Function at 0x10048170
Capabilities:
Check os version
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.psapi.dll
call esi
test eax, eax
je 0x1004819c
push str.GetProcessImageFileNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10422478], eax
push 0x1024cae4
call esi
test eax, eax
je 0x100481ba
push str.QueryFullProcessImageNameW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1042247c], eax
jmp 0x100481bf
mov eax, dword [0x1042247c]
test eax, eax
jne 0x100481d9
cmp dword [0x10422478], eax
jne 0x100481d9
or dword [0x10422488], 0x10
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10048202
or dword [0x10422488], 0x20
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x124], 6
jb 0x100482df
cmp byte [0x1042246c], 0
je 0x10048234
push str._BIsETWStarted__
push 0x167
push str.C:_buildworker_steam_rel_client_win32_build_srccommonetwwin32.cpp
call fcn.100ad9f0
add esp, 0xc
test al, al
jne 0x10048234
int3
push 0x8c
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.100c3490
add esp, 0xc
mov dword [ebp - 0x94], 0x8c
lea eax, [ebp - 0x94]
mov dword [ebp - 0x68], 0x20000
mov dword [ebp - 0x24], 0x78
push eax
push str.Steam_Event_Tracing
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StopTraceA]
push 0x8c
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.100c3490
add esp, 0xc
mov dword [ebp - 0x94], 0x8c
lea eax, [ebp - 0x94]
mov dword [ebp - 0x68], 0x20000
mov dword [ebp - 0x24], 0x78
mov dword [ebp - 0x6c], 2
push eax
push str.Steam_Event_Tracing
lea eax, [ebp - 8]
mov dword [ebp - 0x58], 0x400
push eax
mov dword [ebp - 0x54], 0x100
call dword [sym.imp.ADVAPI32.dll_StartTraceA]
test eax, eax
je 0x10048354
or dword [0x10422488], 0x100
cmp byte [0x1042246c], 0
je 0x10048304
push str._BIsETWStarted__
push 0x22a
push str.C:_buildworker_steam_rel_client_win32_build_srccommonetwwin32.cpp
call fcn.100ad9f0
add esp, 0xc
test al, al
jne 0x10048304
int3
push 0
push 0
push 1
push 0
mov byte [0x1042246c], 1
mov byte [0x1042246d], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x10422484], eax
test eax, eax
je 0x1004841a
push 0
push 0
push 0
push 0x10048550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov eax, dword [0x10422484]
mov dword [0x10422480], ecx
jmp 0x10048420
push 0x1a0
lea eax, [ebp - 0x2c8]
mov byte [0x1042246c], 1
push 0
push eax
call fcn.100c3490
add esp, 0xc
mov dword [ebp - 0x2c4], str.Steam_Event_Tracing
lea eax, [ebp - 0x2c8]
mov dword [ebp - 0x2b4], 0x10000100
mov dword [ebp - 0x138], 0x10048560
push eax
call dword [sym.imp.ADVAPI32.dll_OpenTraceA]
mov dword [0x10422470], eax
mov dword [0x10422474], edx
cmp eax, 0xffffffff
jne 0x100483ba
test edx, edx
jne 0x100483ba
or dword [0x10422488], 0x200
push dword [ebp - 4]
push dword [ebp - 8]
push 0x1024ca2c
push 4
push 0x10
push 1
call dword [sym.imp.ADVAPI32.dll_EnableTrace]
push dword [ebp - 4]
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseTrace]
test esi, esi
je 0x100483f2
or dword [0x10422488], 0x400
jmp 0x100482df
push 0
push 0
push 0
push 0x10048530
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [0x10422488], 1
mov dword [0x10422480], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10422480]
test eax, eax
je 0x10048436
test ecx, ecx
je 0x10048436
or dword [0x10422488], 2
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
or dword [0x10422488], 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret