Function at 0x423a80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x11c
lea eax, [ebp - 0x128]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.005a7a20
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x423adc
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push 0x61f24c
push edi
call fcn.004057a0
mov eax, dword [ebp - 0x124]
add esp, 0x14
add eax, 0xfffffffc
cmp byte [ebp - 0xe], 1
jne 0x423c72
cmp eax, 6
ja case.0x423c7b.3
jmp dword [eax*4 + 0x423dd8]
cmp dword [ebp - 0x120], 0
jne case.default.0x423d0c
push 0x61f260
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x120]
sub eax, 0
je 0x423b9b
sub eax, 1
je 0x423b7d
sub eax, 1
jne case.default.0x423d0c
push 0x61f2c4
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push 0x61f2ac
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push 0x61f290
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x120]
cmp eax, 3
ja case.default.0x423d0c
jmp dword [eax*4 + 0x423df4]
push 0x61f2e8
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push 0x61f304
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push 0x61f318
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push 0x61f32c
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x120], 0
jne case.default.0x423d0c
push 0x61f344
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
cmp eax, 6
ja case.0x423c7b.3
jmp dword [eax*4 + 0x423e04]
cmp dword [ebp - 0x120], 0
jne case.default.0x423d0c
push 0x61f36c
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x120]
sub eax, 0
je 0x423cdf
sub eax, 2
jne case.default.0x423d0c
push 0x61f3b8
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push 0x61f390
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x120]
cmp eax, 3
ja case.default.0x423d0c
jmp dword [eax*4 + 0x423e20]
push 0x61f3e0
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push str.windows_server_2008_r2
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push 0x61f438
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push str.windows_server_2012_r2
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x120], 0
jne case.default.0x423d0c
push 0x61f490
mov ecx, esi
call fcn.00405970
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push 7
push 0x61f35c
mov ecx, esi
call fcn.00403da0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.005a3521
mov esp, ebp
pop ebp
ret