Function at 0x41b1dc
Capabilities:
Allocate or change rwx memory
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x41b682
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [0x40ad24]
call fcn.00406bf8
mov eax, dword [ebp - 0x10]
cmp byte [eax + 4], 0
je 0x41b64e
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x38], 0
jne 0x41b64e
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0xc]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
mov eax, dword [0x4248c8]
call fcn.0041631c
lea edx, [ebp - 0x12c]
mov eax, dword [0x4248a8]
call fcn.0040ccb0
push dword [ebp - 0x12c]
push 0x41b69c
push dword [ebp - 8]
lea eax, [ebp - 0x128]
mov edx, 3
call fcn.004056f4
mov eax, dword [ebp - 0x128]
call fcn.004058b4
push eax
call fcn.00415c40
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41b64e
xor edx, edx
push ebp
push 0x41b647
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor edx, edx
push ebp
push 0x41b629
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
lea edx, [ebp - 0x134]
mov eax, dword [0x4248c0]
call fcn.0040ccb0
push dword [ebp - 0x134]
push 0x41b69c
push dword [ebp - 8]
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.004056f4
mov eax, dword [ebp - 0x130]
call fcn.004058b4
push eax
call fcn.00416138
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41b5c9
xor eax, eax
push ebp
push 0x41b5c2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41b5ab
xor eax, eax
push ebp
push 0x41b5a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx]
lea edx, [esi + 0x16]
cmp eax, dword [edx]
jne 0x41b388
mov eax, dword [esi + 0xc]
add eax, 4
movzx eax, word [eax]
lea edx, [esi + 0x16]
add edx, 4
cmp ax, word [edx]
je 0x41b58d
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 8
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41b58d
lea edx, [ebp - 0x124]
mov eax, dword [esi + 0xc]
call fcn.0040fe5c
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x40], 0
je 0x41b3ec
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x41b3ec
mov eax, dword [ebp - 0x104]
sub eax, dword [ebp - 0x108]
cmp eax, 6
jae 0x41b3ec
push ebp
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x48]
mov eax, dword [esi + 0xc]
call fcn.0041af34
pop ecx
test al, al
jne 0x41b3f0
xor eax, eax
jmp 0x41b3f2
mov al, 1
mov byte [ebp - 0x21], al
cmp byte [ebp - 0x21], 0
je 0x41b496
mov byte [ebp - 0x22], 0xf4
mov edx, dword [esi + 0xc]
lea eax, [ebp - 0x22]
mov ecx, 1
call fcn.00415578
test al, al
jne 0x41b420
mov eax, dword [esi + 0xc]
movzx edx, byte [ebp - 0x22]
mov byte [eax], dl
mov eax, dword [esi + 0xc]
mov edx, 1
call fcn.0041ae48
lea eax, [ebp - 0xc]
call fcn.0041ac40
mov eax, dword [ebp - 0xc]
call fcn.00406a2c
test eax, eax
jl 0x41b496
inc eax
mov dword [ebp - 0x34], eax
xor edi, edi
mov dword [ebp - 0x100], 0x10001
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edi*4]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x41b484
mov eax, dword [esi + 0xc]
cmp eax, dword [ebp - 0x48]
jae 0x41b484
mov eax, dword [esi + 0xc]
add eax, 6
cmp eax, dword [ebp - 0x48]
jbe 0x41b484
push 0xa
call sub.kernel32.dll_Sleep
jmp 0x41b447
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edi*4]
push eax
call sub.kernel32.dll_CloseHandle
inc edi
dec dword [ebp - 0x34]
jne 0x41b447
mov edx, dword [esi + 0xc]
lea eax, [esi + 0x16]
mov ecx, 6
call fcn.00415578
test al, al
jne 0x41b4ba
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x16]
mov dword [eax], edx
mov dx, word [esi + 0x1a]
mov word [eax + 4], dx
mov eax, dword [esi + 0xc]
mov edx, 6
call fcn.0041ae48
cmp byte [ebp - 0x21], 0
je 0x41b56a
mov dl, 1
mov eax, dword [0x4247b0]
call fcn.004113f0
mov ebx, eax
lea eax, [ebx + 0xe]
lea edx, [ebx + 0xa]
add eax, dword [edx]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xc]
call fcn.0041ac40
mov eax, dword [ebp - 0xc]
call fcn.00406a2c
test eax, eax
jl 0x41b56a
inc eax
mov dword [ebp - 0x34], eax
xor edi, edi
mov dword [ebp - 0x100], 0x10001
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edi*4]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x41b558
mov eax, dword [esi + 0xc]
cmp eax, dword [ebp - 0x48]
je 0x41b54f
cmp ebx, dword [ebp - 0x48]
ja 0x41b53a
lea eax, [ebx + 0xa]
cmp eax, dword [ebp - 0x48]
jae 0x41b54f
mov eax, dword [ebp - 0x48]
and eax, 0xffff0000
mov edx, dword [ebp - 0x28]
and edx, 0xffff0000
cmp eax, edx
jne 0x41b558
push 0xa
call sub.kernel32.dll_Sleep
jmp 0x41b504
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edi*4]
push eax
call sub.kernel32.dll_CloseHandle
inc edi
dec dword [ebp - 0x34]
jne 0x41b504
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x2c]
push eax
push 8
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
cmp byte [ebp - 0x21], 0
je 0x41b58d
push ebp
mov eax, dword [ebp - 0x30]
call fcn.0041b15c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b5ab
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b5c9
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle
ret
cmp dword [ebp - 0x20], 0
je 0x41b612
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x44], 0
je 0x41b612
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x43], 0
je 0x41b5ee
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x3c]
call fcn.00416778
jmp 0x41b5f0
xor eax, eax
mov edx, dword [ebp - 0x10]
cmp byte [edx + 0x43], 0
je 0x41b5fd
test eax, eax
je 0x41b612
push eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x20]
call fcn.00416904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b630
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ReleaseMutex
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b689
lea eax, [ebp - 0x134]
mov edx, 4
call fcn.004051d0
lea eax, [ebp - 0xc]
mov edx, dword [0x40ad24]
call fcn.00406bf8
lea eax, [ebp - 8]
call fcn.004051ac
ret