Function at 0x411a70
Capabilities:
Check os version
Get file attributes
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20d4
call fcn.004014d0
mov eax, dword [0x44d024]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x2090], ecx
mov dword [ebp - 0x2084], edx
mov dword [ebp - 0x2094], eax
mov dword [ebp - 0x2080], 0xffffffff
mov dword [ebp - 0x208c], 0xc0000365
mov dword [ebp - 0x2088], 0xffffffd5
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp ebx, 2
je 0x411cbc
mov edi, dword [0x4502e0]
test edi, edi
je 0x411cbc
lea eax, [ebp - 0x207c]
mov dword [ebp - 0x20ac], ecx
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20b0], 0x18
push eax
mov ecx, edi
mov dword [ebp - 0x20a4], 0x40
mov dword [ebp - 0x20a8], edx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call dword [section..rdata]
call edi
test eax, eax
js 0x411c4b
test dword [ebp - 0x204c], 0x400
jne 0x411cb0
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0x2050]
push 0
push 0x64
push dword [ebp - 0x2078]
mov dword [esi], eax
mov eax, dword [ebp - 0x205c]
push dword [ebp - 0x207c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2058]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.00401600
push 0
push 0x64
push dword [ebp - 0x2070]
add eax, 0xb3960000
push dword [ebp - 0x2074]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.00401600
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.00401600
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.00401600
mov edi, dword [ebp - 0x2094]
add eax, 0xb3960000
push 0
adc edx, 0x5e6684f4
mov dword [esi + 0x20], eax
push 0
push edi
mov dword [esi + 0x24], edx
call sym.exceptionsR3.exe_nocrt_strlen
add esp, 4
push eax
mov eax, dword [ebp - 0x204c]
and eax, 0x7fff
shl eax, 0x10
push edi
push eax
call fcn.00410e40
push ebx
push esi
push 0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
call fcn.00411640
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401220
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000024
je 0x411c7b
cmp eax, 0xc0000033
je 0x411c7b
cmp eax, 0xc000000d
je 0x411c7b
cmp eax, 0xc0000022
je 0x411cb0
cmp eax, 0xc0000043
je 0x411cb0
push eax
call fcn.00410900
add esp, 4
mov edi, eax
jmp 0x411ca7
push eax
push 0x2078
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
lea eax, [ebp - 0x20b0]
push esi
push eax
call fcn.004116e0
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x412461
cmp edi, 0x34
jne 0x41245f
mov edx, dword [ebp - 0x2084]
mov ecx, dword [ebp - 0x2090]
mov eax, dword [0x44d16c]
mov edi, 0x4020
mov dword [ebp - 0x2098], eax
test eax, eax
je 0x411cdb
test byte [ebp + 0x18], 2
jne 0x411cdb
mov edi, 0x204020
push 0
push 0
push edi
push 1
push 7
push 0x80
push 0
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x20b0], 0x18
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20ac], ecx
push eax
push 0x100080
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x20a4], 0x40
push eax
mov dword [ebp - 0x20a8], edx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x411d4d
cmp eax, 0xc00000f7
jne 0x411da5
cmp dword [ebp - 0x2098], 0xffffffff
jne 0x411da5
test edi, 0x200000
je 0x411da5
push 0
push 0
and edi, 0xffdfffff
lea eax, [ebp - 0x208c]
push edi
push 1
push 7
push 0x80
push 0
push eax
lea eax, [ebp - 0x20b0]
push eax
push 0x100080
lea eax, [ebp - 0x2080]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x411da5
mov dword [0x44d16c], 0
test eax, eax
js 0x412092
push 0x23
push 8
lea eax, [ebp - 0x20bc]
push eax
lea eax, [ebp - 0x208c]
push eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x411de1
xor edi, edi
xor eax, eax
mov dword [ebp - 0x20b8], edi
mov dword [ebp - 0x20bc], eax
jmp 0x411ded
mov edi, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x20bc]
test eax, 0x400
je 0x411e85
cmp edi, 0xa000000c
je 0x411e85
mov eax, dword [ebp + 0x18]
test al, 2
jne 0x411e85
push 0
push 0
push 0x4020
push 1
push 7
push 0x80
push 0
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x208c], 0xc0000365
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x2088], 0xffffffd5
push eax
push 0x100080
lea eax, [ebp - 0x20b4]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x411e7f
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0x20b4]
xor edi, edi
mov dword [ebp - 0x2080], eax
mov dword [ebp - 0x20b8], edi
mov dword [ebp - 0x20bc], edi
jmp 0x411e8b
mov edi, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x2080]
push 0x12
push 0x68
lea ecx, [ebp - 0x207c]
mov dword [ebp - 0x2098], eax
push ecx
lea ecx, [ebp - 0x20c4]
mov dword [ebp - 0x20c4], 0xc0000365
push ecx
push eax
mov dword [ebp - 0x20c0], 0xffffffd5
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x411ed7
cmp eax, 0x80000005
je 0x411ed7
push eax
call fcn.00410900
add esp, 4
jmp 0x412069
mov eax, dword [ebp - 0x204c]
mov ecx, dword [ebp - 0x2048]
push 0
push 0x64
push dword [ebp - 0x2078]
mov dword [esi], eax
mov eax, dword [ebp - 0x2054]
push dword [ebp - 0x207c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2050]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.00401600
push 0
push 0x64
push dword [ebp - 0x2070]
add eax, 0xb3960000
push dword [ebp - 0x2074]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.00401600
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.00401600
