Function at 0x2103e10a
Capabilities:
Check os version
Get common file path
Get geographical location
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2107bc3c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4a4
mov eax, dword [ebp + 8]
mov word [eax], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x460], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x220], 0
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xe8], 0
call fcn.2103f170
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x210], 1
push 0x21092e48
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x21c], eax
push 0x21092e5c
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x214], eax
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x214], 0
je 0x2103e1ea
lea eax, [ebp - 0x30]
push eax
call dword [ebp - 0x214]
push 0x11c
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.2105e780
add esp, 0xc
mov dword [ebp - 0x20c], 0x11c
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x2103e25e
push 0x11c
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.2105e780
add esp, 0xc
mov dword [ebp - 0x20c], 0x94
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x2103e25e
xor eax, eax
jmp 0x2103f095
cmp dword [ebp - 0x224], 0
je 0x2103e291
mov dl, byte [ebp - 0xf2]
mov byte [ebp - 0x49c], dl
cmp byte [ebp - 0x49c], 2
jb 0x2103e291
cmp byte [ebp - 0x49c], 3
jbe 0x2103e287
jmp 0x2103e291
mov dword [ebp - 0xe8], 1
push 0x104
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x104
lea ecx, [ebp - 0x454]
push ecx
push str.user32.dll
lea edx, [ebp - 0x454]
push edx
call fcn.210153c3
add esp, 0x10
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x24c]
push ecx
push 0
push 0
lea edx, [ebp - 0x454]
push edx
call fcn.2100104c
add esp, 0x24
mov eax, dword [ebp - 0x24c]
and eax, 0xffff
test eax, eax
jne 0x2103e305
mov ecx, dword [ebp - 0x44]
and ecx, 0xffff
test ecx, ecx
je 0x2103e34a
mov edx, dword [ebp - 0x24c]
and edx, 0xffff
cmp dword [ebp - 0x208], edx
jne 0x2103e329
mov eax, dword [ebp - 0x44]
and eax, 0xffff
cmp dword [ebp - 0x204], eax
je 0x2103e34a
mov ecx, dword [ebp - 0x24c]
and ecx, 0xffff
mov dword [ebp - 0x208], ecx
mov edx, dword [ebp - 0x44]
and edx, 0xffff
mov dword [ebp - 0x204], edx
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0
je 0x2103e467
cmp dword [ebp - 0x4a0], 1
je 0x2103e37e
cmp dword [ebp - 0x4a0], 2
je 0x2103e47d
jmp 0x2103ebd0
mov ecx, dword [ebp - 0x208]
shl ecx, 8
or ecx, dword [ebp - 0x204]
mov dword [ebp - 0x4a4], ecx
cmp dword [ebp - 0x4a4], 0x400
je 0x2103e3b9
cmp dword [ebp - 0x4a4], 0x40a
je 0x2103e3ed
cmp dword [ebp - 0x4a4], 0x45a
je 0x2103e421
jmp 0x2103e434
push str.Windows_95
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
mov eax, dword [ebp - 0x1f6]
and eax, 0xffff
cmp eax, 0x42
jne 0x2103e3eb
push str._OSR2
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e462
push str.Windows_98
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
mov eax, dword [ebp - 0x1f6]
and eax, 0xffff
cmp eax, 0x41
jne 0x2103e41f
push 0x21092ec4
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e462
push str.Windows_Me
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e462
mov eax, dword [ebp - 0x204]
push eax
mov ecx, dword [ebp - 0x208]
push ecx
push str.Windows_9x_Me_v_d._02d
mov edx, dword [ebp + 8]
push edx
call fcn.2105e7d8
add esp, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
call fcn.2105e37e
add esp, 0x10
jmp 0x2103ebd0
push str.Win32s
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103ebd0
mov ecx, dword [ebp - 0x208]
shl ecx, 8
or ecx, dword [ebp - 0x204]
mov dword [ebp - 0x4a8], ecx
cmp dword [ebp - 0x4a8], 0x502
ja 0x2103e4c7
cmp dword [ebp - 0x4a8], 0x502
je 0x2103e522
cmp dword [ebp - 0x4a8], 0x500
je 0x2103e4ec
cmp dword [ebp - 0x4a8], 0x501
je 0x2103e50c
jmp 0x2103e62e
cmp dword [ebp - 0x4a8], 0x600
je 0x2103e57d
cmp dword [ebp - 0x4a8], 0x601
je 0x2103e5dc
jmp 0x2103e62e
push str.Windows_2000
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0xec], 1
jmp 0x2103e675
push 0x21092f40
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103e675
cmp dword [ebp - 0xe8], 0
je 0x2103e567
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2103e54a
push str.Windows_Server_2003_R2
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e55b
push str.Windows_Server_2003
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0x458], 1
jmp 0x2103e578
push str.Windows_XP
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103e675
cmp dword [ebp - 0xe8], 0
je 0x2103e5bc
cmp dword [ebp - 0x40], 0
je 0x2103e59f
push 0x21092fc8
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e5b0
push str.Windows_Server_2008
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0x220], 1
jmp 0x2103e5d7
push str.Windows_Vista
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0xf0], 1
jmp 0x2103e675
mov ecx, dword [ebp - 0xf2]
and ecx, 0xff
cmp ecx, 1
jne 0x2103e60a
push str.Windows_7
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0x218], 1
jmp 0x2103e62c
mov dword [ebp - 0x40], 1
push str.Windows_Server_2008_R2
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0x220], 1
jmp 0x2103e675
cmp dword [ebp - 0xe8], 0
je 0x2103e64a
push str.Windows_Server
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e65b
push str.Windows_NT
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
cmp dword [ebp - 0x208], 4
jne 0x2103e66e
mov dword [ebp - 0x460], 1
mov dword [ebp - 0x38], 1
cmp dword [ebp - 0x224], 0
je 0x2103e9a0
cmp dword [ebp - 0xe8], 0
je 0x2103e82f
cmp dword [ebp - 0x460], 0
je 0x2103e6d3
mov eax, dword [ebp - 0xf4]
and eax, 0xffff
and eax, 2
test eax, eax
je 0x2103e6bd
push str._Server_Enterprise_Edition
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e6ce
push 0x210930f0
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e82a
cmp dword [ebp - 0xec], 0
je 0x2103e73f
mov eax, dword [ebp - 0xf4]
and eax, 0xffff
and eax, 0x80
test eax, eax
je 0x2103e703
push str._Datacenter_Server
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e73a
mov edx, dword [ebp - 0xf4]
and edx, 0xffff
and edx, 2
test edx, edx
je 0x2103e729
push str._Advanced_Server
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103e73a
push 0x2109314c
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e82a
cmp dword [ebp - 0x458], 0
je 0x2103e7d6
mov edx, dword [ebp - 0xf4]
and edx, 0xffff
and edx, 0x400
test edx, edx
je 0x2103e775
push str._Web_Edition
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103e7d4
mov ecx, dword [ebp - 0xf4]
and ecx, 0xffff
and ecx, 0x80
test ecx, ecx
je 0x2103e79e
push str._Datacenter_Edition
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e7d4
mov eax, dword [ebp - 0xf4]
and eax, 0xffff
and eax, 2
test eax, eax
je 0x2103e7c3
push str._Enterprise_Edition
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e7d4
push str._Standard_Edition
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e82a
cmp dword [ebp - 0x220], 0
je 0x2103e82a
mov eax, dword [ebp - 0xf4]
and eax, 0xffff
and eax, 0x80
test eax, eax
je 0x2103e806
push str._Datacenter
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e82a
mov edx, dword [ebp - 0xf4]
and edx, 0xffff
and edx, 2
test edx, edx
je 0x2103e82a
push str._Enterprise
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103e99b
mov ecx, dword [ebp - 0xf4]
and ecx, 0xffff
and ecx, 0x200
test ecx, ecx
je 0x2103e8a4
push str._Home
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
cmp dword [ebp - 0xf0], 0
jne 0x2103e868
cmp dword [ebp - 0x218], 0
je 0x2103e89f
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2103e887
push str._Premium
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103e898
push str._Basic
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0x3c], 0
jmp 0x2103e99b
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x4ac], edx
cmp dword [ebp - 0x4ac], 4
je 0x2103e8c4
cmp dword [ebp - 0x4ac], 5
je 0x2103e8da
jmp 0x2103e8f0
push 0x2109324c
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103e99b
push 0x21093268
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e99b
cmp dword [ebp - 0xf0], 0
je 0x2103e932
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2103e918
push 0x21093284
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e929
push str._Business
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0x3c], 0
jmp 0x2103e99b
cmp dword [ebp - 0x218], 0
je 0x2103e99b
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2103e95a
push str._Starter
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e98a
