Function at 0x5027c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x118
lea eax, [ebp - 0x19c]
push 0
push eax
call fcn.00580ff0
add esp, 0xc
mov dword [ebp - 0x1a0], 0x11c
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
jns 0x502819
mov dword [0x62dbb0], 0
jmp 0x502c9a
mov eax, dword [ebp - 0x19c]
mov ecx, 0x2e
push 0
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x198]
push 0x50
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x194]
push 0x62db60
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x80]
push 5
push eax
mov dword [ebp - 0x80], 8
mov dword [ebp - 0x68], 0
mov word [ebp - 0x58], cx
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x38], 0
mov word [ebp - 0x28], cx
mov dword [ebp - 0x20], 8
call sym.SystemInformer.exe_PhFormatToBuffer
mov eax, dword [ebp - 0x198]
lea esi, [ebp - 0x1a0]
mov ecx, 0x47
mov edi, 0x633f98
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x19c]
cmp ecx, 6
jne 0x5028ab
jmp 0x5028a0
cmp eax, 1
jb 0x50280a
jmp 0x5028b7
jb 0x50280a
jne 0x502937
cmp eax, 1
jne 0x5028e1
mov dword [0x62dbb0], 0x3d
mov dword [0x62dbb4], 0x60c918
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x50290a
mov dword [0x62dbb0], 0x3e
mov dword [0x62dbb4], 0x60c904
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x502c90
mov dword [0x62dbb0], 0x3f
mov dword [0x62dbb4], 0x60c8ec
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
jmp 0x502940
cmp ecx, 0xa
jne 0x502c90
cmp dword [ebp - 0x198], 0
jne 0x502c90
mov eax, dword ds:[ebp - 0x194]
cmp eax, 0x65f4
jbe 0x50298b
mov eax, 0x603c10
mov dword [0x62dbb0], 0xffffffff
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
jb 0x5029b1
mov eax, str.Windows_11_24H2
mov dword [0x62dbb0], 0x75
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x5867
jb 0x5029dc
mov eax, str.Windows_11_23H2
mov dword [0x62dbb0], 0x74
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea esp, [esp]
cmp eax, 0x585d
jb 0x502a0b
mov eax, str.Windows_11_22H2
mov dword [0x62dbb0], 0x73
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x55f0
jb 0x502a36
mov eax, str.Windows_11
mov dword [0x62dbb0], 0x72
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x4a65
jb 0x502a61
mov eax, str.Windows_10_22H2
mov dword [0x62dbb0], 0x71
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x4a64
jb 0x502a8c
mov eax, str.Windows_10_21H2
mov dword [0x62dbb0], 0x70
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x4a63
jb 0x502ab7
mov eax, str.Windows_10_21H1
mov dword [0x62dbb0], 0x6f
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x4a62
jb 0x502ae2
mov eax, str.Windows_10_20H2
mov dword [0x62dbb0], 0x6e
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x4a61
jb 0x502b0d
mov eax, str.Windows_10_20H1
mov dword [0x62dbb0], 0x6d
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x47bb
jb 0x502b38
mov eax, str.Windows_10_19H2
mov dword [0x62dbb0], 0x6c
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x47ba
jb 0x502b63
mov eax, str.Windows_10_19H1
mov dword [0x62dbb0], 0x6b
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x4563
jb 0x502b8e
mov eax, str.Windows_10_RS5
mov dword [0x62dbb0], 0x6a
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x42ee
jb 0x502bb9
mov eax, str.Windows_10_RS4
mov dword [0x62dbb0], 0x69
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
lea esp, [esp]
cmp eax, 0x3fab
jb 0x502beb
mov eax, str.Windows_10_RS3
mov dword [0x62dbb0], 0x68
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x3ad7
jb 0x502c16
mov eax, str.Windows_10_RS2
mov dword [0x62dbb0], 0x67
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x3839
jb 0x502c41
mov eax, str.Windows_10_RS1
mov dword [0x62dbb0], 0x66
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
cmp eax, 0x295a
jb 0x502c6c
mov eax, str.Windows_10_TH2
mov dword [0x62dbb0], 0x65
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov eax, str.Windows_10
mov dword [0x62dbb0], 0x64
mov dword [0x62dbb4], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov dword [0x62dbb0], 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [0x62dbb4], 0x603c10
pop esi
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret