Function at 0x448090
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x158], 0
push edi
mov eax, ecx
mov dword [ebp - 0x168], ebx
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
xor edi, edi
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x164], ecx
cmp dword [0x59d748], ebx
jne 0x448109
push str.IsWow64Process2
push ecx
mov ecx, str.Kernel32
call fcn.00446d60
add esp, 4
push eax
call dword [ebp - 0x164]
mov dword [0x59d748], eax
mov eax, dword [ebp - 0x14c]
push 0x9c
push 0
push eax
call fcn.004ab0f0
mov edx, dword [ebp - 0x14c]
add esp, 0xc
movups xmm0, xmmword [str.Windows_Undefined]
movups xmmword [edx + 0x1a], xmm0
mov ax, word [0x53877c]
mov word [edx + 0x2a], ax
lea eax, [ebp - 0x144]
push 0x98
push 0
push eax
mov byte [edx + 0x2b], bl
call fcn.004ab0f0
add esp, 0xc
mov dword [ebp - 0x148], 0x9c
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x44819c
push 0x98
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.004ab0f0
add esp, 0xc
mov dword [ebp - 0x148], 0x94
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x448bd0
cmp dword [ebp - 0x138], 2
jne 0x448360
cmp dword [ebp - 0x144], 6
ja 0x4481c5
jne 0x4482d3
cmp dword [ebp - 0x140], 2
jb 0x4482e0
push 1
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov esi, dword [ebp - 0x144]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], edx
cmp esi, 9
ja 0x4482d3
nop
push 0x94
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.004ab0f0
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa4], esi
push dword [ebp - 0x150]
push dword [ebp - 0x154]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
jne 0x448240
inc esi
cmp esi, 9
jbe 0x4481f0
jmp 0x4482d3
cmp dword [ebp - 0x144], esi
jae 0x448254
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x140], ebx
push 1
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edi, dword [ebp - 0x140]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x154], edx
cmp edi, 9
ja 0x4482d3
nop dword [eax]
push 0x9c
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.004ab0f0
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa0], edi
push dword [ebp - 0x154]
push dword [ebp - 0x150]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
jne 0x4482cd
inc edi
cmp edi, 9
jbe 0x448280
jmp 0x4482d3
mov dword [ebp - 0x140], edi
cmp dword [ebp - 0x144], 0xf
ja 0x448360
mov eax, dword [ebp - 0x140]
cmp eax, 0xf
ja 0x448360
mov edx, dword [ebp - 0x144]
mov ecx, 1
cmp cl, byte [ebp - 0xae]
sbb ecx, ecx
shl edx, 4
or edx, eax
inc ecx
mov eax, dword [ebp - 0x14c]
mov dword [eax], edx
lea eax, [edx - 0x51]
cmp eax, 0x5f
ja case.0x44831f.83
movzx eax, byte [eax + 0x448c0c]
jmp dword [eax*4 + 0x448be4]
mov ebx, 0x538780
jmp 0x448360
test ecx, ecx
je 0x448338
mov ebx, str.XP_64
jmp 0x448360
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov ebx, str.Server_2003
mov ecx, str.Server_2003_R2
cmovne ebx, ecx
jmp 0x448360
mov ebx, str.Vista
mov eax, str.Server_2008
test ecx, ecx
cmove ebx, eax
mov ecx, dword [ebp - 0x14c]
cmp dword [0x59d748], 0
mov dword [ecx + 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ecx + 8], edi
je 0x448455
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x168]
push eax
call esi
push eax
call dword [0x59d748]
test eax, eax
je 0x448455
mov edi, dword [ebp - 0x14c]
mov ax, word [ebp - 0x15c]
mov word [edi + 0x18], ax
jmp 0x4484d3
mov ebx, 0x5387bc
mov eax, str.Server_2008_R2
jmp 0x44835b
mov ebx, 0x5387d0
mov eax, str.Server_2012
jmp 0x44835b
mov ebx, 0x5387e0
mov eax, str.Server_2012_R2
jmp 0x44835b
mov ebx, str.10__Preview_1_
mov eax, str.Server_10__Preview_1_
jmp 0x44835b
mov eax, dword [ebp - 0x13c]
cmp eax, 0x4e20
jae 0x448419
test ecx, ecx
je 0x448402
mov ebx, 0x53881c
jmp 0x448360
cmp eax, 0x4563
mov ebx, str.Server_2016
mov ecx, str.Server_2019
cmovae ebx, ecx
jmp 0x448360
mov eax, dword [ebp - 0x14c]
mov esi, 0xb
mov dword [eax], 0xb0
mov ebx, 0x538838
mov eax, str.Server_2022
jmp 0x44835b
mov ecx, dword [ebp - 0x14c]
cmp edx, 0x51
jae 0x44844b
mov dword [ecx], ebx
jmp 0x448366
mov ebx, str.12_or_later
jmp 0x448366
mov edi, dword [ebp - 0x14c]
mov eax, 0x14c
mov word [edi + 0x18], ax
lea eax, [ebp - 0x160]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x4484c6
cmp dword [ebp - 0x160], 0
je 0x4484c6
movzx eax, word [edi + 0x18]
mov ecx, 0x14c
cmp ax, cx
jne 0x44849a
mov eax, 0x8664
mov word [edi + 0x18], ax
jmp 0x4484c6
mov ecx, 0x1c0
cmp ax, cx
jne 0x4484af
mov eax, 0xaa64
mov word [edi + 0x18], ax
jmp 0x4484c6
push 0x1c3
push str.D:_a_rufus_rufus_src_stdfn.c
push 0x52be08
call fcn.004dfbbc
add esp, 0xc
push str.Note:_Underlying_Windows_architecture_was_guessed_and_may_be_incorrect...
call fcn.0044b0b0
add esp, 4
movzx eax, word [edi + 0x18]
cmp eax, 0x8664
ja 0x448501
je 0x4484fa
sub eax, 0x14c
je 0x4484f3
sub eax, 0x74
jne 0x448508
mov esi, 0x53239c
jmp 0x448514
mov esi, 0x532390
jmp 0x448514
mov esi, 0x53238c
jmp 0x448514
cmp eax, 0xaa64
je 0x44850f
mov esi, str.unknown
jmp 0x448514
mov esi, str.arm64
lea eax, [ebp - 0x158]
push eax
movzx eax, word [ebp - 0xb2]
push eax
movzx eax, word [ebp - 0xb4]
push eax
push dword [ebp - 0x140]
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
lea ecx, [edi + 0x22]
test ebx, ebx
jne 0x44857e
cmp dword [ebp - 0x138], 2
mov edx, 0x5388e0
push esi
push dword [ebp - 0x140]
mov eax, 0x5388dc
push dword [ebp - 0x144]
cmovne eax, edx
push eax
push str._s__u._u__s
push 0x76
push ecx
call fcn.004050d0
mov byte [edi + 0x97], bl
jmp 0x448a2b
mov ax, word [ebp - 0xb2]
test ax, ax
je 0x4485b1
push esi
movzx eax, ax
push eax
movzx eax, word [ebp - 0xb4]
push eax
push ebx
push str._s_SP_u._u__s
push 0x76
push ecx
call fcn.004050d0
mov byte [edi + 0x97], 0
jmp 0x448a2b
mov ax, word [ebp - 0xb4]
test ax, ax
je 0x4485df
push esi
movzx eax, ax
push eax
push ebx
push str._s_SP_u__s
push 0x76
push ecx
call fcn.004050d0
add esp, 0x18
mov byte [edi + 0x97], 0
jmp 0x448a2e
mov ecx, dword [ebp - 0x158]
cmp ecx, 0x57
ja 0x4487e1
je 0x4487d7
cmp ecx, 0x54
ja case.0x44896a.163
movzx eax, byte [ecx + 0x448d28]
jmp dword [eax*4 + 0x448c6c]
mov eax, 0x52ad5a
jmp 0x448a04
mov eax, str.Ultimate
jmp 0x448a04
mov eax, str.Home_Basic
jmp 0x448a04
mov eax, str.Home_Premium
jmp 0x448a04
mov eax, str.Enterprise
jmp 0x448a04
mov eax, str.Home_Basic_N
jmp 0x448a04
mov eax, str.Business
jmp 0x448a04
mov eax, str.Server_Standard
jmp 0x448a04
mov eax, str.Server_Datacenter
jmp 0x448a04
mov eax, str.Smallbusiness_Server
jmp 0x448a04
mov eax, str.Server_Enterprise
jmp 0x448a04
mov eax, str.Starter
jmp 0x448a04
mov eax, str.Server_Datacenter__Core_
jmp 0x448a04
mov eax, str.Server_Standard__Core_
jmp 0x448a04
mov eax, str.Server_Enterprise__Core_
jmp 0x448a04
mov eax, str.Business_N
jmp 0x448a04
mov eax, str.Web_Server
jmp 0x448a04
mov eax, str.HPC_Edition
jmp 0x448a04
mov eax, str.Storage_Server__Essentials_
jmp 0x448a04
mov eax, str.Home_Premium_N
jmp 0x448a04
mov eax, str.Enterprise_N
jmp 0x448a04
mov eax, str.Ultimate_N
jmp 0x448a04
mov eax, str.Home_Server
jmp 0x448a04
mov eax, str.Server_Standard_without_Hyper_V
jmp 0x448a04
mov eax, str.Server_Datacenter_without_Hyper_V
jmp 0x448a04
mov eax, str.Server_Enterprise_without_Hyper_V
jmp 0x448a04
mov eax, str.Server_Datacenter_without_Hyper_V__Core_
jmp 0x448a04
mov eax, str.Server_Standard_without_Hyper_V__Core_
jmp 0x448a04
mov eax, str.Server_Enterprise_without_Hyper_V__Core_
jmp 0x448a04
mov eax, str.Hyper_V_Server
jmp 0x448a04
mov eax, str.Starter_N
jmp 0x448a04
mov eax, 0x53836c
jmp 0x448a04
mov eax, str.Pro_N
jmp 0x448a04
mov eax, str.Server_Solutions_Premium
jmp 0x448a04
mov eax, str.Server_Solutions_Premium__Core_
jmp 0x448a04
mov eax, str.Server_Hyper_Core_V
jmp 0x448a04
mov eax, str.Starter_E
jmp 0x448a04
mov eax, str.Home_Basic_E
jmp 0x448a04
mov eax, str.Premium_E
jmp 0x448a04
mov eax, str.Pro_E
jmp 0x448a04
mov eax, str.Enterprise_E
jmp 0x448a04
mov eax, str.Ultimate_E
jmp 0x448a04
mov eax, str.Enterprise__Eval_
jmp 0x448a04
mov eax, str.Server_Standard__Eval_
jmp 0x448a04
mov eax, str.Server_Datacenter__Eval_
jmp 0x448a04
mov eax, str.Enterprise_N__Eval_
jmp 0x448a04
mov eax, str.Thin_PC
jmp 0x448a04
cmp ecx, 0x7e
ja 0x4488aa
je 0x4488a0
lea eax, [ecx - 0x58]
cmp eax, 0x25
ja case.0x44896a.163
movzx eax, byte [eax + 0x448dc0]
jmp dword [eax*4 + 0x448d80]
mov eax, str.Embedded
jmp 0x448a04
mov eax, str.Home_N
jmp 0x448a04
mov eax, str.Home_China
jmp 0x448a04
mov eax, str.Home_Single_Language
jmp 0x448a04
mov eax, str.Home
jmp 0x448a04
mov eax, str.Pro_with_Media_Center
jmp 0x448a04
mov eax, str.Home_Connected
jmp 0x448a04
mov eax, str.Pro_Student
jmp 0x448a04
mov eax, str.Home_Connected_N
jmp 0x448a04
mov eax, str.Pro_Student_N
jmp 0x448a04
mov eax, str.Home_Connected_Single_Language
jmp 0x448a04
mov eax, str.Home_Connected_China
jmp 0x448a04
mov eax, str.Education
jmp 0x448a04
mov eax, str.Education_N
jmp 0x448a04
mov eax, str.Enterprise_LTSB
jmp 0x448a04
mov eax, str.Enterprise_LTSB_N
jmp 0x448a04
cmp ecx, 0xa1
ja 0x44894e
je 0x448944
lea eax, [ecx - 0x7f]
cmp eax, 0x16
ja case.0x44896a.163
movzx eax, byte [eax + 0x448e18]
jmp dword [eax*4 + 0x448de8]
mov eax, str.Pro_S
jmp 0x448a04
mov eax, str.Pro_S_N
jmp 0x448a04
mov eax, str.Enterprise_LTSB__Eval_
jmp 0x448a04
mov eax, str.Enterprise_LTSB_N__Eval_
jmp 0x448a04
mov eax, str.Pro_Single_Language
jmp 0x448a04
mov eax, str.Pro_China
jmp 0x448a04
mov eax, str.Enterprise_Subscription
jmp 0x448a04
mov eax, str.Enterprise_Subscription_N
jmp 0x448a04
mov eax, str.Server_Datacenter_SA__Core_
jmp 0x448a04
mov eax, str.Server_Standard_SA__Core_
jmp 0x448a04
mov eax, str.Utility_VM
jmp 0x448a04
mov eax, str.Pro_for_Workstations
jmp 0x448a04
cmp ecx, 0xb6
ja 0x4489a1
je 0x44899a
lea eax, [ecx - 0xa2]
cmp eax, 0xa
ja case.0x44896a.163
movzx eax, byte [eax + 0x448e48]
jmp dword [eax*4 + 0x448e30]
mov eax, str.Pro_for_Workstations_N
jmp 0x448a04
mov eax, str.Pro_for_Education
jmp 0x448a04
mov eax, str.Pro_for_Education_N
jmp 0x448a04
mov eax, str.Enterprise_G
jmp 0x448a04
mov eax, str.Enterprise_G_N
jmp 0x448a04
mov eax, str.Home_OS
jmp 0x448a04
cmp ecx, 0xbd
ja 0x4489ce
je 0x4489c7
mov eax, ecx
sub eax, 0xb7
je 0x4489c0
sub eax, 1
jne case.0x44896a.163
mov eax, str.Cloud_E_N
jmp 0x448a04
mov eax, str.Cloud_E
jmp 0x448a04
mov eax, str.Lite
jmp 0x448a04
cmp ecx, 0xabcdabcd
je 0x4489ff
push ecx
push str._Unknown_Edition_0x_02X_
push 0x40
push 0x59d750
call fcn.004050d0
mov ecx, dword [ebp - 0x158]
add esp, 0x10
mov byte [0x59d78f], 0
mov eax, 0x59d750
jmp 0x448a04
mov eax, str._Unlicensed_
push esi
push eax
test ecx, ecx
lea esi, [edi + 0x22]
mov edx, 0x52ad5a
mov eax, 0x5333c4
cmove eax, edx
push eax
push ebx
push str._s_s_s__s
push 0x76
push esi
call fcn.004050d0
mov byte [esi + 0x75], 0
add esp, 0x1c
mov eax, dword [ebp - 0x158]
mov edx, str.SoftwareMicrosoftWindows_NTCurrentVersionUBR
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 0x13c]
push ecx
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x150]
push eax
push ecx
mov ecx, 0x80000002
call fcn.004474e0
mov eax, dword [ebp - 0x150]
lea ebx, [edi + 0x1a]
add esp, 0xc
mov dword [edi + 0x10], eax
test ebx, ebx
jne 0x448a72
lea edx, [edi + 0x1a]
xor ecx, ecx
jmp 0x448a99
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x448a77
sub ecx, edx
lea edx, [ecx + 0x1a]
mov ecx, ebx
add edx, edi
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x448a90
sub ecx, esi
mov esi, 0x7f
mov eax, esi
sub eax, ecx
cmp dword [ebp - 0x150], 0
mov ecx, dword [ebp - 0x14c]
lea edi, [eax + edx]
mov ecx, dword [ecx + 0xc]
je 0x448acf
push dword [ebp - 0x150]
push ecx
push str.__Build__lu._lu_
push eax
push edx
call fcn.004050d0
add esp, 0x14
jmp 0x448adf
push ecx
push str.__Build__lu_
push eax
push edx
call fcn.004050d0
add esp, 0x10
mov byte [edi - 1], 0
test ebx, ebx
jne 0x448af2
mov edi, dword [ebp - 0x14c]
add edi, 0x1a
jmp 0x448b19
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x448af7
mov edi, dword [ebp - 0x14c]
sub ecx, edx
add edi, 0x1a
add edi, ecx
lea ecx, [ebx + 1]
nop
mov al, byte [ebx]
inc ebx
test al, al
jne 0x448b10
sub ebx, ecx
mov eax, dword [0x59d7ec]
sub esi, ebx
test eax, eax
jne 0x448b75
push str.WldpQueryWindowsLockdownMode
push ecx
mov ecx, str.Wldp
call fcn.00446d60
add esp, 4
push eax
call dword [ebp - 0x164]
mov dword [0x59d7ec], eax
test eax, eax
jne 0x448b75
call fcn.0044b6b0
push eax
push str.Wldp
push str.WldpQueryWindowsLockdownMode
push str.Unable_to_locate__s___in__s.dll:__s
call fcn.0044b0b0
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x154]
push ecx
call eax
test eax, eax
je 0x448bad
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.0044b6b0
push eax
push str.Could_not_detect_S_Mode:__s
call fcn.0044b0b0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [ebp - 0x154], eax
setne al
test eax, eax
je 0x448bd0
push str._in_S_Mode
push esi
push edi
call fcn.004050d0
add esp, 0xc
mov byte [esi + edi - 1], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret