
test esi, esi
mov eax, dword [ebp - 0x138]
movzx eax, al
lea esi, [eax + 1]
je 0x42bf3f
shl esi, 5
push esi
push str.Windows_10_or_greater__d_bit
push ecx
call fcn.00405f60
push ebx
push dword [ebp - 0x14c]
push dword [ebp - 0x148]
push esi
push str.Windows_10_or_greater__d_bit_ver._d._d_build__d
push edi
call fcn.00405f60
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
shl esi, 5
cmp byte [ebp - 6], 1
jne 0x42bf54
mov ebx, str.Windows_10__d_bit_build__d
mov eax, str.Windows_10__d_bit
jmp 0x42bf5e
mov ebx, str.Windows_Server_10__d_bit_build__d
mov eax, str.Windows_Server_10__d_bit
push esi
push eax
push ecx
call fcn.00405f60
mov ecx, dword [ebp - 0x13c]
movzx eax, cx
push eax
push esi
push ebx
push edi
call fcn.00405f60
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret
push str.Windows_3.1x
push edi
call fcn.00405f60
lea eax, [ebx + 0x1384]
push str.Windows_3.1
push eax
call fcn.00405f60
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044dcb2
mov esp, ebp
pop ebp
ret