Function at 0x402490
Capabilities:
Check os version
Query environment variable
Terminate process

Disassembly:
push 0x324
push 0x4198d8
call fcn.00410130
xor ebx, ebx
push ebx
mov esi, dword [sym.imp.msvcrt.dll___set_app_type]
call esi
pop ecx
push ebx
mov edi, dword [sym.imp.ole32.dll_CoInitialize]
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
push ebx
push str.0xe0506b84.d
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push eax
call esi
mov dword [esp], 0x104
lea eax, [ebp - 0x134]
push eax
push str.0x8b0001ad
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
add ebx, eax
mov dword [ebp - 0x1c], ebx
push 0xd
call dword [sym.imp.KERNEL32.dll_AddAtomW]
cmp ax, 0xd
je 0x402523
push 0
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
call edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
wait
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 1
jge 0x40255e
push 0xb
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
cmp ax, 0xb
je 0x402559
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x28]
jmp 0x402542
wait
or dword [ebp - 4], 0xffffffff
jmp 0x40257f
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
push ebx
call esi
pop ecx
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
neg eax
sbb esi, esi
neg esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
neg eax
sbb edi, edi
neg edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
add eax, dword [ebp - 0x1c]
lea ecx, [esi + esi]
xor ecx, edi
shl ecx, 0x18
xor eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 6
push 0xc
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
cmp ax, 0xc
jne 0x402ab9
push 0x71
call dword [sym.imp.USER32.dll_CharUpperA]
cmp eax, 0x51
jne 0x402ab9
push ebx
call dword [sym.imp.oledlg.dll_OleUIBusyA]
cmp eax, 0x65
jne 0x402ab9
fld qword [str.333333]
call sub.msvcrt.dll__CIsin
fstp dword [ebp + 8]
fld dword [ebp + 8]
fcomp dword [0x419860]
fnstsw ax
test ah, 0x41
je 0x402ab9
movsx eax, byte [str.GetTickCount]
add eax, 0xb81
xor edx, edx
mov ecx, 0xc8a8786d
div ecx
lea ecx, [edx + 0x2e18]
or ecx, 0x3fbf13f5
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
movzx ecx, word [str.kernel32.dll]
sub ecx, eax
mov esi, dword [ebp + 8]
mov edi, esi
or edi, 0x748fefdf
mov eax, ecx
xor edx, edx
div edi
mov eax, edx
xor eax, 0x93
imul eax, eax, 0x4f
mov ecx, dword [ebp + 8]
or ecx, 0xcc5aa876
xor edx, edx
div ecx
mov ecx, edx
or ecx, 0x8d938eb5
push 0x4a
pop eax
xor edx, edx
div ecx
mov dword [0x420418], eax
push str.GetTickCount
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call fcn.00402000
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
movsx edi, byte [str.GetTickCount]
movzx eax, word [str.kernel32.dll]
mov dword [ebp + 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
and eax, 0x14b6
lea ecx, [esi + 0x51]
or ecx, 0x1b22256d
xor edx, edx
div ecx
mov ecx, eax
and ecx, dword [ebp + 8]
imul ecx, dword [ebp + 8]
imul ecx, edi
or ecx, 0x50eb796e
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
mov dword [0x420418], eax
call dword [ebp - 0x20]
mov dword [ebp + 8], eax
movsx eax, byte [str.GetTickCount]
mov dword [ebp - 0x24], eax
movzx eax, word [str.kernel32.dll]
mov dword [ebp - 0x30], eax
push str.QEz_xHus7_SuV_j_k0_z7R_W_7
push ebx
mov edi, 0x100000
push edi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
and eax, 0x48
sub esi, eax
imul esi, dword [ebp + 8]
or esi, 0x3caacedd
mov eax, 0x38a180ce
xor edx, edx
div esi
mov ecx, eax
or ecx, 5
and ecx, dword [ebp + 8]
or ecx, 0x99a27ffa
mov eax, dword [ebp - 0x30]
xor edx, edx
div ecx
push 2
pop ecx
sub ecx, eax
or ecx, 0x735695d
mov eax, dword [ebp - 0x24]
xor edx, edx
div ecx
xor edx, edx
mov ecx, 0xf19fbfb7
div ecx
mov dword [0x420418], edx
mov esi, 0xfc107
push 0x7a
push dword [ebp + 8]
push 0xc4
push str._i_u_i
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x3f
push dword [ebp + 8]
push 0x40
push str._u_i_d
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
dec esi
jne 0x4027a5
call dword [ebp - 0x20]
mov ecx, eax
imul eax, eax, 0x29
movzx esi, word [str.kernel32.dll]
sub esi, eax
or esi, dword [ebp + 8]
add esi, 0xfc108
or esi, 0x1e16220d
push 0x43
pop eax
xor edx, edx
div esi
movsx edx, byte [str.GetTickCount]
and eax, edx
imul eax, eax, 0x32
mov dword [0x420418], eax
sub ecx, dword [ebp + 8]
je 0x402abe
lea eax, [ebp - 0x1c]
push eax
push 0x4196e4
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
cmp esi, 6
jne 0x402864
fld qword [0x419858]
call sub.msvcrt.dll__CIsin
fstp dword [ebp + 8]
fld dword [ebp + 8]
fcomp dword [0x419850]
fnstsw ax
test ah, 0x41
jne 0x402895
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CancelIo]
and eax, 0x6eaa
or eax, 1
mov ecx, 0x540a1f41
sub ecx, eax
and ecx, esi
or ecx, 0x46f15cfd
push 0x78
pop eax
xor edx, edx
div ecx
imul eax, eax, 0x34
mov dword [ebp - 0x2c], eax
jmp 0x402b99
push ebx
call dword [sym.imp.oledlg.dll_OleUIBusyA]
cmp eax, 0x65
jne 0x402aae
movsx eax, byte [str.GetTickCount]
add eax, 0xb81
xor edx, edx
mov ecx, 0xc8a8786d
div ecx
lea ecx, [edx + 0x2e18]
or ecx, 0x3fbf13f5
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
movzx ecx, word [str.kernel32.dll]
sub ecx, eax
mov esi, dword [ebp + 8]
mov eax, esi
or eax, 0x748fefdf
mov dword [ebp + 8], eax
mov eax, ecx
xor edx, edx
div dword [ebp + 8]
mov eax, edx
xor eax, 0x93
imul eax, eax, 0x4f
mov ecx, dword [ebp + 8]
or ecx, 0xcc5aa876
xor edx, edx
div ecx
mov ecx, edx
or ecx, 0x8d938eb5
push 0x4a
pop eax
xor edx, edx
div ecx
mov dword [0x420418], eax
push str.GetTickCount
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
jmp section..htext
mov eax, dword [ebp - 0x2c]
call fcn.00410169
ret 4
mov edi, 0x100000
push str.jI9zBsUg_2_G_R__B2tJWt_p_3a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]