Function at 0x1ca7a20
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x1d4918b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x1d9682c]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1d9682c]
xor eax, esp
push eax
lea eax, [esp + 0xc4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x108]
mov eax, dword [esp + 0x100]
mov ebp, dword [esp + 0xd8]
mov esi, dword [esp + 0xe4]
mov edi, dword [esp + 0xe8]
mov ebx, dword [esp + 0xec]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.01d0fdc0
mov dword [esp + 0xcc], 0
mov edx, dword [esp + 0xe0]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.01ca4170
lea ecx, [esp + 0x24]
push esi
push ecx
call fcn.01d021d0
push edi
lea edx, [esp + 0x30]
push str._Iosb0x_x
push edx
call fcn.01d10800
add esp, 0x1c
cmp byte [esp + 0xd4], 0
je 0x1ca7b20
push ebx
lea eax, [esp + 0x20]
push str._AllocSize0x_x
push eax
call fcn.01d10800
add esp, 0xc
test ebx, ebx
je 0x1ca7b0b
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
push ecx
push edx
lea eax, [esp + 0x24]
push str._0x_08x_08x
push eax
call fcn.01d10800
add esp, 0x10
mov ecx, dword [esp + 0xf0]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.01ca4250
add esp, 8
mov eax, dword [esp + 0xf4]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.01ca41e0
add esp, 8
cmp byte [esp + 0xd4], 0
je 0x1ca7b93
mov ecx, dword [esp + 0xf8]
mov eax, str._unknown_
cmp ecx, 5
ja case.default.0x1ca7b50
jmp dword [ecx*4 + 0x1ca7ec8]
mov eax, str.FILE_SUPERSEDE
jmp case.default.0x1ca7b50
mov eax, str.FILE_OPEN
jmp case.default.0x1ca7b50
mov eax, str.FILE_CREATE
jmp case.default.0x1ca7b50
mov eax, str.FILE_OPEN_IF
jmp case.default.0x1ca7b50
mov eax, str.FILE_OVERWRITE
jmp case.default.0x1ca7b50
mov eax, str.FILE_OVERWRITE_IF
push eax
push ecx
lea edx, [esp + 0x24]
push str._CreateDisposition0x_x__ls
push edx
call fcn.01d10800
add esp, 0x10
mov ebx, dword [esp + 0xfc]
push ebx
lea eax, [esp + 0x20]
push str._Options0x_x
push eax
call fcn.01d10800
add esp, 0xc
test bl, 1
je 0x1ca7bc7
mov ecx, dword [0x1d76b80]
push ecx
push str._FILE_DIRECTORY_FILE
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test bl, 2
je 0x1ca7be1
mov edx, dword [0x1d76b80]
push edx
push str._FILE_WRITE_THROUGH
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test bl, 4
je 0x1ca7bfa
mov eax, dword [0x1d76b80]
push eax
push str._FILE_SEQUENTIAL_ONLY
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test bl, 8
je 0x1ca7c14
mov ecx, dword [0x1d76b80]
push ecx
push str._FILE_NO_INTERMEDIATE_BUFFERING
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test bl, 0x10
je 0x1ca7c2e
mov edx, dword [0x1d76b80]
push edx
push str._FILE_SYNCHRONOUS_IO_ALERT
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test bl, 0x20
je 0x1ca7c47
mov eax, dword [0x1d76b80]
push eax
push str._FILE_SYNCHRONOUS_IO_NONALERT
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test bl, 0x40
je 0x1ca7c61
mov ecx, dword [0x1d76b80]
push ecx
push str._FILE_NON_DIRECTORY_FILE
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test bl, bl
jns 0x1ca7c7a
mov edx, dword [0x1d76b80]
push edx
push str._FILE_CREATE_TREE_CONNECTION
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x100
je 0x1ca7c96
mov eax, dword [0x1d76b80]
push eax
push str._FILE_COMPLETE_IF_OPLOCKED
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x200
je 0x1ca7cb3
mov ecx, dword [0x1d76b80]
push ecx
push str._FILE_NO_EA_KNOWLEDGE
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x400
je 0x1ca7cd0
mov edx, dword [0x1d76b80]
push edx
push str._FILE_OPEN_FOR_RECOVERY
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x800
je 0x1ca7cec
mov eax, dword [0x1d76b80]
push eax
push str._FILE_RANDOM_ACCESS
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x1000
je 0x1ca7d09
mov ecx, dword [0x1d76b80]
push ecx
push str._FILE_DELETE_ON_CLOSE
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
mov esi, ebx
and esi, 0x2000
je 0x1ca7d28
mov edx, dword [0x1d76b80]
push edx
push str._FILE_OPEN_BY_FILE_ID
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x4000
je 0x1ca7d44
mov eax, dword [0x1d76b80]
push eax
push str._FILE_OPEN_FOR_BACKUP_INTENT
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x8000
je 0x1ca7d61
mov ecx, dword [0x1d76b80]
push ecx
push str._FILE_NO_COMPRESSION
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x100000
je 0x1ca7d7e
mov edx, dword [0x1d76b80]
push edx
push str._FILE_RESERVE_OPFILTER
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x200000
je 0x1ca7d9a
mov eax, dword [0x1d76b80]
push eax
push str._FILE_OPEN_REPARSE_POINT
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x400000
je 0x1ca7db7
mov ecx, dword [0x1d76b80]
push ecx
push str._FILE_OPEN_NO_RECALL
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test ebx, 0x800000
je 0x1ca7dd4
mov edx, dword [0x1d76b80]
push edx
push str._FILE_OPEN_FOR_FREE_SPACE_QUERY
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test esi, esi
je 0x1ca7e05
mov eax, dword [0x1d76b80]
push eax
push str._FILE_OPEN_BY_FILE_ID
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
test esi, esi
je 0x1ca7e05
mov ecx, dword [0x1d76b80]
push ecx
push str._FILE_OPEN_BY_FILE_ID
lea ecx, [esp + 0x24]
call fcn.01d0fdd0
mov bl, byte [esp + 0xd4]
test bl, bl
je 0x1ca7e2f
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x24]
push str._EaBuffer0x_x_EaLength0x_x
push ecx
call fcn.01d10800
add esp, 0x10
mov ecx, dword [esp + 0xdc]
mov eax, str._success_
test ecx, ecx
jge 0x1ca7e44
mov eax, 0x1d5fa6c
push eax
push ebp
push ecx
lea edx, [esp + 0x28]
push str.____0x_x_hFile_x__ls
push edx
call fcn.01d10800
add esp, 0x14
test bl, bl
je 0x1ca7e70
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push str.NtCreateFile__ls__ls_n
jmp 0x1ca7e81
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push eax
mov eax, dword [esp + 0x20]
push eax
push str.NtOpenFile__ls__ls_n
call fcn.01c5dda0
add esp, 0xc
mov dword [esp + 0xcc], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.01d0f660
mov ecx, dword [esp + 0xc4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.01d20f6a
add esp, 0xbc
ret