Function at 0x49f488
Capabilities:
Check os version

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rsi, r9
mov r12, r8
mov r13d, edx
mov rbp, rcx
mov qword [rsp + 0x50], 0xfffffffffffffffe
xor r15d, r15d
mov qword [rsp + 0x20], r15
cmp edx, 0x111
jne 0x49f4e9
mov rax, qword [rcx]
mov r8, r9
mov rdx, r12
call qword [rax + 0xf0]
cmp eax, r15d
je 0x49f4e2
mov qword [rsp + 0x20], 1
jmp case.0x49f6c3.38
xor eax, eax
jmp 0x49fcdc
cmp edx, 0x4e
jne 0x49f517
cmp qword [r9], r15
je 0x49f510
mov rax, qword [rcx]
lea r9, [rsp + 0x20]
mov r8, rsi
mov rdx, r12
call qword [rax + 0xf8]
cmp eax, r15d
jne case.0x49f6c3.38
xor eax, eax
jmp 0x49fcdc
cmp edx, 6
jne 0x49f532
mov rcx, r9
call fcn.0049c99c
mov r8, rax
mov rdx, r12
mov rcx, rbp
call fcn.0049e858
cmp r13d, 0x20
jne 0x49f561
mov rax, rsi
shr rax, 0x10
movzx r8d, ax
movsx edx, si
mov rcx, rbp
call fcn.0049e8cc
cmp eax, r15d
je 0x49f561
mov qword [rsp + 0x20], 1
jmp case.0x49f6c3.38
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x50]
mov r14, rax
mov ebx, eax
xor ebx, r13d
and ebx, 0x1ff
mov ecx, 7
call fcn.004a84f8
lea rdx, [rbx + rbx*2]
lea r8, [0x00400000]
cmp r13d, dword [r8 + rdx*8 + 0xe1af0]
jne 0x49f5d3
cmp r14, qword [r8 + rdx*8 + 0xe1b00]
jne 0x49f5d3
mov rdi, qword [r8 + rdx*8 + 0xe1af8]
mov ecx, 7
call fcn.004a8584
cmp rdi, r15
jne 0x49f5c0
xor eax, eax
jmp 0x49fcdc
mov ecx, 0xc000
cmp r13d, ecx
jb 0x49f683
jmp 0x49fc97
mov dword [r8 + rdx*8 + 0xe1af0], r13d
mov qword [r8 + rdx*8 + 0xe1b00], r14
cmp r14, r15
je 0x49fcc8
mov ecx, 0xc000
cmp r13d, ecx
jae 0x49f625
mov rdi, qword [r14 + 8]
cmp qword [rdi + 0x10], r15
je 0x49f61b
cmp dword [rdi], r13d
jne 0x49f611
cmp dword [rdi + 4], r15d
jne 0x49f611
cmp dword [rdi + 8], r15d
jbe 0x49f61e
add rdi, 0x20
cmp qword [rdi + 0x10], r15
jne 0x49f600
mov rdi, r15
cmp rdi, r15
jne 0x49f671
jmp 0x49f664
mov rdi, qword [r14 + 8]
cmp qword [rdi + 0x10], r15
je 0x49f649
cmp dword [rdi], ecx
jne 0x49f63f
cmp dword [rdi + 4], r15d
jne 0x49f63f
cmp dword [rdi + 8], r15d
jbe 0x49f64c
add rdi, 0x20
cmp qword [rdi + 0x10], r15
jne 0x49f62f
mov rdi, r15
cmp rdi, r15
je 0x49f664
mov rax, qword [rdi + 0x10]
cmp dword [rax], r13d
je 0x49fc85
add rdi, 0x20
jmp 0x49f629
mov r14, qword [r14]
cmp r14, r15
jne 0x49f5f1
jmp 0x49fcc8
mov qword [r8 + rdx*8 + 0xe1af8], rdi
mov ecx, 7
call fcn.004a8584
mov rbx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x10]
cmp dword [rdi + 8], 0x1a
jne 0x49f6a4
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
sbb rax, rax
and rax, 0xfffffffffffffff0
add rax, 0x2f
dec rax
cmp rax, 0x33
ja case.0x49f6c3.38
lea rcx, [0x00400000]
movsxd rax, dword [rcx + rax*4 + 0x9fcf0]
add rax, rcx
jmp rax
mov rcx, r12
call fcn.004a4b5c
mov rdx, rax
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
jmp case.0x49f6c3.38
mov edx, r12d
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
jmp case.0x49f6c3.38
mov rax, rsi
shr rax, 0x10
movzx edi, ax
movsx esi, si
mov rcx, r12
call fcn.0049c99c
mov rdx, rax
mov r9d, edi
mov r8d, esi
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
jmp case.0x49f6c3.38
mov rcx, r12
call fcn.0049c99c
mov rdx, rax
mov r8, rsi
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
jmp case.0x49f6c3.38
mov rdx, rsi
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
jmp case.0x49f6c3.38
lea rcx, [rsp + 0x30]
call fcn.004a4df4
nop
mov rax, qword [rsi + 8]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x60]
call fcn.0049c8c0
nop
mov rcx, qword [rsi]
mov qword [rsp + 0x98], rcx
mov edi, dword [rsi + 0x10]
call fcn.0049d674
cmp rax, r15
jne 0x49f7c9
mov rcx, qword [rbp + 0x68]
cmp rcx, r15
je 0x49f7c4
add rcx, 0x40
mov rdx, qword [rsp + 0x98]
call fcn.0049acbc
mov rcx, qword [rsp + 0xd0]
cmp rax, r15
cmovne rcx, rax
mov qword [rsp + 0xd0], rcx
lea rax, [rsp + 0x60]
mov r9d, edi
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rbp
call rbx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x98], r15
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
call fcn.0049de9c
nop
lea rcx, [rsp + 0x30]
call fcn.004a4ed4
jmp case.0x49f6c3.38
lea rcx, [rsp + 0x30]
call fcn.004a4df4
nop
mov rax, qword [rsi + 8]
mov qword [rsp + 0x38], rax
mov r8d, dword [rsi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call rbx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
call fcn.004a4ed4
jmp case.0x49f6c3.38
mov rax, r12
shr rax, 0x10
movzx edi, ax
mov rcx, rsi
call fcn.0049c99c
mov r8, rax
movzx edx, r12w
mov r9d, edi
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
jmp case.0x49f6c3.38
mov rax, r12
shr rax, 0x10
movzx r8d, ax
movzx edx, r12w
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
jmp case.0x49f6c3.38
mov rax, rsi
shr rax, 0x10
movzx edi, ax
movsx esi, si
mov rcx, r12
call fcn.0049c99c
mov rdx, rax
mov r9d, edi
mov r8d, esi
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
jmp case.0x49f6c3.38
mov rdx, rsi
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
jmp case.0x49f6c3.38
mov r8, rsi
mov rdx, r12
mov rcx, rbp
call rbx
mov qword [rsp + 0x20], rax
jmp case.0x49f6c3.38
mov rcx, rsi
call fcn.004a3c20
mov r9, rax
mov rax, r12
shr rax, 0x10
movzx r8d, ax
movzx edx, r12w
mov rcx, rbp
call rbx
mov qword [rsp + 0x20], rax
jmp case.0x49f6c3.38
mov r8, rsi
mov edx, r12d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rdx, r12
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov r8, rsi
mov rdx, r12
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov edx, r12d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov r8d, esi
mov edx, r12d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rax, rsi
shr rax, 0x10
movsx r8d, ax
movsx edx, si
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rax, rsi
shr rax, 0x10
movzx r9d, ax
movzx r8d, si
mov edx, r12d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rax, rsi
shr rax, 0x10
movzx r9d, ax
movzx r8d, si
mov edx, r12d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov r8, rsi
mov rdx, r12
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rcx, r12
call fcn.0049c99c
mov rdi, rax
mov rcx, rsi
call fcn.0049c99c
mov r8, rax
mov edx, r15d
cmp qword [rbp + 0x38], rsi
sete dl
mov r9, rdi
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rcx, r12
call fcn.004a4b5c
mov rdx, rax
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rcx, r12
call fcn.004a3c20
mov rdx, rax
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rax, rsi
shr rax, 0x10
movzx edi, ax
movzx esi, si
mov rcx, r12
call fcn.004a3c20
mov rdx, rax
mov r9d, edi
mov r8d, esi
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rcx, r12
call fcn.0049c99c
mov rdx, rax
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rcx, rsi
call fcn.0049c99c
mov rdx, rax
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rax, rsi
shr rax, 0x10
movzx edi, ax
movzx esi, si
mov rcx, r12
call fcn.0049c99c
mov rdx, rax
mov r9d, edi
mov r8d, esi
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
movsx eax, si
mov dword [rsp + 0x28], eax
shr esi, 0x10
movsx eax, si
mov dword [rsp + 0x2c], eax
mov rcx, r12
call fcn.0049c99c
mov rdx, rax
mov r8, qword [rsp + 0x28]
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rcx, r12
call fcn.0049c99c
mov rdx, rax
mov r8, rsi
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rcx, rsi
call fcn.0049c99c
mov r8, rax
mov edx, r12d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rax, r12
shr rax, 0x10
movzx edi, ax
mov rcx, rsi
call fcn.0049c99c
mov r8, rax
movzx edx, r12w
mov r9d, edi
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
movsx r13d, r12w
shr r12, 0x10
movsx r12d, r12w
cmp qword [rdi + 0x10], 0x1d
jne 0x49fb46
mov rcx, rsi
call fcn.0049c99c
mov r9, rax
mov r8d, r12d
mov edx, r13d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov r8d, r12d
mov edx, r13d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rdx, rsi
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov r8, rsi
mov edx, r12d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov r8, rsi
mov edx, r12d
mov rcx, rbp
call rbx
mov qword [rsp + 0x20], 1
jmp case.0x49f6c3.38
mov r8, rsi
mov edx, r12d
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
jmp case.0x49f6c3.38
movsx eax, si
mov dword [rsp + 0x28], eax
shr esi, 0x10
movsx eax, si
mov dword [rsp + 0x2c], eax
mov rdx, qword [rsp + 0x28]
mov rcx, rbp
call rbx
mov r11d, eax
mov qword [rsp + 0x20], r11
jmp case.0x49f6c3.38
mov rcx, rbp
call rbx
mov r11d, eax
mov qword [rsp + 0x20], r11
jmp case.0x49f6c3.38
mov r8, rsi
mov edx, r12d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rdx, rsi
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov rax, r12
shr rax, 0x10
movzx r8d, ax
movzx edx, r12w
mov r9, rsi
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
movsx eax, si
mov dword [rsp + 0x28], eax
shr esi, 0x10
movsx eax, si
mov dword [rsp + 0x2c], eax
mov r8, qword [rsp + 0x28]
mov edx, r12d
mov rcx, rbp
call rbx
jmp case.0x49f6c3.38
mov r8, rsi
mov rdx, r12
mov rcx, rbp
call rbx
mov qword [rsp + 0x20], 1
jmp case.0x49f6c3.38
movzx eax, si
mov dword [rsp + 0x28], eax
shr rsi, 0x10
movzx eax, si
mov dword [rsp + 0x2c], eax
mov r8, r12
shr r8, 0x10
movzx edx, r12w
mov r9, qword [rsp + 0x28]
mov rcx, rbp
call rbx
movsxd rcx, eax
mov qword [rsp + 0x20], rcx
cmp rcx, r15
jne case.0x49f6c3.38
xor eax, eax
jmp 0x49fcdc
mov qword [r8 + rdx*8 + 0xe1af8], rdi
mov ecx, 7
call fcn.004a8584
mov r9, qword [rdi + 0x18]
mov r8, rsi
mov rdx, r12
mov rcx, rbp
call r9
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x150]
cmp rdx, r15
je 0x49fcc1
mov rcx, qword [rsp + 0x20]
mov qword [rdx], rcx
mov eax, 1
jmp 0x49fcdc
mov qword [r8 + rdx*8 + 0xe1af8], r15
mov ecx, 7
call fcn.004a8584
xor eax, eax
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret