Function at 0x4e2ad7
Capabilities:
Check os version

Disassembly:
push 0x5ac
mov eax, 0x556254
call fcn.00514880
and dword [ebp - 0x5a0], 0
lea edi, [ebp - 0x304]
mov ebx, dword [ebp + 8]
mov esi, str.kvvMF9m7n5A1IEaLfdaCPIKHuNx1G5NRJua1jXt1hd8Z4MGTHCoD0YptLb7qKJQtkTXEJcKTHPdAn8eke7jksNbH5aXYDJm1AWMnBzrg61lRXkQC4FbfcA2Viul0toX6HMK2G0JJsOUGJv2w1Wv7yopMgohnDv3LfQZuOVkq3xCnro4D5yRv7pI1OiFlhizaXcpbFWcOu4gIessKcStxzgHmnBGtIgJwebiIu3XYyMc
push 0x3b
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x54
pop ecx
mov esi, str.eIJ2H6SCxqXwZgOmoEukXcUFVlDcoIIrMOyZive9k0siz9Lyb9bDHXaP4b92d7UabRxK4jZlNuafqv62tm30FlmK3zKv2Um6SUp8va9EWll4Sr5aExmttdqKmhTbU5baSqHK2Ec5Qa38falCNv6REeV90S0uL5lIdC36aSidJRgFbAdzYPRNZ71YdK2Hh5FMF2xF0SE9VJ392mKWhnx5FEw2PKfttLxum2uQQCXgABnT7F2EGOXAIUe2dSx7jcGOTFKFGpY8IOFjI3FTOZjyNCNjXyrq7N3lRbf6shrMofJnL87OBRJ7uJzjyeXu1jV74p7bmA9XSMwFKBS
mov dword [ebp - 0x5b8], ebx
lea edi, [ebp - 0x454]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp - 0x5b4], esi
mov dword [ebp - 0x5b0], esi
mov dword [ebp - 0x5ac], esi
lea eax, [ebp - 0x304]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x46c]
call fcn.004057d0
lea eax, [ebp - 0x46c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x5b4]
call fcn.00407f90
push esi
push 1
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 1
call fcn.00479e2e
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x46c]
call fcn.004057d0
lea eax, [ebp - 0x46c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x5b4]
call fcn.00407f90
push esi
push 1
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 1
call fcn.00479e2e
push 0x118
lea eax, [ebp - 0x584]
mov dword [ebp - 0x588], 0x11c
push esi
push eax
call fcn.004f14e0
add esp, 0xc
lea eax, [ebp - 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x657910
mov ecx, ebx
call fcn.004024f0
mov eax, dword [ebp - 0x584]
mov edi, dword [ebp - 0x57c]
mov dword [ebp - 0x59c], eax
movzx eax, byte [ebp - 0x46e]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x580]
push str.ntdll.dll
mov dword [ebp - 0x5a0], 1
mov dword [ebp - 0x590], esi
mov dword [ebp - 0x594], esi
mov dword [ebp - 0x58c], esi
mov dword [ebp - 0x598], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x5a4], eax
test eax, eax
je 0x4e2c79
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4e2c6d
lea ecx, [ebp - 0x58c]
push ecx
lea ecx, [ebp - 0x594]
push ecx
lea ecx, [ebp - 0x590]
push ecx
call eax
movzx eax, word [ebp - 0x58c]
mov dword [ebp - 0x58c], eax
push dword [ebp - 0x5a4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x59c]
cmp eax, 5
jne 0x4e2cc3
mov eax, dword [ebp - 0x598]
test eax, eax
je 0x4e2db4
cmp eax, 1
jne 0x4e2cad
push str.WindowsXP
call fcn.005017a9
pop ecx
push eax
push str.WindowsXP
jmp 0x4e2dad
push str.WindowsServer2003
call fcn.005017a9
pop ecx
push eax
push str.WindowsServer2003
jmp 0x4e2dad
cmp eax, 6
jne 0x4e2db4
mov eax, dword [ebp - 0x598]
sub eax, esi
je 0x4e2d80
sub eax, 1
je 0x4e2d6d
sub eax, 1
jne 0x4e2db4
cmp edi, 0x1ebb
je 0x4e2d07
lea eax, [edi - 0x1ee6]
cmp eax, 0x25
jbe 0x4e2d07
cmp edi, 0x1f13
jne 0x4e2d23
mov esi, str.Windows8
push esi
call fcn.005017a9
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.00402650
xor esi, esi
jmp 0x4e2db4
cmp dword [ebp - 0x590], 0xa
jne 0x4e2d48
cmp dword [ebp - 0x594], 0
jne 0x4e2db4
push str.Windows10
call fcn.005017a9
pop ecx
push eax
push str.Windows10
jmp 0x4e2dad
cmp dword [ebp - 0x590], 6
jne 0x4e2db4
cmp dword [ebp - 0x594], 3
jne 0x4e2db4
push str.Windows8.1
call fcn.005017a9
pop ecx
push eax
push str.Windows8.1
jmp 0x4e2dad
push str.Windows7
call fcn.005017a9
pop ecx
push eax
push str.Windows7
jmp 0x4e2dad
cmp dword [ebp - 0x5a8], 1
jne 0x4e2d9c
push str.WindowsVista
call fcn.005017a9
pop ecx
push eax
push str.WindowsVista
jmp 0x4e2dad
push str.WindowsServer2008
call fcn.005017a9
pop ecx
push eax
push str.WindowsServer2008
mov ecx, ebx
call fcn.00402650
push 0x657910
mov ecx, ebx
call fcn.004d194e
test eax, eax
jne 0x4e2e22
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.004f14e0
mov eax, dword [ebp - 0x59c]
push edi
push dword [ebp - 0x598]
push eax
lea eax, [ebp - 0x218]
push str.Windows_d._d._d
push eax
call fcn.00408010
add esp, 0x20
cmp word [ebp - 0x218], 0
jne 0x4e2e06
mov eax, esi
jmp 0x4e2e13
lea eax, [ebp - 0x218]
push eax
call fcn.005017a9
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.00402650
cmp dword [ebp + 0xc], 0
je 0x4e2e50
cmp word [ebp - 0x574], 0
je 0x4e2e41
lea eax, [ebp - 0x574]
push eax
call fcn.005017a9
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0x574]
mov ecx, ebx
push eax
call fcn.00404240
lea ecx, [ebp - 0x5b4]
call fcn.00479e80
mov eax, ebx
call fcn.0051483b
ret