Function at 0x401b00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4074d0
push 0x404188
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xc4], 0x94
push 0x90
push edi
lea eax, [ebp - 0xc0]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0xc4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401de6
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xbc]
cmp ecx, 5
jne 0x401b91
cmp eax, edi
jbe 0x401b91
mov edx, 0xc039
mov word [0x420638], dx
jmp 0x401bbe
cmp ecx, 6
jne 0x401bb1
cmp eax, 2
jae 0x401bb1
xor ecx, ecx
cmp eax, 1
sete cl
lea ecx, [ecx + ecx + 0xc03a]
mov word [0x420638], cx
cmp word [0x420638], di
je 0x401de6
mov eax, 0xc
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x18], esp
mov esi, esp
cmp esi, edi
je 0x401be7
push 0x99
mov eax, esi
mov ebx, 9
mov edx, 0x409dfc
call fcn.00403a50
mov eax, 0x1c
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x18], esp
mov eax, esp
test eax, eax
je 0x401c0e
push 0x8f
mov ebx, 0x18
mov edx, 0x409e08
call fcn.00403a50
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x401de6
mov eax, 0x18
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x18], esp
mov eax, esp
test eax, eax
je 0x401c4e
push 0x82
mov ebx, 0x17
mov edx, 0x409e20
call fcn.00403a50
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x420640], eax
test eax, eax
je 0x401de6
lea edx, [ebp - 0x20]
push edx
push 0
push 0
push 0xb
call edi
test eax, eax
je 0x401de6
mov eax, dword [ebp - 0x20]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x401de6
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push eax
push 0xb
call edi
test eax, eax
jne 0x401de6
mov byte [ebp - 0x1c8], al
push 0x103
push eax
lea ecx, [ebp - 0x1c7]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
xor ebx, ebx
mov edi, dword [sym.imp.ntdll.dll_strstr]
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x1c]
cmp ebx, dword [eax]
jae 0x401d2b
mov edx, ebx
imul edx, edx, 0x11c
lea esi, [edx + eax + 0x20]
push 0x40562c
push esi
call edi
add esp, 8
test eax, eax
je 0x401e0c
push 0x405630
push esi
call edi
add esp, 8
test eax, eax
je 0x401e0c
mov ecx, eax
lea edx, [ebp - 0x1c8]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x401d11
imul ebx, ebx, 0x11c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + eax + 0xc]
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x1c8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x401de6
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x401de6
mov eax, 0x1c
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x18], esp
mov eax, esp
test eax, eax
je 0x401d77
push 0x96
mov ebx, 0x1a
mov edx, 0x409e38
call fcn.00403a50
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x420630], eax
test eax, eax
je 0x401de6
mov ecx, edi
sub ecx, esi
add eax, ecx
mov dword [0x420630], eax
mov eax, 0x18
call sub.ntdll.dll__alloca_probe
mov dword [ebp - 0x18], esp
mov eax, esp
test eax, eax
je 0x401dba
push 0x82
mov ebx, 0x17
mov edx, 0x409e54
call fcn.00403a50
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42063c], eax
test eax, eax
je 0x401de6
sub edi, esi
add eax, edi
mov dword [0x42063c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x42062c], eax
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00401e12
mov eax, dword [ebp - 0x2c]
lea esp, [ebp - 0x1d4]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc ebx
jmp 0x401ccd