Function at 0x426ae0
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4dfe14
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a4
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x30], edi
call fcn.00425990
mov esi, dword [ebp + 8]
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x1c]
cmp eax, 2
jne 0x426b37
xor eax, eax
mov ecx, dword [esp + 0x1b0]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
mov ecx, edi
call fcn.0046f5f3
test eax, eax
jne 0x426b5a
mov ecx, dword [esp + 0x1b0]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0xc], 0
call dword [edx + 0x1c]
cmp eax, 1
jne 0x427375
lea ecx, [esp + 0x60]
call fcn.00486830
lea ecx, [esp + 0x180]
call fcn.00486830
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x180]
push eax
lea edx, [esp + 0x64]
push ecx
push edx
mov ecx, esi
call fcn.004772f7
test eax, eax
je 0x427375
lea edi, [esp + 0x70]
mov ebx, 0x11
mov ecx, edi
call fcn.00486830
add edi, 0x10
dec ebx
jne 0x426bb1
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x18], ecx
mov ecx, esi
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
call fcn.00477600
test eax, eax
je 0x426d20
mov eax, dword [esi + 0x10]
fld qword [esp + 0x4c]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 4]
mov eax, dword [esi + 0x14]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov dword [esp + 0x54], ecx
mov ecx, dword [eax]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x3c], ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x70]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x68]
push edx
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
fld qword [esp + 0x54]
push edx
push eax
fadd st(1)
sub esp, 8
sub esp, 8
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fadd st(1)
sub esp, 8
sub esp, 8
fstp qword [esp + 0x10]
fld qword [esp + 0x7c]
fsub st(1)
fstp qword [esp + 8]
fld qword [esp + 0x5c]
fsub st(1)
fstp qword [esp]
fstp st(0)
call fcn.0047bcc0
mov eax, dword [esp + 0x58]
add esp, 0x48
cdq
sub eax, edx
xor edi, edi
sar eax, 1
test eax, eax
jle 0x426dcf
lea ebx, [esp + 0x70]
mov dword [esp + 0x1c], ebx
push ebx
lea ecx, [esp + 0x40]
call fcn.00468000
mov ecx, dword [esp + 0x10]
sub ecx, edi
dec ecx
shl ecx, 4
inc edi
lea eax, [esp + ecx + 0x70]
mov edx, eax
mov ecx, dword [edx]
mov dword [ebx], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [edx + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [esp + 0x3c]
mov edx, dword [edx + 0xc]
mov dword [ebx + 0xc], edx
mov edx, dword [esp + 0x40]
mov dword [eax], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x48]
mov dword [eax + 8], ecx
mov ebx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x10]
cdq
sub eax, edx
add ebx, 0x10
sar eax, 1
cmp edi, eax
mov dword [esp + 0x1c], ebx
jl 0x426cb7
jmp 0x426dcf
mov eax, dword [esi + 0x14]
fld qword [esp + 0x4c]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax]
mov dword [esp + 0x40], edx
mov edx, dword [eax + 4]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x70]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x60]
push edx
mov edx, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ecx
fld qword [esp + 0x54]
push edx
push eax
fadd st(1)
sub esp, 8
sub esp, 8
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fadd st(1)
sub esp, 8
sub esp, 8
fstp qword [esp + 0x10]
fld qword [esp + 0x7c]
fsub st(1)
fstp qword [esp + 8]
fld qword [esp + 0x5c]
fsub st(1)
fstp qword [esp]
fstp st(0)
call fcn.0047bcc0
add esp, 0x48
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x34], ecx
cmp eax, 4
mov dword [esp + 0x38], edx
jl 0x427375
mov eax, edx
lea edx, [esp + 0xa0]
push eax
push ecx
push edx
lea ecx, [esp + 0x7c]
call fcn.00468030
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x426e47
sub ecx, 3
test ecx, ecx
mov dword [esp + 0x10], ecx
jle 0x426e47
lea eax, [esp + 0x70]
mov dword [esp + 0x1c], ecx
lea edx, [eax + 0x30]
mov edi, eax
add eax, 0x10
mov ebx, dword [edx]
mov dword [edi], ebx
mov ebx, dword [edx + 4]
mov dword [edi + 4], ebx
mov ebx, dword [edx + 8]
mov dword [edi + 8], ebx
mov edx, dword [edx + 0xc]
mov dword [edi + 0xc], edx
mov edx, dword [esp + 0x1c]
dec edx
mov dword [esp + 0x1c], edx
jne 0x426e1e
cmp ecx, 4
jl 0x427375
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
lea eax, [ecx - 4]
shl eax, 4
push edx
shl ecx, 4
lea edx, [esp + eax + 0x78]
push edx
lea ecx, [esp + ecx + 0x6c]
call fcn.00468030
test eax, eax
mov eax, dword [esp + 0x10]
je 0x426e80
sub eax, 3
mov dword [esp + 0x10], eax
cmp eax, 4
jl 0x427375
cmp eax, 0xd
jg 0x427375
cmp eax, 4
jne 0x426efe
push 0x60
call fcn.004bb163
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x1b8], 0
je 0x426ed5
mov edx, dword [esi + 0x14]
mov edi, dword [esi + 0x10]
push edx
lea ecx, [esp + 0x94]
lea edx, [esp + 0x84]
push ecx
push edx
push edi
mov ecx, eax
call fcn.00478420
jmp 0x426ed7
xor eax, eax
mov ecx, dword [esp + 0x30]
push eax
push esi
mov dword [esp + 0x1c0], 0xffffffff
mov dword [esp + 0x14], eax
call fcn.0046f1a9
test esi, esi
je 0x427491
jmp 0x427489
cmp eax, 7
jne 0x426fd7
push 0x60
call fcn.004bb163
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x1b8], 1
je 0x426f4b
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xa0]
push edx
lea edx, [esp + 0x94]
push edx
lea edx, [esp + 0x88]
push edx
push ecx
mov ecx, eax
call fcn.00478420
mov ebx, eax
jmp 0x426f4d
xor ebx, ebx
push 0x60
mov dword [esp + 0x1bc], 0xffffffff
call fcn.004bb163
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x1b8], 2
je 0x426fa3
mov ecx, dword [esi + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffffe
shl ecx, 4
lea edx, [esp + ecx + 0x74]
lea ecx, [esp + 0xb4]
push edx
lea edx, [esp + 0xa8]
push ecx
push edx
mov ecx, eax
call fcn.00478420
mov edi, eax
jmp 0x426fa5
xor edi, edi
mov ecx, dword [esp + 0x30]
push 1
push edi
push ebx
push esi
mov dword [esp + 0x1c8], 0xffffffff
call fcn.0046f392
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x426fce
mov dword [esp + 0xc], ebx
jmp 0x427491
mov dword [esp + 0xc], edi
jmp 0x427491
cmp eax, 0xa
jne 0x427151
push 0x60
call fcn.004bb163
add esp, 4
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x1b8], 3
cmp eax, ebx
je 0x427028
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xa0]
push edx
lea edx, [esp + 0x94]
push edx
lea edx, [esp + 0x88]
push edx
push ecx
mov ecx, eax
call fcn.00478420
mov dword [esp + 0xc], eax
jmp 0x42702c
mov dword [esp + 0xc], ebx
or edi, 0xffffffff
push 0x60
mov dword [esp + 0x1bc], edi
call fcn.004bb163
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x1b8], 4
je 0x427080
lea ecx, [esp + 0xd0]
lea edx, [esp + 0xc0]
push ecx
push edx
lea ecx, [esp + 0xb8]
lea edx, [esp + 0xa8]
push ecx
push edx
mov ecx, eax
call fcn.00478420
mov dword [esp + 0x1c], eax
jmp 0x427084
mov dword [esp + 0x1c], ebx
push 0x60
mov dword [esp + 0x1bc], edi
call fcn.004bb163
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x1b8], 5
je 0x4270cd
mov ecx, dword [esi + 0x14]
lea edx, [esp + 0xe0]
push ecx
lea ecx, [esp + 0xf4]
push ecx
lea ecx, [esp + 0xd8]
push edx
push ecx
mov ecx, eax
call fcn.00478420
mov ebx, eax
push 0x38
mov dword [esp + 0x1bc], edi
call fcn.004bb163
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x1b8], 6
je 0x427108
mov ecx, dword [esi + 0x14]
lea edx, [esp + 0xa0]
push ecx
push edx
mov ecx, eax
call fcn.00479140
mov edi, eax
jmp 0x42710a
xor edi, edi
mov eax, dword [esp + 0xc]
push 1
push edi
push eax
push esi
mov esi, dword [esp + 0x40]
mov ecx, esi
mov dword [esp + 0x1c8], 0xffffffff
call fcn.0046f392
mov ecx, dword [esp + 0x1c]
push 1
push ebx
push ecx
push edi
mov ecx, esi
call fcn.0046f392
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x426fc5
mov edx, dword [esp + 0xc]
mov dword [esp + 0xc], edx
jmp 0x427491
cmp eax, 0xd
jne 0x427491
push 0x60
call fcn.004bb163
add esp, 4
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x1b8], 7
cmp eax, ebx
je 0x4271a2
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xa0]
push edx
lea edx, [esp + 0x94]
push edx
lea edx, [esp + 0x88]
push edx
push ecx
mov ecx, eax
call fcn.00478420
mov dword [esp + 0xc], eax
jmp 0x4271a6
mov dword [esp + 0xc], ebx
or edi, 0xffffffff
push 0x60
mov dword [esp + 0x1bc], edi
call fcn.004bb163
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x1b8], 8
je 0x4271fa
lea ecx, [esp + 0xd0]
lea edx, [esp + 0xc0]
push ecx
push edx
lea ecx, [esp + 0xb8]
lea edx, [esp + 0xa8]
push ecx
push edx
mov ecx, eax
call fcn.00478420
mov dword [esp + 0x1c], eax
jmp 0x4271fe
mov dword [esp + 0x1c], ebx
push 0x60
mov dword [esp + 0x1bc], edi
call fcn.004bb163
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x1b8], 9
je 0x42724f
lea ecx, [esp + 0x100]
lea edx, [esp + 0xf0]
push ecx
push edx
lea ecx, [esp + 0xe8]
lea edx, [esp + 0xd8]
push ecx
push edx
mov ecx, eax
call fcn.00478420
mov dword [esp + 0x14], eax
jmp 0x427253
mov dword [esp + 0x14], ebx
push 0x60
mov dword [esp + 0x1bc], edi
call fcn.004bb163
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov dword [esp + 0x1b8], 0xa
je 0x4272a0
mov ecx, dword [esi + 0x14]
lea edx, [esp + 0x110]
push ecx
lea ecx, [esp + 0x124]
push ecx
lea ecx, [esp + 0x108]
push edx
push ecx
mov ecx, eax
call fcn.00478420
mov dword [esp + 0x24], eax
jmp 0x4272a4
mov dword [esp + 0x24], ebx
push 0x38
mov dword [esp + 0x1bc], edi
call fcn.004bb163
add esp, 4
mov dword [esp + 0x34], eax
cmp eax, ebx
mov dword [esp + 0x1b8], 0xb
je 0x4272dd
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xd0]
push edx
push ecx
mov ecx, eax
call fcn.00479140
mov ebx, eax
push 0x38
mov dword [esp + 0x1bc], edi
call fcn.004bb163
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov dword [esp + 0x1b8], 0xc
je 0x427318
mov ecx, dword [esi + 0x14]
push ecx
lea ecx, [esp + 0xd4]
push ecx
mov ecx, eax
call fcn.00479140
mov edi, eax
jmp 0x42731a
xor edi, edi
push 1
push edi
push ebx
push esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x1c8], 0xffffffff
mov ecx, esi
call fcn.0046f392
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
push 1
push edx
push eax
push ebx
mov ecx, esi
call fcn.0046f392
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
push 1
push ebx
push ecx
push edi
mov ecx, esi
call fcn.0046f392
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x426fc5
mov edx, dword [esp + 0xc]
mov dword [esp + 0xc], edx
jmp 0x427491
mov eax, dword [esi + 0x10]
push 0x60
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0xc]
mov eax, dword [esi + 0x14]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x40], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], edx
call fcn.004bb163
mov edi, eax
add esp, 4
mov dword [esp + 0x34], edi
test edi, edi
mov dword [esp + 0x1b8], 0xd
je 0x427469
fld qword [esp + 0x4c]
fsub qword [esp + 0x14]
mov eax, dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
push eax
lea ecx, [esp + 0x194]
sub esp, 8
fstp qword [esp + 0x58]
fld qword [esp + 0x48]
fsub qword [esp + 0x30]
sub esp, 8
fstp qword [esp + 0x50]
fld qword [esp + 0x60]
fmul qword [0x4ed828]
fadd qword [esp + 0x28]
fstp qword [esp + 8]
fld qword [esp + 0x50]
fmul qword [0x4ed828]
fadd qword [esp + 0x38]
fstp qword [esp]
call fcn.00467fe0
fld qword [esp + 0x50]
fmul qword [0x4ed820]
push eax
lea ecx, [esp + 0x1a8]
sub esp, 8
fadd qword [esp + 0x24]
sub esp, 8
fstp qword [esp + 8]
fld qword [esp + 0x54]
fmul qword [0x4ed820]
fadd qword [esp + 0x3c]
fstp qword [esp]
call fcn.00467fe0
push eax
push ebx
mov ecx, edi
call fcn.00478420
jmp 0x42746b
xor eax, eax
mov ecx, dword [esp + 0x30]
push eax
push esi
mov dword [esp + 0x1c0], 0xffffffff
mov dword [esp + 0x14], eax
call fcn.0046f1a9
test esi, esi
je 0x427491
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov ecx, dword [esp + 0x30]
call fcn.00425990
mov ecx, dword [esp + 0x1b0]
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8