Function at 0x4289d7
Capabilities:
Acquire debug privileges
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [0x45a100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0x104
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
mov ecx, 0x45cca0
push eax
call fcn.004052aa
lea eax, [ebp - 0x28c]
push eax
call fcn.0041e469
pop ecx
test al, al
jne 0x428a32
xor eax, eax
inc eax
jmp 0x428d6d
call fcn.004036f3
test al, al
je 0x428b70
cmp byte [0x45c3c3], 0
jne 0x428b70
mov esi, edi
mov dword [ebp - 0x290], esi
cmp dword [ebp - 0x28c], esi
je 0x428b26
lea esi, [ebp - 0x28c]
push 0x44d774
lea ecx, [ebp - 0x294]
call fcn.004051c4
push dword [esi]
lea ecx, [ebp - 0x298]
call fcn.004051c4
push eax
lea eax, [ebp - 0x29c]
push 0x44cf80
push eax
call fcn.0040819e
add esp, 0xc
lea ecx, [ebp - 0x294]
lea esi, [esi + 4]
push ecx
lea ecx, [ebp - 0x2a0]
push ecx
mov ecx, eax
call fcn.00405319
push eax
lea ecx, [ebp - 0x290]
call fcn.004053b1
mov ecx, dword [ebp - 0x2a0]
test ecx, ecx
je 0x428ad1
call fcn.00403368
mov dword [ebp - 0x2a0], edi
mov ecx, dword [ebp - 0x29c]
test ecx, ecx
je 0x428ae6
call fcn.00403368
mov dword [ebp - 0x29c], edi
mov ecx, dword [ebp - 0x298]
test ecx, ecx
je 0x428afb
call fcn.00403368
mov dword [ebp - 0x298], edi
mov ecx, dword [ebp - 0x294]
test ecx, ecx
je 0x428b10
call fcn.00403368
mov dword [ebp - 0x294], edi
cmp dword [esi], edi
jne 0x428a66
mov esi, dword [ebp - 0x290]
test esi, esi
je 0x428b26
mov eax, dword [esi]
jmp 0x428b28
mov eax, edi
push dword [ebp + 0x14]
push edi
push edi
push edi
push eax
xor edi, edi
inc edi
push edi
push 0x44d138
call fcn.00403393
add esp, 0x1c
test al, al
jne 0x428b5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x52ab04
push 0
call fcn.0041cd7a
add esp, 0xc
jmp 0x428b5e
xor edi, edi
test esi, esi
je 0x428b69
mov ecx, esi
call fcn.00403368
mov eax, edi
jmp 0x428d6d
call fcn.004036f3
push 0x45c180
test al, al
je 0x428b93
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
or dword [0x45c1a8], 0xffffffff
mov dword [0x45c1ac], edi
jmp 0x428baa
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x45c18c]
cdq
mov dword [0x45c1a8], eax
mov dword [0x45c1ac], edx
push esi
lea ecx, [ebp - 0x290]
call fcn.0040517a
mov eax, dword [eax]
test eax, eax
je 0x428bc0
mov eax, dword [eax]
jmp 0x428bc2
mov eax, edi
push eax
call fcn.0042d6fe
pop ecx
mov ecx, dword [ebp - 0x290]
mov dword [0x45c3c4], eax
test ecx, ecx
je 0x428bdd
call fcn.00403368
push edi
push 0x45c174
push edi
push 0xf003f
push edi
push edi
push edi
push 0x44e804
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [0x45c174]
mov ecx, 0x45c638
call fcn.0041f873
call fcn.00411781
mov eax, dword [0x45cc58]
test eax, eax
je 0x428c23
call eax
xor eax, eax
xor edi, edi
push eax
mov dword [ebp - 0x2ac], eax
inc edi
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x290]
mov dword [ebp - 0x2b0], edi
push eax
call sub.gdiplus.dll_GdiplusStartup
mov esi, dword [ebp + 0x14]
push 0x44ea98
mov dword [0x45c17c], esi
mov dword [0x45c178], ebx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x45c3d4], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push ebx
call fcn.0041facb
mov dword [esp], 0x44eac0
call fcn.0041cce0
push edi
push 0x44eae4
push 0x44eb04
push 0x44eb24
call fcn.00408412
add esp, 0x14
push 0
push 0x420ecf
push 0
push 0x44eb30
push ebx
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [0x45c3b8], eax
test eax, eax
jne 0x428ccc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x428b69
push 5
pop ecx
cmp esi, edi
cmove esi, ecx
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x45c3b8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x44e714
push ebx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
mov ebx, eax
jmp 0x428d45
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
lea eax, [ebp - 0x2cc]
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x428d45
lea eax, [ebp - 0x2cc]
push eax
push esi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x428d45
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x2cc]
push eax
call edi
test eax, eax
jne 0x428cfe
mov ecx, 0x45d390
call fcn.00423e46
mov ecx, 0x45cca8
call fcn.00413ad6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a402
mov esp, ebp
pop ebp
ret 0x10