Function at 0x10006bf6
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
sub esp, 0x350
mov eax, dword [0x1008f210]
xor eax, esp
mov dword [esp + 0x34c], eax
mov eax, dword [0x10093f50]
or eax, dword [0x10093f54]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 0
pop ebx
mov ebp, 0x10006a96
jne 0x10006d14
cmp byte [0x10093f09], bl
jne 0x10006cb9
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10006c61
cmp dword [esp + 0x24], 6
setb al
mov byte [0x10093f0a], al
cmp al, bl
jne 0x10006cb2
push 0x10076b88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x10006cab
push str.EventWrite
push edi
call esi
mov dword [0x10093f0c], eax
cmp eax, ebx
je 0x10006cab
push str.EventRegister
push edi
call esi
mov dword [0x10091018], eax
cmp eax, ebx
je 0x10006ca5
push str.EventUnregister
push edi
call esi
mov dword [0x10093f10], eax
cmp eax, ebx
jne 0x10006cb2
mov dword [0x10091018], ebp
mov byte [0x10093f0a], 1
mov byte [0x10093f09], 1
cmp byte [0x10093f0a], bl
jne 0x10006cdd
push 0x10093f50
push 0x10093f58
push 0x10006a46
push 0x10076c00
call dword [0x10091018]
jmp 0x10006d14
mov ecx, 0x10093f58
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x10093f54], edx
lea edx, [esp + 0x24]
push edx
push 1
mov dword [0x10093f50], eax
mov eax, 0x10076c00
push eax
push ecx
push 0x100069db
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov eax, dword [0x10093f88]
or eax, dword [0x10093f8c]
jne 0x10006e15
cmp byte [0x10093f09], bl
jne 0x10006dba
lea eax, [esp + 0x134]
push eax
mov dword [esp + 0x138], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10006d62
cmp dword [esp + 0x138], 6
setb al
mov byte [0x10093f0a], al
cmp al, bl
jne 0x10006db3
push 0x10076b88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x10006dac
push str.EventWrite
push edi
call esi
mov dword [0x10093f0c], eax
cmp eax, ebx
je 0x10006dac
push str.EventRegister
push edi
call esi
mov dword [0x10091018], eax
cmp eax, ebx
je 0x10006da6
push str.EventUnregister
push edi
call esi
mov dword [0x10093f10], eax
cmp eax, ebx
jne 0x10006db3
mov dword [0x10091018], ebp
mov byte [0x10093f0a], 1
mov byte [0x10093f09], 1
cmp byte [0x10093f0a], bl
jne 0x10006dde
push 0x10093f88
push 0x10093f90
push 0x10006a46
push 0x10076c10
call dword [0x10091018]
jmp 0x10006e15
mov ecx, 0x10093f90
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x10093f8c], edx
lea edx, [esp + 0x1c]
push edx
push 1
mov dword [0x10093f88], eax
mov eax, 0x10076c10
push eax
push ecx
push 0x100069db
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov eax, dword [0x10093f18]
or eax, dword [0x10093f1c]
jne 0x10006f16
cmp byte [0x10093f09], bl
jne 0x10006ebb
lea eax, [esp + 0x248]
push eax
mov dword [esp + 0x24c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10006e63
cmp dword [esp + 0x24c], 6
setb al
mov byte [0x10093f0a], al
cmp al, bl
jne 0x10006eb4
push 0x10076b88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x10006ead
push str.EventWrite
push edi
call esi
mov dword [0x10093f0c], eax
cmp eax, ebx
je 0x10006ead
push str.EventRegister
push edi
call esi
mov dword [0x10091018], eax
cmp eax, ebx
je 0x10006ea7
push str.EventUnregister
push edi
call esi
mov dword [0x10093f10], eax
cmp eax, ebx
jne 0x10006eb4
mov dword [0x10091018], ebp
mov byte [0x10093f0a], 1
mov byte [0x10093f09], 1
cmp byte [0x10093f0a], bl
jne 0x10006edf
push 0x10093f18
push 0x10093f20
push 0x10006a46
push 0x10076bd0
call dword [0x10091018]
jmp 0x10006f16
mov ecx, 0x10093f20
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x10093f1c], edx
lea edx, [esp + 0x1c]
push edx
push 1
mov dword [0x10093f18], eax
mov eax, 0x10076bd0
push eax
push ecx
push 0x100069db
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov ecx, dword [esp + 0x35c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov byte [0x100a60b8], 1
mov eax, 0x100a60b8
call fcn.1004c55d
add esp, 0x350
ret