Function at 0x42bfd7
Capabilities:
Check os version

Disassembly:
push 0x350
mov eax, 0x5a4a5e
call fcn.0043b389
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x330]
xor edi, edi
mov dword [ebp - 0x338], esi
push 0x118
push edi
mov dword [ebp - 0x354], edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x35c], esi
mov dword [ebp - 0x334], 0x11c
call fcn.004463a0
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.00425b17
test al, al
je 0x42c054
jnp 0x42c0b1
xchg eax, edx
fnsave dword [eax + eax*2 - 0x73]
cmp eax, dword [esi]
cmc
mov ebp, 0x17ebb86e
enter 0x44b2, 0xffffffffffffffdc
mov al, byte [0x3812a21a]
jbe 0x42c00d
aad 0x6e
pop ecx
push 0x5a7890
mov ecx, esi
call fcn.00403660
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x350], eax
movzx eax, byte [ebp - 0x21a]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 4], edi
mov dword [ebp - 0x354], 1
mov dword [ebp - 0x344], edi
mov dword [ebp - 0x348], edi
mov dword [ebp - 0x340], edi
mov dword [ebp - 0x34c], eax
call fcn.00425dc9
test al, al
je 0x42c0d0
cld
invalid
invalid
adc al, 0x9d
invalid
mov dword [0x702ffc85], eax
xor al, 6
add al, 0xa3
push 0x91fb112e
dec ebp
or edx, 0x49
and dword [esi], esp
jne 0x42c0ae
scasd eax, dword es:[edi]
call fcn.00425b5c
test al, al
je 0x42c0f1
mov al, byte [0xce1baabf]
adc dword [esi + 0x55715678], esi
sbb byte [0x2cb61578], bh
je 0x42c07c
stosb byte es:[edi], al
dec ebx
out dx, al
push ss
mov ch, 0xe8
invalid
call fcn.00425be6
test al, al
je 0x42c112
mov byte [ecx], dh
jo 0x42c121
mov ebx, dword [esp + edi*2 + 0x35]
fst dword [esi - 0x30]
in al, dx
mov ebx, es
or al, 0x8b
and ecx, dword [ecx + 0x79]
pop esi
push ecx
shl byte [ebx], cl
xchg dword [eax + 0x20], ebp
mov esp, 0x15ff005a
mov byte [edx + 0x5a], dh
add byte [ebx + 0x74f685f0], cl
cmp ebp, dword [eax + 0x34]
mov esp, 0xff56005a
adc eax, sym.imp.KERNEL32.dll_GetProcAddress
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42c15e
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42c157
lea ecx, [ebp - 0x340]
push ecx
lea ecx, [ebp - 0x348]
push ecx
lea ecx, [ebp - 0x344]
push ecx
call eax
movzx eax, word [ebp - 0x340]
mov dword [ebp - 0x340], eax
test eax, eax
cld
invalid
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.004259be
test al, al
je 0x42c177
sti
add al, 0x5e
in eax, 0xdb
test al, 0x61
inc esi
cmp edx, dword [0x70d08b0c]
cmp dword [ebp - 0x34f7a75], 0xf883ffff
add eax, 0xb8850f
add byte [eax], al
mov eax, dword [ebp - 0x350]
cmp eax, 5
jne 0x42c23e
mov eax, dword [ebp - 0x34c]
test eax, eax
je 0x42c1b2
cmp eax, 1
jne 0x42c234
mov esi, str.WindowsXP
push esi
call fcn.00454a97
pop ecx
mov ecx, dword [ebp - 0x338]
push eax
push esi
call fcn.00402100
mov ebx, dword [ebp - 0x33c]
call fcn.004259be
test al, al
je 0x42c1d1
ja 0x42c152
pop edi
inc ebx
stc
pop eax
aam 0x56
shr byte [eax + 0x528865c6], cl
cld
cmp dword [ebx - 0x33743], ecx
dec dword [ebx + 0x789068cf]
pop edx
add al, ch
sub edx, dword [ebp - 0x3f7a0001]
mov edi, dword [ebp - 0x338]
mov ecx, edi
push 0x5a7890
call fcn.0042570e
test eax, eax
jne 0x42c35a
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004463a0
mov eax, dword [ebp - 0x350]
push ebx
push dword [ebp - 0x34c]
push eax
lea eax, [ebp - 0x218]
push str.Windows_d._d._d
push eax
call fcn.00408e00
add esp, 0x20
cmp word [ebp - 0x218], 0
jne 0x42c33e
xor eax, eax
jmp 0x42c34b
mov esi, str.WindowsServer2003
jmp 0x42c19e
cmp eax, 6
jne 0x42c31c
mov eax, dword [ebp - 0x34c]
sub eax, 0
je 0x42c2ff
sub eax, 1
je 0x42c2f5
mov ebx, dword [ebp - 0x33c]
sub eax, 1
jne 0x42c1b8
cmp ebx, 0x1ebb
je 0x42c289
lea eax, [ebx - 0x1ee6]
cmp eax, 0x25
jbe 0x42c289
cmp ebx, 0x1f13
jne 0x42c290
mov esi, str.Windows8
jmp 0x42c2dc
cmp dword [ebp - 0x344], 0xa
jne 0x42c2bd
cmp dword [ebp - 0x348], 0
jne 0x42c1b8
cmp dword [ebp - 0x340], 0x4e20
jae 0x42c337
mov esi, str.Windows10
jmp 0x42c2dc
cmp dword [ebp - 0x344], 6
jne 0x42c1b8
cmp dword [ebp - 0x348], 3
jne 0x42c1b8
mov esi, str.Windows8.1
push esi
call fcn.00454a97
pop ecx
mov ecx, dword [ebp - 0x338]
push eax
push esi
call fcn.00402100
jmp 0x42c1b8
mov esi, str.Windows7
jmp 0x42c19e
cmp dword [ebp - 0x358], 1
jne 0x42c312
mov esi, str.WindowsVista
jmp 0x42c19e
mov esi, str.WindowsServer2008
jmp 0x42c19e
cmp eax, 0xa
jne 0x42c1b2
clc
or cl, byte [edi]
test dword [ebp - 0x74000002], ecx
popfd
invalid
mov ebx, dword [ebp - 0x33c]
cmp ebx, 0x4e20
jb 0x42c1b8
mov esi, str.Windows11
jmp 0x42c2dc
lea eax, [ebp - 0x218]
push eax
call fcn.00454a97
pop ecx
xchg dword [edx], eax
add byte [ecx + 0x50], bl
push eax
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.00402100
call fcn.00425e53
test al, al
je 0x42c380
inc ebx
xchg esp, eax
out 0x58, al
adc eax, 0x7bdcc5e4
add ebp, eax
adc dword [edi + 0xa00bf1b], edi
inc edi
out dx, al
pop esi
xchg ebx, eax
movsb byte es:[edi], byte [esi]
add ecx, esp
daa
xor dword [esi - 0x1d175a56], esp
wait
invalid
call fcn.00425f67
test al, al
je 0x42c3ad
inc esp
nop
pop es
lodsb al, byte [esi]
xchg dword [ecx], ebx
dec ebp
cmp al, ch
jne 0x42c347
jo 0x42c31d
retf 0x1dc7
cmp dword [ebp + 0xc], 0
je 0x42c3dd
cmp word [ebp - 0x320], 0
jne 0x42c3c1
xor eax, eax
jmp 0x42c3ce
lea eax, [ebp - 0x320]
push eax
call fcn.00454a97
pop ecx
push eax
lea eax, [ebp - 0x320]
mov ecx, edi
push eax
call fcn.00405220
mov eax, edi
call fcn.0043b344
ret