Function at 0x418190
Capabilities:
Check os version
Get file attributes
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20d4
call fcn.004014f0
mov eax, dword [0x4462b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x2090], ecx
mov dword [ebp - 0x2084], edx
mov dword [ebp - 0x2094], eax
mov dword [ebp - 0x2080], 0xffffffff
mov dword [ebp - 0x208c], 0xc0000365
mov dword [ebp - 0x2088], 0xffffffd5
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp ebx, 2
je 0x4183dc
mov edi, dword [0x447010]
test edi, edi
je 0x4183dc
lea eax, [ebp - 0x207c]
mov dword [ebp - 0x20ac], ecx
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20b0], 0x18
push eax
mov ecx, edi
mov dword [ebp - 0x20a4], 0x40
mov dword [ebp - 0x20a8], edx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call dword [section..rdata]
call edi
test eax, eax
js 0x41836b
test dword [ebp - 0x204c], 0x400
jne 0x4183d0
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0x2050]
push 0
push 0x64
push dword [ebp - 0x2078]
mov dword [esi], eax
mov eax, dword [ebp - 0x205c]
push dword [ebp - 0x207c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2058]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.004018b0
push 0
push 0x64
push dword [ebp - 0x2070]
add eax, 0xb3960000
push dword [ebp - 0x2074]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.004018b0
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.004018b0
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.004018b0
mov edi, dword [ebp - 0x2094]
add eax, 0xb3960000
push 0
adc edx, 0x5e6684f4
mov dword [esi + 0x20], eax
push 0
push edi
mov dword [esi + 0x24], edx
call sym.rdtsc.exe_nocrt_strlen
add esp, 4
push eax
mov eax, dword [ebp - 0x204c]
and eax, 0x7fff
shl eax, 0x10
push edi
push eax
call fcn.00417560
push ebx
push esi
push 0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
call fcn.00417d60
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004013b0
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000024
je 0x41839b
cmp eax, 0xc0000033
je 0x41839b
cmp eax, 0xc000000d
je 0x41839b
cmp eax, 0xc0000022
je 0x4183d0
cmp eax, 0xc0000043
je 0x4183d0
push eax
call fcn.00417250
add esp, 4
mov edi, eax
jmp 0x4183c7
push eax
push 0x2078
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
lea eax, [ebp - 0x20b0]
push esi
push eax
call fcn.00417e00
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x418b81
cmp edi, 0x34
jne 0x418b7f
mov edx, dword [ebp - 0x2084]
mov ecx, dword [ebp - 0x2090]
mov eax, dword [0x4469a0]
mov edi, 0x4020
mov dword [ebp - 0x2098], eax
test eax, eax
je 0x4183fb
test byte [ebp + 0x18], 2
jne 0x4183fb
mov edi, 0x204020
push 0
push 0
push edi
push 1
push 7
push 0x80
push 0
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x20b0], 0x18
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20ac], ecx
push eax
push 0x100080
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x20a4], 0x40
push eax
mov dword [ebp - 0x20a8], edx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x41846d
cmp eax, 0xc00000f7
jne 0x4184c5
cmp dword [ebp - 0x2098], 0xffffffff
jne 0x4184c5
test edi, 0x200000
je 0x4184c5
push 0
push 0
and edi, 0xffdfffff
lea eax, [ebp - 0x208c]
push edi
push 1
push 7
push 0x80
push 0
push eax
lea eax, [ebp - 0x20b0]
push eax
push 0x100080
lea eax, [ebp - 0x2080]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x4184c5
mov dword [0x4469a0], 0
test eax, eax
js 0x4187b2
push 0x23
push 8
lea eax, [ebp - 0x20bc]
push eax
lea eax, [ebp - 0x208c]
push eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x418501
xor edi, edi
xor eax, eax
mov dword [ebp - 0x20b8], edi
mov dword [ebp - 0x20bc], eax
jmp 0x41850d
mov edi, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x20bc]
test eax, 0x400
je 0x4185a5
cmp edi, 0xa000000c
je 0x4185a5
mov eax, dword [ebp + 0x18]
test al, 2
jne 0x4185a5
push 0
push 0
push 0x4020
push 1
push 7
push 0x80
push 0
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x208c], 0xc0000365
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x2088], 0xffffffd5
push eax
push 0x100080
lea eax, [ebp - 0x20b4]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x41859f
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0x20b4]
xor edi, edi
mov dword [ebp - 0x2080], eax
mov dword [ebp - 0x20b8], edi
mov dword [ebp - 0x20bc], edi
jmp 0x4185ab
mov edi, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x2080]
push 0x12
push 0x68
lea ecx, [ebp - 0x207c]
mov dword [ebp - 0x2098], eax
push ecx
lea ecx, [ebp - 0x20c4]
mov dword [ebp - 0x20c4], 0xc0000365
push ecx
push eax
mov dword [ebp - 0x20c0], 0xffffffd5
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x4185f7
cmp eax, 0x80000005
je 0x4185f7
push eax
call fcn.00417250
add esp, 4
jmp 0x418789
mov eax, dword [ebp - 0x204c]
mov ecx, dword [ebp - 0x2048]
push 0
push 0x64
push dword [ebp - 0x2078]
mov dword [esi], eax
mov eax, dword [ebp - 0x2054]
push dword [ebp - 0x207c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2050]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.004018b0
push 0
push 0x64
push dword [ebp - 0x2070]
add eax, 0xb3960000
push dword [ebp - 0x2074]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.004018b0
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.004018b0
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.004018b0
add eax, 0xb3960000
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x2094]
adc edx, 0x5e6684f4
mov dword [esi + 0x24], edx
test eax, eax
je 0x4186c7
push eax
call sym.rdtsc.exe_nocrt_strlen
add esp, 4
jmp 0x4186c9
xor eax, eax
push 0
push edi
push eax
mov eax, dword [ebp - 0x205c]
push dword [ebp - 0x2094]
and eax, 0x7fff
shl eax, 0x10
push eax
call fcn.00417560
add esp, 0x14
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
cmp ebx, 2
jne 0x41877d
mov eax, dword [ebp - 0x2044]
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
cmp eax, 1
ja 0x418717
mov eax, 1
mov ecx, dword [ebp - 0x2038]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0x203c]
push 1
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x207c]
push 0x800
push eax
lea eax, [ebp - 0x20c4]
mov dword [esi + 0x44], 0
push eax
push dword [ebp - 0x2098]
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
jns 0x418774
cmp eax, 0x80000005
jne 0x41877d
mov eax, dword [ebp - 0x2074]
mov dword [esi + 0x44], eax
push ebx
push esi
push 0
call fcn.00417d60
add esp, 0xc
push dword [ebp - 0x2080]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x418826
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004013b0
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000024
je 0x4187f1
cmp eax, 0xc0000033
je 0x4187f1
cmp eax, 0xc0000022
je 0x4187db
cmp eax, 0xc0000043
je 0x4187db
push eax
call fcn.00417250
add esp, 4
mov edi, eax
jmp 0x41881d
mov dword [ebp - 0x208c], 0xc0000365
mov dword [ebp - 0x2088], 0xffffffd5
jmp 0x418826
push eax
push 0x2078
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
lea eax, [ebp - 0x20b0]
push esi
push eax
call fcn.00417e00
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x418b7f
cmp edi, 0x34
jne 0x418b7f
push 0
lea eax, [ebp - 0x20d4]
push eax
lea eax, [ebp - 0x20cc]
push eax
push dword [ebp - 0x2084]
call fcn.00417c90
add esp, 0x10
mov edi, dword [ebp - 0x2090]
lea eax, [ebp - 0x20cc]
mov dword [ebp - 0x20b0], 0x18
mov dword [ebp - 0x20a8], eax
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x20ac], edi
push 0
push 0
push 0x4021
push 1
push 7
push 0x80
push 0
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20a4], 0x40
push eax
push 0x100001
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x20a0], 0
push eax
mov dword [ebp - 0x209c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 0x20b4], eax
test eax, eax
js 0x418afd
mov eax, dword fs:[0x30]
xor edx, edx
mov ecx, dword [eax + 0xa4]
mov eax, dword fs:[0x30]
or edx, dword [eax + 0xa8]
cmp ecx, 5
jb 0x4188f2
ja 0x4188eb
test edx, edx
je 0x4188f2
mov edi, 0x25
jmp 0x4188f7
mov edi, 3
push 0
lea eax, [ebp - 0x20d4]
push eax
push 1
push edi
push 0x2078
lea eax, [ebp - 0x207c]
push eax
lea eax, [ebp - 0x208c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x418ad3
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0x2050]
push 0
push 0x64
push dword [ebp - 0x2070]
mov dword [esi], eax
mov eax, dword [ebp - 0x204c]
push dword [ebp - 0x2074]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2048]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.004018b0
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.004018b0
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.004018b0
push 0
push 0x64
push dword [ebp - 0x2058]
add eax, 0xb3960000
push dword [ebp - 0x205c]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.004018b0
push 0
push dword [ebp - 0x203c]
add eax, 0xb3960000
push dword [ebp - 0x2094]
adc edx, 0x5e6684f4
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
call sym.rdtsc.exe_nocrt_strlen
add esp, 4
push eax
mov eax, dword [ebp - 0x2044]
push dword [ebp - 0x2094]
and eax, 0x7fff
shl eax, 0x10
push eax
call fcn.00417560
add esp, 0x14
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
cmp ebx, 2
jne 0x418aa6
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 0
cmp edi, 0x25
jne 0x418a59
mov eax, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x2018]
jmp 0x418a5d
xor eax, eax
xor ecx, ecx
push 1
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x207c]
push 0x800
push eax
lea eax, [ebp - 0x208c]
mov dword [esi + 0x4c], ecx
push eax
push dword [ebp - 0x2080]
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x418aa6
mov eax, dword [ebp - 0x2074]
mov dword [esi + 0x44], eax
push ebx
push esi
push 0
call fcn.00417d60
add esp, 0xc
mov edi, eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004013b0
mov esp, ebp
pop ebp
ret
push eax
call fcn.00417250
add esp, 4
mov edi, eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004013b0
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000033
je 0x418b0e
cmp eax, 0xc0000024
je 0x418b0e
push eax
jmp 0x418b75
mov ecx, dword [ebp - 0x2084]
push eax
push 0x2078
lea eax, [ebp - 0x207c]
mov dword [ebp - 0x20b0], 0x18
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20ac], edi
push ebx
push esi
push eax
mov dword [ebp - 0x20a4], 0x40
mov dword [ebp - 0x20a8], ecx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call fcn.00417e00
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x418b7f
push dword [ebp - 0x20b4]
call fcn.00417250
mov edi, eax
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004013b0
mov esp, ebp
pop ebp
ret