Function at 0x501f06
Capabilities:
Check os version

Disassembly:
push 0x350
mov eax, 0x55ee09
call fcn.0052a9a8
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x330]
xor ebx, ebx
mov dword [ebp - 0x35c], esi
push 0x118
push ebx
mov dword [ebp - 0x350], ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x334], 0x11c
call fcn.00507800
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x560c80
mov ecx, esi
call fcn.004a0c80
mov eax, dword [ebp - 0x330]
mov edi, dword [ebp - 0x328]
mov dword [ebp - 0x34c], eax
movzx eax, byte [ebp - 0x21a]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x32c]
push str.ntdll.dll
mov dword [ebp - 4], ebx
mov dword [ebp - 0x350], 1
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x344], ebx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x338], edi
mov dword [ebp - 0x348], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x354], eax
test eax, eax
je 0x502006
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x501ffa
lea ecx, [ebp - 0x33c]
push ecx
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x340]
push ecx
call eax
movzx eax, word [ebp - 0x33c]
mov dword [ebp - 0x33c], eax
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x34c]
cmp eax, 5
jne 0x502050
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x502146
cmp eax, 1
jne 0x50203a
push str.WindowsXP
call fcn.00518e1c
pop ecx
push eax
push str.WindowsXP
jmp 0x50211d
push str.WindowsServer2003
call fcn.00518e1c
pop ecx
push eax
push str.WindowsServer2003
jmp 0x50211d
cmp eax, 6
jne 0x502126
mov eax, dword [ebp - 0x348]
sub eax, ebx
je 0x5020f0
sub eax, 1
je 0x5020dd
sub eax, 1
jne 0x502146
cmp edi, 0x1ebb
je 0x502090
cmp edi, 0x23f0
je 0x502090
lea eax, [edi - 0x1ee6]
cmp eax, 0x25
ja 0x50209a
mov edi, str.Windows8
jmp 0x502130
cmp edi, 0x1f13
je 0x502090
cmp dword [ebp - 0x340], 0xa
jne 0x5020b4
cmp dword [ebp - 0x344], 0
jmp 0x502129
cmp dword [ebp - 0x340], 6
jne 0x502146
cmp dword [ebp - 0x344], 3
jne 0x502146
push str.Windows8.1
call fcn.00518e1c
pop ecx
push eax
push str.Windows8.1
jmp 0x50211d
push str.Windows7
call fcn.00518e1c
pop ecx
push eax
push str.Windows7
jmp 0x50211d
cmp dword [ebp - 0x358], 1
jne 0x50210c
push str.WindowsVista
call fcn.00518e1c
pop ecx
push eax
push str.WindowsVista
jmp 0x50211d
push str.WindowsServer2008
call fcn.00518e1c
pop ecx
push eax
push str.WindowsServer2008
mov ecx, esi
call fcn.00499940
jmp 0x502146
cmp eax, 0xa
jne 0x502146
mov edi, str.Windows10
push edi
call fcn.00518e1c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00499940
mov edi, dword [ebp - 0x338]
push 0x560c80
mov ecx, esi
call fcn.00502c86
test eax, eax
jne 0x5021b2
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00507800
mov eax, dword [ebp - 0x34c]
push edi
push dword [ebp - 0x348]
push eax
lea eax, [ebp - 0x218]
push str.Windows_d._d._d
push eax
call fcn.00502d45
add esp, 0x20
cmp word [ebp - 0x218], 0
je 0x5021a3
lea eax, [ebp - 0x218]
push eax
call fcn.00518e1c
pop ecx
mov ebx, eax
push ebx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00499940
mov eax, esi
call fcn.0052a963
ret