Function at 0x100b9eb
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x10222a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableTextFrameService
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_HeapSetInformation]
mov eax, dword [0x1022660]
or eax, dword [0x1022664]
jne 0x100bb2c
cmp byte [0x1022654], bl
jne 0x100bacb
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.API_MS_Win_Core_SysInfo_L1_1_0.dll_GetVersionExW]
test eax, eax
je 0x100ba69
cmp dword [ebp - 0x114], 6
setb al
mov byte [0x1022655], al
cmp al, bl
jne 0x100bac4
push 0x1001a00
call dword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x100babd
mov esi, dword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetProcAddress]
push 0x10019f4
push edi
call esi
mov dword [0x1022658], eax
cmp eax, ebx
je 0x100babd
push 0x10019e4
push edi
call esi
mov dword [0x10220ac], eax
cmp eax, ebx
je 0x100bab3
push 0x10019d4
push edi
call esi
mov dword [0x102265c], eax
cmp eax, ebx
jne 0x100bac4
mov dword [0x10220ac], 0x1003f0c
mov byte [0x1022655], 1
mov byte [0x1022654], 1
cmp byte [0x1022655], bl
jne 0x100baef
push 0x1022660
push 0x1022668
push 0x1003eb2
push 0x10018e4
call dword [0x10220ac]
jmp 0x100bb2c
mov ecx, 0x1022668
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x1022664], edx
lea edx, [ebp - 0x358]
push edx
push 1
mov dword [0x1022660], eax
mov eax, 0x10018e4
push eax
push ecx
push 0x1003e40
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x354], ebx
call dword [sym.imp.ntdll.dll_EtwRegisterTraceGuidsW]
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x100bd8c
push 8
call fcn.0100ea4a
pop ecx
cmp eax, ebx
je 0x100bb5c
push 0x10020c8
mov ecx, eax
call fcn.0100a707
mov dword [ebp - 0x350], eax
jmp 0x100bb62
mov dword [ebp - 0x350], ebx
mov eax, dword [ebp - 0x350]
cmp eax, ebx
je 0x100bd8c
cmp dword [eax], 0xb7
je 0x100bd7f
push ebx
push ebx
call dword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetModuleHandleW]
push eax
push ebx
mov ecx, 0x10226bc
call fcn.0100a658
test eax, eax
jl 0x100bd7f
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x100bd75
call fcn.0100e77b
test eax, eax
jl 0x100bd6f
lea eax, [ebp - 0x348]
push eax
mov dword [ebp - 0x348], ebx
call fcn.0100aab8
test eax, eax
jl 0x100bd6f
cmp dword [ebp - 0x348], ebx
je 0x100bd6f
lea ecx, [ebp - 0x10c]
call fcn.01010be0
push dword [ebp - 0x348]
lea ecx, [ebp - 0x348]
call fcn.0100a733
mov esi, dword [ebp - 0x348]
push 1
push esi
lea ecx, [ebp - 0x10c]
call fcn.01010cfd
mov edi, eax
cmp edi, ebx
jge 0x100bc1f
mov eax, dword [esi]
push ebx
push ebx
push 2
push 0x80000074
push esi
call dword [eax + 0xc]
lea ecx, [ebp - 0x344]
call fcn.0100407a
cmp edi, ebx
jl 0x100bd4a
push esi
lea ecx, [ebp - 0x344]
call fcn.01005087
cmp eax, ebx
push ebx
push ebx
jge 0x100bc56
mov eax, dword [esi]
push 2
push 0x80000072
push esi
call dword [eax + 0xc]
jmp 0x100bd4a
lea eax, [ebp - 0x344]
mov dword [0x10225d8], eax
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.01009533
test eax, eax
jge 0x100bc81
mov eax, dword [esi]
push ebx
push ebx
push 2
push 0x80000072
push esi
call dword [eax + 0xc]
lea eax, [ebp - 0x348]
push eax
mov dword [ebp - 0x348], ebx
call fcn.0100ab4d
test eax, eax
jl 0x100bd3f
mov edi, dword [ebp - 0x348]
cmp edi, ebx
je 0x100bd3f
mov eax, dword [edi]
push edi
call dword [eax + 4]
push ebx
push ebx
push ebx
push ebx
push 0xffff
lea edx, [ebp - 0x348]
lea eax, [edi + 8]
push edx
mov dword [ebp - 0x348], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x100bd29
mov dword [ebp - 0x34c], ebx
jmp 0x100bd02
lea eax, [ebp - 0x354]
push eax
push dword [ebp - 0x34c]
call fcn.0101a52a
mov eax, dword [ebp - 0x34c]
cmp eax, ebx
je 0x100bd02
mov dword [ebp - 0x34c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x348]
mov ecx, dword [eax]
lea edx, [ebp - 0x34c]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
je 0x100bcda
mov eax, dword [ebp - 0x34c]
cmp eax, ebx
je 0x100bd29
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x348]
cmp eax, ebx
je 0x100bd3f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x344]
call fcn.0100413e
call fcn.01006db8
lea ecx, [ebp - 0x10c]
call fcn.01010962
cmp esi, ebx
je 0x100bd64
mov eax, dword [esi]
push esi
call dword [eax + 8]
lea ecx, [ebp - 0x10c]
call fcn.01010a33
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, 0x10226bc
call fcn.0100a994
mov ecx, dword [ebp - 0x350]
push 1
call fcn.0100aa5a
cmp byte [0x1022654], bl
je 0x100bddf
mov esi, dword [0x1022660]
mov eax, dword [0x1022664]
mov ecx, esi
or ecx, eax
je 0x100bddf
cmp byte [0x1022655], bl
jne 0x100bdb7
push eax
push esi
call dword [0x102265c]
jmp 0x100bdd3
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ntdll.dll_EtwUnregisterTraceGuids]
mov dword [esi + 0x20], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [0x1022660], ebx
mov dword [0x1022664], ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0100f77f
leave
ret 0x10