Function at 0x4e572370
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0x58
push 0xffffffffffffffff
push 0x4e5a9cc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
mov dword [ebp + 0x54], 0
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4e5723f8
push str.Cannot_get_OS_version_information
lea ecx, [ebp + 0x2c]
call fcn.4e514340
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp + 0x2c]
push ecx
lea ecx, [ebp]
call fcn.4e54f470
push 0x4e5d2f54
lea edx, [ebp]
push edx
call fcn.4e58a47b
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp + 0x2c]
call fcn.4e5144a0
mov eax, dword [ebp - 0x9c]
mov dword [ebp + 0x48], eax
cmp dword [ebp + 0x48], 4
je 0x4e57254a
cmp dword [ebp + 0x48], 5
je 0x4e5724b5
cmp dword [ebp + 0x48], 6
je 0x4e572420
jmp 0x4e5725d3
mov ecx, dword [ebp - 0x98]
mov dword [ebp + 0x44], ecx
cmp dword [ebp + 0x44], 0
je 0x4e57243d
cmp dword [ebp + 0x44], 1
je 0x4e57245b
cmp dword [ebp + 0x44], 2
je 0x4e572479
jmp 0x4e572497
push str.Windows_Vista_Server_2008
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
push str.Windows_7_Server_2008_R2
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
push str.Windows_8_Server_2012
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
mov eax, dword [ebp - 0x98]
mov dword [ebp + 0x50], eax
cmp dword [ebp + 0x50], 0
je 0x4e5724d2
cmp dword [ebp + 0x50], 1
je 0x4e5724f0
cmp dword [ebp + 0x50], 2
je 0x4e57250e
jmp 0x4e57252c
push str.Windows_2000
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
push str.Windows_XP
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
push str.Windows_Server_2003_Windows_Server_2003_R2
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
mov edx, dword [ebp - 0x98]
mov dword [ebp + 0x4c], edx
cmp dword [ebp + 0x4c], 0
je 0x4e572567
cmp dword [ebp + 0x4c], 0xa
je 0x4e572582
cmp dword [ebp + 0x4c], 0x5a
je 0x4e57259d
jmp 0x4e5725b8
push str.Windows_95_Windows_NT_4.0
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
push str.Windows_98
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
push str.Windows_ME
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4e5725ec
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.4e514340
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add ebp, 0x58
mov esp, ebp
pop ebp
ret