Function at 0x11030b10
Capabilities:
Check mutex on windows
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11180365
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1119bfc4
call fcn.11147060
add esp, 4
xor esi, esi
push esi
push esi
mov ebx, 1
push ebx
push esi
call dword [sym.imp.KeRneL32.DLl_CreateEventA]
push 8
mov dword [0x111ee260], eax
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x11030b90
mov ecx, dword [0x111ee0dc]
push ecx
mov ecx, eax
call fcn.11143630
mov esi, eax
mov dword [ebp - 0x2bc], eax
jmp 0x11030b96
mov dword [ebp - 0x2bc], esi
or edi, 0xffffffff
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 4], edi
call fcn.110ed130
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.11143770
push 0x50
lea edx, [ebp - 0xd0]
push edx
push 0x56
mov ecx, esi
call fcn.11143780
test eax, eax
je 0x11030be5
lea eax, [ebp - 0xd0]
push 0x1119bcf4
push eax
call fcn.11081e70
add esp, 8
test eax, eax
jne 0x11030be5
mov dword [0x111ee254], ebx
push 0x20019
push 0x1119bf94
push reloc.wsOcK32.dll_bind
lea ecx, [ebp - 0x2b4]
call fcn.110ed520
test eax, eax
jne 0x11030c4c
push eax
push 0x1119bf84
lea ecx, [ebp - 0x2b4]
call fcn.110ed5d0
push 0
push 0x1119bf70
lea ecx, [ebp - 0x2b4]
mov dword [0x111ee300], eax
call fcn.110ed5d0
cmp dword [0x111ee300], 0
mov dword [0x111ee304], eax
jne 0x11030c3d
test eax, eax
je 0x11030c4c
push 0
push 0x11026be0
call fcn.11146fe0
add esp, 8
mov ecx, esi
call fcn.11143770
push 0
push 0
push 0x41
mov ecx, esi
call fcn.11143780
test eax, eax
je 0x11030df5
push pe_nt_image_headers32
call fcn.111101b0
mov esi, eax
add esp, 4
mov dword [ebp - 0x2b0], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x11030c92
lea ecx, [esi + 4]
mov dword [esi], fcn.11026ab0
call fcn.11088b30
jmp 0x11030c94
xor esi, esi
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 1
call fcn.1108a880
push 0x1119bf64
push 0
push 0x1f0001
mov byte [ebp - 4], 3
call dword [sym.imp.KeRneL32.DLl_OpenMutexA]
mov edi, eax
test edi, edi
jne 0x11030dda
push 0x1119bf64
push eax
push eax
call dword [sym.imp.KeRneL32.DLl_CreateMutexA]
mov ecx, dword [0x111ee0dc]
push 0x1119bf5c
push ecx
mov edi, eax
call fcn.11165250
add esp, 8
test eax, eax
je 0x11030cf1
mov dword [esi + 0x38], 1
push 0x24
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x11030d1d
push 0
push 1
lea edx, [ebp - 0x2c8]
push edx
mov ecx, eax
call fcn.11061710
jmp 0x11030d1f
xor eax, eax
lea ecx, [ebp - 0x31c]
mov dword [esi + 0x34], eax
call fcn.110161e0
push 0
push 3
push 6
mov byte [ebp - 4], 5
call fcn.11145c70
mov ebx, dword [ebp - 0x31c]
add esp, 0xc
test eax, eax
je 0x11030d5c
push 2
call fcn.111466b0
push 1
call fcn.110cccf0
add esp, 8
jmp 0x11030d88
mov eax, dword [ebp - 0x2dc]
test eax, eax
jne 0x11030d7c
push 0x11199dd4
push ebx
call dword [sym.imp.KeRneL32.DLl_GetProcAddress]
mov dword [ebp - 0x2dc], eax
test eax, eax
je 0x11030d80
call eax
jmp 0x11030d88
push 0x78
call dword [sym.imp.KeRneL32.DLl_SetLastError]
call fcn.110287a0
lea eax, [ebp - 0x2b8]
push eax
push esi
push 0
call fcn.11009370
mov esi, dword [sym.imp.KeRneL32.DLl_WaitForSingleObject]
add esp, 0xc
jmp 0x11030db0
mov ecx, dword [ebp - 0x2b8]
push 0x1f4
push ecx
call esi
test eax, eax
jne 0x11030db0
mov edx, dword [ebp - 0x2b8]
push edx
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
test ebx, ebx
je 0x11030dda
push ebx
call dword [sym.imp.KeRneL32.DLl_FreeLibrary]
push edi
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 1
call fcn.1108a980
jmp 0x11031749
mov ecx, esi
call fcn.11143770
push 0
push 0
push 0x4c
mov ecx, esi
call fcn.11143780
test eax, eax
je 0x11030e1e
push esi
call fcn.110f7ae0
add esp, 4
mov dword [ebp - 4], edi
jmp 0x11031750
mov ecx, esi
call fcn.11143770
push 0
push 0
push 0x42
mov ecx, esi
call fcn.11143780
test eax, eax
je 0x11030e47
push esi
call fcn.110f7dd0
add esp, 4
mov dword [ebp - 4], edi
jmp 0x11031750
mov eax, dword [0x111ee0dc]
push 0x1119bf54
push eax
call fcn.11129e00
add esp, 8
test eax, eax
je 0x11030e6b
call fcn.110b3100
mov dword [ebp - 4], edi
jmp 0x11031750
mov ecx, dword [0x111ee0dc]
push 0x1119bf4c
push ecx
call fcn.11129e00
add esp, 8
test eax, eax
je 0x11030e9a
mov edx, dword [0x111ee0dc]
push edx
call fcn.1105d240
add esp, 4
mov dword [ebp - 4], edi
jmp 0x11031750
mov esi, dword [sym.imp.KeRneL32.DLl_GetVersionExA]
lea eax, [ebp - 0x270]
push eax
mov dword [ebp - 0x270], 0x9c
call esi
test eax, eax
jne 0x11030ed2
lea ecx, [ebp - 0x270]
push ecx
mov dword [ebp - 0x270], 0x94
call esi
test eax, eax
je 0x11030e16
mov ecx, dword [ebp - 0x26c]
mov ebx, 4
cmp ecx, 6
jne 0x11031043
cmp dword [ebp - 0x268], 2
jne 0x11031043
lea edx, [ebp - 0x2b8]
push edx
push 1
push 0
push 0x1119bf1c
push reloc.wsOcK32.dll_bind
mov dword [ebp - 0x2b8], 0
call dword [sym.imp.aDvapi32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x1103103d
mov edx, dword [ebp - 0x2b8]
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0
push 0x1119bf0c
push edx
mov dword [ebp - 0x2cc], 0x14
call fcn.11143bd0
add esp, 0x18
test eax, eax
jne 0x11031030
lea eax, [ebp - 0x24]
push eax
call fcn.11163ca7
movsx ecx, byte [ebp - 0x24]
push ecx
mov edi, eax
lea esi, [ebp - 0x24]
call fcn.111648ed
add esp, 8
test eax, eax
je 0x11030f86
movsx edx, byte [esi + 1]
inc esi
push edx
call fcn.111648ed
add esp, 4
test eax, eax
jne 0x11030f74
cmp byte [esi], 0
je 0x11030f8c
inc esi
push esi
call fcn.11163ca7
add esp, 4
cmp edi, 6
jl 0x11031030
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x268], eax
jne 0x11031030
cmp eax, 3
jne 0x11031030
mov edx, dword [ebp - 0x2b8]
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x2c0]
push ecx
push 0
push 0
push 0x1119bef0
push edx
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2d0], ebx
call fcn.11143bd0
mov edx, dword [ebp - 0x2b8]
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x2b0]
push ecx
push 0
push 0
push 0x1119bed4
push edx
mov dword [ebp - 0x2c4], ebx
call fcn.11143bd0
mov eax, dword [ebp - 0x2c0]
add esp, 0x30
test eax, eax
je 0x11031030
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x2b8]
push ecx
call dword [sym.imp.aDvapi32.DLL_RegCloseKey]
mov ecx, dword [ebp - 0x26c]
mov eax, dword [ebp - 0x260]
dec eax
mov edi, 0xc0003
mov ebx, 9
je 0x11031291
dec eax
jne 0x11031135
cmp ecx, 4
jae 0x110310a9
cmp dword [ebp - 0x268], 0x33
sbb edx, edx
and edx, 0xffff0000
add edx, 0xb0003
mov dword [0x111ee0e0], edx
push 0x54
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x110312d4
mov ecx, eax
call fcn.11109bc0
jmp 0x110312d6
jne 0x110310b3
mov dword [0x111ee0e0], edi
jmp 0x11031081
cmp ecx, 5
jb 0x11031135
push 0x1119bec0
push 0x1119beb0
xor esi, esi
call dword [sym.imp.KeRneL32.DLl_GetModuleHandleA]
push eax
call dword [sym.imp.KeRneL32.DLl_GetProcAddress]
test eax, eax
je 0x110310ed
lea ecx, [ebp - 0x34]
push ecx
call eax
cmp word [ebp - 0x34], bx
jne 0x110310ed
mov esi, 1
mov byte [0x111ee26d], 1
mov eax, dword [ebp - 0x26c]
mov dword [0x111ee0e0], 0xd0003
cmp eax, 6
jb 0x1103122f
jne 0x11031202
mov eax, dword [ebp - 0x268]
test eax, eax
jne 0x1103116d
cmp byte [ebp - 0x1d6], 1
jne 0x1103118c
neg esi
sbb esi, esi
and esi, 0x10000
add esi, 0x120003
mov dword [0x111ee0e0], esi
cmp dword [0x111ee0e0], 0xa0003
jge 0x11031081
push 0x3c
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x110312d0
mov ecx, eax
call fcn.110fae60
jmp 0x110312db
cmp eax, 1
jne 0x1103119e
cmp byte [ebp - 0x1d6], al
jne 0x1103118c
neg esi
sbb esi, esi
and esi, 0x10000
add esi, 0x160003
jmp 0x1103112f
neg esi
sbb esi, esi
and esi, 0x10000
add esi, 0x140003
jmp 0x1103112f
cmp eax, 2
jne 0x110311d0
cmp byte [ebp - 0x1d6], 1
jne 0x110311c1
neg esi
sbb esi, esi
and esi, 0x10000
add esi, 0x180003
jmp 0x1103112f
mov dword [0x111ee0e0], 0x1a0003
jmp 0x11031081
cmp eax, 3
jne 0x11031202
cmp byte [ebp - 0x1d6], 1
jne 0x110311f3
neg esi
sbb esi, esi
and esi, 0x10000
add esi, 0x1b0003
jmp 0x1103112f
mov dword [0x111ee0e0], 0x1d0003
jmp 0x11031081
cmp byte [ebp - 0x1d6], 1
jne 0x11031220
neg esi
sbb esi, esi
and esi, 0x10000
add esi, 0x1e0003
jmp 0x1103112f
mov dword [0x111ee0e0], 0x200003
jmp 0x11031081
cmp eax, 5
jne 0x11031258
mov eax, dword [ebp - 0x268]
cmp eax, 1
jne 0x1103124e
mov dword [0x111ee0e0], 0xe0003
jmp 0x11031081
cmp eax, 2
jae 0x1103125e
jmp 0x11031081
jbe 0x11031081
cmp byte [ebp - 0x1d6], 1
jne 0x1103127c
neg esi
sbb esi, esi
and esi, 0x20000
add esi, 0xe0003
jmp 0x1103112f
neg esi
sbb esi, esi
and esi, 0x20000
add esi, 0xf0003
jmp 0x1103112f
cmp ecx, 4
jne 0x11031135
mov eax, dword [ebp - 0x268]
cmp eax, 0x5a
jb 0x110312b4
mov dword [0x111ee0e0], 0x30001
jmp 0x11031145
cmp eax, 0xa
sbb edx, edx
and edx, 0xffff0000
add edx, 0x20001
mov dword [0x111ee0e0], edx
jmp 0x11031145
xor eax, eax
jmp 0x110312db
xor eax, eax
mov dword [0x111ee30c], eax
push 0xd
mov dword [0x111ee308], eax
mov byte [ebp - 4], 1
call dword [sym.imp.Gdi32.Dll_GetStockObject]
lea ecx, [ebp - 0x2ac]
push ecx
push 0x3c
push eax
call dword [sym.imp.Gdi32.Dll_GetObjectA]
mov dl, byte [ebp - 0x295]
sub dl, 0x80
cmp dl, 8
ja 0x11031364
mov eax, 1
mov dword [0x111ee0e8], eax
mov dword [0x111ee0ec], eax
cmp dword [0x111ee0e0], edi
jge 0x1103132b
mov dword [0x111ee0ec], 0
mov esi, dword [sym.imp.KeRneL32.DLl_SetErrorMode]
xor edi, edi
push edi
call esi
or eax, 1
push eax
call esi
push 0x98
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 8
cmp eax, edi
je 0x11031370
push 1
mov ecx, eax
call fcn.11028980
mov esi, eax
jmp 0x11031372
mov dword [0x111ee0e8], 0
jmp 0x11031321
xor esi, esi
push 0x98
mov byte [ebp - 4], 1
mov dword [0x111ee0f0], esi
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], bl
cmp eax, edi
je 0x110313a1
push 2
mov ecx, eax
call fcn.11028980
jmp 0x110313a3
xor eax, eax
mov dword [0x111ee0f4], eax
mov eax, dword [0x111ee0f0]
push 0x1388
add eax, 0x10
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KeRneL32.DLl_InterlockedExchange]
push 8
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 0xa
cmp eax, edi
je 0x110313e1
mov ecx, eax
call fcn.1108a880
jmp 0x110313e3
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x111ee0f8], eax
call dword [sym.imp.KeRneL32.DLl_GetACP]
push eax
lea ecx, [ebp - 0x40]
push 0x1119beac
push ecx
mov dword [0x111ee120], eax
call fcn.11163f93
lea edx, [ebp - 0x40]
push edx
push edi
call fcn.111663a3
mov ebx, dword [ebp - 0x2bc]
add esp, 0x14
mov ecx, ebx
mov byte [ebp - 0x1d4], 0
call fcn.11143770
push 0x104
lea eax, [ebp - 0x1d4]
push eax
push 0x52
mov ecx, ebx
call fcn.11143780
test eax, eax
je 0x11031615
xor eax, eax
push 0x48
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 0xb
cmp eax, edi
je 0x1103148b
mov ecx, dword [0x111ee0f8]
push edi
push 0x111e5278
push 1
push edi
push 0xffffffffffffffff
push ecx
push esi
mov ecx, eax
call fcn.11061aa0
mov esi, eax
jmp 0x1103148d
xor esi, esi
mov byte [ebp - 4], 1
cmp dword [0x111ee100], edi
jne 0x1103149f
mov dword [0x111ee100], esi
cmp dword [0x111ee104], edi
jne 0x110314e1
push 0x24
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 0xc
cmp eax, edi
je 0x110314d6
mov edx, dword [0x111ee0f8]
push 0x1119bca0
push 1
push edx
mov ecx, eax
call fcn.11061710
jmp 0x110314d8
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x111ee104], eax
mov eax, dword [0x111ee0f8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], edi
call fcn.110ccc90
push 0x38
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 0xd
cmp eax, edi
je 0x11031527
mov ecx, dword [0x111ee0f4]
push edi
push ecx
push esi
push edi
mov ecx, eax
call fcn.11125d40
mov esi, eax
jmp 0x11031529
xor esi, esi
cmp byte [ebp - 0x1d4], 0
mov byte [ebp - 4], 1
mov ecx, esi
je 0x11031546
lea edx, [ebp - 0x1d4]
push edx
call fcn.11114fb0
jmp 0x1103154c
push edi
call fcn.11125990
cmp eax, edi
je 0x110315db
push 0x30
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 0xe
cmp eax, edi
je 0x11031575
mov ecx, eax
call fcn.11088b30
jmp 0x11031577
xor eax, eax
push 0x80
mov byte [ebp - 4], 1
mov dword [0x111ee0f4], eax
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 0xf
cmp eax, edi
je 0x110315b0
mov edx, dword [0x111ee0f4]
lea ecx, [ebp - 0x24]
push ecx
push edx
push esi
mov ecx, eax
call fcn.1105cdb0
jmp 0x110315b2
xor eax, eax
mov ecx, eax
mov byte [ebp - 4], 1
mov dword [0x111ee20c], eax
call fcn.11110270
mov ecx, dword [0x111ee20c]
push 1
mov dword [0x111ee210], eax
call fcn.1105d1a0
call fcn.11027810
jmp 0x110315ef
cmp esi, edi
je 0x110315ef
mov ecx, esi
call fcn.11125e30
push esi
call fcn.11162777
add esp, 4
call fcn.1100d620
cmp eax, edi
je 0x11031749
push eax
call fcn.1100d330
push eax
push 0x1119b404
call fcn.11147060
add esp, 0xc
jmp 0x11031749
mov eax, dword [0x111ee0dc]
push 0x1119bea0
push eax
call fcn.11165250
add esp, 8
test eax, eax
je 0x11031636
call fcn.11026ae0
jmp 0x11031749
mov ecx, ebx
call fcn.11143770
push pe_nt_image_headers32
lea ecx, [ebp - 0x80]
push ecx
push 0x32
mov ecx, ebx
call fcn.11143780
test eax, eax
je 0x1103169d
push 2
lea edx, [ebp - 0x80]
push 0x1119be9c
push edx
call fcn.11081f20
add esp, 0xc
test eax, eax
jne 0x1103169d
mov eax, dword [0x1119be8c]
mov ecx, dword [0x1119be90]
mov edx, dword [0x1119be94]
mov dword [0x111ee21c], eax
mov al, byte [0x1119be98]
mov dword [0x111ee23c], 1
mov dword [0x111ee220], ecx
mov dword [0x111ee224], edx
mov byte [0x111ee228], al
mov ecx, ebx
call fcn.11143770
push pe_nt_image_headers32
lea ecx, [ebp - 0x80]
push ecx
push 0x4d
mov ecx, ebx
call fcn.11143780
test eax, eax
je 0x110316ca
push 0x1f
lea edx, [ebp - 0x80]
push edx
push 0x111ee21c
call fcn.11164ed0
add esp, 0xc
mov esi, dword [sym.imp.KeRneL32.DLl_InitializeCriticalSection]
push 0x111ee294
call esi
push 0x111ee2ac
call esi
push 4
call fcn.111101b0
add esp, 4
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 4], 0x10
cmp eax, edi
je 0x11031702
push edi
push 1
mov ecx, eax
call fcn.11110de0
jmp 0x11031704
xor eax, eax
mov esi, dword [sym.imp.uSEr32.dll_RegisterWindowMessageA]
push 0x1119be40
mov byte [ebp - 4], 1
mov dword [0x111ee1d4], eax
call esi
push 0x1119bdf0
mov dword [0x111ee1e4], eax
call esi
push 0x1119bda8
mov dword [0x111ee1e8], eax
call esi
mov ecx, dword [0x111ee308]
mov dword [0x111ee1ec], eax
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 0x1102ebd0
call edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b4]
call fcn.110edb10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret