Function at 0x4a4390
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4d800c
push 0x4aa580
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 0x584
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x48c], esi
mov dword [ebp - 0x490], ebx
mov eax, dword [0x4f195c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x594], eax
mov dword [ebp - 0x58c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x588], eax
mov dword [ebp - 0x584], 0
call fcn.004a4370
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x57c], eax
mov dword [ebp - 0x578], ebp
mov dword [ebp - 0x574], esp
mov word [ebp - 0x590], cs
mov word [ebp - 0x58e], ss
add esp, 0xfffffff8
mov dword [esp], 0x28
mov dword [esp + 4], 0
call fcn.004a2030
mov dword [ebp - 0x570], eax
add esp, 8
add esp, 0xfffffff4
mov dword [esp], 0x5077e0
mov eax, dword [ebp - 0x570]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x64
call fcn.004ad650
mov dword [ebp - 0x56c], eax
add esp, 0xc
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x564], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x55c], eax
push eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
add esp, 0xfffffff4
mov eax, dword [ebp - 0x564]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov eax, dword [sym.imp.imagehlp.dll_SymInitialize]
call eax
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x554]
test eax, eax
jne 0x4a45e0
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x548], eax
mov eax, 0x4f1980
mov eax, dword [eax]
test eax, eax
jne 0x4a453c
call fcn.004a0af0
mov dword [ebp - 0x540], eax
mov eax, 0x4f1980
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x544], eax
jmp 0x4a4550
mov eax, 0x4f1980
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x544], eax
add esp, 0xfffffff8
mov dword [esp], 0x1b
mov dword [esp + 4], 0
call fcn.004a2030
mov dword [ebp - 0x538], eax
add esp, 8
mov eax, dword [ebp - 0x544]
add esp, 0xfffffff4
mov dword [esp], 0x5077e0
mov edx, dword [ebp - 0x538]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x548]
mov dword [esp + 8], edx
call eax
mov dword [ebp - 0x530], eax
add esp, 0xc
mov eax, 1
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 8], eax
xor eax, ebp
mov ecx, eax
call fcn.004a91cc
mov eax, dword [ebp - 0x4b4]
mov esp, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x490]
mov esi, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
add esp, 0xfffffff4
lea eax, [ebp - 0x124]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], pe_nt_image_headers32
call fcn.004aa730
mov dword [ebp - 0x54c], eax
add esp, 0xc
mov dword [ebp - 0x118], 3
mov dword [ebp - 0xe8], 3
mov dword [ebp - 0xf8], 3
mov eax, dword [ebp - 0x588]
test eax, eax
je 0x4a4663
add esp, 0xfffffff4
lea eax, [ebp - 0x484]
mov dword [esp], eax
mov eax, dword [ebp - 0x588]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2cc
call fcn.004aa890
mov dword [ebp - 0x53c], eax
add esp, 0xc
jmp 0x4a4951
mov eax, dword [0x5077c4]
or eax, dword [0x5077c0]
jne 0x4a4912
push eax
mov dword [esp], str.NTDLL.DLL
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
test eax, eax
jne 0x4a4745
add esp, 0xfffffff8
mov dword [esp], 0x1c
mov dword [esp + 4], 0
call fcn.004a2030
mov dword [ebp - 0x524], eax
add esp, 8
add esp, 0xfffffff4
mov dword [esp], 0x5077e0
mov eax, dword [ebp - 0x524]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x64
call fcn.004ad650
mov dword [ebp - 0x51c], eax
add esp, 0xc
push eax
mov eax, dword [ebp - 0x564]
mov dword [esp], eax
mov eax, dword [sym.imp.imagehlp.dll_SymCleanup]
call eax
mov dword [ebp - 0x518], eax
mov eax, 2
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 8], eax
xor eax, ebp
mov ecx, eax
call fcn.004a91cc
mov eax, dword [ebp - 0x4b0]
mov esp, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x490]
mov esi, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
add esp, 0xfffffff8
mov eax, dword [ebp - 0x52c]
mov dword [esp], eax
mov dword [esp + 4], str.RtlCaptureContext
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x49c], eax
cdq
mov eax, dword [ebp - 0x49c]
mov dword [0x5077c0], eax
mov dword [0x5077c4], edx
mov eax, dword [0x5077c4]
or eax, dword [0x5077c0]
jne 0x4a4912
mov eax, 0x4f1980
mov eax, dword [eax]
test eax, eax
jne 0x4a47c1
call fcn.004a0af0
mov dword [ebp - 0x508], eax
mov eax, 0x4f1980
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x50c], eax
jmp 0x4a47d5
mov eax, 0x4f1980
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x50c], eax
add esp, 0xfffffff8
mov dword [esp], 0x1d
mov dword [esp + 4], 0
call fcn.004a2030
mov dword [ebp - 0x504], eax
add esp, 8
mov eax, dword [ebp - 0x50c]
add esp, 0xfffffff4
mov dword [esp], 0x5077e0
mov dword [esp + 4], 0x4cd8f8
mov edx, dword [ebp - 0x504]
mov dword [esp + 8], edx
call eax
mov dword [ebp - 0x4f4], eax
add esp, 0xc
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x4e8], eax
mov eax, 0x4f1980
mov eax, dword [eax]
test eax, eax
jne 0x4a485a
call fcn.004a0af0
mov dword [ebp - 0x4d0], eax
mov eax, 0x4f1980
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x4d4], eax
jmp 0x4a486e
mov eax, 0x4f1980
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x4d4], eax
add esp, 0xfffffff8
mov dword [esp], 0x1e
mov dword [esp + 4], 0
call fcn.004a2030
mov dword [ebp - 0x4c8], eax
add esp, 8
mov eax, dword [ebp - 0x4d4]
add esp, 0xfffffff8
mov edx, 0x5077e0
add edx, dword [ebp - 0x4e8]
mov dword [esp], edx
mov edx, dword [ebp - 0x4c8]
mov dword [esp + 4], edx
call eax
mov dword [ebp - 0x4c0], eax
add esp, 8
push eax
mov eax, dword [ebp - 0x564]
mov dword [esp], eax
mov eax, dword [sym.imp.imagehlp.dll_SymCleanup]
call eax
mov dword [ebp - 0x4b8], eax
mov eax, 3
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 8], eax
xor eax, ebp
mov ecx, eax
call fcn.004a91cc
mov eax, dword [ebp - 0x4ac]
mov esp, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x490]
mov esi, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
mov eax, dword [0x5077c0]
add esp, 0xfffffff8
lea edx, [ebp - 0x484]
mov dword [ebp - 0x498], eax
mov eax, edx
mov dword [ebp - 0x494], edx
cdq
mov eax, dword [ebp - 0x494]
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x498]
call eax
add esp, 8
mov dword [ebp - 0x584], 1
mov eax, dword [ebp - 0x588]
test eax, eax
je 0x4a49ee
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xb8]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xc4]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xb4]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xbc]
mov word [ebp - 0x11c], ax
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xc8]
mov word [ebp - 0xec], ax
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xc8]
mov word [ebp - 0xfc], ax
jmp 0x4a4a64
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], 0
movzx eax, word [ebp - 0x590]
mov word [ebp - 0x11c], ax
movzx eax, word [ebp - 0x58e]
mov word [ebp - 0xec], ax
movzx eax, word [ebp - 0x58e]
mov word [ebp - 0xfc], ax
mov dword [ebp - 0x584], 1
mov dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x584]
test eax, eax
je 0x4a4b07
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4a4a8e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x528], eax
jmp 0x4a4a98
mov dword [ebp - 0x528], 5
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x1b8], 0x94
push eax
lea eax, [ebp - 0x1b8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x514]
test eax, eax
je 0x4a4b07
mov eax, dword [ebp - 0x1b4]
cmp eax, 6
jb 0x4a4b07
mov eax, 0xffffffff
add eax, dword [ebp - 0x528]
mov dword [ebp - 0x528], eax
mov dword [ebp - 4], 0
mov eax, 0
cmp eax, 1
je 0x4a4d3f
add esp, 0xffffffdc
mov dword [esp], 0x14c
mov eax, dword [ebp - 0x564]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x55c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x124]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x484]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov eax, dword [sym.imp.imagehlp.dll_StackWalk64]
call eax
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x554]
test eax, eax
jne 0x4a4c9c
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x548], eax
mov eax, 0x4f1980
mov eax, dword [eax]
test eax, eax
jne 0x4a4bda
call fcn.004a0af0
mov dword [ebp - 0x4e0], eax
mov eax, 0x4f1980
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x4e4], eax
jmp 0x4a4bee
mov eax, 0x4f1980
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x4e4], eax
add esp, 0xfffffff8
mov dword [esp], 0x1f
mov dword [esp + 4], 0
call fcn.004a2030
mov dword [ebp - 0x4cc], eax
add esp, 8
mov eax, dword [ebp - 0x4e4]
add esp, 0xfffffff4
mov dword [esp], 0x5077e0
mov edx, dword [ebp - 0x4cc]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x548]
mov dword [esp + 8], edx
call eax
mov dword [ebp - 0x4c4], eax
add esp, 0xc
push eax
mov eax, dword [ebp - 0x564]
mov dword [esp], eax
mov eax, dword [sym.imp.imagehlp.dll_SymCleanup]
call eax
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, 4
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 8], eax
xor eax, ebp
mov ecx, eax
call fcn.004a91cc
mov eax, dword [ebp - 0x4a8]
mov esp, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x490]
mov esi, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
mov eax, dword [ebp - 0x528]
test eax, eax
jg 0x4a4cb2
mov dword [ebp - 0x4f0], 0
jmp 0x4a4cbc
mov dword [ebp - 0x4f0], 1
mov eax, 0xffffffff
add eax, dword [ebp - 0x528]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp + 0x10]
add esp, 0xfffffff4
lea edx, [ebp - 0x124]
mov dword [esp], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x4f0]
mov dword [esp + 8], edx
call eax
mov dword [ebp - 0x4dc], eax
add esp, 0xc
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
cmp eax, 0xfffffffe
jne 0x4a4d1b
mov dword [ebp - 0x58c], 7
jmp 0x4a4d3f
mov eax, dword [ebp - 0x548]
cmp eax, 0xffffffff
je 0x4a4d3f
mov eax, dword [ebp - 0x110]
or eax, dword [ebp - 0x114]
jne 0x4a4b07
jmp 0x4a4d3f
mov dword [ebp - 4], 0xfffffffe
jmp 0x4a4ded
push eax
mov eax, dword [ebp - 0x564]
mov dword [esp], eax
mov eax, dword [sym.imp.imagehlp.dll_SymCleanup]
call eax
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 8], eax
xor eax, ebp
mov ecx, eax
call fcn.004a91cc
mov eax, dword [ebp - 0x4a0]
mov esp, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x490]
mov esi, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret