Function at 0x421400
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x532ab0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x536314]
mov dword [ebp - 0x140], 0
cmp eax, 0xffffffff
jne 0x421597
push pe_nt_image_headers32
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004a96d0
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 5
jbe 0x42148d
mov dword [0x536314], 1
jmp 0x42159f
mov dword [0x536314], 0
push 0x519a64
lea ecx, [ebp - 0x128]
call fcn.004019c0
push str.LogFilesFolder
lea ecx, [ebp - 0x13c]
mov dword [ebp - 4], 5
call fcn.004019c0
push ecx
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x12c], esp
push 0x516c94
call fcn.004019c0
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 7
call fcn.00424db0
mov byte [ebp - 4], 8
push dword [0x535ee4]
lea ecx, [ebp - 0x128]
push ecx
lea ecx, [ebp - 0x13c]
push ecx
mov edx, eax
mov ecx, ebx
mov byte [ebp - 4], 9
call fcn.0043d9f0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x130]
add edx, 0xfffffff0
or esi, 0xffffffff
add esp, 0x10
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x421532
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x13c]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x421555
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x128]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x421579
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4ab5
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x421497
push 0x519a64
lea ecx, [ebp - 0x138]
call fcn.004019c0
push str.LogFilesFolder
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0
call fcn.004019c0
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x130], esp
push 0x516c94
call fcn.004019c0
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 2
call fcn.00424f70
mov byte [ebp - 4], 3
push dword [0x535ee4]
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x134]
push ecx
mov edx, eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.0043d9f0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x12c]
add edx, 0xfffffff0
or esi, 0xffffffff
add esp, 0x10
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42163a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x134]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42165d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x138]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x421579
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x421579