Function at 0x4eb1ce
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62fde7
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x652018]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x652018]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x2c], ebx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x48], eax
cmp dword [ebx], eax
jne 0x4eb239
cmp byte [esi], 0x2a
je 0x4eb237
mov eax, dword [esi + 0x1c]
jmp 0x4eb239
xor eax, eax
mov edi, dword [0x660170]
test eax, 0xffffff
je 0x4eb2ae
push 0x30
push 0xc
push dword [0x65e8d0]
call edi
push 0x30
push 0
push eax
mov dword [esp + 0x28], eax
call 0x5a49da
mov eax, dword [esp + 0x28]
add esp, 0xc
mov dword [esp + 0x28], eax
test eax, eax
je 0x4eb2a4
mov ecx, eax
call 0x3f684e
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x1c]
mov ecx, eax
push esi
mov dword [eax], 0x41f164
call 0x3bffbe
mov dword [esp + 0x80], 0xffffffff
mov ecx, dword [esp + 0x1c]
jmp 0x4eb2aa
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x44], ecx
xor eax, eax
cmp dword [ebx], eax
jne 0x4eb2ba
mov eax, dword [esi + 0xa8]
test eax, 0xffffff
je 0x4eb31f
push 0x30
push 0xc
push dword [0x65e8d0]
call edi
push 0x30
mov ebx, eax
push 0
push ebx
mov dword [esp + 0x3c], ebx
call 0x5a49da
add esp, 0xc
mov dword [esp + 0x28], ebx
test ebx, ebx
je 0x4eb315
mov ecx, ebx
call 0x3f684e
mov dword [esp + 0x80], 1
mov ecx, ebx
push esi
mov dword [ebx], 0x41f160
call 0x3c015e
mov dword [esp + 0x80], 0xffffffff
jmp 0x4eb31b
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x24]
mov ecx, ebx
push esi
push 0x121
call fcn.004bf00e
test al, al
je 0x4eba0c
mov eax, dword [ebx + 4]
cmp dword [eax + 0xa54], 0
jne 0x4eb38b
mov eax, dword [ebx + 8]
push 0
push 0
push dword [ebx + 0xc]
mov ecx, dword [eax + 0x38]
push 0x125
call 0x3c62de
test eax, eax
jne 0x4eb365
mov dword [esp + 0x20], eax
jmp 0x4eb398
test byte [0x65bd74], 0x80
je 0x4eb374
mov eax, dword [eax + 0x80]
push 0
push 0
push 0
push eax
mov ecx, ebx
call fcn.004baf3e
mov ecx, dword [ebx + 4]
mov dword [ecx + 0xa54], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0xa54]
mov dword [esp + 0x20], eax
mov esi, dword [0x66016c]
xor ecx, ecx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + ecx*4 + 0x44]
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x4eb9a6
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x80], 2
mov eax, dword [ecx + 0x24]
mov dword [ecx + 0x28], eax
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x4eb5a6
mov esi, dword [eax]
test esi, esi
je 0x4eb5a6
add eax, 4
mov dword [ecx + 0x28], eax
test esi, esi
je 0x4eb5a6
movzx eax, byte [esi]
cmp eax, 3
je 0x4eb408
cmp eax, 6
jne 0x4eb419
mov esi, dword [esi + 0x50]
jmp 0x4eb415
mov ecx, esi
call 0x3dc91e
test eax, eax
je 0x4eb415
mov esi, eax
test esi, esi
jne 0x4eb3f6
mov cl, byte [esi]
movzx eax, cl
test byte [eax + eax*2 + 0x405210], 8
je 0x4eb482
test byte [eax + eax*2 + 0x405211], 0x80
je 0x4eb44c
mov ecx, dword [esi + 0x50]
call 0x3dc91e
mov ecx, eax
call 0x3c4d6e
mov ecx, eax
call 0x3c4d6e
mov ecx, eax
jmp 0x4eb44e
mov ecx, esi
test byte [ecx + 0x60], 0x80
je 0x4eb478
movzx eax, byte [ecx]
test byte [eax + eax*2 + 0x405210], 0x10
je 0x4eb469
mov eax, dword [ecx + 0xac]
jmp 0x4eb46b
xor eax, eax
test eax, eax
je 0x4eb478
mov ecx, eax
call 0x3da6ae
jmp 0x4eb495
cmp byte [ecx], 0x2a
je 0x4eb493
mov eax, dword [ecx + 0x20]
jmp 0x4eb48a
cmp cl, 0x2a
je 0x4eb493
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4eb493
mov eax, dword [eax + 0xc]
jmp 0x4eb495
xor eax, eax
test eax, eax
je 0x4eb595
test byte [eax + 5], 0x20
je 0x4eb595
lea ecx, [esp + 0x54]
mov dword [esp + 0x10], 0x2d
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [eax + 0x14]
call 0x3f356e
test al, al
je 0x4eba2c
mov eax, dword [esp + 0x54]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4eb54d
mov cl, byte [esi]
mov edi, dword [esi + 4]
movzx eax, cl
test byte [eax + eax*2 + 0x405210], 8
je 0x4eb4f0
mov ecx, esi
call 0x3c4d6e
jmp 0x4eb4fc
cmp cl, 5
jne 0x4eb505
mov ecx, esi
call 0x3e9cce
test eax, eax
je 0x4eb528
mov eax, dword [eax + 0x50]
jmp 0x4eb52a
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4eb528
mov edi, edi
mov al, byte [ecx]
cmp al, 5
je 0x4eb4f7
movzx eax, al
test byte [eax + eax*2 + 0x405210], 8
jne 0x4eb4e9
mov ecx, dword [ecx + 0x14]
test ecx, ecx
jne 0x4eb50e
xor eax, eax
test eax, eax
je 0x4eb542
cmp dword [eax + 0x4c], 0
jne 0x4eb542
push edi
push esi
add eax, 0x1c4
push 0x7ef9
jmp 0x4eb573
push edi
push esi
xor eax, eax
push 0x7ef9
jmp 0x4eb573
jns 0x4eb57c
mov edi, dword [esi + 4]
mov ecx, esi
call 0x3e0c1e
test eax, eax
je 0x4eb56a
cmp dword [eax + 0x4c], 0
jne 0x4eb56a
add eax, 0x1c4
jmp 0x4eb56c
xor eax, eax
push edi
push esi
push 0x7efa
push eax
call 0x3cd30e
add esp, 0x10
push ecx
lea ecx, [esp + 0x38]
call 0x3ca1de
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
jmp 0x4eb3d3
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], 0
jmp 0x4eb3d3
mov ebx, dword [esp + 0x3c]
push 0x566c90
push 4
push dword [esp + 0x40]
push ebx
call dword [0x660320]
mov ecx, dword [esp + 0x28]
add esp, 0x10
mov edi, 1
mov eax, dword [ecx + 0x24]
mov dword [ecx + 0x28], eax
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x4eb974
mov esi, dword [eax]
test esi, esi
je 0x4eb974
add eax, 4
mov dword [ecx + 0x28], eax
test esi, esi
je 0x4eb974
movzx eax, byte [esi]
cmp eax, 3
je 0x4eb603
cmp eax, 6
jne 0x4eb614
mov esi, dword [esi + 0x50]
jmp 0x4eb610
mov ecx, esi
call 0x3dc91e
test eax, eax
je 0x4eb610
mov esi, eax
test esi, esi
jne 0x4eb5f1
test byte [esi + 0x78], 6
mov ecx, dword [esp + 0x18]
jne 0x4eb5ce
xor bl, bl
mov dword [esp + 0x5c], edi
jmp 0x4eb62e
push 0x566c90
push 4
push dword [esp + 0x40]
lea eax, [esp + 0x20]
mov dword [esp + 0x20], edi
push dword [esp + 0x48]
inc edi
push eax
call dword [0x660350]
add esp, 0x14
test eax, eax
jne 0x4eb62e
mov ecx, esi
call fcn.004eb11e
test al, al
je 0x4eb669
mov dword [esp + 0x14], 0xfffffffc
jmp 0x4eb6b4
mov cl, byte [esi]
cmp cl, 0x1f
jne 0x4eb8a1
test byte [esi + 0x8c], 4
je 0x4eb687
mov dword [esp + 0x14], 0
jmp 0x4eb6b4
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4eb691
mov ecx, dword [ecx + 0xc]
test ecx, ecx
je 0x4eb6b4
test byte [ecx + 5], 0x20
je 0x4eb6b4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x2d
push eax
add ecx, 0x14
call 0x3f305e
mov dword [esp + 0x14], eax
mov cl, byte [esi]
cmp cl, 0x1f
jne 0x4eb8a1
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4eb6c9
mov ecx, dword [ecx + 0xc]
test ecx, ecx
je 0x4eb6ea
test byte [ecx + 5], 0x20
je 0x4eb6ea
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x2d
push eax
add ecx, 0x14
call 0x3f305e
jmp 0x4eb749
mov eax, dword [esp + 0x2c]
xor edx, edx
cmp dword [eax], edx
jne 0x4eb6f7
mov edx, dword [esi + 0x1c]
mov eax, dword [esp + 0x14]
lea ebx, [esp + 0x58]
mov dword [esp + 0x6a], eax
mov eax, dword [esp + 0x24]
push ebx
push 8
lea ebx, [esp + 0x70]
mov dword [esp + 0x60], 0xc000000
mov eax, dword [eax + 0x10]
push ebx
push dword [esp + 0x2c]
mov word [esp + 0x78], 1
mov word [esp + 0x7e], 0
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x94]
test eax, eax
jns 0x4eb747
push 0
push 0
push 0
push eax
call dword [0x660144]
mov bl, 1
mov ecx, dword [esi + 0x80]
test ecx, ecx
je 0x4eb7ec
call 0x3da59e
cmp eax, 6
jne 0x4eb7ec
mov ecx, dword [esi + 0x80]
mov dl, byte [ecx]
movzx eax, dl
test byte [eax + eax*2 + 0x405210], 8
je 0x4eb788
call 0x3c4d6e
mov ecx, eax
call 0x3da6ae
jmp 0x4eb79b
cmp dl, 0x2a
je 0x4eb799
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x4eb799
mov eax, dword [eax + 0xc]
jmp 0x4eb79b
xor eax, eax
test eax, eax
je 0x4eb7bc
test byte [eax + 5], 0x20
je 0x4eb7bc
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x2d
push ecx
lea ecx, [eax + 0x14]
call 0x3f305e
jmp 0x4eb7ec
mov edx, dword [esp + 0x2c]
xor eax, eax
mov ecx, dword [esi + 0x80]
cmp dword [edx], eax
jne 0x4eb7d8
cmp byte [ecx], 0x2a
je 0x4eb7d6
mov eax, dword [ecx + 0x1c]
jmp 0x4eb7d8
xor eax, eax
push dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
push dword [esp + 0x24]
push eax
call fcn.004bec1e
mov bl, 1
mov ecx, dword [esi + 0x84]
test ecx, ecx
je 0x4eb855
call 0x3da59e
cmp eax, 6
jne 0x4eb855
mov ecx, dword [esi + 0x84]
mov dl, byte [ecx]
movzx eax, dl
test byte [eax + eax*2 + 0x405210], 8
je 0x4eb823
call 0x3c4d6e
mov ecx, eax
call 0x3da6ae
jmp 0x4eb836
cmp dl, 0x2a
je 0x4eb834
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x4eb834
mov eax, dword [eax + 0xc]
jmp 0x4eb836
xor eax, eax
test eax, eax
je 0x4eb86a
test byte [eax + 5], 0x20
je 0x4eb86a
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x2d
push ecx
lea ecx, [eax + 0x14]
call 0x3f305e
mov ecx, dword [esp + 0x18]
test bl, bl
jne 0x4eb5ce
mov edi, dword [esp + 0x5c]
jmp 0x4eb5ce
mov edx, dword [esp + 0x2c]
xor eax, eax
mov ecx, dword [esi + 0x84]
cmp dword [edx], eax
jne 0x4eb886
cmp byte [ecx], 0x2a
je 0x4eb884
mov eax, dword [ecx + 0x1c]
jmp 0x4eb886
xor eax, eax
push dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
push dword [esp + 0x24]
push eax
call fcn.004bec1e
mov ecx, dword [esp + 0x18]
jmp 0x4eb5ce
movzx eax, cl
test byte [eax + eax*2 + 0x405210], 8
je 0x4eb8be
mov ecx, esi
call 0x3c4d6e
mov ecx, eax
call 0x3da6ae
jmp 0x4eb8d1
cmp cl, 0x2a
je 0x4eb8cf
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4eb8cf
mov eax, dword [eax + 0xc]
jmp 0x4eb8d1
xor eax, eax
test eax, eax
je 0x4eb8fd
test byte [eax + 5], 0x20
je 0x4eb8fd
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x2d
push ecx
lea ecx, [eax + 0x14]
call 0x3f305e
mov edi, dword [esp + 0x5c]
mov ecx, dword [esp + 0x18]
jmp 0x4eb5ce
mov eax, dword [esp + 0x2c]
xor edx, edx
cmp dword [eax], edx
jne 0x4eb913
cmp byte [esi], 0x2a
je 0x4eb911
mov edx, dword [esi + 0x1c]
jmp 0x4eb913
xor edx, edx
mov eax, dword [esp + 0x14]
lea esi, [esp + 0x28]
mov dword [esp + 0x62], eax
mov eax, dword [esp + 0x24]
push esi
push 8
lea esi, [esp + 0x68]
mov dword [esp + 0x30], 0xc000000
mov eax, dword [eax + 0x10]
push esi
push dword [esp + 0x2c]
mov word [esp + 0x70], 1
mov word [esp + 0x76], 0
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x94]
mov ecx, dword [esp + 0x18]
test eax, eax
jns 0x4eb5ce
push 0
push 0
push 0
push eax
call dword [0x660144]
mov ecx, dword [esp + 0x18]
jmp 0x4eb5ce
mov dword [esp + 0x80], 0xffffffff
mov ebx, dword [esp + 0x3c]
mov esi, dword [0x66016c]
test ebx, ebx
je 0x4eb998
push ebx
push 0
push dword [0x65e8d0]
call esi
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x40]
inc ecx
mov dword [esp + 0x40], ecx
cmp ecx, 2
jl 0x4eb3a4
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x28], ebx
test ebx, ebx
je 0x4eb9e2
mov dword [esp + 0x80], 0xffffffff
lea ecx, [ebx + 4]
call 0x3bd04e
push ebx
push 0
push dword [0x65e8d0]
call esi
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
test ebx, ebx
je 0x4eba0c
mov dword [esp + 0x80], 0xffffffff
lea ecx, [ebx + 4]
call 0x3bd04e
push ebx
push 0
push dword [0x65e8d0]
call esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call 0x59f18f
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x44]
call dword [0x660330]
mov byte [esp + 0x80], 3
mov dword [esp + 0x44], 0x40cc48
mov dword [esp + 0x50], 0x41edf0
mov byte [esp + 0x80], 2
lea eax, [esp + 0x44]
push 0x651bb0
push eax
call 0x5a4c84
int3