Function at 0x1003aa20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.100532f0
test eax, eax
je 0x1003aa47
mov eax, 1
jmp 0x1003b105
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 3
ja case.default.0x1003aa63
mov ecx, dword [ebp - 0x45c]
jmp dword [ecx*4 + 0x1003b118]
call fcn.1003a2a0
mov dword [0x100676bc], eax
cmp dword [0x100676bc], 0x600
jge 0x1003aa8c
mov dword [0x1011eafc], 0
jmp 0x1003aaaa
push 0
push str.EnableLUA
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
call fcn.1003d020
add esp, 0x10
mov dword [0x1011eafc], eax
mov edx, dword [ebp + 8]
mov dword [0x10280c60], edx
call fcn.100100d0
mov dword [0x10067bd0], eax
cmp dword [0x10067bd0], 0x89578da3
jne 0x1003b054
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1000fce0
add esp, 4
test eax, eax
setne al
mov byte [0x10280c59], al
mov byte [0x10067bcc], 1
call fcn.1002bc30
mov byte [0x10280c58], al
cmp dword [0x100676a8], 0
jne 0x1003ab0a
mov dword [0x100676a8], 0x111111
cmp dword [0x1011d848], 1
jne 0x1003ab2b
mov ecx, dword [0x10120b54]
and ecx, 0x80000000
jne 0x1003ab2b
mov dword [0x100676a8], 0x222222
cmp dword [0x1011d848], 2
jne 0x1003ab4c
mov edx, dword [0x10120b54]
and edx, 0x80000000
jne 0x1003ab4c
mov dword [0x100676a8], 0xaaaaaa
mov eax, dword [0x100676bc]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x601
jg 0x1003aba0
cmp dword [ebp - 0x460], 0x600
jge 0x1003ac88
cmp dword [ebp - 0x460], 0x500
je 0x1003abd5
cmp dword [ebp - 0x460], 0x500
jle 0x1003adb1
cmp dword [ebp - 0x460], 0x502
jle 0x1003ac06
jmp 0x1003adb1
cmp dword [ebp - 0x460], 0x602
jl 0x1003adb1
cmp dword [ebp - 0x460], 0x603
jle 0x1003ad2d
cmp dword [ebp - 0x460], 0xa00
je 0x1003ad2d
jmp 0x1003adb1
mov ecx, dword [0x101373fc]
and ecx, 0x40000000
je 0x1003abf7
push str.OS_2000
lea edx, [ebp - 0x408]
push edx
call fcn.10008420
add esp, 8
mov dword [0x10280c5c], 1
jmp 0x1003adcf
mov eax, dword [0x101373fc]
and eax, 0x40000000
je 0x1003ac52
cmp dword [0x100676bc], 0x502
jne 0x1003ac32
push str.OS_2003
lea ecx, [ebp - 0x408]
push ecx
call fcn.10008420
add esp, 8
cmp dword [0x100676bc], 0x501
jne 0x1003ac52
push str.OS_XP
lea edx, [ebp - 0x408]
push edx
call fcn.10008420
add esp, 8
movzx eax, byte [0x10067bcc]
test eax, eax
je 0x1003ac6e
mov ecx, dword [0x100676a8]
and ecx, 0xf
mov dword [0x10280c5c], ecx
jmp 0x1003ac83
mov edx, dword [0x100676a8]
and edx, 0xf0
shr edx, 4
mov dword [0x10280c5c], edx
jmp 0x1003adcf
mov eax, dword [0x101373fc]
and eax, 0x40000000
je 0x1003acf4
cmp dword [0x100676bc], 0x600
jne 0x1003acb4
push str.OS_VISTA
lea ecx, [ebp - 0x408]
push ecx
call fcn.10008420
add esp, 8
cmp dword [0x100676bc], 0x600
jne 0x1003acd4
push str.OS_2008
lea edx, [ebp - 0x408]
push edx
call fcn.10008420
add esp, 8
cmp dword [0x100676bc], 0x601
jne 0x1003acf4
push str.OS_7
lea eax, [ebp - 0x408]
push eax
call fcn.10008420
add esp, 8
movzx ecx, byte [0x10067bcc]
test ecx, ecx
je 0x1003ad16
mov edx, dword [0x100676a8]
and edx, 0xf00
shr edx, 8
mov dword [0x10280c5c], edx
jmp 0x1003ad28
mov eax, dword [0x100676a8]
and eax, 0xf000
shr eax, 0xc
mov dword [0x10280c5c], eax
jmp 0x1003adcf
mov ecx, dword [0x101373fc]
and ecx, 0x40000000
je 0x1003ad7b
cmp dword [0x100676bc], 0x602
jne 0x1003ad5b
push str.OS_8
lea edx, [ebp - 0x408]
push edx
call fcn.10008420
add esp, 8
cmp dword [0x100676bc], 0x602
jne 0x1003ad7b
push str.OS_2012
lea eax, [ebp - 0x408]
push eax
call fcn.10008420
add esp, 8
movzx ecx, byte [0x10067bcc]
test ecx, ecx
je 0x1003ad9d
mov edx, dword [0x100676a8]
and edx, 0xf0000
shr edx, 0x10
mov dword [0x10280c5c], edx
jmp 0x1003adaf
mov eax, dword [0x100676a8]
and eax, 0xf00000
shr eax, 0x14
mov dword [0x10280c5c], eax
jmp 0x1003adcf
push str.Unknown
lea ecx, [ebp - 0x408]
