Function at 0x4346f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
mov ebx, ecx
push eax
xor ebp, ebp
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x434a1c
mov eax, dword [esp + 0x20]
sub eax, ebp
je 0x434a07
dec eax
je 0x43494f
dec eax
jne 0x434a1c
mov esi, dword [esp + 0x128]
xor ecx, ecx
mov eax, esi
and eax, 1
or eax, ecx
je 0x43474a
mov ebp, 1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x12c]
and eax, 0xffff
shl eax, 0x10
and ecx, 0xffff
or eax, ecx
cmp eax, 0x50002
ja 0x4347ad
cmp eax, 0x50002
je 0x434894
cmp eax, 0x50000
ja 0x4347a0
je 0x4348d8
cmp eax, 0x30033
je 0x43491c
cmp eax, 0x40000
je 0x4348fa
jmp case.default.0x4347b7
cmp eax, 0x50001
je 0x4348b6
jmp case.default.0x4347b7
add eax, 0xfffa0000
cmp eax, 3
ja case.default.0x4347b7
jmp dword [eax*4 + 0x434a2c]
cmp dword [esp + 0x1c], 0x55f0
jb 0x4347ea
mov eax, esi
xor ecx, ecx
and eax, 0x400000
or eax, ecx
je 0x4347ea
push 0xa0000
push edi
lea edx, [esp + 0x18]
push esi
push edx
mov ecx, ebx
call fcn.00434640
mov ebp, eax
mov eax, esi
xor ecx, ecx
and eax, 0x100000
or eax, ecx
je case.0x4347b7.393219
push 0xa0000
push edi
lea eax, [esp + 0x18]
push esi
push eax
mov ecx, ebx
call fcn.00434640
mov ebp, eax
mov eax, esi
xor ecx, ecx
and eax, 0x80000
or eax, ecx
je case.0x4347b7.393218
push 0x60003
push edi
lea ecx, [esp + 0x18]
push esi
push ecx
mov ecx, ebx
call fcn.00434640
mov ebp, eax
mov eax, esi
xor ecx, ecx
and eax, 0x40000
or eax, ecx
je case.0x4347b7.393217
push 0x60002
push edi
lea edx, [esp + 0x18]
push esi
push edx
mov ecx, ebx
call fcn.00434640
mov ebp, eax
mov eax, esi
xor ecx, ecx
and eax, 0x4000
or eax, ecx
je case.0x4347b7.393216
push 0x60001
push edi
lea eax, [esp + 0x18]
push esi
push eax
mov ecx, ebx
call fcn.00434640
mov ebp, eax
mov eax, esi
xor ecx, ecx
and eax, 0x2000
or eax, ecx
je 0x434894
push 0x60000
push edi
lea ecx, [esp + 0x18]
push esi
push ecx
mov ecx, ebx
call fcn.00434640
mov ebp, eax
mov eax, esi
xor ecx, ecx
and eax, 0x1000
or eax, ecx
je 0x4348b6
push 0x50002
push edi
lea edx, [esp + 0x18]
push esi
push edx
mov ecx, ebx
call fcn.00434640
mov ebp, eax
mov eax, esi
xor ecx, ecx
and eax, 0x200
or eax, ecx
je 0x4348d8
push 0x50001
push edi
lea eax, [esp + 0x18]
push esi
push eax
mov ecx, ebx
call fcn.00434640
mov ebp, eax
mov eax, esi
xor ecx, ecx
and eax, 0x100
or eax, ecx
je 0x4348fa
push 0x50000
push edi
lea ecx, [esp + 0x18]
push esi
push ecx
mov ecx, ebx
call fcn.00434640
mov ebp, eax
mov eax, esi
xor ecx, ecx
and eax, 0x80
or eax, ecx
je 0x43491c
push 0x40000
push edi
lea edx, [esp + 0x18]
push esi
push edx
mov ecx, ebx
call fcn.00434640
mov ebp, eax
mov eax, esi
xor ecx, ecx
and eax, 0x200000
or eax, ecx
je 0x434a1c
push 0x30033
push edi
lea eax, [esp + 0x18]
push esi
push eax
mov ecx, ebx
call fcn.00434640
mov ebp, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 8
mov eax, dword [esp + 0x128]
xor edx, edx
mov ecx, eax
and ecx, 2
or ecx, edx
je 0x434966
mov ebp, 1
cmp dword [esp + 0x14], 4
jne 0x434a1c
mov ecx, dword [esp + 0x18]
mov si, word [esp + 0x26]
test ecx, ecx
je 0x4349bf
cmp ecx, 0xa
je 0x434996
mov ecx, eax
xor edx, edx
and ecx, 0xc70
or ecx, edx
je 0x434996
mov ebp, 1
cmp si, 0x41
mov ecx, eax
jne 0x4349b1
and ecx, 0x820
xor edx, edx
or ecx, edx
je 0x4349cb
mov ebp, 1
jmp 0x4349cb
and ecx, 0x20
xor edx, edx
or ecx, edx
je 0x4349bf
mov ebp, 1
cmp si, 0x43
je 0x4349e8
cmp si, 0x42
je 0x4349e8
and eax, 0x10
xor ecx, ecx
or eax, ecx
je 0x434a1c
mov ebp, 1
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 8
and eax, 0x410
xor ecx, ecx
or eax, ecx
je 0x434a1c
mov ebp, 1
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 8
mov eax, dword [esp + 0x128]
xor ecx, ecx
and eax, 4
or eax, ecx
je 0x434a1c
mov ebp, 1
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 8