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2103e979
push str._Ultimate
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
jmp 0x2103e98a
push str._Professional
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x210], 0
jmp 0x2103ea6a
mov dword [ebp - 0x46c], 0
mov word [ebp - 0x454], 0
mov dword [ebp - 0x468], 0x208
lea ecx, [ebp - 0x46c]
push ecx
push 0x210932f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x2103ea6a
lea edx, [ebp - 0x468]
push edx
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x464]
push ecx
push 0
push 0x21093350
mov edx, dword [ebp - 0x46c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2103ea5d
push str.WinNt
lea eax, [ebp - 0x454]
push eax
call fcn.2105e86f
add esp, 8
test eax, eax
jne 0x2103ea34
push str._Workstation
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103ea5d
push 0x21093390
lea edx, [ebp - 0x454]
push edx
call fcn.2105e86f
add esp, 8
test eax, eax
jne 0x2103ea5d
push str._Server
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
mov ecx, dword [ebp - 0x46c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x4b0], edx
cmp dword [ebp - 0x4b0], 0
je 0x2103ea87
cmp dword [ebp - 0x4b0], 9
je 0x2103ea9a
jmp 0x2103eaab
push str._x86
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103eaab
push str._x64
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
cmp dword [ebp - 0x38], 0
je 0x2103eadf
mov edx, dword [ebp - 0x204]
push edx
mov eax, dword [ebp - 0x208]
push eax
push str.__d._02d
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e7d8
add esp, 4
mov edx, dword [ebp + 8]
lea eax, [edx + eax*2]
push eax
call fcn.2105e37e
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x2103ebd0
cmp dword [ebp - 0x224], 0
je 0x2103eb82
mov ecx, dword [ebp - 0xf8]
and ecx, 0xffff
test ecx, ecx
jne 0x2103eb08
jmp 0x2103eb80
mov edx, dword [ebp - 0xf6]
and edx, 0xffff
test edx, edx
jne 0x2103eb46
mov eax, dword [ebp - 0xf8]
and eax, 0xffff
push eax
push str._SP_d
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e7d8
add esp, 4
mov edx, dword [ebp + 8]
lea eax, [edx + eax*2]
push eax
call fcn.2105e37e
add esp, 0xc
jmp 0x2103eb80
mov ecx, dword [ebp - 0xf6]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0xf8]
and edx, 0xffff
push edx
push str._SP_d._02d
mov eax, dword [ebp + 8]
push eax
call fcn.2105e7d8
add esp, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
call fcn.2105e37e
add esp, 0x10
jmp 0x2103ebd0
mov eax, dword [ebp - 0x1f8]
and eax, 0xffff
test eax, eax
je 0x2103ebd0
push 0x21093404
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.2105e83a
add esp, 8
test eax, eax
je 0x2103ebd0
lea edx, [ebp - 0x1f8]
push edx
push 0x21093408
mov eax, dword [ebp + 8]
push eax
call fcn.2105e7d8
add esp, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
call fcn.2105e37e
add esp, 0xc
push 0x50
lea eax, [ebp - 0xe4]
push eax
push 9
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x2103ec79
push 0
lea ecx, [ebp - 0x45c]
push ecx
lea edx, [ebp - 0xe4]
push edx
call fcn.2105ba53
add esp, 0xc
test eax, eax
je 0x2103ec79
mov eax, dword [ebp - 0x45c]
and eax, 0xffff
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x45c]
and ecx, 0xffff
and ecx, 0x3ff
cmp ecx, 9
je 0x2103ec79
push 0x50
lea edx, [ebp - 0xe4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x470]
push ecx
call fcn.2103f417
add esp, 0x10
test eax, eax
je 0x2103ec79
lea edx, [ebp - 0xe4]
push edx
push 0x21093410
mov eax, dword [ebp + 8]
push eax
call fcn.2105e7d8
add esp, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
call fcn.2105e37e
add esp, 0xc
cmp dword [ebp + 0xc], 1
jne 0x2103ed94
cmp dword [ebp - 0x214], 0
je 0x2103eceb
mov eax, dword [ebp - 0x248]
and eax, 0xffff
mov ecx, dword [ebp - 0x30]
and ecx, 0xffff
cmp eax, ecx
je 0x2103eceb
mov edx, dword [ebp - 0x30]
and edx, 0xffff
mov eax, dword [edx*4 + 0x21092cc0]
push eax
mov ecx, dword [ebp - 0x248]
and ecx, 0xffff
mov edx, dword [ecx*4 + 0x21092cc0]
push edx
push 0x21093418
mov eax, dword [ebp + 8]
push eax
call fcn.2105e7d8
add esp, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
call fcn.2105e37e
add esp, 0x10
jmp 0x2103ed2e
mov eax, dword [ebp - 0x248]
and eax, 0xffff
test eax, eax
je 0x2103ed2e
mov ecx, dword [ebp - 0x248]
and ecx, 0xffff
mov edx, dword [ecx*4 + 0x21092cc0]
