Function at 0x426f40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x451430]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x210], esi
call fcn.00421a60
add esp, 4
test al, al
je 0x426f97
mov dword [ebp - 0x218], str.McAfee__Inc.
mov dword [ebp - 0x210], str.McAfee_Inc
push 0x90
lea edx, [ebp - 0x15c]
push esi
push edx
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x200], esi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x204], esi
call fcn.0042d860
push 0x98
lea eax, [ebp - 0x1f8]
push esi
push eax
call fcn.0042d860
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0x18
lea ecx, [ebp - 0x160]
push ecx
mov dword [ebp - 0x160], 0x94
mov dword [ebp - 0x1fc], 0x9c
call esi
lea edx, [ebp - 0x1fc]
push edx
call esi
push 0xf0000040
push 1
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4270f8
mov eax, dword [ebp - 0x208]
cmp eax, esi
je 0x4270f8
push esi
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0xcc]
push edx
push 4
push eax
mov dword [ebp - 0x240], 0xc8
call dword [sym.imp.ADVAPI32.dll_CryptGetProvParam]
test eax, eax
jne 0x427098
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x427536
test byte [eax + 0x1c], 1
je 0x427536
cmp byte [eax + 0x19], 3
jb 0x427536
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x44b008]
push 0x446878
push 0x15
jmp 0x427526
lea eax, [ebp - 0xcc]
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
mov word [ebp - 6], si
call fcn.00421c70
add esp, 8
test eax, eax
jne 0x42716e
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x427536
test byte [eax + 0x1c], 1
je 0x427536
cmp byte [eax + 0x19], 3
jb 0x427536
push 0x446878
push 0x16
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
push ecx
push edx
call fcn.00424ba0
add esp, 0x10
jmp 0x427536
mov dword [ebp - 0x208], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x80090009
jne 0x42713d
xor esi, esi
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x427536
test byte [eax + 0x1c], 1
je 0x427536
cmp byte [eax + 0x19], 3
jb 0x427536
push 0x446878
push 0x13
jmp 0x4270e3
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x427536
test byte [eax + 0x1c], 1
je 0x427536
cmp byte [eax + 0x19], 2
jb 0x427536
push esi
push 0x446878
push 0x14
jmp 0x427526
mov edx, dword [ebp + 8]
xor eax, eax
lea ecx, [ebp - 0x200]
push ecx
mov ecx, dword [ebp - 0x23c]
push ebx
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
push edi
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x208]
push edx
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp + 0x18]
push eax
push ecx
xor esi, esi
push esi
lea edx, [ebp - 0x254]
push edx
mov dword [ebp - 0x254], 0x14
mov dword [ebp - 0x250], 0x10001
call dword [sym.imp.CRYPT32.dll_CryptVerifyDetachedMessageSignature]
test eax, eax
je 0x4274f8
cmp dword [ebp - 0x200], esi
je 0x4274f8
push str.ROOT
push 0x10000
push esi
push esi
push 0xa
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov ecx, eax
cmp ecx, esi
mov dword [ebp - 0x214], ecx
jne 0x427246
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x427536
test byte [eax + 0x1c], 1
je 0x427536
cmp byte [eax + 0x19], 3
jb 0x427536
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x44b008]
push 0x446878
push 0x18
jmp 0x427526
mov bl, byte [ebp + 0x20]
xor eax, eax
test bl, bl
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x264], 0x10
mov dword [ebp - 0x260], esi
jne 0x427298
mov edx, dword [ebp - 0x15c]
imul edx, edx, 0x64
add edx, dword [ebp - 0x158]
mov eax, 4
cmp edx, 0x1f4
jbe 0x427298
mov eax, reloc.OLEAUT32.dll_SysReAllocStringLen
lea edx, [ebp - 0x20c]
push edx
push esi
push eax
lea eax, [ebp - 0x264]
push eax
push ecx
mov ecx, dword [ebp - 0x200]
push esi
push ecx
push esi
call dword [sym.imp.CRYPT32.dll_CertGetCertificateChain]
test eax, eax
je 0x4274c5
cmp dword [ebp - 0x20c], esi
je 0x4274c5
mov edx, dword [ebp - 0x200]
mov edi, dword [sym.imp.CRYPT32.dll_CertGetNameStringW]
push esi
push esi
push esi
push esi
push 4
push edx
call edi
mov esi, eax
lea eax, [ebp - 0x204]
push esi
push eax
call fcn.004219e0
mov ecx, dword [ebp - 0x204]
mov edx, dword [ebp - 0x200]
add esp, 8
push esi
push ecx
push 0
push 0
push 4
push edx
call edi
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x204]
push eax
push ecx
call fcn.004268a0
add esp, 8
test eax, eax
je 0x427394
mov esi, dword [ebp - 0x210]
push esi
call fcn.00421a60
add esp, 4
test al, al
jne 0x42734b
mov edx, dword [ebp - 0x204]
push esi
push edx
call fcn.004268a0
add esp, 8
test eax, eax
je 0x427394
mov esi, 0x7b
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x427536
test byte [eax + 0x1c], 1
je 0x427536
cmp byte [eax + 0x19], 2
jb 0x427536
mov ecx, dword [ebp - 0x204]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
push ecx
push 0x446878
push 0x1a
push edx
push eax
call fcn.004245a0
jmp 0x427533
xor eax, eax
test bl, bl
mov ecx, 0xc
mov edx, 1
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], edx
jne 0x4273cc
mov dword [ebp - 0x220], 0x11
xor eax, eax
cmp dword [ebp - 0x15c], 5
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x270]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x270], ecx
jne 0x427418
cmp dword [ebp - 0x158], edx
jne 0x427418
mov ax, word [ebp - 0x168]
test ax, ax
je 0x42740e
cmp ax, dx
jne 0x427418
mov dword [ebp - 0x26c], 0x200
xor eax, eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x224]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x20c]
push edx
push eax
push 2
mov dword [ebp - 0x238], 0x14
xor esi, esi
call dword [sym.imp.CRYPT32.dll_CertVerifyCertificateChainPolicy]
test eax, eax
jne 0x42746b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x427474
cmp dword [ebp - 0x234], 0
je 0x4274bd
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x4274b9
test byte [eax + 0x1c], 1
je 0x4274b9
cmp byte [eax + 0x19], 2
jb 0x4274b9
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x230]
push ecx
mov ecx, dword [ebp - 0x234]
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
push ecx
push esi
push 0x446878
push 0x1b
push edx
push eax
call fcn.00426900
add esp, 0x20
test esi, esi
jne 0x427536
mov esi, dword [ebp - 0x234]
jmp 0x427536
mov dword [ebp - 0x20c], esi
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x427536
test byte [eax + 0x1c], 1
je 0x427536
cmp byte [eax + 0x19], 3
jb 0x427536
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x44b008]
push 0x446878
push 0x19
jmp 0x427526
mov dword [ebp - 0x200], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x44b008]
cmp eax, 0x44b008
je 0x427536
test byte [eax + 0x1c], 1
je 0x427536
cmp byte [eax + 0x19], 2
jb 0x427536
push esi
push 0x446878
push 0x17
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
push ecx
push edx
call fcn.00426940
add esp, 0x14
mov eax, dword [ebp - 0x204]
push eax
call fcn.00420af0
mov eax, dword [ebp - 0x20c]
add esp, 4
test eax, eax
je 0x427556
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x427569
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov eax, dword [ebp - 0x200]
test eax, eax
je 0x42757a
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x42758d
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d845
mov esp, ebp
pop ebp
ret