Function at 0x408806
Capabilities:
Check os version
Create thread

Disassembly:
mov eax, 0x45f9ca
call fcn.0043b5c0
sub esp, 0x14c
push ebx
xor ebx, ebx
cmp dword [0x47d954], ebx
push esi
push edi
mov edi, ecx
jne 0x408831
cmp byte [0x47d959], bl
je 0x408bd9
lea eax, [ebp - 0x158]
mov dword [ebp - 0x158], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, edi
call fcn.00408c6e
cmp dword [ebp - 0x154], 5
mov byte [ebp - 0xd], bl
ja 0x408865
jne 0x408872
cmp dword [ebp - 0x150], ebx
jbe 0x408872
cmp dword [ebp - 0x148], 2
jne 0x408872
mov byte [ebp - 0xd], 1
cmp byte [0x47d959], bl
je 0x408b36
cmp byte [0x47d7d0], bl
mov esi, 0x4766f8
jne 0x408893
cmp byte [0x47e030], bl
je 0x4088fe
lea eax, [ebp - 0x15]
push 1
push eax
push esi
lea ecx, [ebp - 0x74]
call fcn.0040a6ae
mov eax, 0x476a24
mov dword [ebp - 4], ebx
mov ecx, eax
mov dword [ebp - 0x4c], 0x4675b0
test ecx, ecx
mov dword [ebp - 0x2c], 0x4675a8
jne 0x4088c3
mov eax, 0x47d8e0
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040b3c8
lea eax, [ebp - 0x74]
push 0x339
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.0045d920
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.00406320
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.00406320
cmp dword [ebp - 0x154], 6
jb 0x40890a
mov byte [ebp - 0xd], bl
mov ecx, edi
call fcn.0040a42a
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x408bd9
cmp byte [ebp - 0xd], bl
je 0x4089d7
cmp byte [0x47d7d0], bl
jne 0x408935
cmp byte [0x47e030], bl
je 0x4089a5
lea eax, [ebp - 0xe]
push 1
push eax
push esi
lea ecx, [ebp - 0x74]
call fcn.0040a6ae
mov eax, 0x4769d8
mov dword [ebp - 4], 2
mov ecx, eax
mov dword [ebp - 0x4c], 0x4675b0
test ecx, ecx
mov dword [ebp - 0x2c], 0x4675a8
jne 0x408969
mov eax, 0x47d8e0
lea ecx, [ebp - 0x15]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040b3c8
lea eax, [ebp - 0x74]
push 0x341
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 3
call fcn.0045d920
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00406320
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.00406320
mov al, byte [ebp + 8]
push ebx
neg al
sbb eax, eax
add eax, 4
push eax
push 0x111
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 2
jne 0x408bd9
push dword [ebp - 0x14]
mov ecx, edi
call fcn.0040a576
jmp 0x408bd9
cmp byte [ebp + 8], bl
je 0x408bd9
mov eax, dword [edi + 0xc8]
push 1
lea ecx, [ebp - 0x74]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xb]
push eax
push esi
call fcn.0040a6ae
mov eax, dword [eax + 8]
mov dword [ebp - 4], 4
cmp eax, ebx
mov esi, 0x4675bc
jne 0x408a10
mov eax, esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x349
push dword [edi + 0x16c]
push 0x476988
push eax
call fcn.00408446
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea ecx, [ebp - 0x74]
call fcn.00406320
lea eax, [ebp + 0xb]
push ebx
push eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x4675b0
mov dword [ebp - 0x7c], 0x4675a8
call fcn.0040b2c0
mov eax, dword [edi + 0xd8]
mov dword [ebp - 4], 5
cmp eax, ebx
je 0x408a74
mov esi, eax
mov ecx, dword [0x47d95c]
lea eax, [ebp - 0xc4]
push 0x675
push eax
call fcn.00403e06
mov eax, dword [eax + 8]
mov byte [ebp - 4], 6
cmp eax, ebx
jne 0x408a9b
mov eax, 0x46756c
push esi
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.0040aff7
add esp, 0xc
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 5
call fcn.0040127e
lea ecx, [ebp - 0x9c]
call fcn.0040bc78
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push ebx
push 0xc
push dword [ebp - 0x14]
call esi
mov eax, dword [edi + 0xc8]
mov eax, dword [eax + 0x14]
inc eax
push eax
push 1
push 0x406
push dword [ebp - 0x14]
call esi
cmp eax, 2
je 0x408b18
push ebx
push ebx
push 0x402
push dword [ebp - 0x14]
call esi
cmp eax, 2
je 0x408b18
push ebx
push dword [edi + 0x16c]
push 0x402
push dword [ebp - 0x14]
call esi
cmp eax, 2
jne 0x408b22
push dword [ebp - 0x14]
mov ecx, edi
call fcn.0040a576
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.00406320
jmp 0x408bd9
cmp byte [ebp + 8], bl
je 0x408b8e
cmp byte [ebp - 0xd], bl
je 0x408b70
push 0xfffffffffffffff0
push dword [0x47d954]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [edi + 0x164], eax
or al, 8
push eax
push 0xfffffffffffffff0
push dword [0x47d954]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x64
push 1
push 0x40a
jmp 0x408bcd
lea eax, [edi + 0x160]
push eax
push ebx
push edi
push 0x408bea
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x15c], eax
jmp 0x408bd9
cmp byte [ebp - 0xd], bl
je 0x408bc6
cmp dword [edi + 0x164], ebx
lea esi, [edi + 0x164]
je 0x408bc6
push ebx
push ebx
push 0x40a
push dword [0x47d954]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi]
push 0xfffffffffffffff0
push dword [0x47d954]
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x408bd9
push ebx
push ebx
push 0x402
push dword [0x47d954]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4