Function at 0x11658
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x15390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4e
pop edi
xor ebx, ebx
push edi
lea eax, [ebp - 0x52]
push ebx
push eax
mov word [ebp - 0x54], bx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.ntoskrnl.exe_PsGetVersion]
push 0x50
pop esi
push esi
lea eax, [ebp - 0x54]
push eax
push 0x14d0a
push 0x14c8c
call fcn.00010d14
test al, al
je 0x11999
cmp dword [ebp - 0x60], 5
jne 0x1184d
cmp dword [ebp - 0x58], ebx
jne 0x11705
xor eax, eax
mov dword [0x1540c], esi
mov dword [0x1542c], 0x1a4
mov dword [0x15424], 0x1fc
mov dword [0x153f8], 0xa0
inc eax
mov dword [0x15420], 0x4a
mov dword [0x15428], 0x20
jmp 0x1199b
cmp dword [ebp - 0x58], 1
jne 0x11738
push 2
mov dword [0x1540c], 0x190
mov dword [0x1542c], 0x22c
mov dword [0x15424], 0x174
mov dword [0x153f8], 0x88
pop eax
jmp 0x116ec
cmp dword [ebp - 0x58], 2
jne 0x11999
lea eax, [ebp - 0x54]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x11748
sub eax, edx
sar eax, 1
jne 0x1179c
mov dword [0x1540c], 0x170
mov dword [0x1542c], 0x234
mov dword [0x15424], 0x154
mov dword [0x153f8], 0x88
mov dword [0x15420], 0x4a
mov dword [0x15428], 0x30
push 3
pop eax
jmp 0x1199b
push 4
mov esi, 0x14c6e
lea ecx, [ebp - 0x54]
pop eax
mov dx, word [ecx]
cmp dx, word [esi]
jne 0x117cb
cmp dx, bx
je 0x117c7
mov dx, word [ecx + 2]
cmp dx, word [esi + 2]
jne 0x117cb
add ecx, eax
add esi, eax
cmp dx, bx
jne 0x117a7
xor ecx, ecx
jmp 0x117d0
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
jne 0x11812
mov dword [0x1540c], 0x180
mov dword [0x1542c], 0x224
mov dword [0x15424], 0x164
mov dword [0x153f8], 0x98
mov dword [0x15420], 0x3e
mov dword [0x15428], 0x74
jmp 0x11794
mov edx, 0x14c50
lea ecx, [ebp - 0x54]
mov si, word [ecx]
cmp si, word [edx]
jne 0x1183e
cmp si, bx
je 0x1183a
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1183e
add ecx, eax
add edx, eax
cmp si, bx
jne 0x1181a
xor eax, eax
jmp 0x11843
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x11999
jmp 0x117d4
cmp dword [ebp - 0x60], 6
jne 0x11999
cmp dword [ebp - 0x58], ebx
jne 0x11925
lea eax, [ebp - 0x54]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x11866
sub eax, edx
push 4
sar eax, 1
pop eax
jne 0x118b6
mov dword [0x1540c], 0x168
mov dword [0x1542c], 0x248
mov dword [0x15424], 0x14c
mov dword [0x153f8], 0xa0
mov dword [0x15420], edi
mov dword [0x15428], 0x84
jmp 0x1199b
mov esi, 0x14c6e
lea ecx, [ebp - 0x54]
mov dx, word [ecx]
cmp dx, word [esi]
jne 0x118e2
cmp dx, bx
je 0x118de
mov dx, word [ecx + 2]
cmp dx, word [esi + 2]
jne 0x118e2
add ecx, eax
add esi, eax
cmp dx, bx
jne 0x118be
xor ecx, ecx
jmp 0x118e7
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
je 0x11879
mov edx, 0x14c50
lea ecx, [ebp - 0x54]
mov si, word [ecx]
cmp si, word [edx]
jne 0x11917
cmp si, bx
je 0x11913
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x11917
add ecx, eax
add edx, eax
cmp si, bx
jne 0x118f3
xor ecx, ecx
jmp 0x1191c
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
jne 0x11999
jmp 0x11879
cmp dword [ebp - 0x58], 1
jne 0x11999
lea eax, [ebp - 0x54]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x11931
sub eax, edx
sar eax, 1
jne 0x11984
mov dword [0x1540c], 0x188
mov dword [0x1542c], 0x268
mov dword [0x15424], 0x16c
mov dword [0x153f8], 0xb8
mov dword [0x15420], 0x56
mov dword [0x15428], 0x88
push 5
jmp 0x11796
lea eax, [ebp - 0x54]
push 0x14c6e
push eax
call dword [sym.imp.ntoskrnl.exe_wcsstr]
test eax, eax
pop ecx
pop ecx
jne 0x11941
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00012c87
leave
ret