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.00401600
add eax, 0xb3960000
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x2094]
adc edx, 0x5e6684f4
mov dword [esi + 0x24], edx
test eax, eax
je 0x411fa7
push eax
call sym.exceptionsR3.exe_nocrt_strlen
add esp, 4
jmp 0x411fa9
xor eax, eax
push 0
push edi
push eax
mov eax, dword [ebp - 0x205c]
push dword [ebp - 0x2094]
and eax, 0x7fff
shl eax, 0x10
push eax
call fcn.00410e40
add esp, 0x14
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
cmp ebx, 2
jne 0x41205d
mov eax, dword [ebp - 0x2044]
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
cmp eax, 1
ja 0x411ff7
mov eax, 1
mov ecx, dword [ebp - 0x2038]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0x203c]
push 1
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x207c]
push 0x800
push eax
lea eax, [ebp - 0x20c4]
mov dword [esi + 0x44], 0
push eax
push dword [ebp - 0x2098]
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
jns 0x412054
cmp eax, 0x80000005
jne 0x41205d
mov eax, dword [ebp - 0x2074]
mov dword [esi + 0x44], eax
push ebx
push esi
push 0
call fcn.00411640
add esp, 0xc
push dword [ebp - 0x2080]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x412106
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401220
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000024
je 0x4120d1
cmp eax, 0xc0000033
je 0x4120d1
cmp eax, 0xc0000022
je 0x4120bb
cmp eax, 0xc0000043
je 0x4120bb
push eax
call fcn.00410900
add esp, 4
mov edi, eax
jmp 0x4120fd
mov dword [ebp - 0x208c], 0xc0000365
mov dword [ebp - 0x2088], 0xffffffd5
jmp 0x412106
push eax
push 0x2078
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
lea eax, [ebp - 0x20b0]
push esi
push eax
call fcn.004116e0
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x41245f
cmp edi, 0x34
jne 0x41245f
push 0
lea eax, [ebp - 0x20d4]
push eax
lea eax, [ebp - 0x20cc]
push eax
push dword [ebp - 0x2084]
call fcn.00411570
add esp, 0x10
mov edi, dword [ebp - 0x2090]
lea eax, [ebp - 0x20cc]
mov dword [ebp - 0x20b0], 0x18
mov dword [ebp - 0x20a8], eax
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x20ac], edi
push 0
push 0
push 0x4021
push 1
push 7
push 0x80
push 0
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20a4], 0x40
push eax
push 0x100001
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x20a0], 0
push eax
mov dword [ebp - 0x209c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 0x20b4], eax
test eax, eax
js 0x4123dd
mov eax, dword fs:[0x30]
xor edx, edx
mov ecx, dword [eax + 0xa4]
mov eax, dword fs:[0x30]
or edx, dword [eax + 0xa8]
cmp ecx, 5
jb 0x4121d2
ja 0x4121cb
test edx, edx
je 0x4121d2
mov edi, 0x25
jmp 0x4121d7
mov edi, 3
push 0
lea eax, [ebp - 0x20d4]
push eax
push 1
push edi
push 0x2078
lea eax, [ebp - 0x207c]
push eax
lea eax, [ebp - 0x208c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x4123b3
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0x2050]
push 0
push 0x64
push dword [ebp - 0x2070]
mov dword [esi], eax
mov eax, dword [ebp - 0x204c]
push dword [ebp - 0x2074]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2048]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.00401600
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.00401600
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.00401600
push 0
push 0x64
push dword [ebp - 0x2058]
add eax, 0xb3960000
push dword [ebp - 0x205c]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.00401600
push 0
push dword [ebp - 0x203c]
add eax, 0xb3960000
push dword [ebp - 0x2094]
adc edx, 0x5e6684f4
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
call sym.exceptionsR3.exe_nocrt_strlen
add esp, 4
push eax
mov eax, dword [ebp - 0x2044]
push dword [ebp - 0x2094]
and eax, 0x7fff
shl eax, 0x10
push eax
call fcn.00410e40
add esp, 0x14
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
cmp ebx, 2
jne 0x412386
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 0
cmp edi, 0x25
jne 0x412339
mov eax, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x2018]
jmp 0x41233d
xor eax, eax
xor ecx, ecx
push 1
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x207c]
push 0x800
push eax
lea eax, [ebp - 0x208c]
mov dword [esi + 0x4c], ecx
push eax
push dword [ebp - 0x2080]
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x412386
mov eax, dword [ebp - 0x2074]
mov dword [esi + 0x44], eax
push ebx
push esi
push 0
call fcn.00411640
add esp, 0xc
mov edi, eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401220
mov esp, ebp
pop ebp
ret
push eax
call fcn.00410900
add esp, 4
mov edi, eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401220
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000033
je 0x4123ee
cmp eax, 0xc0000024
je 0x4123ee
push eax
jmp 0x412455
mov ecx, dword [ebp - 0x2084]
push eax
push 0x2078
lea eax, [ebp - 0x207c]
mov dword [ebp - 0x20b0], 0x18
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20ac], edi
push ebx
push esi
push eax
mov dword [ebp - 0x20a4], 0x40
mov dword [ebp - 0x20a8], ecx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call fcn.004116e0
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x41245f
push dword [ebp - 0x20b4]
call fcn.00410900
mov edi, eax
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401220
mov esp, ebp
pop ebp
ret