Function at 0x1003aa40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.10053310
test eax, eax
je 0x1003aa67
mov eax, 1
jmp 0x1003b125
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 3
ja case.default.0x1003aa83
mov ecx, dword [ebp - 0x45c]
jmp dword [ecx*4 + 0x1003b138]
call fcn.1003a2c0
mov dword [0x100676bc], eax
cmp dword [0x100676bc], 0x600
jge 0x1003aaac
mov dword [0x1011eafc], 0
jmp 0x1003aaca
push 0
push str.EnableLUA
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
call fcn.1003d040
add esp, 0x10
mov dword [0x1011eafc], eax
mov edx, dword [ebp + 8]
mov dword [0x10280c60], edx
call fcn.100100d0
mov dword [0x10067bd0], eax
cmp dword [0x10067bd0], 0x89578da3
jne 0x1003b074
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1000fce0
add esp, 4
test eax, eax
setne al
mov byte [0x10280c59], al
mov byte [0x10067bcc], 1
call fcn.1002bc50
mov byte [0x10280c58], al
cmp dword [0x100676a8], 0
jne 0x1003ab2a
mov dword [0x100676a8], 0x111111
cmp dword [0x1011d848], 1
jne 0x1003ab4b
mov ecx, dword [0x10120b54]
and ecx, 0x80000000
jne 0x1003ab4b
mov dword [0x100676a8], 0x222222
cmp dword [0x1011d848], 2
jne 0x1003ab6c
mov edx, dword [0x10120b54]
and edx, 0x80000000
jne 0x1003ab6c
mov dword [0x100676a8], 0xaaaaaa
mov eax, dword [0x100676bc]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x601
jg 0x1003abc0
cmp dword [ebp - 0x460], 0x600
jge 0x1003aca8
cmp dword [ebp - 0x460], 0x500
je 0x1003abf5
cmp dword [ebp - 0x460], 0x500
jle 0x1003add1
cmp dword [ebp - 0x460], 0x502
jle 0x1003ac26
jmp 0x1003add1
cmp dword [ebp - 0x460], 0x602
jl 0x1003add1
cmp dword [ebp - 0x460], 0x603
jle 0x1003ad4d
cmp dword [ebp - 0x460], 0xa00
je 0x1003ad4d
jmp 0x1003add1
mov ecx, dword [0x101373fc]
and ecx, 0x40000000
je 0x1003ac17
push str.OS_2000
lea edx, [ebp - 0x408]
push edx
call fcn.10008420
add esp, 8
mov dword [0x10280c5c], 1
jmp 0x1003adef
mov eax, dword [0x101373fc]
and eax, 0x40000000
je 0x1003ac72
cmp dword [0x100676bc], 0x502
jne 0x1003ac52
push str.OS_2003
lea ecx, [ebp - 0x408]
push ecx
call fcn.10008420
add esp, 8
cmp dword [0x100676bc], 0x501
jne 0x1003ac72
push str.OS_XP
lea edx, [ebp - 0x408]
push edx
call fcn.10008420
add esp, 8
movzx eax, byte [0x10067bcc]
test eax, eax
je 0x1003ac8e
mov ecx, dword [0x100676a8]
and ecx, 0xf
mov dword [0x10280c5c], ecx
jmp 0x1003aca3
mov edx, dword [0x100676a8]
and edx, 0xf0
shr edx, 4
mov dword [0x10280c5c], edx
jmp 0x1003adef
mov eax, dword [0x101373fc]
and eax, 0x40000000
je 0x1003ad14
cmp dword [0x100676bc], 0x600
jne 0x1003acd4
push str.OS_VISTA
lea ecx, [ebp - 0x408]
push ecx
call fcn.10008420
add esp, 8
cmp dword [0x100676bc], 0x600
jne 0x1003acf4
push str.OS_2008
lea edx, [ebp - 0x408]
push edx
call fcn.10008420
add esp, 8
cmp dword [0x100676bc], 0x601
jne 0x1003ad14
push str.OS_7
lea eax, [ebp - 0x408]
push eax
call fcn.10008420
add esp, 8
movzx ecx, byte [0x10067bcc]
test ecx, ecx
je 0x1003ad36
mov edx, dword [0x100676a8]
and edx, 0xf00
shr edx, 8
mov dword [0x10280c5c], edx
jmp 0x1003ad48
mov eax, dword [0x100676a8]
and eax, 0xf000
shr eax, 0xc
mov dword [0x10280c5c], eax
jmp 0x1003adef
mov ecx, dword [0x101373fc]
and ecx, 0x40000000
je 0x1003ad9b
cmp dword [0x100676bc], 0x602
jne 0x1003ad7b
push str.OS_8
lea edx, [ebp - 0x408]
push edx
call fcn.10008420
add esp, 8
cmp dword [0x100676bc], 0x602
jne 0x1003ad9b
push str.OS_2012
lea eax, [ebp - 0x408]
push eax
call fcn.10008420
add esp, 8
movzx ecx, byte [0x10067bcc]
test ecx, ecx
je 0x1003adbd
mov edx, dword [0x100676a8]
and edx, 0xf0000
shr edx, 0x10
mov dword [0x10280c5c], edx
jmp 0x1003adcf
mov eax, dword [0x100676a8]
and eax, 0xf00000
shr eax, 0x14
mov dword [0x10280c5c], eax
jmp 0x1003adef
push str.Unknown
lea ecx, [ebp - 0x408]
push ecx
call fcn.10008420
add esp, 8
mov dword [0x10280c5c], 1
mov edx, dword [0x101373fc]
and edx, 0x40000000
je 0x1003aeee
cmp dword [0x10120f8c], 0
je 0x1003aeee
mov eax, dword [0x10280c5c]
and eax, 1
je 0x1003ae24
mov dword [ebp - 0x464], 0x10060a58
jmp 0x1003ae74
mov ecx, dword [0x10280c5c]
and ecx, 2
je 0x1003ae3b
mov dword [ebp - 0x468], 0x10060a5c
jmp 0x1003ae68
mov edx, dword [0x10280c5c]
and edx, 4
je 0x1003ae52
mov dword [ebp - 0x46c], 0x10060a60
jmp 0x1003ae5c
mov dword [ebp - 0x46c], str.UnKnown
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x468]
mov dword [ebp - 0x464], ecx
movzx edx, byte [0x10067bcc]
test edx, edx
je 0x1003aeb6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1000fce0
add esp, 4
test eax, eax
je 0x1003ae9e
mov dword [ebp - 0x470], 0x10060a6c
jmp 0x1003aea8
mov dword [ebp - 0x470], str.32bit_____App
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x474], eax
jmp 0x1003aec0
mov dword [ebp - 0x474], str.64bit_____App
mov ecx, dword [ebp - 0x464]
push ecx
push 0x1011f518
mov edx, dword [ebp - 0x474]
push edx
lea eax, [ebp - 0x408]
push eax
push str._s__s__s__s_
lea ecx, [ebp - 0x208]
push ecx
call fcn.1003e91e
add esp, 0x18
cmp dword [0x1011fd7c], 0
je 0x1003af67
movzx edx, byte [0x10067bcc]
test edx, edx
je 0x1003af39
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1000fce0
add esp, 4
test eax, eax
je 0x1003af21
mov dword [ebp - 0x478], str.32bit_WoW_App
jmp 0x1003af2b
mov dword [ebp - 0x478], str.32bit_App
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x47c], eax
jmp 0x1003af43
mov dword [ebp - 0x47c], str.64bit_App
mov ecx, dword [0x100676a8]
push ecx
mov edx, dword [0x10280c5c]
push edx
mov eax, dword [ebp - 0x47c]
push eax
push str.This_is_a__s___Engine__d_g_tc_Engine_0x_08x_
push 0
call fcn.1003b7a0
add esp, 0x14
lea ecx, [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 8
push 0
lea ecx, [ebp - 0x438]
push ecx
call fcn.1003e4c0
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, dword [ebp - 0x434]
xor edx, edx
mov cl, 0x20
call fcn.10042ef0
mov ecx, dword [ebp - 0x438]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], edx
mov edx, dword [ebp - 0x410]
add edx, 0x989680
mov eax, dword [ebp - 0x40c]
adc eax, 0
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x40c], eax
mov ecx, dword [ebp - 0x410]
mov edx, dword [ebp - 0x40c]
and edx, 0
mov dword [ebp - 0x438], ecx
mov eax, dword [ebp - 0x410]
mov edx, dword [ebp - 0x40c]
mov cl, 0x20
call fcn.10042ed0
mov dword [ebp - 0x434], eax
cmp dword [0x1026cc2c], 0
je 0x1003b04e
mov eax, dword [ebp + 8]
push eax
call fcn.1003b150
jmp 0x1003b072
lea ecx, [ebp - 0x454]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
push fcn.1003b150
push 0
push 0
call fcn.1004036e
add esp, 0x18
mov dword [ebp - 0x458], eax
jmp 0x1003b0b3
cmp dword [0x10067bd0], 0x23785289
jne 0x1003b09f
cmp dword [0x1011fd7c], 0
je 0x1003b09d
push 0x10060803
push str.found_OK_NOBHKOK__s_
push 0
call fcn.1003b7a0
add esp, 0xc
jmp 0x1003b0b3
push 0x1006080a
push str.Cannot_found_ME_______s___perfectly_ridiculous.
push 0
call fcn.1003b7a0
add esp, 0xc
jmp case.default.0x1003aa83
cmp dword [0x10067bd0], 0x89578da3
je 0x1003b0c3
jmp case.default.0x1003aa83
cmp dword [0x1011fd7c], 0x97
je 0x1003b0db
cmp dword [0x1011fd7c], 0x99
jne 0x1003b0ef
push 0x1011f518
push str.ProcessDetach:__s
push 0
call fcn.1003b7a0
add esp, 0xc
call fcn.10010050
mov eax, dword [ebp + 8]
push eax
call fcn.1000fef0
add esp, 4
jmp 0x1003b125
mov ecx, dword [ebp + 8]
push ecx
call fcn.10039b20
add esp, 4
jmp 0x1003b125
mov edx, dword [ebp + 8]
push edx
call fcn.10039b70
add esp, 4
jmp 0x1003b125
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret 0xc