Function at 0x4609ad
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x124
mov eax, dword [0x502344]
xor eax, ebp
mov dword [ebp + 0x74], eax
push edi
push 0x118
lea eax, [ebp - 0xa4]
push 0
push eax
call fcn.0049d850
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x11c
call edi
mov dword [ebp - 0xac], eax
test eax, eax
jne 0x460a1d
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call edi
test eax, eax
jne 0x460a1d
push 0x4dbd8c
jmp 0x460d6c
mov eax, dword [ebp - 0x98]
sub eax, 0
je 0x460d67
dec eax
je 0x460cee
dec eax
jne 0x460a13
cmp dword [ebp - 0xa4], 6
jne 0x460b43
cmp dword [ebp - 0xa0], 1
jne 0x460abe
cmp byte [ebp + 0x72], 1
jne 0x460a8d
call fcn.0043e8f0
test al, al
movzx eax, word [ebp + 0x6c]
je 0x460a76
dec eax
je 0x460a6c
push str.Windows_7_x64
jmp 0x460d6c
push str.Windows_7_x64_Service_Pack_1
jmp 0x460d6c
dec eax
je 0x460a83
push str.Windows_7_x86
jmp 0x460d6c
push str.Windows_7_x86_Service_Pack_1
jmp 0x460d6c
call fcn.0043e8f0
test al, al
je 0x460ab1
movzx eax, word [ebp + 0x6c]
dec eax
je 0x460aa7
push str.Windows_Server_2008_R2_x64
jmp 0x460d6c
push str.Windows_Server_2008_R2_x64_Service_Pack_1
jmp 0x460d6c
cmp dword [ebp - 0xa4], 6
jne 0x460b43
cmp dword [ebp - 0xa0], 0
jne 0x460a13
cmp byte [ebp + 0x72], 1
jne 0x460b26
call fcn.0043e8f0
test al, al
movzx eax, word [ebp + 0x6c]
je 0x460b02
dec eax
je 0x460af8
dec eax
je 0x460aee
push str.Windows_Vista_x64
jmp 0x460d6c
push str.Windows_Vista_x64_Service_Pack_2
jmp 0x460d6c
push str.Windows_Vista_x64_Service_Pack_1
jmp 0x460d6c
dec eax
je 0x460b1c
dec eax
je 0x460b12
push str.Windows_Vista_x86
jmp 0x460d6c
push str.Windows_Vista_x86_Service_Pack_2
jmp 0x460d6c
push str.Windows_Vista_x86_Service_Pack_1
jmp 0x460d6c
call fcn.0043e8f0
test al, al
je 0x460b39
push str.Windows_Server_2008_x64
jmp 0x460d6c
push str.Windows_Server_2008_x86
jmp 0x460d6c
cmp dword [ebp - 0xa4], 5
jne 0x460c7f
cmp dword [ebp - 0xa0], 2
jne 0x460be0
cmp byte [ebp + 0x72], 1
jne 0x460b8b
movzx eax, word [ebp + 0x6c]
dec eax
je 0x460b81
dec eax
je 0x460b77
push str.Windows_XP_x64
jmp 0x460d6c
push str.Windows_XP_x64_Service_Pack_2
jmp 0x460d6c
push str.Windows_XP_x64_Service_Pack_1
jmp 0x460d6c
call fcn.0043e8f0
test al, al
movzx eax, word [ebp + 0x6c]
je 0x460bbc
dec eax
je 0x460bb2
dec eax
je 0x460ba8
push str.Windows_Server_2003_x64
jmp 0x460d6c
push str.Windows_Server_2003_x64_Service_Pack_2
jmp 0x460d6c
push str.Windows_Server_2003_x64_Service_Pack_1
jmp 0x460d6c
dec eax
je 0x460bd6
dec eax
je 0x460bcc
push str.Windows_Server_2003_x86
jmp 0x460d6c
push str.Windows_Server_2003_x86_Service_Pack_2
jmp 0x460d6c
push str.Windows_Server_2003_x86_Service_Pack_1
jmp 0x460d6c
cmp dword [ebp - 0xa0], 1
jne 0x460c27
cmp dword [ebp - 0xac], 0
jne 0x460bfc
push str.Windows_XP_x86
jmp 0x460d6c
movzx eax, word [ebp + 0x6c]
dec eax
je 0x460c1d
dec eax
je 0x460c13
dec eax
jne 0x460bf2
push str.Windows_XP_x86_Service_Pack_3
jmp 0x460d6c
push str.Windows_XP_x86_Service_Pack_2
jmp 0x460d6c
push str.Windows_XP_x86_Service_Pack_1
jmp 0x460d6c
cmp dword [ebp - 0xa0], 0
jne 0x460a13
cmp dword [ebp - 0xac], 0
jne 0x460c47
push str.Windows_2000
jmp 0x460d6c
movzx eax, word [ebp + 0x6c]
dec eax
je 0x460c75
dec eax
je 0x460c6b
dec eax
je 0x460c61
dec eax
jne 0x460c3d
push str.Windows_2000_Service_Pack_4
jmp 0x460d6c
push str.Windows_2000_Service_Pack_3
jmp 0x460d6c
push str.Windows_2000_Service_Pack_2
jmp 0x460d6c
push str.Windows_2000_Service_Pack_1
jmp 0x460d6c
cmp dword [ebp - 0xa4], 4
ja 0x460a13
cmp dword [ebp - 0xac], 0
jne 0x460c9f
push str.Windows_NT_4.0
jmp 0x460d6c
movzx eax, word [ebp + 0x6c]
dec eax
je 0x460ce7
dec eax
je 0x460cdd
dec eax
je 0x460cd3
dec eax
je 0x460cc9
dec eax
je 0x460cbf
dec eax
jne 0x460c95
push str.Windows_NT_4.0_Service_Pack_6
jmp 0x460d6c
push str.Windows_NT_4.0_Service_Pack_5
jmp 0x460d6c
push str.Windows_NT_4.0_Service_Pack_4
jmp 0x460d6c
push str.Windows_NT_4.0_Service_Pack_3
jmp 0x460d6c
push str.Windows_NT_4.0_Service_Pack_2
jmp 0x460d6c
push str.Windows_NT_4.0_Service_Pack_1
jmp 0x460d6c
cmp dword [ebp - 0xa4], 4
jne 0x460a13
cmp dword [ebp - 0xa0], 0
jne 0x460d28
cmp dword [ebp - 0x9c], 0x3b6
jbe 0x460d17
push str.Windows_95_OSR
jmp 0x460d6c
cmp word [ebp - 0x92], 0x43
jne 0x460d67
push str.Windows_95_OSR2.5
jmp 0x460d6c
cmp dword [ebp - 0xa0], 0xa
jne 0x460d53
cmp word [ebp - 0x92], 0x41
je 0x460d4c
cmp word [ebp - 0x92], 0x42
je 0x460d4c
push str.Windows_98
jmp 0x460d6c
push str.Windows_98_SE
jmp 0x460d6c
cmp dword [ebp - 0xa0], 0x5a
jne 0x460a13
push str.Windows_Millennium
jmp 0x460d6c
push str.Windows_95
push esi
call fcn.00405d54
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
mov eax, esi
pop edi
call fcn.0049cdcb
add ebp, 0x78
leave
ret