Function at 0x4010b0
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8fc
mov eax, dword [0x414244]
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, ebp
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x904], eax
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x4c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x4c], 6
jne 0x40119a
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x40119a
push 0x400
lea ecx, [esp + 0x504]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
lea edx, [esp + 0x500]
push eax
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x540
mov dword [esp + 0x1c], str.runas
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4013a6
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4013a6
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4013a6
call fcn.00401bb0
jmp 0x4013a6
lea ecx, [esp + 0xe0]
push ecx
call fcn.00401900
add esp, 4
test eax, eax
jne 0x4011db
push 0x10
push str.Error
push str.Cannot_find_Temp_Directory_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8f8]
xor ecx, ebp
call fcn.00404a91
mov esp, ebp
pop ebp
ret 0x10
push str.NGMDll.dll
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0x2f8]
push str._s_s
push eax
call fcn.00404a08
push 0x3e6
lea ecx, [esp + 0x304]
push ecx
push esi
call fcn.00401b10
add esp, 0x1c
test eax, eax
jne 0x401241
push 0x10
push str.Error
push str.Cannot_Load_Dll_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8f8]
xor ecx, ebp
call fcn.00404a91
mov esp, ebp
pop ebp
ret 0x10
push str.NGMResource.dll
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0x1f0]
push str._s_s
push eax
call fcn.00404a08
push 0x3e5
lea ecx, [esp + 0x1fc]
push ecx
push esi
call fcn.00401b10
push str.unicows.dll
lea edx, [esp + 0x100]
push edx
lea eax, [esp + 0x20c]
push str._s_s
push eax
call fcn.00404a08
push 0x3e4
lea ecx, [esp + 0x218]
push ecx
push esi
call fcn.00401b10
mov eax, dword [0x414180]
add esp, 0x38
test eax, eax
jbe 0x401313
push eax
lea edx, [esp + 0xe4]
push edx
lea eax, [esp + 0x400]
push str._s_d.dat
push eax
call fcn.00404a08
push 0x3e7
lea ecx, [esp + 0x40c]
push ecx
push esi
call fcn.00401b10
add esp, 0x1c
test eax, eax
jne 0x401313
push 0x10
push str.Error
push str.Cannot_Load_Game_Data_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8f8]
xor ecx, ebp
call fcn.00404a91
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x2f0]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x401355
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Load_Library_Failed_
call section..text
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8f8]
xor ecx, ebp
call fcn.00404a91
mov esp, ebp
pop ebp
ret 0x10
push str.NGMSetupMain
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401393
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProcAddress_Failed
call section..text
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8f8]
xor ecx, ebp
call fcn.00404a91
mov esp, ebp
pop ebp
ret 0x10
push str.1234567890_mom_ABCDEFGHIJ
push ebx
push esi
call eax
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x904]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00404a91
mov esp, ebp
pop ebp
ret 0x10