Function at 0xe3c268
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push edi
cmp ebx, eax
je 0xe3c4de
cmp dword [ebx + 0x10], eax
je 0xe3c28e
cmp dword [ebp + 0xc], eax
je 0xe3c4de
cmp dword [ebx + 0x14], eax
je 0xe3c29c
cmp dword [ebp + 0x10], eax
je 0xe3c4de
cmp dword [ebx + 0x18], eax
je 0xe3c2aa
cmp dword [ebp + 0x14], eax
je 0xe3c4de
mov dword [ebp - 0x18], eax
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0xc0], 0x9c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0xe3c4de
mov eax, dword [ebx + 0x18]
push esi
add eax, dword [ebx + 0x14]
mov edi, 0xe56028
lea ecx, [eax + eax*2]
mov eax, dword [ebx + 0x10]
inc eax
inc eax
lea eax, [eax + eax*4]
shl eax, 2
lea eax, [eax + ecx*4]
push eax
push edi
mov dword [ebp - 0x1c], eax
call fcn.00e3d496
mov esi, eax
mov eax, dword [ebx + 0x10]
pop ecx
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 8]
test eax, eax
pop ecx
je 0xe3c322
sub eax, dword [0xe56058]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
test eax, eax
je 0xe3c332
sub eax, dword [0xe56058]
mov dword [esi + 0xc], eax
mov eax, dword [ebx]
test eax, eax
je 0xe3c340
sub eax, dword [0xe56058]
mov dword [esi], eax
mov eax, dword [ebx + 4]
test eax, eax
je 0xe3c350
sub eax, dword [0xe56058]
mov dword [esi + 4], eax
and dword [ebp + 8], 0
cmp dword [ebx + 0x10], 0
lea eax, [esi + 0x1c]
mov dword [ebp - 4], eax
jbe 0xe3c3b8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
sub edx, dword [0xe56058]
mov dword [eax], edx
mov edx, dword [ecx + 4]
sub edx, dword [0xe56058]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
sub edx, dword [0xe56058]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
sub edx, dword [0xe56058]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x10]
test edx, edx
je 0xe3c3a1
sub edx, dword [0xe56058]
mov dword [eax + 0x10], edx
inc dword [ebp + 8]
add ecx, 0x14
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp + 8]
add eax, 0x14
cmp ecx, dword [ebx + 0x10]
jb 0xe3c360
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x14]
inc eax
lea eax, [eax + eax*2]
shl eax, 2
push eax
push edi
call fcn.00e3d496
mov edi, eax
mov eax, dword [esi + 0x14]
lea eax, [eax + eax*2]
shl eax, 2
push eax
push dword [ebp + 0x10]
push edi
call fcn.00e3b834
mov eax, dword [esi + 0x14]
mov ecx, 0xe451e8
add esp, 0x14
mov dword [ebp + 0x10], edi
lea eax, [eax + eax*2]
push 0
mov dword [edi + eax*4], ecx
mov eax, dword [esi + 0x14]
lea eax, [eax + eax*2]
mov dword [edi + eax*4 + 4], ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 4]
lea eax, [eax + eax*2]
mov dword [edi + eax*4 + 8], 0x104
inc dword [esi + 0x14]
pop eax
je 0xe3c43d
mov edx, dword [edi]
add edi, 0xc
sub edx, dword [0xe56058]
mov dword [ecx], edx
mov edx, dword [edi - 8]
sub edx, dword [0xe56058]
inc eax
mov dword [ecx + 4], edx
mov edx, dword [edi - 4]
mov dword [ecx + 8], edx
add ecx, 0xc
cmp eax, dword [esi + 0x14]
jb 0xe3c415
and dword [ebp + 8], 0
cmp dword [ebx + 0x18], 0
jbe 0xe3c48e
mov edx, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
sub dword [ebp + 0xc], edx
lea eax, [edx + 8]
mov edx, dword [eax - 8]
sub edx, dword [0xe56058]
mov dword [ecx], edx
mov edx, dword [ebp + 0xc]
mov edi, dword [eax - 4]
add edx, eax
sub edi, dword [0xe56058]
mov dword [edx - 4], edi
mov edi, dword [eax]
test edi, edi
je 0xe3c47d
sub edi, dword [0xe56058]
mov dword [edx], edi
inc dword [ebp + 8]
add eax, 0xc
mov edx, dword [ebp + 8]
add ecx, 0xc
cmp edx, dword [ebx + 0x18]
jb 0xe3c453
mov eax, dword [esi + 0x14]
cmp dword [ebp - 0xbc], 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0xe3c4e4
mov dword [ebp - 0x10], eax
pop esi
jne 0xe3c4c5
cmp dword [ebp + 0x18], 0
jne 0xe3c4de
lea eax, [ebp - 0x18]
push eax
call fcn.00e3ccb4
jmp 0xe3c4db
cmp dword [ebp - 0xbc], 6
jne 0xe3c4de
push dword [ebp + 0x18]
lea eax, [ebp - 0x18]
push eax
call fcn.00e3cdcd
pop ecx
pop ecx
jmp 0xe3c4e0
xor eax, eax
pop edi
pop ebx
leave
ret