Function at 0x4e570f90
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0x58
push 0xffffffffffffffff
push 0x4e5a68c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
mov dword [ebp + 0x54], 0
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4e571018
push str.Cannot_get_OS_version_information
lea ecx, [ebp + 0x2c]
call fcn.4e513ee0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp + 0x2c]
push ecx
lea ecx, [ebp]
call fcn.4e54e1b0
push 0x4e5cf96c
lea edx, [ebp]
push edx
call fcn.4e58707b
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp + 0x2c]
call fcn.4e514040
mov eax, dword [ebp - 0x9c]
mov dword [ebp + 0x48], eax
cmp dword [ebp + 0x48], 4
je 0x4e57116a
cmp dword [ebp + 0x48], 5
je 0x4e5710d5
cmp dword [ebp + 0x48], 6
je 0x4e571040
jmp 0x4e5711f3
mov ecx, dword [ebp - 0x98]
mov dword [ebp + 0x44], ecx
cmp dword [ebp + 0x44], 0
je 0x4e57105d
cmp dword [ebp + 0x44], 1
je 0x4e57107b
cmp dword [ebp + 0x44], 2
je 0x4e571099
jmp 0x4e5710b7
push str.Windows_Vista_Server_2008
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
push str.Windows_7_Server_2008_R2
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
push str.Windows_8_Server_2012
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
mov eax, dword [ebp - 0x98]
mov dword [ebp + 0x50], eax
cmp dword [ebp + 0x50], 0
je 0x4e5710f2
cmp dword [ebp + 0x50], 1
je 0x4e571110
cmp dword [ebp + 0x50], 2
je 0x4e57112e
jmp 0x4e57114c
push str.Windows_2000
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
push str.Windows_XP
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
push str.Windows_Server_2003_Windows_Server_2003_R2
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
mov edx, dword [ebp - 0x98]
mov dword [ebp + 0x4c], edx
cmp dword [ebp + 0x4c], 0
je 0x4e571187
cmp dword [ebp + 0x4c], 0xa
je 0x4e5711a2
cmp dword [ebp + 0x4c], 0x5a
je 0x4e5711bd
jmp 0x4e5711d8
push str.Windows_95_Windows_NT_4.0
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
push str.Windows_98
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
push str.Windows_ME
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4e57120c
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.4e513ee0
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add ebp, 0x58
mov esp, ebp
pop ebp
ret