Function at 0x4c07b0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0x58
push 0xffffffffffffffff
push 0x4fd480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
mov dword [ebp + 0x54], 0
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4c0838
push str.Cannot_get_OS_version_information
lea ecx, [ebp + 0x2c]
call fcn.004763c0
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp + 0x2c]
push ecx
lea ecx, [ebp]
call fcn.004a5010
push 0x548710
lea edx, [ebp]
push edx
call fcn.004d0a2b
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp + 0x2c]
call fcn.004769f0
mov eax, dword [ebp - 0x9c]
mov dword [ebp + 0x48], eax
cmp dword [ebp + 0x48], 4
je 0x4c098a
cmp dword [ebp + 0x48], 5
je 0x4c08f5
cmp dword [ebp + 0x48], 6
je 0x4c0860
jmp 0x4c0a13
mov ecx, dword [ebp - 0x98]
mov dword [ebp + 0x44], ecx
cmp dword [ebp + 0x44], 0
je 0x4c087d
cmp dword [ebp + 0x44], 1
je 0x4c089b
cmp dword [ebp + 0x44], 2
je 0x4c08b9
jmp 0x4c08d7
push str.Windows_Vista_Server_2008
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
push str.Windows_7_Server_2008_R2
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
push str.Windows_8_Server_2012
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
mov eax, dword [ebp - 0x98]
mov dword [ebp + 0x50], eax
cmp dword [ebp + 0x50], 0
je 0x4c0912
cmp dword [ebp + 0x50], 1
je 0x4c0930
cmp dword [ebp + 0x50], 2
je 0x4c094e
jmp 0x4c096c
push str.Windows_2000
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
push str.Windows_XP
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
push str.Windows_Server_2003_Windows_Server_2003_R2
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
mov edx, dword [ebp - 0x98]
mov dword [ebp + 0x4c], edx
cmp dword [ebp + 0x4c], 0
je 0x4c09a7
cmp dword [ebp + 0x4c], 0xa
je 0x4c09c2
cmp dword [ebp + 0x4c], 0x5a
je 0x4c09dd
jmp 0x4c09f8
push str.Windows_95_Windows_NT_4.0
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
push str.Windows_98
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
push str.Windows_ME
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov edx, dword [ebp + 0x54]
or edx, 1
mov dword [ebp + 0x54], edx
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov eax, dword [ebp + 0x54]
or eax, 1
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0x4c0a2c
push str.Unknown
mov ecx, dword [ebp + 0x60]
call fcn.004763c0
mov ecx, dword [ebp + 0x54]
or ecx, 1
mov dword [ebp + 0x54], ecx
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add ebp, 0x58
mov esp, ebp
pop ebp
ret