Function at 0x402a60
Capabilities:
Check os version

Disassembly:
sub esp, 0x1e8
push ebx
push ebp
push esi
lea eax, [esp + 0x40]
push edi
push eax
mov dword [esp + 0x48], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x48], 5
je 0x402a94
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1e8
ret
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x402ab1
cmp eax, 1
je 0x402ab1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1e8
ret
mov dword [0x405d40], eax
call fcn.00402690
test eax, eax
jne 0x402acf
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1e8
ret
call fcn.00402840
call fcn.00402750
cmp eax, 0xffffffff
jne 0x402ae3
call fcn.00402840
call fcn.00402750
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x402aff
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1e8
ret
push str._ntoskrnl.exe
call fcn.00402390
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x24], edi
jne 0x402b26
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1e8
ret
push 0x4050a0
push edi
call fcn.00402540
mov esi, eax
add esp, 8
test esi, esi
jne 0x402b4a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1e8
ret
lea ecx, [esp + 0x28]
lea edx, [esp + 0x118]
push ecx
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0xe0]
push eax
push ecx
push edi
call fcn.004021f0
add esp, 0x14
test al, al
jne 0x402b81
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1e8
ret
call fcn.00402980
mov ecx, dword [esp + 0x134]
sub eax, 0x80000000
mov ebx, eax
add eax, esi
mov dword [esp + 0x20], eax
mov esi, eax
lea edx, [esp + 0x10]
sub ebx, ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
push ebp
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x2000
call fcn.004027d0
add esp, 0x10
test eax, eax
je 0x402d89
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
sub esi, edi
sub eax, esi
cmp eax, 4
jb 0x402cc4
mov ecx, dword [esp + 0x10]
cmp eax, 0xc
mov edx, dword [esi + ecx]
mov dword [esp + 0x14], edx
jb 0x402bfd
mov edi, dword [esi + ecx + 8]
mov dword [esp + 0x18], edi
jmp 0x402c01
mov edi, dword [esp + 0x18]
push ecx
call fcn.00402830
add esp, 4
cmp edi, 0x12c
jb 0x402c22
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1e8
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
lea esi, [eax - 0x80000000]
lea eax, [esp + 0x24]
push edx
push eax
push ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x2000
call fcn.004027d0
add esp, 0x10
test eax, eax
je 0x402d89
mov ecx, dword [esp + 0x20]
mov eax, esi
sub eax, ecx
mov ecx, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x14], eax
shr ecx, 2
cmp ecx, edi
jb 0x402d7c
shl edi, 2
push edi
call sub.MSVCRT.dll_malloc
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x402c9f
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1e8
ret
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push str._ntdll.dll
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00402390
add esp, 4
test eax, eax
jne 0x402cd4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1e8
ret
mov edi, dword [esp + 0x18]
push edi
push ebp
push eax
call fcn.004025c0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea ebp, [ecx + eax]
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x24]
sub esi, eax
sub esi, ebx
push 4
add esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x402d7c
lea edx, [esi + edi*4 - 4]
push 4
push edx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x402d7c
test edi, edi
mov dword [esp + 0x18], eax
jbe 0x402d7c
mov ecx, ebp
mov eax, esi
sub ecx, esi
mov dword [esp + 0x14], edi
mov edx, dword [ecx + eax]
sub edx, ebx
sub edx, 0x80000000
cmp edx, dword [eax]
je 0x402d42
inc dword [esp + 0x18]
mov edx, dword [esp + 0x14]
add eax, 4
dec edx
mov dword [esp + 0x14], edx
jne 0x402d2f
mov eax, dword [esp + 0x18]
test eax, eax
je 0x402d7c
mov eax, ebp
sub esi, ebp
mov edx, dword [eax]
mov ecx, dword [esi + eax]
sub edx, ebx
sub edx, 0x80000000
cmp edx, ecx
je 0x402d76
lea ecx, [ecx + ebx - 0x80000000]
mov dword [eax], ecx
add eax, 4
dec edi
jne 0x402d5c
mov edx, dword [esp + 0x10]
push edx
call fcn.00402830
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1e8
ret