Function at 0x476c70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3dd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c0
mov eax, dword [0x4fa674]
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
mov dword [ebp - 0x10], esp
jne 0x476fc5
mov ebx, 1
push ebx
push 0x4fa680
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push esi
push esi
push ebx
push 0x4fa680
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.advapi32.dll
mov dword [0x4fa698], 0xc
mov dword [0x4fa6a0], esi
mov dword [0x4fa69c], 0x4fa680
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x476d05
lea eax, [ebp - 0x44]
push 0x4d8208
push eax
mov dword [ebp - 0x44], esi
call fcn.00439ca8
push str.ConvertStringSidToSidW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
mov dword [ebp - 0x40], eax
jne 0x476d29
lea ecx, [ebp - 0x50]
push 0x4d8208
push ecx
mov dword [ebp - 0x50], esi
call fcn.00439ca8
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0x3ca]
mov word [ebp - 0x3cc], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0x302]
mov word [ebp - 0x304], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0x23a]
mov word [ebp - 0x23c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4fa6d4]
mov dword [ebp - 0x1c], esi
cmp eax, esi
mov dword [ebp - 0x5c], str.S_1_1_0
mov dword [ebp - 0x58], str.S_1_15_2_1
mov dword [ebp - 0x54], str.S_1_15_2_2
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], 3
jne 0x476df8
mov ecx, 0x44
xor eax, eax
lea edi, [ebp - 0x170]
lea edx, [ebp - 0x174]
rep stosd dword es:[edi], eax
push edx
mov dword [ebp - 0x174], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x164]
mov ecx, 2
cmp eax, ecx
jne 0x476df2
mov eax, dword [ebp - 0x170]
cmp eax, 6
ja 0x476dec
jne 0x476df2
cmp dword [ebp - 0x16c], ecx
jb 0x476df2
mov dword [0x4fa6d8], ebx
mov dword [0x4fa6d4], ebx
cmp dword [0x4fa6d8], esi
jne 0x476e03
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
cmp ebx, dword [ebp - 0x2c]
jge 0x476e96
mov ecx, dword [ebp + ebx*4 - 0x5c]
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [ebp - 0x40]
cmp eax, esi
je 0x476e90
mov ecx, 0x31
xor eax, eax
lea edi, [ebp - 0x126]
mov word [ebp - 0x128], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, 0x63
lea eax, [ebx + ebx*4]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x3c], edx
lea edx, [eax + eax*4]
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x3c]
push eax
lea esi, [ebp + edx*8 - 0x3cc]
lea edx, [ebp - 0x128]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x30]
push edx
push eax
push esi
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x476e8e
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
mov dword [ebp + eax*4 - 0x28], esi
inc eax
mov dword [ebp - 0x1c], eax
xor esi, esi
inc ebx
jmp 0x476e05
mov edi, dword [ebp - 0x1c]
cmp edi, esi
jg 0x476eae
lea eax, [ebp - 0x4c]
push 0x4d8208
push eax
mov dword [ebp - 0x4c], esi
call fcn.00439ca8
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, 1
mov dword [ebp - 0x18], esi
jne 0x476eed
mov edx, dword [ebp - 0x28]
push 0xffffffffffffffff
push edx
push edi
push 0x4fa6b8
call fcn.00476920
add esp, 0x10
cmp eax, esi
jne 0x476fa1
lea eax, [ebp - 0x48]
push 0x4d8208
push eax
mov dword [ebp - 0x48], esi
call fcn.00439ca8
cmp edi, 2
jne 0x476f25
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
push 0xffffffffffffffff
push ecx
push 0xffffffffffffffff
push edx
push edi
push 0x4fa6b8
call fcn.00476920
add esp, 0x18
cmp eax, esi
jne 0x476fa1
lea eax, [ebp - 0x34]
push 0x4d8208
push eax
mov dword [ebp - 0x34], esi
call fcn.00439ca8
cmp edi, 3
jne 0x476fa1
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
push 0xffffffffffffffff
push ecx
push 0xffffffffffffffff
push edx
push 0xffffffffffffffff
push eax
push edi
push 0x4fa6b8
call fcn.00476920
add esp, 0x20
cmp eax, esi
jne 0x476fa1
lea ecx, [ebp - 0x38]
push 0x4d8208
push ecx
mov dword [ebp - 0x38], esi
call fcn.00439ca8
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x476f6d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x476f7b
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
push 0x4fa6b8
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push 0x4fa6b8
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, 0x476f9f
ret
mov dword [0x4fa6a8], 0xc
mov dword [0x4fa6b0], esi
mov dword [0x4fa6ac], 0x4fa6b8
mov dword [0x4fa674], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret