Function at 0x408768
Capabilities:
Check os version
Create thread

Disassembly:
mov eax, 0x45f756
call fcn.0043b400
sub esp, 0x14c
push ebx
xor ebx, ebx
cmp dword [0x47d7e4], ebx
push esi
push edi
mov edi, ecx
jne 0x408793
cmp byte [0x47d7e9], bl
je 0x408b3b
lea eax, [ebp - 0x158]
mov dword [ebp - 0x158], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, edi
call fcn.00408bd0
cmp dword [ebp - 0x154], 5
mov byte [ebp - 0xd], bl
ja 0x4087c7
jne 0x4087d4
cmp dword [ebp - 0x150], ebx
jbe 0x4087d4
cmp dword [ebp - 0x148], 2
jne 0x4087d4
mov byte [ebp - 0xd], 1
cmp byte [0x47d7e9], bl
je 0x408a98
cmp byte [0x47d660], bl
mov esi, 0x4766f8
jne 0x4087f5
cmp byte [0x47dec0], bl
je 0x408860
lea eax, [ebp - 0x15]
push 1
push eax
push esi
lea ecx, [ebp - 0x74]
call fcn.0040a610
mov eax, 0x476a24
mov dword [ebp - 4], ebx
mov ecx, eax
mov dword [ebp - 0x4c], 0x4675b0
test ecx, ecx
mov dword [ebp - 0x2c], 0x4675a8
jne 0x408825
mov eax, 0x47d770
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040b32a
lea eax, [ebp - 0x74]
push 0x333
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.0045d6d0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.00406295
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.00406295
cmp dword [ebp - 0x154], 6
jb 0x40886c
mov byte [ebp - 0xd], bl
mov ecx, edi
call fcn.0040a38c
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x408b3b
cmp byte [ebp - 0xd], bl
je 0x408939
cmp byte [0x47d660], bl
jne 0x408897
cmp byte [0x47dec0], bl
je 0x408907
lea eax, [ebp - 0xe]
push 1
push eax
push esi
lea ecx, [ebp - 0x74]
call fcn.0040a610
mov eax, 0x4769d8
mov dword [ebp - 4], 2
mov ecx, eax
mov dword [ebp - 0x4c], 0x4675b0
test ecx, ecx
mov dword [ebp - 0x2c], 0x4675a8
jne 0x4088cb
mov eax, 0x47d770
lea ecx, [ebp - 0x15]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040b32a
lea eax, [ebp - 0x74]
push 0x33b
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 3
call fcn.0045d6d0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00406295
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.00406295
mov al, byte [ebp + 8]
push ebx
neg al
sbb eax, eax
add eax, 4
push eax
push 0x111
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 2
jne 0x408b3b
push dword [ebp - 0x14]
mov ecx, edi
call fcn.0040a4d8
jmp 0x408b3b
cmp byte [ebp + 8], bl
je 0x408b3b
mov eax, dword [edi + 0xc8]
push 1
lea ecx, [ebp - 0x74]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xb]
push eax
push esi
call fcn.0040a610
mov eax, dword [eax + 8]
mov dword [ebp - 4], 4
cmp eax, ebx
mov esi, 0x4675bc
jne 0x408972
mov eax, esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x343
push dword [edi + 0x16c]
push 0x476988
push eax
call fcn.004083a8
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea ecx, [ebp - 0x74]
call fcn.00406295
lea eax, [ebp + 0xb]
push ebx
push eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x4675b0
mov dword [ebp - 0x7c], 0x4675a8
call fcn.0040b222
mov eax, dword [edi + 0xd8]
mov dword [ebp - 4], 5
cmp eax, ebx
je 0x4089d6
mov esi, eax
mov ecx, dword [0x47d7ec]
lea eax, [ebp - 0xc4]
push 0x675
push eax
call fcn.00403dbe
mov eax, dword [eax + 8]
mov byte [ebp - 4], 6
cmp eax, ebx
jne 0x4089fd
mov eax, 0x46756c
push esi
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.0040af59
add esp, 0xc
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 5
call fcn.00401279
lea ecx, [ebp - 0x9c]
call fcn.0040bbda
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push ebx
push 0xc
push dword [ebp - 0x14]
call esi
mov eax, dword [edi + 0xc8]
mov eax, dword [eax + 0x14]
inc eax
push eax
push 1
push 0x406
push dword [ebp - 0x14]
call esi
cmp eax, 2
je 0x408a7a
push ebx
push ebx
push 0x402
push dword [ebp - 0x14]
call esi
cmp eax, 2
je 0x408a7a
push ebx
push dword [edi + 0x16c]
push 0x402
push dword [ebp - 0x14]
call esi
cmp eax, 2
jne 0x408a84
push dword [ebp - 0x14]
mov ecx, edi
call fcn.0040a4d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.00406295
jmp 0x408b3b
cmp byte [ebp + 8], bl
je 0x408af0
cmp byte [ebp - 0xd], bl
je 0x408ad2
push 0xfffffffffffffff0
push dword [0x47d7e4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [edi + 0x164], eax
or al, 8
push eax
push 0xfffffffffffffff0
push dword [0x47d7e4]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x64
push 1
push 0x40a
jmp 0x408b2f
lea eax, [edi + 0x160]
push eax
push ebx
push edi
push 0x408b4c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x15c], eax
jmp 0x408b3b
cmp byte [ebp - 0xd], bl
je 0x408b28
cmp dword [edi + 0x164], ebx
lea esi, [edi + 0x164]
je 0x408b28
push ebx
push ebx
push 0x40a
push dword [0x47d7e4]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi]
push 0xfffffffffffffff0
push dword [0x47d7e4]
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x408b3b
push ebx
push ebx
push 0x402
push dword [0x47d7e4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4