push edx
push str._nArchitecture:__s
mov eax, dword [ebp + 8]
push eax
call fcn.2105e7d8
add esp, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
call fcn.2105e37e
add esp, 0xc
cmp dword [ebp - 0x3c], 0
je 0x2103ed51
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2103ed51
push str._nMedia_Center_Edition
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
cmp dword [ebp - 0x210], 0
je 0x2103ed77
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2103ed77
push str._nStarter_Edition
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2103ed94
push str._nTablet_PC_Edition
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
cmp dword [ebp - 0x1fc], 2
jne 0x2103efc5
cmp dword [ebp + 0xc], 1
jne 0x2103efc5
call fcn.21053dea
test eax, eax
je 0x2103ee84
mov eax, dword [ebp - 0xf4]
and eax, 0xffff
and eax, 0x10
test eax, eax
je 0x2103eddd
push str._nTerminal_Server
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103ee04
mov edx, dword [ebp - 0xf4]
and edx, 0xffff
and edx, 0x100
test edx, edx
je 0x2103ee04
push str._nTerminal_Server__single_user_
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
call fcn.2105409f
test eax, eax
je 0x2103ee84
push str._nremote_client
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
lea ecx, [ebp - 0x498]
call fcn.21053740
mov dword [ebp - 4], 0
push 0x104
lea edx, [ebp - 0x454]
push edx
lea ecx, [ebp - 0x498]
call fcn.21053c2c
test eax, eax
je 0x2103ee72
lea eax, [ebp - 0x454]
push eax
push 0x2109358c
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e7d8
add esp, 4
mov edx, dword [ebp + 8]
lea eax, [edx + eax*2]
push eax
call fcn.2105e37e
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x498]
call fcn.21053b35
lea ecx, [ebp - 0x478]
push ecx
lea edx, [ebp - 0x474]
push edx
call fcn.210514b2
add esp, 8
test eax, eax
jle 0x2103eee7
push str._nadministrative_user
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
cmp dword [0x2109c230], 5
jl 0x2103eee5
cmp dword [ebp - 0x474], 0
je 0x2103eed4
push str.__elevated_
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103eee5
push str.__not_elevated_
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
jmp 0x2103eef8
push str._nnon_administrative_user
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
cmp dword [0x2109c230], 5
jl 0x2103efc5
push str._nprocess_integrity_level:
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
cmp dword [ebp - 0x478], 0x1000
jae 0x2103ef38
push str.untrusted
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
jmp 0x2103efc5
cmp dword [ebp - 0x478], 0x2000
jae 0x2103ef57
push 0x2109367c
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103efc5
cmp dword [ebp - 0x478], 0x3000
jae 0x2103ef76
push str.medium
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
jmp 0x2103efc5
cmp dword [ebp - 0x478], 0x4000
jae 0x2103ef95
push str.high
mov edx, dword [ebp + 8]
push edx
call fcn.2105e3ed
add esp, 8
jmp 0x2103efc5
cmp dword [ebp - 0x478], 0x5000
jae 0x2103efb4
push str.system
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
jmp 0x2103efc5
push str.protected
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e3ed
add esp, 8
cmp dword [ebp + 0xc], 1
jne 0x2103f01a
mov edx, dword [ebp - 0x1f8]
and edx, 0xffff
test edx, edx
je 0x2103f01a
push 0x210936c4
lea eax, [ebp - 0x1f8]
push eax
call fcn.2105e83a
add esp, 8
test eax, eax
je 0x2103f01a
lea ecx, [ebp - 0x1f8]
push ecx
push 0x210936c8
mov edx, dword [ebp + 8]
push edx
call fcn.2105e7d8
add esp, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
call fcn.2105e37e
add esp, 0xc
cmp dword [ebp + 0xc], 1
jne 0x2103f08d
push 0x210936f4
mov eax, dword [ebp + 8]
push eax
call fcn.2105e3ed
add esp, 8
mov ecx, dword [ebp - 0xf4]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0xf2]
and edx, 0xff
mov eax, dword [edx*4 + 0x21092cec]
push eax
mov ecx, dword [ebp - 0x200]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x204]
push edx
mov eax, dword [ebp - 0x208]
push eax
push 0x210936f8
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e7d8
add esp, 4
mov edx, dword [ebp + 8]
lea eax, [edx + eax*2]
push eax
call fcn.2105e37e
add esp, 0x1c
mov ecx, dword [ebp + 8]
xor eax, eax
mov ax, word [ecx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret