Function at 0x5defb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x637bdb
mov eax, dword fs:[0]
push eax
sub esp, 0x658
mov eax, dword [0x6ce488]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x618], 0
cmp dword [0x6d86b8], 0
jne 0x5df42b
lea ecx, [ebp - 0x664]
call fcn.005e2bc0
push 0x6d86b4
lea ecx, [ebp - 0x664]
mov dword [ebp - 4], 0
call fcn.005e3470
push 0x110
lea eax, [ebp - 0x604]
push 0
push eax
call fcn.005feb40
add esp, 0xc
mov dword [ebp - 0x608], 0x114
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x604], 5
ja 0x5df420
call fcn.005df460
test al, al
je 0x5df0a9
push 0x691f28
lea ecx, [ebp - 0x60c]
call fcn.004178d0
lea eax, [ebp - 0x60c]
mov byte [ebp - 4], 1
push eax
mov ecx, 0x6d86b4
call fcn.00411a20
push 0xe
push str.VMWare_Hardisk
mov ecx, eax
call fcn.00401e40
mov edx, dword [ebp - 0x60c]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jmp 0x5df416
mov ax, word [0x69fdb8]
xorps xmm0, xmm0
push 0x206
mov word [ebp - 0x2a8], ax
lea eax, [ebp - 0x2a6]
push 0
push eax
movups xmmword [ebp - 0x4dc], xmm0
mov byte [ebp - 0x4bc], 0
movups xmmword [ebp - 0x4cc], xmm0
call fcn.005feb40
push 0
lea eax, [ebp - 0x2a8]
push str..PHYSICALDRIVE_d
push eax
call fcn.005dc630
add esp, 0x18
lea eax, [ebp - 0x2a8]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x5df420
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea eax, [ebp - 0x614]
push 0
push eax
push 0x18
lea eax, [ebp - 0x4f4]
push eax
push 0
push 0
push 0x74080
push edi
call esi
mov al, byte [ebp - 0x4f1]
and al, 0x10
neg al
push 0
sbb al, al
and al, 0xb5
add al, 0xec
mov byte [ebp - 0x4d2], al
lea eax, [ebp - 0x614]
push eax
push 0x210
lea eax, [ebp - 0x4b8]
push eax
push 0x20
lea eax, [ebp - 0x4dc]
push eax
push 0x7c088
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xa0]
push eax
push 0x2e
lea eax, [ebp - 0x4a8]
push 0x1b
push eax
call fcn.005df550
lea eax, [ebp - 0x40]
push eax
push 0x13
lea eax, [ebp - 0x4a8]
push 0xa
push eax
call fcn.005df550
add esp, 0x20
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x60c]
push eax
call fcn.004178d0
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x610]
call fcn.004178d0
lea ecx, [ebp - 0x60c]
mov byte [ebp - 4], 3
call fcn.00411fb0
lea ecx, [ebp - 0x610]
call fcn.00411fb0
push 0x691f28
lea ecx, [ebp - 0x614]
call fcn.004178d0
mov eax, dword [ebp - 0x610]
mov byte [ebp - 4], 5
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x5df220
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x5df238
call fcn.004021b0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x5df446
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x618], 1
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x610]
push 2
push 0x691fd8
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.00412660
add esp, 0x14
mov esi, dword [ebp - 0x61c]
mov ecx, dword [esi - 0x10]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 6
mov dword [ebp - 0x634], eax
test ecx, ecx
je 0x5df299
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x5df2b1
call fcn.004021b0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x5df450
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x618], 3
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x60c]
push dword [eax - 0xc]
push eax
push dword [esi - 0xc]
lea eax, [ebp - 0x620]
push esi
push eax
call fcn.00412660
add esp, 0x14
lea eax, [ebp - 0x614]
mov ecx, 0x6d86b4
push eax
call fcn.00411a20
mov ecx, dword [ebp - 0x620]
or esi, 0xffffffff
mov dword [ebp - 0x624], eax
mov edx, dword [eax]
sub edx, 0x10
lea edi, [ecx - 0x10]
mov dword [ebp - 0x62c], edx
cmp edi, edx
je 0x5df37f
cmp dword [edx + 0xc], 0
lea eax, [edx + 0xc]
mov dword [ebp - 0x628], eax
jl 0x5df370
mov eax, dword [edi]
cmp eax, dword [edx]
jne 0x5df370
push edi
call fcn.00401b80
mov edx, dword [ebp - 0x628]
add esp, 4
mov dword [ebp - 0x630], eax
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5df363
mov eax, dword [ebp - 0x62c]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0x624]
add eax, 0x10
mov dword [ecx], eax
jmp 0x5df37f
push dword [ecx - 0xc]
push ecx
mov ecx, dword [ebp - 0x624]
call fcn.00401e40
mov dword [ebp - 0x618], 1
mov eax, esi
mov byte [ebp - 4], 5
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x5df3a1
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x634]
mov eax, esi
mov byte [ebp - 4], 4
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5df3bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x614]
mov eax, esi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5df3e0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x610]
mov eax, esi
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x5df401
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x60c]
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x5df420
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x664]
call fcn.005e2e80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c358e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401f90
push 0x80004005
call fcn.00401f90
int3