Function at 0x47bf70
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0x58
push 0xffffffffffffffff
push 0x52acf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
mov dword [ebp + 0x54], 0
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x47bff8
push str.Cannot_get_OS_version_information
lea ecx, [ebp + 0x2c]
call fcn.00406b80
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp + 0x2c]
push ecx
lea ecx, [ebp]
call fcn.00454570
push 0x572e5c
lea edx, [ebp]
push edx
call fcn.004be2db
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp + 0x2c]
call fcn.00407040
mov eax, dword [ebp - 0x9c]
mov dword [ebp + 0x48], eax
cmp dword [ebp + 0x48], 4
je 0x47c14a
cmp dword [ebp + 0x48], 5
je 0x47c0b5
cmp dword [ebp + 0x48], 6
je 0x47c020
jmp 0x47c1d3
mov ecx, dword [ebp - 0x98]
mov dword [ebp + 0x44], ecx
cmp dword [ebp + 0x44], 0
je 0x47c03d
cmp dword [ebp + 0x44], 1
je 0x47c05b
cmp dword [ebp + 0x44], 2
je 0x47c079
jmp 0x47c097
push str.Windows_Vista_Server_2008
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
push str.Windows_7_Server_2008_R2
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
push str.Windows_8_Server_2012
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
mov eax, dword [ebp - 0x98]
mov dword [ebp + 0x50], eax
cmp dword [ebp + 0x50], 0
je 0x47c0d2
cmp dword [ebp + 0x50], 1
je 0x47c0f0
cmp dword [ebp + 0x50], 2
je 0x47c10e
jmp 0x47c12c
push str.Windows_2000
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
push str.Windows_XP
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
push str.Windows_Server_2003_Windows_Server_2003_R2
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
mov edx, dword [ebp - 0x98]
mov dword [ebp + 0x4c], edx
cmp dword [ebp + 0x4c], 0
je 0x47c167
cmp dword [ebp + 0x4c], 0xa
je 0x47c182
cmp dword [ebp + 0x4c], 0x5a
je 0x47c19d
jmp 0x47c1b8
push str.Windows_95_Windows_NT_4.0
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
push str.Windows_98
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
push str.Windows_ME
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x47c1ec
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.00406b80
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add ebp, 0x58
mov esp, ebp
pop ebp
ret