Function at 0x49f6b8
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x49f6c0
push ebx
push esi
push edi
mov ebx, eax
lea eax, [ebp - 0xe8]
mov edx, dword [0x4915a8]
call fcn.0040535c
lea eax, [ebp - 0xf4]
mov edx, dword [0x499900]
call fcn.0040535c
xor eax, eax
push ebp
push 0x49ff4a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x49fe80
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x49fe6f
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x465c64]
call fcn.00403b44
mov edx, dword [0x4a7768]
mov dword [edx], eax
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49ff60
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49ff6c
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49ff60
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49ff90
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov dl, 1
mov eax, dword [0x491648]
call fcn.004916bc
mov dword [ebp - 4], eax
cmp dword [ebp - 0xa8], 5
jbe 0x49fd73
cmp dword [ebp - 0xa8], 6
jne 0x49f7b8
cmp dword [ebp - 0xa4], 0
je 0x49fd73
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49ffb4
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x49ffd0
mov eax, dword [ebp - 0xa8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xfc]
call fcn.004093d0
push dword [ebp - 0xfc]
push 0x49ffe8
mov eax, dword [ebp - 0xa4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x100]
call fcn.004093d0
push dword [ebp - 0x100]
lea eax, [ebp - 0xf8]
mov edx, 4
call fcn.00404d20
mov edx, dword [ebp - 0xf8]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x10], 0
mov eax, dword [0x4a7b04]
mov al, byte [eax + 0xc]
mov edx, dword [ebp - 4]
mov byte [edx + 0x38], al
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x4a7b04]
mov ecx, dword [ecx + 0x14]
mov edx, dword [0x4a7b04]
mov edx, dword [edx + 0x10]
mov eax, dword [ebp - 4]
call fcn.00493228
lea ecx, [ebp - 0xf4]
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004a0238
mov dl, 1
mov eax, dword [0x41b130]
call fcn.00403b44
mov dl, 1
mov eax, dword [0x41b130]
call fcn.00403b44
cmp dword [ebp - 0xf4], 0
je 0x49fcbb
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x4a0000
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0xf4]
mov eax, ebx
call fcn.004a0bd8
mov edi, eax
lea edx, [ebp - 0xf4]
mov eax, ebx
call fcn.004a0f78
mov esi, eax
cmp dword [ebp - 0xf4], 1
jne 0x49f926
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.004a1a48
cmp dword [ebp - 0x18], 0
je 0x49f984
lea eax, [ebp - 0x104]
mov ecx, dword [ebp - 0x18]
mov edx, 0x4a0020
call fcn.00404cac
mov edx, dword [ebp - 0x104]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x10], 0
lea eax, [ebp - 0x10]
mov edx, 0x4a0068
call fcn.00404a1c
jmp 0x49f984
cmp dword [ebp - 0xf4], 2
jne 0x49f984
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.004a1f6c
cmp dword [ebp - 0x18], 0
je 0x49f984
lea eax, [ebp - 0x108]
mov ecx, dword [ebp - 0x18]
mov edx, 0x4a0078
call fcn.00404cac
mov edx, dword [ebp - 0x108]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x10], 1
lea eax, [ebp - 0x10]
mov edx, 0x4a00c8
call fcn.00404a1c
cmp dword [ebp - 0x18], 0
jne 0x49fa75
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49ff60
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x4a00d8
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0049ad4c
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebx + 0x3e4]
call fcn.004049d8
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x10], 5
lea edx, [ebp - 0x10c]
mov eax, dword [ebx + 0x308]
call fcn.004092e4
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 4]
add eax, 0x24
call fcn.004049d8
lea edx, [ebp - 0x110]
mov eax, dword [ebx + 0x30c]
neg eax
call fcn.004092e4
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 4]
add eax, 0x28
call fcn.004049d8
lea edx, [ebp - 0x114]
mov eax, dword [ebx + 0x3b8]
call fcn.004092e4
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004049d8
mov eax, dword [ebp - 4]
add eax, 0x30
mov edx, dword [ebx + 0x3bc]
call fcn.004049d8
mov eax, dword [ebp - 4]
add eax, 0x3c
mov edx, dword [ebx + 0x3c8]
call fcn.004049d8
call fcn.004043c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49feef
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0049ad4c
mov eax, dword [0x4a7b04]
mov al, byte [eax + 0xc]
mov edx, dword [ebp - 4]
mov byte [edx + 0x38], al
cmp byte [0x4a7744], 0
je 0x49fabf
mov eax, dword [ebp - 8]
call fcn.00405be4
mov edx, eax
shl eax, 4
sub eax, edx
mov edx, dword [ebp - 8]
lea edx, [edx + eax*4 - 0x78]
lea eax, [ebp - 0xe8]
mov ecx, dword [0x4915a8]
call fcn.00405690
jmp 0x49fae6
mov eax, dword [ebp - 8]
call fcn.00405be4
mov edx, eax
shl eax, 4
sub eax, edx
mov edx, dword [ebp - 8]
lea edx, [edx + eax*4 - 0x3c]
lea eax, [ebp - 0xe8]
mov ecx, dword [0x4915a8]
call fcn.00405690
push 0x4a0108
push dword [ebp - 0xe0]
push 0x4a0134
push dword [ebp - 0xd8]
push 0x4a0144
push dword [ebp - 0xe0]
lea eax, [ebp - 0x118]
mov edx, 6
call fcn.00404d20
mov edx, dword [ebp - 0x118]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebp - 0xe0]
call fcn.004049d8
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x11c]
mov edx, 0x4a015c
call fcn.00404cac
mov edx, dword [ebp - 0x11c]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xc]
mov edx, 0x4a0178
call fcn.00404a1c
mov eax, ebx
call fcn.0049f2b8
lea eax, [ebp - 0x14]
mov edx, dword [ebx + 0x304]
call fcn.00404a1c
lea eax, [ebx + 0x3c8]
mov edx, dword [0x4a7720]
call fcn.004049d8
lea edx, [ebp - 0x120]
mov eax, dword [ebx + 0x308]
call fcn.004092e4
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 4]
add eax, 0x24
call fcn.004049d8
lea edx, [ebp - 0x124]
mov eax, dword [ebx + 0x30c]
neg eax
call fcn.004092e4
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 4]
add eax, 0x28
call fcn.004049d8
lea edx, [ebp - 0x128]
mov eax, dword [ebx + 0x3b8]
call fcn.004092e4
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004049d8
mov eax, dword [ebp - 4]
add eax, 0x30
mov edx, dword [ebx + 0x3bc]
call fcn.004049d8
mov eax, dword [ebp - 4]
add eax, 0x3c
mov edx, dword [ebx + 0x3c8]
call fcn.004049d8
lea eax, [ebx + 0x304]
mov edx, dword [ebp - 0xe0]
call fcn.004049d8
mov edx, dword [ebp - 0x18]
mov eax, 0x4a0184
call fcn.00404fa4
lea edx, [ebp - 0x18]
mov ecx, 3
xchg edx, eax
call fcn.00404f00
mov eax, dword [ebp - 4]
add eax, 0x1c
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x4a7b04]
mov eax, dword [eax + 4]
push eax
push 3
mov eax, dword [0x4a7b04]
mov eax, dword [eax + 8]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0049c9c8
test al, al
jne 0x49fc89
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 4]
add eax, 0x14
mov edx, dword [ebp - 0x18]
call fcn.004049d8
lea eax, [ebx + 0x304]
mov edx, dword [ebp - 0x14]
call fcn.004049d8
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x4a0190
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x49fe37
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0049ad4c
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebx + 0x3e4]
call fcn.004049d8
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x10], 5
lea edx, [ebp - 0x12c]
mov eax, dword [ebx + 0x308]
call fcn.004092e4
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 4]
add eax, 0x24
call fcn.004049d8
lea edx, [ebp - 0x130]
mov eax, dword [ebx + 0x30c]
neg eax
call fcn.004092e4
mov edx, dword [ebp - 0x130]
mov eax, dword [ebp - 4]
add eax, 0x28
call fcn.004049d8
lea edx, [ebp - 0x134]
mov eax, dword [ebx + 0x3b8]
call fcn.004092e4
mov edx, dword [ebp - 0x134]
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004049d8
mov eax, dword [ebp - 4]
add eax, 0x30
mov edx, dword [ebx + 0x3bc]
call fcn.004049d8
mov eax, dword [ebp - 4]
add eax, 0x3c
mov edx, dword [ebx + 0x3c8]
call fcn.004049d8
jmp 0x49fe37
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x4a01b0
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0049ad4c
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebx + 0x3e4]
call fcn.004049d8
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x10], 5
lea edx, [ebp - 0x138]
mov eax, dword [ebx + 0x308]
call fcn.004092e4
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 4]
add eax, 0x24
call fcn.004049d8
lea edx, [ebp - 0x13c]
mov eax, dword [ebx + 0x30c]
neg eax
call fcn.004092e4
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 4]
add eax, 0x28
call fcn.004049d8
lea edx, [ebp - 0x140]
mov eax, dword [ebx + 0x3b8]
call fcn.004092e4
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.004049d8
mov eax, dword [ebp - 4]
add eax, 0x30
mov edx, dword [ebx + 0x3bc]
call fcn.004049d8
mov eax, dword [ebp - 4]
add eax, 0x3c
mov edx, dword [ebx + 0x3c8]
call fcn.004049d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fe76
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x49ff60
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [0x4a7768]
mov eax, dword [eax]
mov edx, 0x4a01e8
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
call fcn.00491808
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ff51
lea eax, [ebp - 0x140]
mov edx, 0x13
call fcn.004049a8
lea eax, [ebp - 0xf4]
mov edx, dword [0x499900]
call fcn.0040542c
lea eax, [ebp - 0xe8]
mov edx, dword [0x4915a8]
call fcn.0040542c
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.004049a8
lea eax, [ebp - 8]
mov edx, dword [0x491618]
call fcn.00405eec
ret