Function at 0x40d78e
Capabilities:
Access peb ldr_data
Check os version
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x128
mov byte [esp + 0x11f], 0xd0
mov word [esp + 0x10c], 0x4f6e
mov dword [esp + 0x108], 0x1cf07f1
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x114]
mov dword [esp + 0xa8], 0x49c7aff
mov edx, esp
xor esi, esi
mov dword [edx], esi
mov edx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], ecx
mov dword [esp + 0x9c], esi
call edx
sub esp, 4
mov ecx, dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
mov dword [esp + 0x98], eax
call ecx
mov di, word [esp + 0x11c]
mov bl, byte [esp + 0x10f]
lea ecx, [esp + 0xac]
mov edx, dword [esp + 0x9c]
mov dword [esp + 0xe4], edx
mov esi, dword [esp + 0xa0]
mov dword [esp + 0x114], esi
mov edx, dword [esp + 0xa4]
mov dword [esp + 0x110], edx
mov dword [esp + 0x94], eax
mov word [esp + 0x92], di
mov byte [esp + 0x91], bl
mov dword [esp + 0x8c], ecx
jmp 0x40dbaf
mov eax, dword [esp + 0x94]
sub eax, 0x79e880cb
mov ecx, dword [esp + 0xfc]
mov dx, word [esp + 0x10c]
xor dx, 0x4f6e
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0x94]
sub eax, 0x35b816f2
mov si, word [ecx + 0x4a]
mov dword [esp + 0x120], eax
cmp word [esp + 0xee], 6
setne bl
cmp si, dx
setne bh
or bl, bh
test bl, 1
jne 0x40db85
jmp 0x40d95f
call fcn.0040fea2
mov cx, word [esp + 0x92]
add cx, 0x221f
mov word [esp + 0x11c], cx
mov edx, eax
add edx, dword [eax + 0x3c]
mov cx, word [esp + 0x92]
mov word [esp + 0x11c], cx
mov eax, dword [esp + 0x108]
add eax, 0x7d133463
mov dword [esp + 0xf0], edx
imul cx, cx
mov word [esp + 0x11c], cx
mov edx, dword [esp + 0xa8]
mov cx, word [esp + 0x92]
add cx, 0x7855
mov esi, dword [esp + 0xf0]
mov word [esp + 0x11c], cx
mov esi, dword [esi]
mov bl, byte [esp + 0x91]
mov byte [esp + 0x10f], bl
mov dword [esp + 0x104], esi
cmp eax, edx
jne 0x40db22
jmp 0x40daf5
mov cx, word [esp + 0x92]
mov ax, cx
not eax
mov dx, ax
mov word [esp + 0x11c], dx
lea eax, [esp + 0x100]
mov dword [esp + 0xf4], eax
mov byte [esp + 0x10f], 0x71
mov dword [esp + 0x100], 0x75b
mov esi, dword [esp + 0x108]
mov word [esp + 0x11c], 0xc590
mov edi, 0x1cf0853
sub edi, esi
mov esi, esp
mov dword [esi + 0x18], eax
mov eax, 0x40d18a
mov dword [esi + 0x10], eax
mov dword [esi + 8], eax
mov dword [esi], eax
mov dword [esi + 0x14], 0x7a7
mov dword [esi + 0xc], 0x6e9
mov dword [esi + 4], 0xdb4
mov eax, dword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
mov dword [esp + 0x88], edi
call eax
sub esp, 0x1c
mov bl, byte [esp + 0x91]
mov dword [esp + 0x84], eax
mov al, bl
mul bl
mov byte [esp + 0x10f], al
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov byte [esp + 0x10f], bl
mov eax, dword [eax + 0xa4]
mov esi, dword [esp + 0xa0]
mov dword [esp + 0x114], esi
mov edi, dword [esp + 0xa4]
mov dword [esp + 0x110], edi
and bl, 0x20
mov byte [esp + 0x10f], bl
mov esi, dword [esp + 0x88]
mov dword [esp + 0xe8], esi
cmp eax, 6
jb 0x40db05
jmp 0x40de3e
mov ecx, dword fs:[0x18]
mov eax, dword [esp + 0xa4]
add eax, 0x2bdeea0b
mov edx, dword [esp + 0xa0]
adc edx, 0
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], edx
mov byte [esp + 0x10f], 0xfd
mov eax, dword [ecx + 0x30]
cmp dword [eax + 0xa4], 6
jb 0x40d95f
jmp 0x40d8ca
call fcn.0040fc40
mov cl, byte [esp + 0x91]
xor cl, 0xff
mov byte [esp + 0x10f], cl
mov dword [esp + 0xe8], 0x62
mov dx, word [esp + 0x92]
xor dx, 0xffff
mov word [esp + 0x11c], dx
cmp eax, 0
jne 0x40db05
call fcn.004102e7
mov dword [esp + 0xe8], 1
mov dword [esp + 0x80], eax
jmp 0x40db05
mov eax, dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
call eax
mov dword [esp + 0x7c], eax
jmp 0x40d95f
mov eax, dword [esp + 0xe8]
mov cl, byte [esp + 0x91]
mov byte [esp + 0x10f], cl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0x104]
cmp edx, 0x4550
cmove eax, ecx
mov dword [esp + 0xfc], eax
mov eax, dword [esp + 0xfc]
mov bl, 0x82
mov bh, byte [esp + 0x91]
mov dword [esp + 0x78], eax
mov al, bh
mul bl
mov byte [esp + 0x10f], al
mov ecx, dword [esp + 0x78]
mov si, word [ecx + 0x48]
mov word [esp + 0xee], si
cmp word [esp + 0xee], 6
jb 0x40d95f
jmp 0x40d86a
mov al, byte [esp + 0x91]
mov cl, byte [esp + 0x91]
mul cl
mov byte [esp + 0x10f], al
call fcn.0040fc40
cmp eax, 0
je 0x40daf5
jmp 0x40d95f
lea eax, [esp + 0xed]
mov ecx, 0xee4
mov edx, 0x54
mov esi, dword [esp + 0x108]
mov bx, word [esp + 0x92]
mov di, bx
or edi, 0x7406
mov ebx, dword [esp + 0xe4]
mov word [esp + 0x11c], di
mov edi, dword [esp + 0xa4]
or edi, 0x2bda7fb6
mov dword [esp + 0x74], eax
mov eax, 0x1cf121e
sub eax, esi
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x114], eax
mov dword [esp + 0x110], edi
mov edi, 0x1cf07f2
sub edi, esi
xor esi, esi
mov eax, dword [esp + 0x8c]
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax + 0xc], esi
mov dword [eax + 8], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], esi
mov dword [eax + 0x18], esi
mov dword [eax + 0x24], esi
mov dword [eax + 0x20], esi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x28], esi
mov dword [eax + 0x30], esi
mov al, byte [esp + 0x91]
mov byte [esp + 0x10f], al
mov eax, esp
mov dword [esp + 0x6c], eax
lea eax, [esp + 0xac]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x68]
mov dword [eax + 4], ecx
mov dword [eax], esi
mov ecx, dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
call ecx
sub esp, 8
mov cl, byte [esp + 0x91]
not cl
mov edx, dword [esp + 0x108]
mov esi, edx
xor esi, 0x1cf031e
mov ch, byte [esp + 0x11f]
add ch, 0x35
mov byte [esp + 0x10f], cl
mov edi, edx
xor edi, 0x1cf0012
xor edx, 0x1cf0032
mov ebx, esp
mov dword [ebx], 0x58
mov ebx, dword [sym.imp.USER32.dll_IsCharLowerA]
mov dword [esp + 0x50], eax
mov byte [esp + 0x4f], ch
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], edx
call ebx
sub esp, 4
mov edx, esp
mov esi, dword [esp + 0x60]
mov dword [edx], esi
mov edx, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x3c], eax
call edx
sub esp, 4
mov edx, dword [esp + 0x108]
mov esi, dword [esp + 0x60]
mov dword [esp + 0x114], esi
mov dword [esp + 0x110], 0x3860d558
mov cl, 0xb8
mov ch, byte [esp + 0x91]
mov dword [esp + 0x38], eax
mov al, ch
mul cl
mov edi, 0x1cf07fb
sub edi, edx
mov byte [esp + 0x10f], al
mov edx, dword [esp + 0xa4]
not edx
mov ebx, dword [esp + 0xa0]
not ebx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x110], edx
mov al, byte [esp + 0x4f]
mov byte [esp + 0xed], al
mov edx, esp
mov ebx, dword [esp + 0x44]
mov dword [edx + 0x14], ebx
mov eax, dword [esp + 0x70]
mov dword [edx + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [edx + 8], eax
lea eax, [esp + 0xed]
mov dword [edx], eax
mov dword [edx + 0x18], 0x54
mov dword [edx + 4], 0xee4
mov eax, dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov dword [esp + 0x34], edi
call eax
sub esp, 0x1c
mov edx, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
add edx, esi
mov esi, dword [esp + 0x94]
mov dword [esp + 0x120], esi
mov dword [esp + 0xe4], edx
mov edi, dword [esp + 0x34]
cmp edx, edi
mov dword [esp + 0x30], eax
je 0x40da5a
jmp 0x40dbaf
mov eax, dword [esp + 0xf8]
mov ecx, dword [esp + 0xa4]
mov dword [esp + 0x110], ecx
mov edx, dword [esp + 0xa0]
mov dword [esp + 0x114], edx
cmp word [eax + 0x4a], 0
setne bl
cmp word [esp + 0xe2], 6
setne bh
or bh, bl
mov dword [esp + 0xe8], 0x62
test bh, 1
jne 0x40daa2
jmp 0x40db05
call fcn.0040fea2
mov dx, word [esp + 0x92]
mov cx, dx
imul esi, ecx, 0x5e93
mov di, si
mov word [esp + 0x11c], di
mov esi, dword [eax + 0x3c]
xor ebx, ebx
mov dword [esp + 0x120], ebx
mov edi, dword [esp + 0x94]
xor edi, 0x3652abc4
mov edx, dword [esp + 0x108]
mov dword [esp + 0x2c], eax
mov eax, edx
xor eax, 0x1cf42a1
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
add eax, esi
mov dword [esp + 0x120], edi
mov edi, dword [esp + 0x2c]
mov esi, dword [edi + esi]
mov dword [esp + 0x114], ebx
mov dword [esp + 0x110], ebx
mov edi, dword [esp + 0x94]
add edi, 0x5c42409f
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x28]
sub esi, eax
mov al, byte [esp + 0x91]
mov byte [esp + 0x10f], al
mov eax, dword [esp + 0x24]
cmove ebx, eax
mov dword [esp + 0x120], edi
mov dword [esp + 0xf8], ebx
imul ecx, ecx
mov di, cx
mov eax, dword [esp + 0xf8]
mov ecx, 0x1cf0853
sub ecx, edx
mov ax, word [eax + 0x48]
mov word [esp + 0x11c], di
mov word [esp + 0xe2], ax
mov ax, word [esp + 0xe2]
mov edx, dword [esp + 0xa0]
mov dword [esp + 0x114], edx
mov ebx, dword [esp + 0xa4]
mov dword [esp + 0x110], ebx
mov dword [esp + 0xe8], ecx
cmp ax, 6
mov dword [esp + 0x20], esi
jb 0x40db05
jmp 0x40ddec