Function at 0x40b4b0
Capabilities:
Check os version
Create thread
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x694
mov eax, dword [0x4946c0]
xor eax, esp
mov dword [esp + 0x690], eax
push ebx
push esi
mov eax, ecx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
imul ecx, ecx, 0x1d4
mov edx, edi
imul edx, edx, 0x584
mov dword [esp + 0x10], eax
lea ebx, [ecx + eax + 0x6c]
lea eax, [edx + eax + 0x1d46c]
push 0
mov dword [esp + 0x18], eax
call sub.dxwnd.dll_Ordinal_5
mov ecx, dword [esp + 0x18]
mov esi, eax
add esp, 4
neg esi
sbb esi, esi
neg esi
add ecx, 0x51
mov eax, ecx
lea edx, [eax + 1]
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40b520
sub eax, dword [esp + 0x20]
je 0x40b533
mov dword [esp + 0x1c], ecx
jmp 0x40b53a
lea eax, [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x174]
and eax, 0x300000
neg eax
sbb eax, eax
add eax, 1
mov dword [esp + 0x20], eax
je 0x40b580
mov ecx, 0x75
mov esi, ebx
lea edi, [esp + 0xc0]
push 0x1d4
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x298]
push 0
push ecx
call fcn.00451440
mov esi, dword [esp + 0x24]
mov edi, dword [ebp + 0xc]
add esp, 0xc
mov eax, dword [esp + 0x14]
add eax, 0x156
cmp byte [eax], 0
jne 0x40b5cf
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x584]
push 0x118
push eax
call fcn.004530e6
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x478]
push 0x118
push edx
call fcn.004530e6
add esp, 0x18
lea eax, [esp + 0x580]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
jmp 0x40b5fc
push eax
lea ecx, [esp + 0x584]
push 0x118
push ecx
call fcn.004530e6
mov edx, dword [esp + 0x28]
push edx
lea eax, [esp + 0x478]
push 0x118
push eax
call fcn.004530e6
add esp, 0x18
cmp dword [esp + 0x20], 0
je 0x40b658
test dword [ebx + 0x17c], 0x80000000
je 0x40b638
lea ecx, [esp + 0x468]
call fcn.00408520
push 0x104
lea ecx, [esp + 0x46c]
push ecx
lea edx, [esp + 0xcc]
push edx
call fcn.00452230
add esp, 0xc
cmp dword [ebp + 8], 1
jne 0x40b646
and dword [esp + 0x22c], 0xffffffef
lea eax, [esp + 0xc0]
push eax
push 0
call sub.dxwnd.dll_Ordinal_1
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea eax, [ebx + 4]
push eax
push edi
push str.OnRun_idx_d_prog__s__mode_x_n
mov dword [esp + 0x2c], eax
call fcn.0041ab40
add esp, 0x10
test dword [ebx + 0x17c], 0x20000
je 0x40b6a9
push 0x10
push 0xea61
push 0xea83
call fcn.0041a120
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x690]
xor ecx, esp
call fcn.00450c28
mov esp, ebp
pop ebp
ret 8
test byte [ebx + 0x164], 8
je 0x40b6fb
push 0x90
lea edx, [esp + 0x30]
push 0
push edx
mov dword [esp + 0x34], 0x94
call fcn.00451440
add esp, 0xc
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40b6fb
cmp dword [esp + 0x2c], 6
jb 0x40b6fb
push str.self_elevation_n
call fcn.0041ab40
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00404420
add esp, 8
test dword [ebx + 0x16c], 0x400
jne 0x40b713
test dword [ebx + 0x170], 0x40000000
je 0x40b778
mov edx, dword [esp + 0x10]
cmp dword [edx + 0x64], 0
je 0x40b759
push 0x41
push 0xea61
push 0xea84
call fcn.0041a120
add esp, 0xc
cmp eax, 1
jne 0x40b759
mov ecx, dword [esp + 0x14]
push edi
push ebx
mov esi, 0x4967c0
call fcn.0040a5c0
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
add esp, 8
xor ecx, ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
push str.export_virtual_registry_entry__d__n
call fcn.0041ab40
mov eax, dword [esp + 0x18]
mov edi, dword [eax + 0x56c]
add esp, 4
call fcn.00407830
mov edi, dword [ebp + 0xc]
test byte [ebx + 0x188], 0x60
je 0x40b7c7
mov ecx, dword [esp + 0x10]
cmp dword [ecx + 0x68], 0
je 0x40b7c7
push 0x41
push 0xea61
push 0xeaa0
call fcn.0041a120
add esp, 0xc
cmp eax, 1
jne 0x40b7c7
mov ecx, dword [esp + 0x14]
push edi
push ebx
mov esi, 0x4967c0
call fcn.0040a5c0
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
add esp, 8
xor ecx, ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
test dword [ebx + 0x17c], 0x2000
je 0x40b7ea
push str.checksafediscversion_n
call fcn.0041ab40
mov edx, dword [esp + 0x20]
push edx
call fcn.004083f0
add esp, 8
test byte [ebx + 0x164], 2
je 0x40b800
push str.__COMPAT_LAYERHIGHDPIAWARE
call fcn.00453efc
add esp, 4
mov eax, dword [ebx + 0x190]
mov edi, eax
shr edi, 5
and edi, 1
test dword [ebx + 0x168], 0x20000000
mov cl, 0x10
je 0x40b8b9
test byte [ebx + 0x16c], cl
je 0x40b8b9
test esi, esi
je 0x40b8b9
push str.debugger_mode_n
call fcn.0041ab40
add esp, 4
cmp dword [ebp + 8], 2
jne 0x40b861
mov ecx, dword [esp + 0x10]
push 0x30
push str.Warning
push str.Suspended_mode_not_available_for_debug_hook
call fcn.0042ae63
jmp 0x40ba42
push 0x85c
call fcn.004525be
mov edi, eax
mov ecx, 0x75
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x18]
lea edi, [eax + 0x1d4]
mov ecx, 0x161
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x46c]
push ecx
mov dword [esp + 0x20], eax
add eax, 0x758
push 0x104
push eax
call fcn.004530e6
mov edx, dword [esp + 0x28]
add esp, 0x10
push 0
push 0
push edx
push 0x418130
jmp 0x40ba31
test dword [ebx + 0x17c], 0x8000
je 0x40b928
test byte [ebx + 0x16c], cl
je 0x40b928
test esi, esi
je 0x40b928
mov esi, dword [ebp + 8]
cmp esi, 2
jne 0x40b8e0
mov eax, str.SUSPENDED
jmp 0x40b8ef
mov eax, str.UNHOOKED
cmp esi, 1
je 0x40b8ef
mov eax, str.DEFAULT
push eax
push esi
push str.injectsuspended_mode_d__s__n
call fcn.0041ab40
mov eax, dword [esp + 0x20]
xor ecx, ecx
push eax
cmp esi, 2
sete cl
push ebx
push edi
lea edx, [esp + 0x598]
lea eax, [esp + 0x480]
push ecx
push edx
push eax
call fcn.00418e00
add esp, 0x24
jmp 0x40ba42
test eax, 0x80000
je 0x40b9b4
test byte [ebx + 0x16c], cl
je 0x40b9b4
test esi, esi
je 0x40b9b4
cmp dword [ebp + 8], 2
jne 0x40b95f
mov ecx, dword [esp + 0x10]
push 0x30
push str.Warning
push str.Suspended_mode_not_available_for_proxy_hook
call fcn.0042ae63
jmp 0x40ba42
push 0x85c
call fcn.004525be
mov edi, eax
mov ecx, 0x75
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x18]
lea edi, [eax + 0x1d4]
mov ecx, 0x161
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x46c]
push ecx
mov dword [esp + 0x20], eax
add eax, 0x758
push 0x104
push eax
call fcn.004530e6
mov edx, dword [esp + 0x28]
add esp, 0x10
push 0
push 0
push edx
push 0x418b70
jmp 0x40ba31
push str.setwindowshook_mode_n
call fcn.0041ab40
add esp, 4
cmp dword [ebp + 8], 2
jne 0x40b9de
mov ecx, dword [esp + 0x10]
push 0x30
push str.Warning
push str.Suspended_mode_useless_for_windows_hook
call fcn.0042ae63
jmp 0x40ba42
push 0x85c
call fcn.004525be
mov edi, eax
mov ecx, 0x75
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x18]
lea edi, [eax + 0x1d4]
mov ecx, 0x161
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x46c]
push ecx
mov dword [esp + 0x20], eax
add eax, 0x758
push 0x104
push eax
call fcn.004530e6
mov edx, dword [esp + 0x28]
add esp, 0x10
push 0
push 0
push edx
push 0x4186c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [ebx + 0x164], 2
je 0x40ba58
push str.__COMPAT_LAYER
call fcn.00453efc
add esp, 4
cmp dword [0x496530], 0
je 0x40ba8c
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0x4966a0
push 0x408250
push 0
push 0
mov dword [0x4966a4], eax
mov dword [0x4966a0], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esp + 0x20], 0
je 0x40baae
mov edx, dword [esp + 0x10]
push 0
push 0
add edx, 0x6c
push edx
push 0x4083b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x496538], 0
je 0x40bac6
cmp dword [ebp + 8], 1
je 0x40bac6
mov ecx, dword [esp + 0x10]
call fcn.004094b0
mov ecx, dword [esp + 0x69c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00450c28
mov esp, ebp
pop ebp
ret 8