Function at 0x42d7f3
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x11c
push ebx
push esi
mov esi, dword [ebp + 0x7c]
push edi
push 0x124
xor ebx, ebx
push ebx
push esi
call fcn.00446b72
add esp, 0xc
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x118
mov edi, eax
lea eax, [ebp - 0xa4]
push ebx
push eax
mov dword [ebp - 0xa8], 0x11c
call fcn.00446b72
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
cmp edi, ebx
je 0x42d860
call edi
test eax, eax
jne 0x42d895
jmp 0x42d866
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0xa4]
mov dword [esi], eax
mov eax, dword [ebp - 0xa0]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x9c]
mov dword [esi + 8], eax
movzx eax, word [ebp + 0x6c]
mov dword [esi + 0xc], eax
movzx eax, byte [ebp + 0x72]
mov dword [esi + 0x10], eax
movzx eax, word [ebp + 0x70]
mov dword [esi + 0x14], eax
mov edi, dword [esi]
push 0xa
xor edx, edx
pop ecx
mov eax, edi
div ecx
push 0xa
pop ebx
mov ecx, eax
mov eax, dword [esi + 4]
mov dword [ebp + 0x7c], edx
xor edx, edx
div ebx
shl ecx, 4
add ecx, dword [ebp + 0x7c]
shl ecx, 4
add ecx, eax
shl ecx, 4
lea eax, [ecx + edx]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
cmp edi, 5
jb 0x42d994
call fcn.00427584
mov dword [ebp + 0x7c], eax
test eax, eax
je 0x42d926
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
lea eax, [esi + 0x28]
push eax
call ebx
mov edi, str.Win32
lea eax, [esi + 0x38]
push edi
push eax
call ebx
push edi
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x42d994
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str._on
lea ebx, [esi + 0x38]
push ebx
call edi
push dword [ebp + 0x7c]
push ebx
call edi
mov dword [esi + 0x24], 1
jmp 0x42d994
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x42d95a
and dword [ebp + 0x7c], 0
lea eax, [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov eax, dword [ebp + 0x7c]
mov dword [esi + 0x24], eax
cmp dword [esi + 0x24], 0
lea eax, [esi + 0x38]
je 0x42d97e
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.Win32_on_x64
push eax
call edi
push 0x46ec08
lea eax, [esi + 0x28]
push eax
call edi
jmp 0x42d994
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, str.Win32
push edi
push eax
call ebx
push edi
lea eax, [esi + 0x28]
push eax
call ebx
push 0x40
lea eax, [esi + 0x58]
push eax
push 0x46fa04
mov ebx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push ebx
mov edi, 0x80000002
push edi
call fcn.00427c75
cmp dword [esi + 8], 0x55f0
jb 0x42d9c7
cmp word [esi + 0x6a], 0x30
jne 0x42d9c7
push 0x31
pop eax
mov word [esi + 0x6a], ax
cmp dword [esi], 0xa
jb 0x42da11
push 0x10
lea eax, [esi + 0xd8]
push eax
push str.DisplayVersion
push ebx
push edi
call fcn.00427c75
lea eax, [esi + 0xd8]
cmp word [eax], 0
jne 0x42d9fc
push 0x10
push eax
push str.ReleaseID
push ebx
push edi
call fcn.00427c75
push 0x10
add esi, 0xf8
push esi
push 0x46f968
push ebx
push edi
call fcn.00427c75
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4