Function at 0x40ba30
Capabilities:
Check os version
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [str.V__]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
mov dword [ebp - 0x124], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
call esi
push 0x411d88
mov dword [0x428030], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x40ba8e
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040161c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov dword [0x42802c], eax
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40bc59
cmp dword [ebp - 0x11c], 5
jne 0x40bae4
cmp dword [ebp - 0x118], 1
jb 0x40bae4
cmp byte [ebp - 6], 1
mov dword [0x4140bc], 0
je 0x40bb5b
add dword [0x4140bc], 2
jmp 0x40bb5b
push 0x411dcc
call esi
test eax, eax
je 0x40bb5b
mov ecx, dword [eax + 0x3c]
movzx edx, word [ecx + eax + 0x40]
movzx eax, word [ecx + eax + 0x42]
cmp edx, 6
jne 0x40bb48
test eax, eax
jne 0x40bb11
mov dword [0x4140bc], 4
jmp 0x40bb5b
cmp eax, 1
jne 0x40bb22
mov dword [0x4140bc], 6
jmp 0x40bb5b
cmp eax, 2
jne 0x40bb33
mov dword [0x4140bc], 8
jmp 0x40bb5b
cmp eax, 3
jne 0x40ba7a
mov dword [0x4140bc], 0xa
jmp 0x40bb5b
cmp edx, 0xa
jne 0x40ba7a
mov dword [0x4140bc], 0xc
lea eax, [ebp - 0x124]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x40ba7a
cmp dword [ebp - 0x124], 0
jne 0x40ba7a
mov eax, dword [0x4140bc]
mov eax, dword [eax*4 + 0x4140c0]
mov dword [0x427fe8], eax
mov eax, dword [0x4140bc]
mov eax, dword [eax*4 + str._h_h_h]
mov dword [0x427ff8], eax
mov eax, dword [0x4140bc]
mov eax, dword [eax*4 + 0x414130]
mov dword [0x427ffc], eax
mov eax, dword [0x4140bc]
mov eax, dword [eax*4 + 0x414168]
mov dword [0x428000], eax
call fcn.0040bf60
mov dword [0x427fe8], eax
call fcn.0040bd80
cmp dword [0x427fe8], 0
mov dword [0x427fec], eax
je 0x40ba7a
test eax, eax
je 0x40ba7a
cmp dword [0x4140bc], 0xc
jne 0x40bc09
push str.win32u.dll
call esi
test eax, eax
je 0x40bc09
add dword [0x427ff8], 8
jmp 0x40bc24
cmp dword [0x4140bc], 0xd
jne 0x40bc24
push str.win32u.dll
call esi
test eax, eax
je 0x40bc24
sub dword [0x427ff8], 4
mov eax, dword [0x427fec]
add eax, 0xfffffffc
mov dword [0x427ff0], eax
mov eax, dword [0x427fe0]
neg eax
sbb eax, eax
and eax, 0x18
add eax, 0x2a
mov dword [0x427fe4], eax
mov eax, dword [0x427fe0]
neg eax
sbb eax, eax
and eax, 0x24
add eax, 0x34
mov dword [0x427ff4], eax
mov eax, dword [0x428030]
xorps xmm0, xmm0
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x154]
push eax
mov dword [ebp - 0x154], 0x30
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0x40d960
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
movdqu xmmword [ebp - 0x13c], xmm0
mov dword [ebp - 0x12c], str.MyMainWnd
mov dword [ebp - 0x128], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x40ba7a
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
push 0
call esi
push 1
mov dword [0x4141a4], eax
call esi
push 0
push 0
push 0
push 0x40c090
push 0
push 0
mov dword [0x4141a8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
je 0x40bd60
xor esi, esi
cmp dword [0x428024], esi
jne 0x40bd39
lea esp, [esp]
mov eax, dword [0x4141a0]
cmp dword [0x428034], eax
jae 0x40bd39
mov eax, dword [0x4141a0]
lea eax, [eax + eax*4]
add eax, eax
cmp esi, eax
jae 0x40bd39
push 0x64
call edi
inc esi
cmp dword [0x428024], 0
je 0x40bd10
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x64
call edi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x1b
call esi
push 0
push 2
push 0
push 0x12
call esi
mov eax, dword [0x428024]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0040161c
mov esp, ebp
pop ebp
ret 4