Function at 0x4214e0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0x134
mov eax, dword [0x48b990]
xor eax, ebp
mov dword [ebp + 0xb0], eax
mov eax, dword [ebp + 0xc0]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xbc]
push str.CCompetitorProductMgr::GetWindowsDefenderStatus
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x7c], eax
call fcn.00407111
and dword [ebp - 0x74], 0
mov esi, 0x11c
push esi
lea eax, [ebp - 0x6c]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x4215be
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x6c], 0x114
call esi
test eax, eax
jne 0x4215be
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42156a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x42159a
test byte [eax + 0x1c], 1
je 0x42159a
cmp byte [eax + 0x19], 2
jb 0x42159a
push esi
push 0x46d578
push 0x5b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004213e2
add esp, 0x14
lea ecx, [ebp - 0x80]
call fcn.00407157
mov ecx, dword [ebp + 0xb0]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045ce96
add ebp, 0xb4
leave
ret 8
cmp dword [ebp - 0x68], 5
mov esi, str.SoftwareMicroSoftWindows_Defender_
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
jne 0x421634
cmp dword [ebp - 0x64], 1
jb 0x421669
and dword [ebp - 0x70], 0
push 0x20019
push esi
push ebx
lea ecx, [ebp - 0x70]
call fcn.00402e79
test eax, eax
jne 0x421622
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x42161c
test byte [eax + 0x1c], 1
je 0x42161c
cmp byte [eax + 0x19], 4
jb 0x42161c
push 0x46d578
push 0x5c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
mov dword [edi], 1
lea ecx, [ebp - 0x70]
call fcn.00402e14
lea ecx, [ebp - 0x70]
call fcn.00402e14
jmp 0x421669
jbe 0x421669
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x421663
test byte [eax + 0x1c], 1
je 0x421663
cmp byte [eax + 0x19], 4
jb 0x421663
push 0x46d578
push 0x5d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
mov dword [edi], 1
cmp dword [edi], 0
jne 0x4216a2
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x42169b
test byte [eax + 0x1c], 1
je 0x42169b
cmp byte [eax + 0x19], 4
jb 0x42169b
push 0x46d578
push 0x5e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00406feb
add esp, 0x10
xor esi, esi
jmp 0x42159a
and dword [ebp - 0x70], 0
push 0x20019
push esi
push ebx
lea ecx, [ebp - 0x70]
call fcn.00402e79
test eax, eax
jne 0x421756
and dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
xor ebx, ebx
push eax
mov esi, str.DisableAntiSpyware
inc ebx
push esi
lea ecx, [ebp - 0x70]
mov dword [edi], ebx
call fcn.0041ed51
test eax, eax
jne 0x42171c
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x42170a
test byte [eax + 0x1c], bl
je 0x42170a
cmp byte [eax + 0x19], 4
jb 0x42170a
push dword [ebp - 0x78]
push 0x46d578
push 0x5f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004213e2
add esp, 0x14
mov ecx, dword [ebp - 0x7c]
xor eax, eax
cmp dword [ebp - 0x78], ebx
setne al
mov dword [ecx], eax
jmp 0x42179e
cmp eax, 2
jne 0x42179e
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x42174f
test byte [eax + 0x1c], 1
je 0x42174f
cmp byte [eax + 0x19], 4
jb 0x42174f
push esi
push 0x46d578
push 0x60
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004070b8
add esp, 0x14
mov eax, dword [ebp - 0x7c]
mov dword [eax], ebx
jmp 0x42179e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42176a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x74], eax
mov eax, dword [0x488018]
cmp eax, 0x488018
je 0x42179e
test byte [eax + 0x1c], 1
je 0x42179e
cmp byte [eax + 0x19], 2
jb 0x42179e
push dword [ebp - 0x74]
push esi
push 0x46d578
push 0x61
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00426ba7
add esp, 0x18
lea ecx, [ebp - 0x70]
call fcn.00402e14
lea ecx, [ebp - 0x70]
call fcn.00402e14
mov esi, dword [ebp - 0x74]
jmp 0x42159a