Function at 0x402e66
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x486090], 0
jne 0x402e9a
push 0x404344
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x486090], eax
test eax, eax
je 0x403119
cmp dword [0x486094], 0
jne 0x402ec9
push 0x404378
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x486094], eax
test eax, eax
je 0x403119
cmp dword [0x48609c], 0
jne 0x402ef8
push 0x4043aa
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x48609c], eax
test eax, eax
je 0x403119
cmp dword [0x4860a0], 0
jne 0x402f27
push 0x4043dc
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x4860a0], eax
test eax, eax
je 0x403119
cmp dword [0x4860a4], 0
jne 0x402f56
push 0x40440e
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x4860a4], eax
test eax, eax
je 0x403119
cmp dword [0x4860b4], 0
jne 0x402f85
push 0x40441e
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x4860b4], eax
test eax, eax
je 0x403119
cmp dword [0x4860b8], 0
jne 0x402fb4
push 0x404442
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x4860b8], eax
test eax, eax
je 0x403119
cmp dword [0x4860bc], 0
jne 0x402fe3
push 0x40446c
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x4860bc], eax
test eax, eax
je 0x403119
cmp dword [0x4860c0], 0
jne 0x403012
push 0x40449a
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x4860c0], eax
test eax, eax
je 0x403119
cmp dword [0x4860c4], 0
jne 0x403041
push 0x4044ca
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x4860c4], eax
test eax, eax
je 0x403119
cmp dword [0x486098], 0
jne 0x403061
push 0x403a4a
call fcn.00402416
mov dword [0x486098], eax
test eax, eax
je 0x403119
cmp dword [0x4860a8], 0
jne 0x403081
push 0x403aa4
call fcn.00402416
mov dword [0x4860a8], eax
test eax, eax
je 0x403119
cmp dword [0x4860ac], 0
jne 0x40309d
push 0x403ab8
call fcn.00402416
mov dword [0x4860ac], eax
test eax, eax
je 0x403119
cmp dword [0x4860b0], 0
jne 0x4030b9
push 0x4044fe
call fcn.00402416
mov dword [0x4860b0], eax
test eax, eax
je 0x403119
cmp dword [0x4860c8], 0
jne 0x4030d5
push 0x403acc
call fcn.00402416
mov dword [0x4860c8], eax
test eax, eax
je 0x403119
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
cmp word [eax], 0x1770
jb 0x4030fd
cmp dword [0x4860cc], 0
jne 0x4030fd
push 0x403ae2
call fcn.00402416
mov dword [0x4860cc], eax
test eax, eax
je 0x403119
cmp dword [0x4860d0], 0
jne 0x40311d
push 0x40450a
call fcn.00402416
mov dword [0x4860d0], eax
test eax, eax
jne 0x40311d
xor al, al
leave
ret
mov al, 1
leave
ret