Function at 0x4be2e0
Capabilities:
Check os version

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x398
mov rsi, qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, ecx
mov ecx, 5
call rsi
mov ecx, 6
mov dword [0x0069fb18], eax
call rsi
cmp eax, dword [0x0069fb18]
jg 0x4be640
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.DISPLAY
call qword [sym.imp.GDI32.dll_CreateDCA]
test ebp, ebp
mov rbx, rax
mov rdi, qword [0x00670bd0]
je 0x4be622
mov rax, qword [rdi]
lea rcx, [0x0069fa40]
call qword [rax + 0x3e0]
mov dword [rsp + 0x230], 0x158
mov dword [rsp + 0xb0], 0x94
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0xb4], 5
jbe 0x4be520
mov edx, dword [rsp + 0x230]
lea rbp, [rsp + 0x230]
xor r9d, r9d
mov ecx, 0x29
mov r12, qword [sym.imp.USER32.dll_SystemParametersInfoA]
mov r8, rbp
call r12
lea rcx, [rbp + 0xa0]
lea rbp, [rsp + 0x50]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov rcx, rbx
mov rdx, rax
mov r13, rax
mov r14, qword [sym.imp.GDI32.dll_SelectObject]
call r14
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetTextMetricsA]
mov r8, rbp
mov edx, 0x20
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetTextFaceA]
mov edx, 0x5a
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, dword [rsp + 0x70]
sub ecx, dword [rsp + 0x7c]
mov r8d, eax
mov edx, 0x48
call qword [sym.imp.KERNEL32.dll_MulDiv]
cmp dword [rsp + 0x8c], 0x2bb
mov dword [rsp + 0x2c], eax
mov ecx, 0xd
setg r15b
cmp byte [rsp + 0xa0], 0
jne 0x4be540
call qword [sym.imp.GDI32.dll_GetStockObject]
mov rcx, rbx
mov rdx, rax
call r14
mov rcx, rbx
lea rbx, [rsp + 0x30]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, qword [rdi]
mov rdx, rbp
lea rcx, [0x0069fa40]
call qword [rax + 0x3c0]
mov r8d, dword [rsp + 0x2c]
lea rdx, [0x0064c57d]
mov rcx, rbx
call sub.msvcrt.dll_sprintf
mov rax, qword [rdi]
mov rdx, rbx
lea rcx, [0x0069fa40]
call qword [rax + 0x3c0]
test r15b, r15b
jne 0x4be689
call fcn.0042fa20
test eax, eax
jle 0x4be601
mov ecx, 0x48
call rsi
mov ecx, 7
mov dword [0x0069fb2c], eax
call rsi
mov ebx, eax
mov ecx, 5
call rsi
mov ecx, 0x47
add ebx, eax
call rsi
mov edi, eax
mov ecx, 7
call rsi
lea edx, [rbx + rdi + 7]
and edx, 0xfff8
sub edx, eax
mov dword [0x0069fb30], edx
mov dword [0x0069fb28], 1
call fcn.0042fa20
cmp eax, 2
je 0x4be670
add rsp, 0x398
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x230]
lea edx, [rax - 4]
mov dword [rsp + 0x230], edx
jmp 0x4be38c
call qword [sym.imp.GDI32.dll_GetStockObject]
mov rcx, rbx
mov rdx, rax
call r14
mov rcx, rbx
lea rbx, [rsp + 0x30]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, qword [rdi]
mov rdx, rbp
lea rcx, [0x0069fa40]
call qword [rax + 0x3c0]
mov r8d, dword [rsp + 0x2c]
lea rdx, [0x0064c57d]
mov rcx, rbx
call sub.msvcrt.dll_sprintf
mov rax, qword [rdi]
mov rdx, rbx
lea rcx, [0x0069fa40]
lea rbx, [rsp + 0x150]
call qword [rax + 0x3c0]
mov rax, qword [rdi]
mov rcx, rbx
call qword [rax + 0x3e0]
test r15b, r15b
jne 0x4be652
mov rax, qword [rdi]
lea rdx, str.italic
mov rcx, rbx
call qword [rax + 0x3c0]
mov rax, qword [rdi]
mov rdx, qword [rsp + 0x150]
lea rcx, [0x0069fa40]
call qword [rax + 0x3c0]
mov rax, qword [rdi]
mov rcx, rbx
call qword [rax + 0x3d0]
call fcn.0042fa20
test eax, eax
jg 0x4be4ad
call qword [sym.imp.USER32.dll_GetMenuCheckMarkDimensions]
mov edx, eax
and eax, 0xffff
shr edx, 0x10
mov dword [0x0069fb30], eax
mov dword [0x0069fb2c], edx
jmp 0x4be4ee
mov rax, qword [rdi]
lea rcx, [0x0069fa40]
call qword [rax + 0x3d0]
jmp 0x4be343
mov ecx, 6
call rsi
mov dword [0x0069fb18], eax
jmp 0x4be31c
mov rax, qword [rdi]
lea rdx, str.bold
mov rcx, rbx
call qword [rax + 0x3c0]
jmp 0x4be5bd
xor r9d, r9d
lea r8, [0x0069fb28]
xor edx, edx
mov ecx, 0x100a
call r12
jmp 0x4be506
mov rax, qword [rdi]
lea rbx, [rsp + 0x150]
mov rcx, rbx
call qword [rax + 0x3e0]
mov rax, qword [rdi]
lea rdx, str.bold
mov rcx, rbx
call qword [rax + 0x3c0]
jmp 0x4be5d0