Function at 0x422910
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c596c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
push str.unknown_Windows_version
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov byte [ebp - 0x24], 0
mov dword [ebp - 0xb8], 0x94
lea ecx, [ebp - 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x42296a
xor eax, eax
jmp 0x422dac
mov dword [ebp - 0xd0], 0x14
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 0x20]
push eax
push 1
push str.PROCESSOR_ARCHITECTURE
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
call fcn.004298ee
add esp, 0x14
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0xc8]
call fcn.004a3312
mov dword [ebp - 4], 0
push 0x4f1958
lea edx, [ebp - 0xc8]
push edx
call fcn.004166a0
and eax, 0xff
test eax, eax
je 0x4229c9
mov byte [ebp - 0x24], 0
jmp 0x4229cd
mov byte [ebp - 0x24], 1
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xb0]
mov dword [ebp - 0xbc], ecx
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0xac]
and eax, 0xffff
mov dword [ebp - 0xc0], eax
push 0x5054c4
mov ecx, dword [ebp + 0x10]
call fcn.004a342d
cmp dword [ebp - 0xcc], 1
jne 0x422b7f
cmp dword [ebp - 0xc4], 4
jne 0x422b7f
cmp dword [ebp - 0xbc], 0xa
jae 0x422a59
cmp dword [ebp - 0xc0], 0x3b6
jne 0x422a59
push str.Windows_95
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 1
jmp 0x422b7a
cmp dword [ebp - 0xbc], 0xa
jae 0x422a95
cmp dword [ebp - 0xc0], 0x3b6
jbe 0x422a95
cmp dword [ebp - 0xc0], 0x438
ja 0x422a95
push str.Windows_95_SP1
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov edx, dword [ebp + 0xc]
mov dword [edx], 2
jmp 0x422b7a
cmp dword [ebp - 0xbc], 0xa
jae 0x422ac5
cmp dword [ebp - 0xc0], 0x438
jbe 0x422ac5
push str.Windows_95_OSR2
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov eax, dword [ebp + 0xc]
mov dword [eax], 3
jmp 0x422b7a
cmp dword [ebp - 0xbc], 0xa
jne 0x422af5
cmp dword [ebp - 0xc0], 0x7ce
jne 0x422af5
push str.Windows_98
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 4
jmp 0x422b7a
cmp dword [ebp - 0xbc], 0xa
jne 0x422b2e
cmp dword [ebp - 0xc0], 0x7ce
jbe 0x422b2e
cmp dword [ebp - 0xc0], 0x887
jae 0x422b2e
push str.Windows_98_SP1
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov edx, dword [ebp + 0xc]
mov dword [edx], 5
jmp 0x422b7a
cmp dword [ebp - 0xbc], 0xa
jne 0x422b5b
cmp dword [ebp - 0xc0], 0x887
jb 0x422b5b
push str.Windows_98_SE
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov eax, dword [ebp + 0xc]
mov dword [eax], 6
jmp 0x422b7a
cmp dword [ebp - 0xbc], 0x5a
jne 0x422b7a
push str.Windows_ME
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 7
jmp 0x422d8a
cmp dword [ebp - 0xcc], 2
jne 0x422d6b
cmp dword [ebp - 0xc4], 3
jne 0x422bb9
cmp dword [ebp - 0xbc], 0x33
jne 0x422bb9
push str.Windows_NT_3.51
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x65
jmp 0x422d69
cmp dword [ebp - 0xc4], 4
jne 0x422be6
cmp dword [ebp - 0xbc], 0
jne 0x422be6
push str.Windows_NT_4
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x66
jmp 0x422d69
cmp dword [ebp - 0xc4], 5
jne 0x422c13
cmp dword [ebp - 0xbc], 0
jne 0x422c13
push str.Windows_2000
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x67
jmp 0x422d69
cmp dword [ebp - 0xc4], 5
jne 0x422c4f
cmp dword [ebp - 0xbc], 1
jne 0x422c4f
push str.Windows_XP
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x68
lea eax, [ebp - 0xa4]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004a342d
jmp 0x422d69
cmp dword [ebp - 0xc4], 5
jne 0x422cb0
cmp dword [ebp - 0xbc], 2
jne 0x422cb0
mov ecx, dword [ebp - 0x24]
and ecx, 0xff
test ecx, ecx
je 0x422c86
push str.Windows_X64
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x6a
jmp 0x422c9c
push str.Windows_2003
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x69
lea ecx, [ebp - 0xa4]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004a342d
jmp 0x422d69
cmp dword [ebp - 0xc4], 6
jne 0x422d0e
cmp dword [ebp - 0xbc], 0
jne 0x422d0e
mov edx, dword [ebp - 0x24]
and edx, 0xff
test edx, edx
je 0x422ce7
push str.Windows_VistaX64
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x6c
jmp 0x422cfd
push str.Windows_VistaX86
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x6b
lea edx, [ebp - 0xa4]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.004a342d
jmp 0x422d69
cmp dword [ebp - 0xc4], 6
jb 0x422d69
cmp dword [ebp - 0xbc], 1
jb 0x422d69
mov eax, dword [ebp - 0x24]
and eax, 0xff
test eax, eax
je 0x422d44
push str.Windows_Win7X64
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x6e
jmp 0x422d5a
push str.Windows_Win7X86
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x6d
lea eax, [ebp - 0xa4]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004a342d
jmp 0x422d8a
cmp dword [ebp - 0xcc], 3
jne 0x422d8a
push str.Windows_CE
mov ecx, dword [ebp + 8]
call fcn.004a342d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xc9
mov dword [ebp - 0xd4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.004a32a4
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret