Function at 0x5ba8c7bb
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x5bb70c3c]
push ebx
push esi
mov esi, ecx
mov dword [esi + 4], 0x5ba44d5c
mov dword [esi + 0xc], 0x5ba44d80
mov dword [esi + 0x1c], 0x5ba44dc4
push edi
mov dword [ebp - 4], eax
mov dword [esi], 0x5ba44f24
mov dword [esi + 4], 0x5ba44f00
mov dword [esi + 8], 0x5ba44ee4
mov dword [esi + 0xc], 0x5ba44ea0
mov dword [esi + 0x10], 0x5ba44e84
mov dword [esi + 0x14], 0x5ba44e74
mov dword [esi + 0x18], 0x5ba44e54
mov dword [esi + 0x1c], 0x5ba44e44
mov dword [esi + 0x20], 0x5ba44e2c
mov dword [esi + 0x24], 0x5ba44e18
mov dword [esi + 0x28], 0x5ba44dec
mov dword [esi + 0x2c], 0x5ba44ddc
call fcn.5bae6ef6
mov ecx, dword [0x5bb73808]
xor ebx, ebx
push ebx
push ebx
push 0x10
call fcn.5ba7464c
mov eax, dword [esi + 0x140]
and dword [esi + 0x144], 0xfffffffc
and eax, 0x180601c0
or eax, 0x400015
lea edi, [esi + 0x178]
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x158], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0x88], 0x12
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x140], eax
mov dword [edi], ebx
call fcn.5ba8cb0f
test eax, eax
je 0x5ba8c95c
call fcn.5ba8cb40
test eax, eax
je 0x5ba8c95c
push 0xde
call fcn.5ba5c700
xor ecx, ecx
cmp eax, ebx
setne cl
push edi
shl ecx, 0x1b
xor ecx, dword [esi + 0x140]
and ecx, 0x8000000
xor dword [esi + 0x140], ecx
call fcn.5bacf964
jmp 0x5ba8c963
and byte [esi + 0x143], 0xf7
call fcn.5ba8cb40
test eax, eax
je 0x5ba8c994
push 0xe7
call fcn.5ba5c700
xor ecx, ecx
cmp eax, ebx
setne cl
shl ecx, 0x1c
xor ecx, dword [esi + 0x140]
and ecx, 0x10000000
xor dword [esi + 0x140], ecx
jmp 0x5ba8c99b
and byte [esi + 0x143], 0xef
or dword [esi + 0xb0], 0xffffffff
push 0xb1
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xdc], 1
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xac], ebx
call fcn.5ba5c700
xor ecx, ecx
cmp eax, ebx
setne cl
push 0xb2
shl ecx, 7
xor ecx, dword [esi + 0x140]
and ecx, 0x80
xor dword [esi + 0x140], ecx
call fcn.5ba5c700
xor ecx, ecx
cmp eax, ebx
setne cl
lea eax, [esi + 0xb8]
push eax
shl ecx, 8
xor ecx, dword [esi + 0x140]
and ecx, 0x100
xor dword [esi + 0x140], ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
or dword [esi + 0xb4], 0xffffffff
push 0x26
pop ecx
xor eax, eax
lea edi, [ebp - 0x9c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x5ba8ca83
cmp dword [ebp - 0x90], 2
jne 0x5ba8ca83
cmp dword [ebp - 0x9c], 5
jne 0x5ba8ca83
cmp dword [ebp - 0x98], 1
jne 0x5ba8ca83
cmp word [ebp - 0x94], 0xa28
jne 0x5ba8ca83
call fcn.5babcc7f
mov dword [ebp - 0xa4], eax
cmp dword [0x5bb72ac0], ebx
mov edi, dword [sym.imp.USER32.dll_LoadAcceleratorsA]
jne 0x5ba8caa3
push 0xc9
push dword [0x5bb73708]
call edi
mov dword [0x5bb72ac0], eax
cmp dword [ebp - 0xa4], ebx
je 0x5ba8cac5
cmp dword [0x5bb72ac8], ebx
jne 0x5ba8cac5
push 0xce
push dword [ebp - 0xa4]
call edi
mov dword [0x5bb72ac8], eax
cmp dword [0x5bb72ac4], ebx
jne 0x5ba8cadf
push 0xca
push dword [0x5bb73708]
call edi
mov dword [0x5bb72ac4], eax
xor eax, eax
lea edi, [esi + 0x164]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x5ba4f760
stosd dword es:[edi], eax
call fcn.5ba8cb59
mov ecx, dword [ebp - 4]
mov dword [esi + 0x174], eax
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret