Function at 0x10025356
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005e634
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb0
and dword [esp + 0x18], 0
push ebx
push esi
push edi
push 2
pop ebx
mov esi, edx
mov edi, ecx
push ebx
lea ecx, [esp + 0x54]
mov dword [esp + 0x18], esi
call fcn.1000580e
xor edx, edx
mov dword [esp + 0xc4], edx
push 0xfffffffffffffff8
pop eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], 0x4c3f4f88
mov dword [esp + 0x1c], 6
mov dword [esp + 0xc], edx
jmp 0x100253e9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x50]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x100253d6
mov dword [esp + 0xc], edx
jmp 0x10025405
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x38], 0xffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x100253f5
mov dword [esp + 0x28], edx
cmp dword [esp + 0x28], 1
jg 0x100254fb
mov dword [esp + 0x18], 0x8421705
lea ecx, [esp + 0x70]
push 1
call fcn.1000580e
xor edx, edx
mov dword [esp + 0xc], edx
jmp 0x10025448
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x70]
mov dword [eax + ecx*4], 0x9161d594
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x10025435
mov dword [esp + 0xc], edx
jmp 0x10025465
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x7c], 0xc62b
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10025455
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x7c]
sub eax, 0x7966d0e2
jne 0x10025481
cmp dword [esp + 0x1c], edx
je 0x10025484
xor edx, edx
inc edx
mov ecx, dword [esp + 0x28]
xor esi, esi
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + ecx*4]
mov eax, dword [esp + 0x38]
add ecx, 0x677b
imul eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
dec dword [esp + 0x38]
cmp eax, edx
jl 0x100254af
inc esi
mov ecx, dword [esp + 0x28]
xor edx, edx
mov eax, dword [esp + 0x50]
cmp dword [eax + ecx*4], esi
setge dl
sub edx, 6
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x18], edx
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x100254df
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
lea ecx, [esp + 0x70]
call fcn.1000586b
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 1
jle 0x1002541a
mov esi, dword [esp + 0x14]
or dword [esp + 0xc4], 0xffffffff
lea ecx, [esp + 0x50]
call fcn.1000586b
call fcn.10021da5
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.10025940
xor ecx, ecx
inc ecx
mov dword [esp + 0xc4], ecx
mov dword [esp + 0x14], 0xbe4438be
mov dword [esp + 0x1c], 0xf703c576
mov dword [esp + 0x18], 0x94d0e83
mov dword [esp + 0xc], ecx
mov dword [esp + 0xc], 0
jmp 0x1002555c
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x5c], 5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x1002554c
mov dword [esp + 0xc], 0
jmp 0x1002557c
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x20], 0xfffffff6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1002556c
mov eax, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setg dl
sub edx, 0xfffffff6
neg edx
sbb edx, edx
inc edx
cmp edx, 0xffff
ja 0x100255a9
mov eax, dword [esp + 0x14]
xor edx, edx
cmp dword [esp + 0x14], edx
jne 0x100255b2
inc edx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xe2db58e4
jae 0x100255ed
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x10025639
push 0x134d
push 0xf6
push 0x124f
push 0x3bf
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x10025639
xor eax, eax
mov dword [esp + 0xc], 9
mov dword [esp + 0x1c], eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x10025613
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor eax, eax
mov edx, dword [esp + 0xc]
neg edx
sbb edx, edx
neg edx
cmp dword [esp + 0x14], eax
je 0x10025626
xor eax, eax
inc eax
mov dword [esp + 0x1c], eax
xor ecx, ecx
mov eax, dword [esp + 0x1c]
cmp edx, eax
setge cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x18], 0xffffffff
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
cmp eax, 0x72920796
mov eax, dword [esp + 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setne dl
xor ecx, ecx
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
sub edx, 0x24a5d932
cmp eax, edx
setge cl
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x20], 0xac06e326
mov dword [esp + 0xc], 0x576660b2
dec dword [esp + 0xc]
mov dword [esp + 0xc], 0xffffffe3
jmp 0x1002570b
push ebx
lea ecx, [esp + 0x68]
call fcn.1000580e
mov dword [esp + 0x14], 0
jmp 0x100256cf
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], 0x16744fa7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x100256bc
cmp dword [esp + 0x20], 0
jne 0x100256e0
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x64]
mov dword [eax], ecx
lea ecx, [esp + 0x64]
call fcn.1000586b
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xa
jl 0x100256a8
mov ecx, dword [esp + 0x40]
add esi, 0xfffff70c
mov edx, ecx
mov eax, dword [ecx + 4]
cmp byte [eax + 0xd], 0
jne 0x1002574e
cmp dword [eax + 0x10], esi
jge 0x10025731
mov eax, dword [eax + 8]
jmp 0x10025735
mov edx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10025727
cmp edx, ecx
je 0x1002574e
cmp esi, dword [edx + 0x10]
jl 0x1002574e
mov dword [esp + 0x4c], edx
lea esi, [esp + 0x4c]
jmp 0x10025756
mov dword [esp + 0x48], ecx
lea esi, [esp + 0x48]
mov eax, dword [0x1010d9a0]
mov esi, dword [esi]
test al, 1
jne 0x10025791
and dword [0x1010d9bc], 0
or eax, 1
mov dword [0x1010d9a0], eax
xor eax, eax
push 0x1005f1b0
mov dword [0x1010d9c0], 7
mov word [0x1010d9ac], ax
call fcn.10046972
pop ecx
mov ecx, dword [esp + 0x40]
cmp esi, ecx
je 0x100257b4
push dword [esi + 0x18]
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0xa4]
call fcn.1001cccc
pop ecx
mov byte [esp + 0xc4], bl
xor ebx, ebx
inc ebx
jmp 0x100257d0
push 0x1010d9ac
lea ecx, [esp + 0x8c]
call fcn.1000a7c7
mov dword [esp + 0xc4], 3
push eax
mov ecx, edi
mov dword [esp + 0x28], ebx
call fcn.1000a7c7
or ebx, 4
test bl, 2
je 0x100257f7
push 0
push 1
lea ecx, [esp + 0x90]
and ebx, 0xfffffffd
call fcn.10005f65
test bl, 1
je 0x1002580c
push 0
push 1
lea ecx, [esp + 0xa8]
call fcn.10005f65
lea ecx, [esp + 0x40]
call fcn.100258ad
mov ecx, dword [esp + 0xbc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret