Function at 0x10019b10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x1003e830]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.10031050
test eax, eax
je 0x10019b37
mov eax, 1
jmp 0x1001a1f5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 3
ja case.default.0x10019b53
mov ecx, dword [ebp - 0x45c]
jmp dword [ecx*4 + 0x1001a208]
call fcn.10019390
mov dword [0x1003e704], eax
cmp dword [0x1003e704], 0x600
jge 0x10019b7c
mov dword [0x100ded84], 0
jmp 0x10019b9a
push 0
push str.EnableLUA
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
call fcn.1001c110
add esp, 0x10
mov dword [0x100ded84], eax
mov edx, dword [ebp + 8]
mov dword [0x101df8b8], edx
call fcn.1000b8e0
mov dword [0x1003e814], eax
cmp dword [0x1003e814], 0x89578da3
jne 0x1001a144
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1000b850
add esp, 4
test eax, eax
setne al
mov byte [0x101df8b1], al
mov byte [0x1003e810], 1
call fcn.1000b8d0
mov byte [0x101df8b0], al
cmp dword [0x1003e6f0], 0
jne 0x10019bfa
mov dword [0x1003e6f0], 0x111111
cmp dword [0x100ddad0], 1
jne 0x10019c1b
mov ecx, dword [0x100e0ddc]
and ecx, 0x80000000
jne 0x10019c1b
mov dword [0x1003e6f0], 0x222222
cmp dword [0x100ddad0], 2
jne 0x10019c3c
mov edx, dword [0x100e0ddc]
and edx, 0x80000000
jne 0x10019c3c
mov dword [0x1003e6f0], 0xaaaaaa
mov eax, dword [0x1003e704]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x601
jg 0x10019c90
cmp dword [ebp - 0x460], 0x600
jge 0x10019d78
cmp dword [ebp - 0x460], 0x500
je 0x10019cc5
cmp dword [ebp - 0x460], 0x500
jle 0x10019ea1
cmp dword [ebp - 0x460], 0x502
jle 0x10019cf6
jmp 0x10019ea1
cmp dword [ebp - 0x460], 0x602
jl 0x10019ea1
cmp dword [ebp - 0x460], 0x603
jle 0x10019e1d
cmp dword [ebp - 0x460], 0xa00
je 0x10019e1d
jmp 0x10019ea1
mov ecx, dword [0x100f7684]
and ecx, 0x40000000
je 0x10019ce7
push str.OS_2000
lea edx, [ebp - 0x408]
push edx
call fcn.10003f20
add esp, 8
mov dword [0x101df8b4], 1
jmp 0x10019ebf
mov eax, dword [0x100f7684]
and eax, 0x40000000
je 0x10019d42
cmp dword [0x1003e704], 0x502
jne 0x10019d22
push str.OS_2003
lea ecx, [ebp - 0x408]
push ecx
call fcn.10003f20
add esp, 8
cmp dword [0x1003e704], 0x501
jne 0x10019d42
push str.OS_XP
lea edx, [ebp - 0x408]
push edx
call fcn.10003f20
add esp, 8
movzx eax, byte [0x1003e810]
test eax, eax
je 0x10019d5e
mov ecx, dword [0x1003e6f0]
and ecx, 0xf
mov dword [0x101df8b4], ecx
jmp 0x10019d73
mov edx, dword [0x1003e6f0]
and edx, 0xf0
shr edx, 4
mov dword [0x101df8b4], edx
jmp 0x10019ebf
mov eax, dword [0x100f7684]
and eax, 0x40000000
je 0x10019de4
cmp dword [0x1003e704], 0x600
jne 0x10019da4
push str.OS_VISTA
lea ecx, [ebp - 0x408]
push ecx
call fcn.10003f20
add esp, 8
cmp dword [0x1003e704], 0x600
jne 0x10019dc4
push str.OS_2008
lea edx, [ebp - 0x408]
push edx
call fcn.10003f20
add esp, 8
cmp dword [0x1003e704], 0x601
jne 0x10019de4
push str.OS_7
lea eax, [ebp - 0x408]
push eax
call fcn.10003f20
add esp, 8
movzx ecx, byte [0x1003e810]
test ecx, ecx
je 0x10019e06
mov edx, dword [0x1003e6f0]
and edx, 0xf00
shr edx, 8
mov dword [0x101df8b4], edx
jmp 0x10019e18
mov eax, dword [0x1003e6f0]
and eax, 0xf000
shr eax, 0xc
mov dword [0x101df8b4], eax
jmp 0x10019ebf
mov ecx, dword [0x100f7684]
and ecx, 0x40000000
je 0x10019e6b
cmp dword [0x1003e704], 0x602
jne 0x10019e4b
push str.OS_8
lea edx, [ebp - 0x408]
push edx
call fcn.10003f20
add esp, 8
cmp dword [0x1003e704], 0x602
jne 0x10019e6b
push str.OS_2012
lea eax, [ebp - 0x408]
push eax
call fcn.10003f20
add esp, 8
movzx ecx, byte [0x1003e810]
test ecx, ecx
je 0x10019e8d
mov edx, dword [0x1003e6f0]
and edx, 0xf0000
shr edx, 0x10
mov dword [0x101df8b4], edx
jmp 0x10019e9f
mov eax, dword [0x1003e6f0]
and eax, 0xf00000
shr eax, 0x14
mov dword [0x101df8b4], eax
jmp 0x10019ebf
push str.Unknown
lea ecx, [ebp - 0x408]
push ecx
call fcn.10003f20
add esp, 8
mov dword [0x101df8b4], 1
mov edx, dword [0x100f7684]
and edx, 0x40000000
je 0x10019fbe
cmp dword [0x100e1214], 0
je 0x10019fbe
mov eax, dword [0x101df8b4]
and eax, 1
je 0x10019ef4
mov dword [ebp - 0x464], 0x10038ecc
jmp 0x10019f44
mov ecx, dword [0x101df8b4]
and ecx, 2
je 0x10019f0b
mov dword [ebp - 0x468], 0x10038ed0
jmp 0x10019f38
mov edx, dword [0x101df8b4]
and edx, 4
je 0x10019f22
mov dword [ebp - 0x46c], 0x10038ed4
jmp 0x10019f2c
mov dword [ebp - 0x46c], str.UnKnown
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x468], eax
mov ecx, dword [ebp - 0x468]
mov dword [ebp - 0x464], ecx
movzx edx, byte [0x1003e810]
test edx, edx
je 0x10019f86
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1000b850
add esp, 4
test eax, eax
je 0x10019f6e
mov dword [ebp - 0x470], 0x10038ee0
jmp 0x10019f78
mov dword [ebp - 0x470], str.32bit_____App
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x474], eax
jmp 0x10019f90
mov dword [ebp - 0x474], str.64bit_____App
mov ecx, dword [ebp - 0x464]
push ecx
push 0x100df7a0
mov edx, dword [ebp - 0x474]
push edx
lea eax, [ebp - 0x408]
push eax
push str._s__s__s__s_
lea ecx, [ebp - 0x208]
push ecx
call fcn.1001d9ee
add esp, 0x18
cmp dword [0x100e0004], 0
je 0x1001a037
movzx edx, byte [0x1003e810]
test edx, edx
je 0x1001a009
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.1000b850
add esp, 4
test eax, eax
je 0x10019ff1
mov dword [ebp - 0x478], str.32bit_WoW_App
jmp 0x10019ffb
mov dword [ebp - 0x478], str.32bit_App
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x47c], eax
jmp 0x1001a013
mov dword [ebp - 0x47c], str.64bit_App
mov ecx, dword [0x1003e6f0]
push ecx
mov edx, dword [0x101df8b4]
push edx
mov eax, dword [ebp - 0x47c]
push eax
push str.This_is_a__s___Engine__d_g_tc_Engine_0x_08x_
push 0
call fcn.1001a870
add esp, 0x14
lea ecx, [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 8
push 0
lea ecx, [ebp - 0x438]
push ecx
call fcn.1001d590
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, dword [ebp - 0x434]
xor edx, edx
mov cl, 0x20
call fcn.10021440
mov ecx, dword [ebp - 0x438]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], edx
mov edx, dword [ebp - 0x410]
add edx, 0x989680
mov eax, dword [ebp - 0x40c]
adc eax, 0
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x40c], eax
mov ecx, dword [ebp - 0x410]
mov edx, dword [ebp - 0x40c]
and edx, 0
mov dword [ebp - 0x438], ecx
mov eax, dword [ebp - 0x410]
mov edx, dword [ebp - 0x40c]
mov cl, 0x20
call fcn.10021420
mov dword [ebp - 0x434], eax
cmp dword [0x101cb884], 0
je 0x1001a11e
mov eax, dword [ebp + 8]
push eax
call fcn.1001a220
jmp 0x1001a142
lea ecx, [ebp - 0x454]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
push fcn.1001a220
push 0
push 0
call fcn.100210ef
add esp, 0x18
mov dword [ebp - 0x458], eax
jmp 0x1001a183
cmp dword [0x1003e814], 0x23785289
jne 0x1001a16f
cmp dword [0x100e0004], 0
je 0x1001a16d
push 0x10038f78
push str.found_OK_NOBHKOK__s_
push 0
call fcn.1001a870
add esp, 0xc
jmp 0x1001a183
push 0x10038f9c
push str.Cannot_found_ME_______s___perfectly_ridiculous.
push 0
call fcn.1001a870
add esp, 0xc
jmp case.default.0x10019b53
cmp dword [0x1003e814], 0x89578da3
je 0x1001a193
jmp case.default.0x10019b53
cmp dword [0x100e0004], 0x97
je 0x1001a1ab
cmp dword [0x100e0004], 0x99
jne 0x1001a1bf
push 0x100df7a0
push str.ProcessDetach:__s
push 0
call fcn.1001a870
add esp, 0xc
call fcn.1000b8c0
mov eax, dword [ebp + 8]
push eax
call fcn.1000b8b0
add esp, 4
jmp 0x1001a1f5
mov ecx, dword [ebp + 8]
push ecx
call fcn.10018bf0
add esp, 4
jmp 0x1001a1f5
mov edx, dword [ebp + 8]
push edx
call fcn.10018c40
add esp, 4
jmp 0x1001a1f5
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001d57b
mov esp, ebp
pop ebp
ret 0xc