push ecx
call fcn.10008420
add esp, 8
mov dword [0x10280c5c], 1
mov edx, dword [0x101373fc]
and edx, 0x40000000
je 0x1003aece
cmp dword [0x10120f8c], 0
je 0x1003aece
mov eax, dword [0x10280c5c]
and eax, 1
je 0x1003ae04
mov dword [ebp - 0x464], 0x10060a58
jmp 0x1003ae54
mov ecx, dword [0x10280c5c]
and ecx, 2
je 0x1003ae1b
mov dword [ebp - 0x468], 0x10060a5c
jmp 0x1003ae48
mov edx, dword [0x10280c5c]
and edx, 4
je 0x1003ae32
mov dword [ebp - 0x46c], 0x10060a60
jmp 0x1003ae3c
mov dword [ebp - 0x46c], str.UnKnown
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x468]
mov dword [ebp - 0x464], ecx
movzx edx, byte [0x10067bcc]
test edx, edx
je 0x1003ae96
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1000fce0
add esp, 4
test eax, eax
je 0x1003ae7e
mov dword [ebp - 0x470], 0x10060a6c
jmp 0x1003ae88
mov dword [ebp - 0x470], str.32bit_____App
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x474], eax
jmp 0x1003aea0
mov dword [ebp - 0x474], str.64bit_____App
mov ecx, dword [ebp - 0x464]
push ecx
push 0x1011f518
mov edx, dword [ebp - 0x474]
push edx
lea eax, [ebp - 0x408]
push eax
push str._s__s__s__s_
lea ecx, [ebp - 0x208]
push ecx
call fcn.1003e8fe
add esp, 0x18
cmp dword [0x1011fd7c], 0
je 0x1003af47
movzx edx, byte [0x10067bcc]
test edx, edx
je 0x1003af19
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1000fce0
add esp, 4
test eax, eax
je 0x1003af01
mov dword [ebp - 0x478], str.32bit_WoW_App
jmp 0x1003af0b
mov dword [ebp - 0x478], str.32bit_App
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x47c], eax
jmp 0x1003af23
mov dword [ebp - 0x47c], str.64bit_App
mov ecx, dword [0x100676a8]
push ecx
mov edx, dword [0x10280c5c]
push edx
mov eax, dword [ebp - 0x47c]
push eax
push str.This_is_a__s___Engine__d_g_tc_Engine_0x_08x_
push 0
call fcn.1003b780
add esp, 0x14
lea ecx, [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 8
push 0
lea ecx, [ebp - 0x438]
push ecx
call fcn.1003e4a0
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, dword [ebp - 0x434]
xor edx, edx
mov cl, 0x20
call fcn.10042ed0
mov ecx, dword [ebp - 0x438]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], edx
mov edx, dword [ebp - 0x410]
add edx, 0x989680
mov eax, dword [ebp - 0x40c]
adc eax, 0
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x40c], eax
mov ecx, dword [ebp - 0x410]
mov edx, dword [ebp - 0x40c]
and edx, 0
mov dword [ebp - 0x438], ecx
mov eax, dword [ebp - 0x410]
mov edx, dword [ebp - 0x40c]
mov cl, 0x20
call fcn.10042eb0
mov dword [ebp - 0x434], eax
cmp dword [0x1026cc2c], 0
je 0x1003b02e
mov eax, dword [ebp + 8]
push eax
call fcn.1003b130
jmp 0x1003b052
lea ecx, [ebp - 0x454]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
push fcn.1003b130
push 0
push 0
call fcn.1004034e
add esp, 0x18
mov dword [ebp - 0x458], eax
jmp 0x1003b093
cmp dword [0x10067bd0], 0x23785289
jne 0x1003b07f
cmp dword [0x1011fd7c], 0
je 0x1003b07d
push 0x10060803
push str.found_OK_NOBHKOK__s_
push 0
call fcn.1003b780
add esp, 0xc
jmp 0x1003b093
push 0x1006080a
push str.Cannot_found_ME_______s___perfectly_ridiculous.
push 0
call fcn.1003b780
add esp, 0xc
jmp case.default.0x1003aa63
cmp dword [0x10067bd0], 0x89578da3
je 0x1003b0a3
jmp case.default.0x1003aa63
cmp dword [0x1011fd7c], 0x97
je 0x1003b0bb
cmp dword [0x1011fd7c], 0x99
jne 0x1003b0cf
push 0x1011f518
push str.ProcessDetach:__s
push 0
call fcn.1003b780
add esp, 0xc
call fcn.10010050
mov eax, dword [ebp + 8]
push eax
call fcn.1000fef0
add esp, 4
jmp 0x1003b105
mov ecx, dword [ebp + 8]
push ecx
call fcn.10039b00
add esp, 4
jmp 0x1003b105
mov edx, dword [ebp + 8]
push edx
call fcn.10039b50
add esp, 4
jmp 0x1003b105
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e48b
mov esp, ebp
pop ebp
ret 0xc