Function at 0x40b030
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x148
push ebx
push ebp
push esi
push edi
push 0x98
lea eax, [esp + 0x20]
push 0
push eax
call fcn.004192e0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0x24]
add esp, 0xc
mov dword [esp + 0x18], 0x9c
push eax
call esi
test eax, eax
jne 0x40b097
push 0x98
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004192e0
add esp, 0xc
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call esi
test eax, eax
je 0x40b381
cmp dword [esp + 0x28], 2
jne 0x40b381
cmp dword [esp + 0x1c], 6
ja 0x40b0ba
jne 0x40b197
cmp dword [esp + 0x20], 2
jb 0x40b1a2
push 1
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, edx
cmp esi, 9
ja 0x40b197
mov edi, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
nop
push 0x94
lea eax, [esp + 0xc4]
push 0
push eax
call fcn.004192e0
add esp, 0xc
mov dword [esp + 0xb8], 0x9c
lea eax, [esp + 0xb8]
mov dword [esp + 0xbc], esi
push ebp
push ebx
push 2
push eax
call edi
test eax, eax
jne 0x40b123
inc esi
cmp esi, 9
jbe 0x40b0e0
jmp 0x40b197
cmp dword [esp + 0x1c], esi
jae 0x40b135
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0
push 1
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov esi, dword [esp + 0x20]
mov ebx, eax
mov ebp, edx
cmp esi, 9
ja 0x40b197
push 0x9c
lea eax, [esp + 0xbc]
push 0
push eax
call fcn.004192e0
add esp, 0xc
mov dword [esp + 0xb8], 0x9c
lea eax, [esp + 0xb8]
mov dword [esp + 0xc0], esi
push ebp
push ebx
push 1
push eax
call edi
test eax, eax
jne 0x40b193
inc esi
cmp esi, 9
jbe 0x40b150
jmp 0x40b197
mov dword [esp + 0x20], esi
cmp dword [esp + 0x1c], 0xf
ja 0x40b381
mov eax, dword [esp + 0x20]
cmp eax, 0xf
ja 0x40b381
cmp byte [esp + 0xb2], 1
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
setbe dl
shl ecx, 4
or ecx, eax
lea eax, [ecx - 0x50]
cmp eax, 0x60
ja case.0x40b1da.83
movzx eax, byte [eax + 0x40b3b4]
jmp dword [eax*4 + 0x40b38c]
mov edi, 1
mov esi, str.2000
jmp 0x40b2c6
mov edi, 2
mov esi, 0x43d5bc
jmp 0x40b2c6
mov edi, 3
mov esi, str.2003
jmp 0x40b2c6
test dl, dl
mov esi, str.Vista
mov eax, str.2008
mov edi, 4
cmove esi, eax
jmp 0x40b2c6
test dl, dl
mov esi, 0x43d5d8
mov eax, str.2008_R2
mov edi, 5
cmove esi, eax
jmp 0x40b2c6
test dl, dl
mov esi, 0x43d5e4
mov eax, str.2012
mov edi, 6
cmove esi, eax
jmp 0x40b2b6
test dl, dl
mov esi, 0x43d5f0
mov eax, str.2012_R2
mov edi, 7
cmove esi, eax
jmp 0x40b2c6
test dl, dl
mov esi, 0x43d5fc
mov eax, str.2016
mov edi, 8
cmove esi, eax
cmp ebx, 0x4e20
jb 0x40b2b1
test dl, dl
mov esi, 0x43d608
mov eax, str.2022
mov edi, 9
cmove esi, eax
jmp 0x40b2b1
cmp ecx, 0x50
jb 0x40b381
mov edi, 0xa
mov esi, str.12_or_later
cmp ecx, 0x62
jne 0x40b2c6
cmp ebx, 0x23f0
mov eax, str.8__or_later_
cmovne eax, esi
mov esi, eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0x14], 0
mov ecx, str.32_bit
mov eax, str.64_bit
cmove eax, ecx
mov cx, word [esp + 0xae]
push eax
test cx, cx
je 0x40b32e
movzx eax, cx
push eax
movzx eax, word [esp + 0xb4]
push eax
push esi
push str.Windows__s_SP_u._u__s
push str.get_windows_version
push 4
push 0
call fcn.00407e20
add esp, 0x20
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov cx, word [esp + 0xb0]
test cx, cx
je 0x40b360
movzx eax, cx
push eax
push esi
push str.Windows__s_SP_u__s
push str.get_windows_version
push 4
push 0
call fcn.00407e20
add esp, 0x1c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.Windows__s__s
push str.get_windows_version
push 4
push 0
call fcn.00407e20
add esp, 0x18
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret