Function at 0x42b5a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479186
mov eax, dword fs:[0]
push eax
sub esp, 0x1f8
mov eax, dword [0x49f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1f4], edi
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f8], 0
push 0x20019
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x200]
mov dword [ebp - 4], 0
call fcn.00428c30
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42b6b2
push 0xca
lea eax, [ebp - 0xdc]
push 0
push eax
call fcn.00451eb0
add esp, 0xc
mov dword [ebp - 0x1f4], 0x64
lea eax, [ebp - 0x1f4]
lea ecx, [ebp - 0x200]
push eax
lea eax, [ebp - 0xdc]
push eax
push str.ProductName
call fcn.00428ce0
mov esi, dword [ebp - 0x200]
test esi, esi
je 0x42b680
push esi
call ebx
xor esi, esi
mov dword [ebp - 0x200], esi
cmp word [ebp - 0xdc], 0
mov dword [ebp - 0x1fc], 0
je 0x42b6b8
lea eax, [ebp - 0xdc]
mov ecx, edi
push eax
call fcn.00407540
test esi, esi
je 0x42b8e9
push esi
call ebx
jmp 0x42b8e9
mov esi, dword [ebp - 0x200]
call fcn.004067b0
mov ecx, eax
test ecx, ecx
jne 0x42b6cd
push 0x80004005
call fcn.004064f0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1f4], eax
push 0x110
lea eax, [ebp - 0x1ec]
mov byte [ebp - 4], 1
push 0
push eax
mov dword [ebp - 0x1f0], 0x114
call fcn.00451eb0
add esp, 0xc
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x1e0]
sub eax, 0
je 0x42b89e
sub eax, 1
je 0x42b7f8
sub eax, 1
jne 0x42b8b0
mov eax, dword [ebp - 0x1ec]
cmp eax, 4
ja 0x42b74d
push str.Microsoft_Windows_NT
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
jmp 0x42b8b0
cmp eax, 5
jne 0x42b7a5
mov eax, dword [ebp - 0x1e8]
test eax, eax
jne 0x42b771
push str.Microsoft_Windows_2000
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
jmp 0x42b8b0
cmp eax, 1
jne 0x42b78b
push str.Microsoft_Windows_XP
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
jmp 0x42b8b0
cmp eax, 2
jne 0x42b7e3
push str.Microsoft_Windows_Server_2003
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
jmp 0x42b8b0
cmp eax, 6
jne 0x42b7e3
mov eax, dword [ebp - 0x1e8]
test eax, eax
jne 0x42b7c9
push str.Microsoft_Windows_Vista
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
jmp 0x42b8b0
cmp eax, 1
jne 0x42b7e3
push str.Microsoft_Windows_Longhorn_Server
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
jmp 0x42b8b0
push str.Microsoft_Windows_Vista_Later
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
jmp 0x42b8b0
cmp dword [ebp - 0x1ec], 4
jne 0x42b88c
mov eax, dword [ebp - 0x1e8]
test eax, eax
jne 0x42b844
push str.Microsoft_Windows_95
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
mov ax, word [ebp - 0x1da]
cmp ax, 0x43
je 0x42b832
cmp ax, 0x42
jne 0x42b8b0
push str._OSR2
lea ecx, [ebp - 0x1f4]
call fcn.00412a30
jmp 0x42b8b0
cmp eax, 0xa
jne 0x42b875
push str.Microsoft_Windows_98
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
cmp word [ebp - 0x1da], 0x41
jne 0x42b8b0
push 0x4940fc
lea ecx, [ebp - 0x1f4]
call fcn.00412a30
jmp 0x42b8b0
cmp eax, 0x5a
jne 0x42b88c
push str.Microsoft_Windows_Me
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
jmp 0x42b8b0
push str.Microsoft_Windows_Me_later
lea ecx, [ebp - 0x1f4]
call fcn.004076d0
jmp 0x42b8b0
push 0x10
push str.Microsoft_Win32s
lea ecx, [ebp - 0x1f4]
call fcn.004085a0
mov ebx, dword [ebp - 0x1f4]
add ebx, 0xfffffff0
mov ecx, ebx
call fcn.004087c0
add eax, 0x10
mov byte [ebp - 4], 0
mov dword [edi], eax
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x42b8de
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x42b8e9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044df7a
mov esp, ebp
pop ebp
ret