Function at 0x663d10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x886e80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c0
mov eax, dword [0x9dd114]
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
mov dword [ebp - 0x10], esp
jne 0x664065
mov ebx, 1
push ebx
push 0x9dd120
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push ebx
push 0x9dd120
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x9458d8
mov dword [0x9dd138], 0xc
mov dword [0x9dd140], esi
mov dword [0x9dd13c], 0x9dd120
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x663da5
lea eax, [ebp - 0x44]
push 0x909050
push eax
mov dword [ebp - 0x44], esi
call fcn.005fd217
push str.ConvertStringSidToSidW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
mov dword [ebp - 0x40], eax
jne 0x663dc9
lea ecx, [ebp - 0x50]
push 0x909050
push ecx
mov dword [ebp - 0x50], esi
call fcn.005fd217
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0x3ca]
mov word [ebp - 0x3cc], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0x302]
mov word [ebp - 0x304], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0x23a]
mov word [ebp - 0x23c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x9dd174]
mov dword [ebp - 0x1c], esi
cmp eax, esi
mov dword [ebp - 0x5c], str.S_1_1_0
mov dword [ebp - 0x58], str.S_1_15_2_1
mov dword [ebp - 0x54], str.S_1_15_2_2
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], 3
jne 0x663e98
mov ecx, 0x44
xor eax, eax
lea edi, [ebp - 0x170]
lea edx, [ebp - 0x174]
rep stosd dword es:[edi], eax
push edx
mov dword [ebp - 0x174], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x164]
mov ecx, 2
cmp eax, ecx
jne 0x663e92
mov eax, dword [ebp - 0x170]
cmp eax, 6
ja 0x663e8c
jne 0x663e92
cmp dword [ebp - 0x16c], ecx
jb 0x663e92
mov dword [0x9dd178], ebx
mov dword [0x9dd174], ebx
cmp dword [0x9dd178], esi
jne 0x663ea3
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
cmp ebx, dword [ebp - 0x2c]
jge 0x663f36
mov ecx, dword [ebp + ebx*4 - 0x5c]
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [ebp - 0x40]
cmp eax, esi
je 0x663f30
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0x126]
mov word [ebp - 0x128], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, 0x63
lea eax, [ebx + ebx*4]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x3c], edx
lea edx, [eax + eax*4]
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x3c]
push eax
lea esi, [ebp + edx*8 - 0x3cc]
lea edx, [ebp - 0x128]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x30]
push edx
push eax
push esi
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x663f2e
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
mov dword [ebp + eax*4 - 0x28], esi
inc eax
mov dword [ebp - 0x1c], eax
xor esi, esi
inc ebx
jmp 0x663ea5
mov edi, dword [ebp - 0x1c]
cmp edi, esi
jg 0x663f4e
lea eax, [ebp - 0x4c]
push 0x909050
push eax
mov dword [ebp - 0x4c], esi
call fcn.005fd217
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, 1
mov dword [ebp - 0x18], esi
jne 0x663f8d
mov edx, dword [ebp - 0x28]
push 0xffffffffffffffff
push edx
push edi
push 0x9dd158
call fcn.006639c0
add esp, 0x10
cmp eax, esi
jne 0x664041
lea eax, [ebp - 0x48]
push 0x909050
push eax
mov dword [ebp - 0x48], esi
call fcn.005fd217
cmp edi, 2
jne 0x663fc5
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
push 0xffffffffffffffff
push ecx
push 0xffffffffffffffff
push edx
push edi
push 0x9dd158
call fcn.006639c0
add esp, 0x18
cmp eax, esi
jne 0x664041
lea eax, [ebp - 0x34]
push 0x909050
push eax
mov dword [ebp - 0x34], esi
call fcn.005fd217
cmp edi, 3
jne 0x664041
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
push 0xffffffffffffffff
push ecx
push 0xffffffffffffffff
push edx
push 0xffffffffffffffff
push eax
push edi
push 0x9dd158
call fcn.006639c0
add esp, 0x20
cmp eax, esi
jne 0x664041
lea ecx, [ebp - 0x38]
push 0x909050
push ecx
mov dword [ebp - 0x38], esi
call fcn.005fd217
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x66400d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x66401b
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
push 0x9dd158
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push 0x9dd158
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, 0x66403f
ret
mov dword [0x9dd148], 0xc
mov dword [0x9dd150], esi
mov dword [0x9dd14c], 0x9dd158
mov dword [0x9dd114], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret