Function at 0x10065470
Capabilities:
Check os version

Disassembly:
endbr32
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10217690
push 0x101abf40
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 0x584
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x48c], esi
mov dword [ebp - 0x490], ebx
mov eax, dword [0x10234e38]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x594], eax
mov dword [ebp - 0x58c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x588], eax
mov dword [ebp - 0x584], 0
call fcn.10065450
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x57c], eax
mov dword [ebp - 0x578], ebp
mov dword [ebp - 0x574], esp
mov word [ebp - 0x590], cs
mov word [ebp - 0x58e], ss
add esp, 0xfffffff8
mov dword [esp], 0x28
mov dword [esp + 4], 0
call fcn.100666c0
mov dword [ebp - 0x570], eax
add esp, 8
add esp, 0xfffffff4
mov dword [esp], 0x1024bc80
mov eax, dword [ebp - 0x570]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x64
call fcn.101c8c50
mov dword [ebp - 0x56c], eax
add esp, 0xc
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x564], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x55c], eax
push eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
add esp, 0xfffffff4
mov eax, dword [ebp - 0x564]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov eax, dword [sym.imp.imagehlp.dll_SymInitialize]
call eax
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x554]
test eax, eax
jne 0x100656cb
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x548], eax
mov eax, 0x102372a0
mov eax, dword [eax]
test eax, eax
jne 0x10065620
call fcn.10061c60
mov dword [ebp - 0x540], eax
mov eax, 0x102372a0
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x544], eax
jmp 0x10065634
mov eax, 0x102372a0
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x544], eax
add esp, 0xfffffff8
mov dword [esp], 0x1b
mov dword [esp + 4], 0
call fcn.100666c0
mov dword [ebp - 0x538], eax
add esp, 8
mov eax, dword [ebp - 0x544]
add esp, 0xfffffff4
mov dword [esp], 0x1024bc80
mov edx, dword [ebp - 0x538]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x548]
mov dword [esp + 8], edx
call eax
mov dword [ebp - 0x530], eax
add esp, 0xc
mov eax, 1
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
xor dword [ebp - 8], eax
xor eax, ebp
mov ecx, eax
call fcn.101a6152
mov eax, dword [ebp - 0x4b4]
mov esp, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x490]
mov esi, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
add esp, 0xfffffff4
lea eax, [ebp - 0x124]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x108
call fcn.101abd10
mov dword [ebp - 0x54c], eax
add esp, 0xc
mov dword [ebp - 0x118], 3
mov dword [ebp - 0xe8], 3
mov dword [ebp - 0xf8], 3
mov eax, dword [ebp - 0x588]
test eax, eax
je 0x1006574e
add esp, 0xfffffff4
lea eax, [ebp - 0x484]
mov dword [esp], eax
mov eax, dword [ebp - 0x588]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x2cc
call fcn.101ab210
mov dword [ebp - 0x53c], eax
add esp, 0xc
jmp 0x10065a4a
mov eax, dword [0x1024bc64]
or eax, dword [0x1024bc60]
jne 0x10065a0b
push eax
mov dword [esp], str.NTDLL.DLL
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
test eax, eax
jne 0x10065837
add esp, 0xfffffff8
mov dword [esp], 0x1c
mov dword [esp + 4], 0
call fcn.100666c0
mov dword [ebp - 0x524], eax
add esp, 8
add esp, 0xfffffff4
mov dword [esp], 0x1024bc80
mov eax, dword [ebp - 0x524]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x64
call fcn.101c8c50
mov dword [ebp - 0x51c], eax
add esp, 0xc
push eax
mov eax, dword [ebp - 0x564]
mov dword [esp], eax
mov eax, dword [sym.imp.imagehlp.dll_SymCleanup]
call eax
mov dword [ebp - 0x518], eax
mov eax, 2
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
xor dword [ebp - 8], eax
xor eax, ebp
mov ecx, eax
call fcn.101a6152
mov eax, dword [ebp - 0x4b0]
mov esp, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x490]
mov esi, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
add esp, 0xfffffff8
mov eax, dword [ebp - 0x52c]
mov dword [esp], eax
mov dword [esp + 4], str.RtlCaptureContext
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x49c], eax
cdq
mov eax, dword [ebp - 0x49c]
mov dword [0x1024bc60], eax
mov dword [0x1024bc64], edx
mov eax, dword [0x1024bc64]
or eax, dword [0x1024bc60]
jne 0x10065a0b
mov eax, 0x102372a0
mov eax, dword [eax]
test eax, eax
jne 0x100658b3
call fcn.10061c60
mov dword [ebp - 0x508], eax
mov eax, 0x102372a0
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x50c], eax
jmp 0x100658c7
mov eax, 0x102372a0
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x50c], eax
add esp, 0xfffffff8
mov dword [esp], 0x1d
mov dword [esp + 4], 0
call fcn.100666c0
mov dword [ebp - 0x504], eax
add esp, 8
mov eax, dword [ebp - 0x50c]
add esp, 0xfffffff4
mov dword [esp], 0x1024bc80
mov dword [esp + 4], 0x102137c0
mov edx, dword [ebp - 0x504]
mov dword [esp + 8], edx
call eax
mov dword [ebp - 0x4f4], eax
add esp, 0xc
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x4e8], eax
mov eax, 0x102372a0
mov eax, dword [eax]
test eax, eax
jne 0x1006594c
call fcn.10061c60
mov dword [ebp - 0x4d0], eax
mov eax, 0x102372a0
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x4d4], eax
jmp 0x10065960
mov eax, 0x102372a0
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x4d4], eax
add esp, 0xfffffff8
mov dword [esp], 0x1e
mov dword [esp + 4], 0
call fcn.100666c0
mov dword [ebp - 0x4c8], eax
add esp, 8
mov eax, dword [ebp - 0x4d4]
add esp, 0xfffffff8
mov edx, 0x1024bc80
add edx, dword [ebp - 0x4e8]
mov dword [esp], edx
mov edx, dword [ebp - 0x4c8]
mov dword [esp + 4], edx
call eax
mov dword [ebp - 0x4c0], eax
add esp, 8
push eax
mov eax, dword [ebp - 0x564]
mov dword [esp], eax
mov eax, dword [sym.imp.imagehlp.dll_SymCleanup]
call eax
mov dword [ebp - 0x4b8], eax
mov eax, 3
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
xor dword [ebp - 8], eax
xor eax, ebp
mov ecx, eax
call fcn.101a6152
mov eax, dword [ebp - 0x4ac]
mov esp, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x490]
mov esi, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
mov eax, dword [0x1024bc60]
add esp, 0xfffffff8
lea edx, [ebp - 0x484]
mov dword [ebp - 0x498], eax
mov eax, edx
mov dword [ebp - 0x494], edx
cdq
mov eax, dword [ebp - 0x494]
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x498]
call eax
add esp, 8
mov dword [ebp - 0x584], 1
mov eax, dword [ebp - 0x588]
test eax, eax
je 0x10065ae7
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xb8]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xc4]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xb4]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xbc]
mov word [ebp - 0x11c], ax
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xc8]
mov word [ebp - 0xec], ax
mov eax, dword [ebp - 0x588]
mov eax, dword [eax + 0xc8]
mov word [ebp - 0xfc], ax
jmp 0x10065b5d
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], 0
movzx eax, word [ebp - 0x590]
mov word [ebp - 0x11c], ax
movzx eax, word [ebp - 0x58e]
mov word [ebp - 0xec], ax
movzx eax, word [ebp - 0x58e]
mov word [ebp - 0xfc], ax
mov dword [ebp - 0x584], 1
mov dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x584]
test eax, eax
je 0x10065c00
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10065b87
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x528], eax
jmp 0x10065b91
mov dword [ebp - 0x528], 5
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x1b8], 0x94
push eax
lea eax, [ebp - 0x1b8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVersionExA]
call eax
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x514]
test eax, eax
je 0x10065c00
mov eax, dword [ebp - 0x1b4]
cmp eax, 6
jb 0x10065c00
mov eax, 0xffffffff
add eax, dword [ebp - 0x528]
mov dword [ebp - 0x528], eax
mov dword [ebp - 4], 0
mov eax, 0
cmp eax, 1
je fcn.10065e3f
add esp, 0xffffffdc
mov dword [esp], 0x14c
mov eax, dword [ebp - 0x564]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x55c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x124]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x484]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov eax, dword [sym.imp.imagehlp.dll_StackWalk64]
call eax
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x554]
test eax, eax
jne 0x10065d9c
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x548], eax
mov eax, 0x102372a0
mov eax, dword [eax]
test eax, eax
jne 0x10065cd3
call fcn.10061c60
mov dword [ebp - 0x4e0], eax
mov eax, 0x102372a0
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x4e4], eax
jmp 0x10065ce7
mov eax, 0x102372a0
mov edx, 0x70
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x4e4], eax
add esp, 0xfffffff8
mov dword [esp], 0x1f
mov dword [esp + 4], 0
call fcn.100666c0
mov dword [ebp - 0x4cc], eax
add esp, 8
mov eax, dword [ebp - 0x4e4]
add esp, 0xfffffff4
mov dword [esp], 0x1024bc80
mov edx, dword [ebp - 0x4cc]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x548]
mov dword [esp + 8], edx
call eax
mov dword [ebp - 0x4c4], eax
add esp, 0xc
push eax
mov eax, dword [ebp - 0x564]
mov dword [esp], eax
mov eax, dword [sym.imp.imagehlp.dll_SymCleanup]
call eax
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, 4
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
xor dword [ebp - 8], eax
xor eax, ebp
mov ecx, eax
call fcn.101a6152
mov eax, dword [ebp - 0x4a8]
mov esp, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x490]
mov esi, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
leave
ret
mov eax, dword [ebp - 0x528]
test eax, eax
jg 0x10065db2
mov dword [ebp - 0x4f0], 0
jmp 0x10065dbc
mov dword [ebp - 0x4f0], 1
mov eax, 0xffffffff
add eax, dword [ebp - 0x528]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp + 0x10]
add esp, 0xfffffff4
lea edx, [ebp - 0x124]
mov dword [esp], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x4f0]
mov dword [esp + 8], edx
call eax
mov dword [ebp - 0x4dc], eax
add esp, 0xc
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
cmp eax, 0xfffffffe
jne 0x10065e1b
mov dword [ebp - 0x58c], 7
jmp fcn.10065e3f
mov eax, dword [ebp - 0x548]
cmp eax, 0xffffffff
je fcn.10065e3f
mov eax, dword [ebp - 0x110]
or eax, dword [ebp - 0x114]
jne 0x10065c00
jmp fcn.10065e3f