Function at 0x4042d0
Capabilities:
Check os version
Link many functions at runtime
Parse pe header

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x98
push 0xfffffffffffffffe
push 0x442630
push 0x424fa0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x449590]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x94], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
cmp dword [0x44ab18], ebx
je 0x40432e
xor eax, eax
jmp 0x404948
mov eax, 1
mov dword [0x44ab18], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 4], eax
mov dword [ebp], 0x94
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4048f7
mov edx, dword [ebp + 4]
mov dword [0x44ab0c], edx
mov esi, dword [ebp + 8]
mov dword [0x44aaf8], esi
movzx ecx, word [ebp + 0xc]
mov dword [0x44aacc], ecx
xor eax, eax
mov edi, dword [ebp + 0x10]
cmp edi, 1
sete al
mov dword [0x44aabc], eax
test eax, eax
je 0x404396
cmp edx, 4
jne 0x404396
cmp esi, 3
jge 0x404396
lea ecx, [edx - 3]
jmp 0x404398
xor ecx, ecx
mov dword [0x44aad4], ecx
test eax, eax
je 0x4043b6
cmp edx, 4
jne 0x4043b6
cmp esi, 3
jl 0x4043b6
cmp esi, 0xa
jg 0x4043b6
lea ecx, [edx - 3]
jmp 0x4043b8
xor ecx, ecx
mov dword [0x44aadc], ecx
test eax, eax
je 0x4043d1
cmp edx, 4
jne 0x4043d1
cmp esi, 0x5a
jl 0x4043d1
lea ecx, [edx - 3]
jmp 0x4043d3
xor ecx, ecx
mov dword [0x44aa80], ecx
xor edx, edx
cmp edi, 2
sete dl
mov dword [0x44aab0], edx
xor edi, edi
cmp eax, edi
je 0x4046db
call fcn.004039a0
mov dword [0x44aaac], eax
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x2c], ebx
cmp ebx, edi
je 0x4048f7
push 0x47
push ebx
call fcn.00403540
add esp, 8
mov dword [0x44aa8c], eax
cmp eax, edi
je 0x4048f7
push 0x5d
push ebx
call fcn.00403540
add esp, 8
mov dword [0x44aae8], eax
cmp eax, edi
je 0x4048f7
push 0x61
push ebx
call fcn.00403540
add esp, 8
mov dword [0x44aaa0], eax
cmp eax, edi
je 0x4048f7
push 0x62
push ebx
call fcn.00403540
add esp, 8
mov dword [0x44aafc], eax
cmp eax, edi
je 0x4048f7
mov dword [0x44aa88], edi
push 0x44aa88
call dword [0x44aae8]
cmp dword [0x44aa88], edi
je 0x4048f7
mov dword [0x44aaec], edi
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x40450c
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov dword [ebp - 0x38], eax
cmp dword [eax], 0x4550
jne 0x40450c
movzx ecx, word [eax + 6]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], edi
cmp edi, dword [ebp - 0x30]
jge 0x40450c
lea edx, [edi + edi*4]
mov eax, dword [ebp - 0x38]
mov esi, dword [eax + edx*8 + 0x10]
add esi, ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x404636
push 4
push str.KEXP
push esi
call fcn.00424f33
add esp, 0xc
test eax, eax
jne 0x404636
mov esi, dword [esi + 8]
cmp dword [0x44aad4], eax
je 0x404628
mov ecx, dword [esi + 0x28]
mov dword [0x44aaec], ecx
push 0x439830
push ebx
call fcn.00403480
mov edi, eax
push edi
push ebx
call fcn.00403540
mov esi, eax
push edi
push ebx
call fcn.00403690
add esp, 0x18
cmp byte [esi], 0x68
jne 0x404539
mov esi, dword [esi + 1]
mov eax, 0x1000
push 5
push 0x439828
push eax
push esi
call fcn.00403860
add esp, 0x10
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4048f7
mov dword [0x44aa84], eax
push str.DebugActiveProcess
push ebx
call fcn.00403480
mov edi, eax
push edi
push ebx
call fcn.00403540
mov esi, eax
push edi
push ebx
call fcn.00403690
add esp, 0x18
cmp byte [esi], 0x68
jne 0x404587
mov esi, dword [esi + 1]
mov eax, 0x1000
push 5
push 0x43980c
push eax
push esi
call fcn.00403860
add esp, 0x10
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4048f7
cmp byte [eax + 6], 0xe8
jne 0x4048f7
add eax, 7
mov dword [ebp - 0x20], eax
mov ecx, dword [eax]
lea edx, [ecx + eax + 4]
mov dword [0x44aaa8], edx
sub eax, esi
mov edi, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], 0
test edi, edi
jle 0x40463c
cmp byte [esi], 0xa1
jne 0x4045f4
mov eax, dword [esi + 1]
mov eax, dword [eax]
cmp eax, dword [0x44aa88]
je 0x4045f4
cmp dword [0x44aaec], 0
jne 0x4045f4
mov dword [0x44aaec], eax
cmp byte [esi], 0xe8
jne 0x40460b
mov eax, dword [esi + 1]
lea eax, [eax + esi + 5]
cmp eax, dword [0x44aaa0]
jne 0x40460b
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
push esi
call fcn.004054d0
add esp, 0xc
add esi, eax
mov dword [ebp - 0x20], esi
sub edi, eax
mov dword [ebp - 0x34], edi
jmp 0x4045d0
mov edx, dword [esi + 0x30]
mov dword [0x44aaec], edx
jmp 0x40450c
inc edi
jmp 0x4044b7
mov eax, dword [ebp - 0x24]
cmp eax, 2
jl 0x404651
cmp dword [0x44aaec], 0
je 0x4048f7
cmp eax, 1
jg 0x404660
mov dword [0x44aaec], 0
push 0x17
push ebx
call fcn.00403540
mov esi, eax
push 0x17
push ebx
call fcn.00403690
add esp, 0x10
cmp byte [esi], 0x68
jne 0x404682
mov esi, dword [esi + 1]
mov eax, 0x1000
push 2
push 0x439808
push eax
push esi
call fcn.00403860
add esp, 0x10
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4048f7
add eax, 2
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
mov ecx, dword [eax]
mov dword [0x44ab08], ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x44aa80], 0
je 0x4046e1
push str.OpenThread
push ebx
call esi
mov dword [0x44aab4], eax
test eax, eax
jne 0x4046e1
mov dword [ebp - 4], eax
call fcn.00404908
jmp 0x40493e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x44aab0], 0
je 0x4048f0
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x2c], ebx
test ebx, ebx
je 0x4048f7
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4048f7
push str.CreateRemoteThread
push ebx
call esi
mov dword [0x44aaa4], eax
test eax, eax
je 0x4048f7
push str.RtlCreateUserThread
mov edx, dword [ebp - 0x1c]
push edx
call esi
mov dword [0x44aa90], eax
test eax, eax
je 0x4048f7
push str.NtQueueApcThread
mov eax, dword [ebp - 0x1c]
push eax
call esi
mov dword [0x44aa9c], eax
test eax, eax
je 0x4048f7
push str.LdrShutdownThread
mov ecx, dword [ebp - 0x1c]
push ecx
call esi
mov dword [0x44aad0], eax
test eax, eax
je 0x4048f7
push str.NtTerminateThread
mov edx, dword [ebp - 0x1c]
push edx
call esi
mov dword [0x44aaf4], eax
test eax, eax
je 0x4048f7
push str.NtAllocateVirtualMemory
mov eax, dword [ebp - 0x1c]
push eax
call esi
mov dword [0x44ab04], eax
test eax, eax
je 0x4048f7
push str.NtFreeVirtualMemory
mov ecx, dword [ebp - 0x1c]
push ecx
call esi
mov dword [0x44ab10], eax
test eax, eax
je 0x4048f7
push str.NtOpenThread
mov edx, dword [ebp - 0x1c]
push edx
call esi
mov dword [0x44aac0], eax
test eax, eax
je 0x4048f7
push str.RtlNtStatusToDosError
mov eax, dword [ebp - 0x1c]
push eax
call esi
mov dword [0x44aab8], eax
test eax, eax
je 0x4048f7
push str.NtQuerySystemInformation
mov ecx, dword [ebp - 0x1c]
push ecx
call esi
mov dword [0x44aae0], eax
test eax, eax
je 0x4048f7
push str.NtQueryInformationProcess
mov edx, dword [ebp - 0x1c]
push edx
call esi
mov dword [0x44aac8], eax
test eax, eax
je 0x4048f7
push str.NtQueryInformationThread
mov eax, dword [ebp - 0x1c]
push eax
call esi
mov dword [0x44aae4], eax
test eax, eax
je 0x4048f7
cmp dword [0x44ab0c], 4
jl 0x40486c
push str.VirtualAllocEx
push ebx
call esi
mov dword [0x44aa98], eax
test eax, eax
je 0x4048f7
push str.VirtualFreeEx
push ebx
call esi
mov dword [0x44aaf0], eax
test eax, eax
je 0x4048f7
mov edi, 5
cmp dword [0x44ab0c], edi
jl 0x4048f0
push str.OpenThread
push ebx
call esi
mov dword [0x44aab4], eax
test eax, eax
je 0x4048f7
push 0x4396a8
push ebx
call esi
mov dword [0x44aa94], eax
test eax, eax
je 0x4048f7
push str.Thread32First
push ebx
call esi
mov dword [0x44ab00], eax
test eax, eax
je 0x4048f7
push str.Thread32Next
push ebx
call esi
mov dword [0x44ab14], eax
test eax, eax
je 0x4048f7
cmp dword [0x44ab0c], edi
jne 0x4048f0
cmp dword [0x44aaf8], 2
jl 0x4048f0
push str.GetProcessId
push ebx
call esi
mov dword [0x44aac4], eax
test eax, eax
je 0x4048f7
push str.GetThreadId
push ebx
call esi
mov dword [0x44aad8], eax
test eax, eax
je 0x4048f7
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0
call fcn.00404908
jmp 0x40493e
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0042433d
add ebp, 0x98
mov esp, ebp
pop ebp
ret