Function at 0x5e6ec8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x2d
push 0
push 0
dec ecx
jne 0x5e6ed1
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5e7241
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x134]
xor ecx, ecx
mov edx, 0x114
call fcn.00403bd8
mov dword [ebp - 0x134], 0x114
lea eax, [ebp - 0x134]
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 0x130]
cmp eax, 6
jb 0x5e6f31
cmp dword [ebp - 0x12c], 1
jae 0x5e6f36
cmp eax, 0xa
jne 0x5e6fa1
mov byte [ebp - 0x1d], 1
lea ecx, [ebp - 0x140]
mov edx, 0x1a
xor eax, eax
call fcn.00514e38
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.0047a47c
push dword [ebp - 0x13c]
push 0x5e7260
lea eax, [ebp - 0x144]
mov edx, dword [ebp - 0x14]
call fcn.00406d64
push dword [ebp - 0x144]
push 0x5e72ec
lea eax, [ebp - 0x138]
mov edx, 4
call fcn.0040705c
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x10]
call fcn.00406e34
jmp 0x5e6fa5
mov byte [ebp - 0x1d], 0
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.00406d64
cmp byte [ebp - 0x1d], 0
je 0x5e70ae
mov eax, dword [ebp - 8]
call fcn.005e5920
test al, al
je 0x5e70ae
cmp dword [ebp - 0x18], 0
jne 0x5e703f
mov eax, dword [ebp - 8]
call fcn.005e5920
test al, al
je 0x5e70ae
lea eax, [ebp - 0x148]
mov edx, dword [ebp - 0x10]
call fcn.00406e20
mov eax, dword [ebp - 0x148]
call fcn.00471a2c
test al, al
je 0x5e70ae
lea eax, [ebp - 0x14c]
mov edx, dword [ebp - 0x14]
call fcn.00406d64
mov eax, dword [ebp - 0x14c]
call fcn.005e63dc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 0x10]
call fcn.00406e20
mov eax, dword [ebp - 0x150]
push eax
mov eax, dword [0x694354]
mov eax, dword [eax]
call eax
test eax, eax
jmp 0x5e70ae
cmp dword [ebp - 0x18], 1
jne 0x5e70ae
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 0x14]
call fcn.00406d64
mov eax, dword [ebp - 0x154]
call fcn.005e63dc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x158]
mov ecx, dword [ebp - 0x10]
mov edx, 0x5e72fc
call fcn.00406958
mov eax, dword [ebp - 0x158]
call fcn.0040688c
push eax
mov eax, dword [0x694130]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x15c]
mov edx, dword [ebp - 0x10]
call fcn.00406e20
mov eax, dword [ebp - 0x15c]
push eax
mov eax, dword [0x694354]
mov eax, dword [eax]
call eax
test eax, eax
jmp 0x5e71d8
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.005e5a60
cmp dword [ebp - 0xc], 0
je 0x5e71d1
cmp dword [ebp - 8], 0
je 0x5e7136
cmp byte [ebp - 0x1d], 0
je 0x5e70db
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406d64
jmp 0x5e7140
push 1
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x164]
mov edx, dword [ebp - 0x14]
call fcn.00406824
mov eax, dword [ebp - 0x164]
push eax
lea eax, [ebp - 0x168]
mov edx, ebx
call fcn.00406824
mov eax, dword [ebp - 0x168]
mov edx, dword [ebp - 0x18]
and edx, 0x80000001
jns 0x5e711c
dec edx
or edx, 0xfffffffe
inc edx
dec edx
sete cl
pop edx
call fcn.005e5738
mov edx, dword [ebp - 0x160]
lea eax, [ebp - 4]
call fcn.00406e20
jmp 0x5e7140
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406d64
xor eax, eax
push ebp
push 0x5e7166
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.005e5b74
mov dword [ebp - 0x1c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5e71a6
cmp dword [ebp - 0x1c], 0
jne 0x5e71d8
cmp dword [ebp - 0x18], 0
jne 0x5e71d8
lea eax, [ebp - 0x170]
mov edx, dword [ebp - 0x14]
call fcn.00406d64
mov eax, dword [ebp - 0x170]
movzx edx, byte [ebp - 0x1d]
call fcn.005e68d4
jmp 0x5e71d8
mov dword [ebp - 0x1c], 0xfffffffe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e7248
lea eax, [ebp - 0x170]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004066c0
lea eax, [ebp - 0x15c]
call fcn.00406b98
lea eax, [ebp - 0x158]
call fcn.004066a8
lea eax, [ebp - 0x154]
mov edx, 8
call fcn.00406ba0
lea eax, [ebp - 0x10]
call fcn.004066a8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406ba0
ret