Function at 0x402506
Capabilities:
Check os version
Get system information on windows
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x484
mov eax, dword [0x406008]
xor eax, esp
mov dword [esp + 0x480], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [esp + 0x10], edi
call fcn.004028d4
test al, al
je 0x40253d
call fcn.0040240b
push 0x110
lea eax, [esp + 0x48]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x40], 0x114
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
inc ebx
cmp dword [esp + 0x44], 6
jb 0x402748
call fcn.004028d4
test al, al
je 0x402748
mov esi, dword [0x407a38]
mov eax, esi
or eax, dword [0x407a3c]
jne 0x4026b5
xor edi, edi
cmp byte [0x407a4d], al
jne 0x40264e
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4025d9
cmp dword [esp + 0x44], 6
setb al
mov byte [0x407a4c], al
ja 0x4025d3
jne 0x4025cf
cmp dword [esp + 0x48], ebx
ja 0x4025d3
xor edi, edi
jmp 0x4025d5
mov edi, ebx
test al, al
jne 0x402648
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x4025ff
test edi, edi
je 0x402642
push str.api_ms_win_eventing_provider_l1_1_0.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x402642
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EventWrite
push esi
call edi
mov dword [0x407a48], eax
test eax, eax
je 0x402642
push str.EventRegister
push esi
call edi
mov dword [0x407560], eax
test eax, eax
je 0x402638
push str.EventUnregister
push esi
call edi
mov dword [0x407a44], eax
test eax, eax
jne 0x402648
mov dword [0x407560], 0x401579
mov byte [0x407a4c], bl
mov byte [0x407a4d], bl
cmp byte [0x407a4c], 0
jne 0x402673
push 0x407a38
push 0x407528
push 0x401445
push 0x4046f8
call dword [0x407560]
jmp 0x4026ab
mov esi, 0x407528
mov ecx, 0x4046f8
push esi
mov eax, esi
mov dword [esp + 0x18], ecx
cdq
mov dword [0x407a38], eax
xor eax, eax
push eax
push eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push ebx
push ecx
push esi
push 0x4012ec
mov dword [0x407a3c], edx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov edi, dword [esp + 0x10]
mov esi, dword [0x407a38]
test byte [0x407a40], 1
je 0x4026cd
push ecx
push ecx
call fcn.00401733
mov esi, dword [0x407a38]
pop ecx
pop ecx
cmp byte [0x407a4d], 0
je 0x402748
mov ecx, dword [0x407a3c]
mov eax, esi
or eax, ecx
je 0x402748
cmp byte [0x407a4c], 0
jne 0x4026f5
push ecx
push esi
call dword [0x407a44]
jmp 0x40273d
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
movzx eax, word [esi + 0x2a]
xor ecx, ecx
mov dword [esi + 0x20], ecx
mov byte [esi + 0x28], cl
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
test ax, ax
je 0x402738
dec eax
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
lea eax, [eax*4 + 4]
push eax
push ecx
push dword [esi + 0x2c]
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], ecx
xorps xmm0, xmm0
movlpd qword [0x407a38], xmm0
mov esi, 0x11c
lea eax, [esp + 0x158]
push esi
push 0
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
mov dword [esp + 0x158], esi
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.004028d4
test al, al
jne 0x4027e2
cmp dword [esp + 0x15c], 5
jne 0x4027e2
cmp dword [esp + 0x160], 2
jne 0x4027e2
push 0x24
lea eax, [esp + 0x20]
push 0
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x30], ebx
jbe 0x4027e2
xor ecx, ecx
xor eax, eax
xor edx, edx
test dword [esp + 0x2c], ebx
je 0x4027c8
inc eax
cmp eax, 2
jge 0x4027d2
add ebx, ebx
inc edx
cmp edx, 0x20
jl 0x4027bc
jmp 0x4027d4
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
call fcn.004028d4
test al, al
je 0x402806
call fcn.00402484
test eax, eax
je 0x402806
push 0x800
push 0
push str.riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x20a
mov esi, eax
lea eax, [esp + 0x27c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, esi
sub ecx, edi
mov eax, 0x104
push ecx
push esi
push edi
push str._QQPerfLog__dwMainEntry___lu___dwSH___lu___dwDelete___lu
push eax
push eax
lea eax, [esp + 0x290]
push eax
call fcn.00401140
add esp, 0x1c
lea eax, [esp + 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, str.HummerEngine.dll
or esi, 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x402874
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4028bb
push str.RunQQHummerEngine
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x40288e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4028bb
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push dword [ebp + 8]
call edi
pop ecx
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4028bb
push str.UninitializeCom
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4028bb
call eax
mov ecx, dword [esp + 0x48c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402d98
mov esp, ebp
pop ebp
ret 4