Function at 0x421f10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cc2dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc8
push str.unknown_Windows_version
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov byte [ebp - 0x24], 0
mov dword [ebp - 0xb8], 0x94
lea ecx, [ebp - 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x421f6a
xor eax, eax
jmp 0x42240d
mov dword [ebp - 0xd0], 0x14
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 0x20]
push eax
push 1
push str.PROCESSOR_ARCHITECTURE
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
call fcn.00428f6d
add esp, 0x14
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0xc8]
call fcn.004ad12e
mov dword [ebp - 4], 0
push 0x5247e8
lea edx, [ebp - 0xc8]
push edx
call fcn.00415f90
and eax, 0xff
test eax, eax
je 0x421fc9
mov byte [ebp - 0x24], 0
jmp 0x421fcd
mov byte [ebp - 0x24], 1
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xb0]
mov dword [ebp - 0xbc], ecx
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0xac]
and eax, 0xffff
mov dword [ebp - 0xc0], eax
push 0x5b7940
mov ecx, dword [ebp + 0x10]
call fcn.004ad249
cmp dword [ebp - 0xcc], 1
jne 0x42217f
cmp dword [ebp - 0xc4], 4
jne 0x42217f
cmp dword [ebp - 0xbc], 0xa
jae 0x422059
cmp dword [ebp - 0xc0], 0x3b6
jne 0x422059
push str.Windows_95
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 1
jmp 0x42217a
cmp dword [ebp - 0xbc], 0xa
jae 0x422095
cmp dword [ebp - 0xc0], 0x3b6
jbe 0x422095
cmp dword [ebp - 0xc0], 0x438
ja 0x422095
push str.Windows_95_SP1
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov edx, dword [ebp + 0xc]
mov dword [edx], 2
jmp 0x42217a
cmp dword [ebp - 0xbc], 0xa
jae 0x4220c5
cmp dword [ebp - 0xc0], 0x438
jbe 0x4220c5
push str.Windows_95_OSR2
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov eax, dword [ebp + 0xc]
mov dword [eax], 3
jmp 0x42217a
cmp dword [ebp - 0xbc], 0xa
jne 0x4220f5
cmp dword [ebp - 0xc0], 0x7ce
jne 0x4220f5
push str.Windows_98
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 4
jmp 0x42217a
cmp dword [ebp - 0xbc], 0xa
jne 0x42212e
cmp dword [ebp - 0xc0], 0x7ce
jbe 0x42212e
cmp dword [ebp - 0xc0], 0x887
jae 0x42212e
push str.Windows_98_SP1
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov edx, dword [ebp + 0xc]
mov dword [edx], 5
jmp 0x42217a
cmp dword [ebp - 0xbc], 0xa
jne 0x42215b
cmp dword [ebp - 0xc0], 0x887
jb 0x42215b
push str.Windows_98_SE
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov eax, dword [ebp + 0xc]
mov dword [eax], 6
jmp 0x42217a
cmp dword [ebp - 0xbc], 0x5a
jne 0x42217a
push str.Windows_ME
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 7
jmp 0x4223eb
cmp dword [ebp - 0xcc], 2
jne 0x4223cc
cmp dword [ebp - 0xc4], 3
jne 0x4221b9
cmp dword [ebp - 0xbc], 0x33
jne 0x4221b9
push str.Windows_NT_3.51
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x65
jmp 0x4223ca
cmp dword [ebp - 0xc4], 4
jne 0x4221e6
cmp dword [ebp - 0xbc], 0
jne 0x4221e6
push str.Windows_NT_4
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x66
jmp 0x4223ca
cmp dword [ebp - 0xc4], 5
jne 0x422213
cmp dword [ebp - 0xbc], 0
jne 0x422213
push str.Windows_2000
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x67
jmp 0x4223ca
cmp dword [ebp - 0xc4], 5
jne 0x42224f
cmp dword [ebp - 0xbc], 1
jne 0x42224f
push str.Windows_XP
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x68
lea eax, [ebp - 0xa4]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004ad249
jmp 0x4223ca
cmp dword [ebp - 0xc4], 5
jne 0x4222b0
cmp dword [ebp - 0xbc], 2
jne 0x4222b0
mov ecx, dword [ebp - 0x24]
and ecx, 0xff
test ecx, ecx
je 0x422286
push str.Windows_X64
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x6a
jmp 0x42229c
push str.Windows_2003
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x69
lea ecx, [ebp - 0xa4]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004ad249
jmp 0x4223ca
cmp dword [ebp - 0xc4], 6
jne 0x422311
cmp dword [ebp - 0xbc], 0
jne 0x422311
mov edx, dword [ebp - 0x24]
and edx, 0xff
test edx, edx
je 0x4222e7
push str.Windows_VistaX64
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x6c
jmp 0x4222fd
push str.Windows_VistaX86
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x6b
lea edx, [ebp - 0xa4]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.004ad249
jmp 0x4223ca
cmp dword [ebp - 0xc4], 6
jb 0x42236e
cmp dword [ebp - 0xbc], 1
jne 0x42236e
mov eax, dword [ebp - 0x24]
and eax, 0xff
test eax, eax
je 0x422347
push str.Windows_Win7X64
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x6e
jmp 0x42235d
push str.Windows_Win7X86
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x6d
lea eax, [ebp - 0xa4]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004ad249
jmp 0x4223ca
cmp dword [ebp - 0xc4], 6
jb 0x4223ca
cmp dword [ebp - 0xbc], 2
jb 0x4223ca
mov ecx, dword [ebp - 0x24]
and ecx, 0xff
test ecx, ecx
je 0x4223a5
push str.Windows_Win8X64
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x70
jmp 0x4223bb
push str.Windows_Win8X86
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x6f
lea ecx, [ebp - 0xa4]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004ad249
jmp 0x4223eb
cmp dword [ebp - 0xcc], 3
jne 0x4223eb
push str.Windows_CE
mov ecx, dword [ebp + 8]
call fcn.004ad249
mov edx, dword [ebp + 0xc]
mov dword [edx], 0xc9
mov dword [ebp - 0xd4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.004ad0c0
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret