Function at 0x4083c0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x48cfd7
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x4bb028]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bb028]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1cc]
mov ebp, dword [esp + 0x1c8]
mov edi, ecx
xor ebx, ebx
lea ecx, [esp + 0x60]
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esp + 0x7c]
mov dword [esp + 0x1c0], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esp + 0x44]
mov byte [esp + 0x1c0], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [esp + 0x1c0], 3
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x98], 0x11c
cmp dword [ebp + 0x10c], ebx
je 0x408497
push str.Wow64DisableWow64FsRedirection
push str.kernel32
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x408493
lea ecx, [esp + 0x1c]
push ecx
call eax
mov esi, eax
mov dword [esp + 0x14], esi
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x4084a4
mov eax, dword [esi]
jmp 0x4084a6
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
jne 0x4086dc
push edi
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
push str.__t_r_n
lea ecx, [esp + 0x48]
lea ebx, [esp + 0x2c]
call fcn.00431bd0
add esp, 4
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x1c4], 4
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov bl, 3
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c0], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp dword [edi + 0x18], 8
jb 0x408505
mov edx, dword [esi]
jmp 0x408507
mov edx, esi
lea edi, [esp + 0x60]
call fcn.0045b720
push 0
push 0x498cf8
lea ecx, [esp + 0x4c]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
cmp eax, 0xffffffff
jne 0x4085d7
mov esi, edi
push 0x498cfc
lea edi, [esp + 0x2c]
call fcn.00431b90
add esp, 4
push eax
mov ecx, esi
mov byte [esp + 0x1c4], 5
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov ecx, edi
mov byte [esp + 0x1c0], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push ebp
lea ecx, [esp + 0x80]
lea ebx, [esp + 0x2c]
call fcn.00406f40
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x1c4], 6
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov bl, 3
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c0], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov edx, esi
push edx
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x1c4], 7
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c0], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x4086c7
mov eax, dword [esp + 0x48]
mov edi, 8
cmp dword [esp + 0x5c], edi
jae 0x4085ea
lea eax, [esp + 0x48]
mov esi, dword [sym.imp.MSVCR90.dll__wcsicmp]
push str._windir__system32_sdclt.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x408698
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x5c], edi
jae 0x408611
lea eax, [esp + 0x48]
push str._windir__system32_ntbackup.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x408698
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x5c], edi
jae 0x40862e
lea eax, [esp + 0x48]
push str._windir__system32_rstrui.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x40866a
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x5c], edi
jae 0x40864b
lea eax, [esp + 0x48]
push str._windir__system32_restore_rstrui.exe
push eax
call esi
add esp, 8
test eax, eax
je 0x40866a
mov edx, dword [esp + 0x48]
cmp dword [esp + 0x5c], edi
jae 0x4086be
lea edx, [esp + 0x48]
jmp 0x4086be
lea edx, [esp + 0x98]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4086c7
cmp dword [esp + 0x9c], 5
lea edi, [esp + 0x60]
ja 0x408691
mov edx, str._windir__system32_restore_rstrui.exe
jmp 0x4086c2
mov edx, str._windir__system32_rstrui.exe
jmp 0x4086c2
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4086c7
cmp dword [esp + 0x9c], 5
mov edx, str._windir__system32_ntbackup.exe
jbe 0x4086be
mov edx, str._windir__system32_sdclt.exe
lea edi, [esp + 0x60]
call fcn.0045b720
lea ecx, [esp + 0x60]
push ecx
mov ecx, dword [esp + 0x1c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp dword [ebp + 0x10c], ebx
je 0x40870c
cmp dword [esp + 0x14], ebx
je 0x40870c
mov esi, dword [esp + 0x1c]
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40870c
push esi
call eax
mov esi, dword [esp + 0x24]
push edi
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x44]
mov dword [esp + 0x20], 1
mov byte [esp + 0x1c0], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1c0], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x60]
mov byte [esp + 0x1c0], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.0048a3f6
add esp, 0x1b0
ret 8