Function at 0x12ae5f0
Capabilities:
Check os version
Get file attributes
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20d4
call fcn.012712c0
mov eax, dword [0x12fceb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x2090], ecx
mov dword [ebp - 0x2084], edx
mov dword [ebp - 0x2094], eax
mov dword [ebp - 0x2080], 0xffffffff
mov dword [ebp - 0x208c], 0xc0000365
mov dword [ebp - 0x2088], 0xffffffd5
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp ebx, 2
je 0x12ae83c
mov edi, dword [0x12fe408]
test edi, edi
je 0x12ae83c
lea eax, [ebp - 0x207c]
mov dword [ebp - 0x20ac], ecx
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20b0], 0x18
push eax
mov ecx, edi
mov dword [ebp - 0x20a4], 0x40
mov dword [ebp - 0x20a8], edx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call dword [section..rdata]
call edi
test eax, eax
js 0x12ae7cb
test dword [ebp - 0x204c], 0x400
jne 0x12ae830
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0x2050]
push 0
push 0x64
push dword [ebp - 0x2078]
mov dword [esi], eax
mov eax, dword [ebp - 0x205c]
push dword [ebp - 0x207c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2058]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.012b9c70
push 0
push 0x64
push dword [ebp - 0x2070]
add eax, 0xb3960000
push dword [ebp - 0x2074]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.012b9c70
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.012b9c70
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.012b9c70
mov edi, dword [ebp - 0x2094]
add eax, 0xb3960000
push 0
adc edx, 0x5e6684f4
mov dword [esi + 0x20], eax
push 0
push edi
mov dword [esi + 0x24], edx
call sym.VBoxTray.exe_nocrt_strlen
add esp, 4
push eax
mov eax, dword [ebp - 0x204c]
and eax, 0x7fff
shl eax, 0x10
push edi
push eax
call fcn.012afb80
push ebx
push esi
push 0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
call fcn.012adf60
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01271180
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000024
je 0x12ae7fb
cmp eax, 0xc0000033
je 0x12ae7fb
cmp eax, 0xc000000d
je 0x12ae7fb
cmp eax, 0xc0000022
je 0x12ae830
cmp eax, 0xc0000043
je 0x12ae830
push eax
call fcn.012a7bb0
add esp, 4
mov edi, eax
jmp 0x12ae827
push eax
push 0x2078
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
lea eax, [ebp - 0x20b0]
push esi
push eax
call fcn.012ae000
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x12aefe1
cmp edi, 0x34
jne 0x12aefdf
mov edx, dword [ebp - 0x2084]
mov ecx, dword [ebp - 0x2090]
mov eax, dword [0x12fd7dc]
mov edi, 0x4020
mov dword [ebp - 0x2098], eax
test eax, eax
je 0x12ae85b
test byte [ebp + 0x18], 2
jne 0x12ae85b
mov edi, 0x204020
push 0
push 0
push edi
push 1
push 7
push 0x80
push 0
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x20b0], 0x18
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20ac], ecx
push eax
push 0x100080
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x20a4], 0x40
push eax
mov dword [ebp - 0x20a8], edx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x12ae8cd
cmp eax, 0xc00000f7
jne 0x12ae925
cmp dword [ebp - 0x2098], 0xffffffff
jne 0x12ae925
test edi, 0x200000
je 0x12ae925
push 0
push 0
and edi, 0xffdfffff
lea eax, [ebp - 0x208c]
push edi
push 1
push 7
push 0x80
push 0
push eax
lea eax, [ebp - 0x20b0]
push eax
push 0x100080
lea eax, [ebp - 0x2080]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x12ae925
mov dword [0x12fd7dc], 0
test eax, eax
js 0x12aec12
push 0x23
push 8
lea eax, [ebp - 0x20bc]
push eax
lea eax, [ebp - 0x208c]
push eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x12ae961
xor edi, edi
xor eax, eax
mov dword [ebp - 0x20b8], edi
mov dword [ebp - 0x20bc], eax
jmp 0x12ae96d
mov edi, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x20bc]
test eax, 0x400
je 0x12aea05
cmp edi, 0xa000000c
je 0x12aea05
mov eax, dword [ebp + 0x18]
test al, 2
jne 0x12aea05
push 0
push 0
push 0x4020
push 1
push 7
push 0x80
push 0
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x208c], 0xc0000365
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x2088], 0xffffffd5
push eax
push 0x100080
lea eax, [ebp - 0x20b4]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x12ae9ff
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0x20b4]
xor edi, edi
mov dword [ebp - 0x2080], eax
mov dword [ebp - 0x20b8], edi
mov dword [ebp - 0x20bc], edi
jmp 0x12aea0b
mov edi, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x2080]
push 0x12
push 0x68
lea ecx, [ebp - 0x207c]
mov dword [ebp - 0x2098], eax
push ecx
lea ecx, [ebp - 0x20c4]
mov dword [ebp - 0x20c4], 0xc0000365
push ecx
push eax
mov dword [ebp - 0x20c0], 0xffffffd5
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x12aea57
cmp eax, 0x80000005
je 0x12aea57
push eax
call fcn.012a7bb0
add esp, 4
jmp 0x12aebe9
mov eax, dword [ebp - 0x204c]
mov ecx, dword [ebp - 0x2048]
push 0
push 0x64
push dword [ebp - 0x2078]
mov dword [esi], eax
mov eax, dword [ebp - 0x2054]
push dword [ebp - 0x207c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2050]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.012b9c70
push 0
push 0x64
push dword [ebp - 0x2070]
add eax, 0xb3960000
push dword [ebp - 0x2074]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.012b9c70
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.012b9c70
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.012b9c70
add eax, 0xb3960000
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x2094]
adc edx, 0x5e6684f4
mov dword [esi + 0x24], edx
test eax, eax
je 0x12aeb27
push eax
call sym.VBoxTray.exe_nocrt_strlen
add esp, 4
jmp 0x12aeb29
xor eax, eax
push 0
push edi
push eax
mov eax, dword [ebp - 0x205c]
push dword [ebp - 0x2094]
and eax, 0x7fff
shl eax, 0x10
push eax
call fcn.012afb80
add esp, 0x14
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
cmp ebx, 2
jne 0x12aebdd
mov eax, dword [ebp - 0x2044]
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
cmp eax, 1
ja 0x12aeb77
mov eax, 1
mov ecx, dword [ebp - 0x2038]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0x203c]
push 1
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x207c]
push 0x800
push eax
lea eax, [ebp - 0x20c4]
mov dword [esi + 0x44], 0
push eax
push dword [ebp - 0x2098]
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
jns 0x12aebd4
cmp eax, 0x80000005
jne 0x12aebdd
mov eax, dword [ebp - 0x2074]
mov dword [esi + 0x44], eax
push ebx
push esi
push 0
call fcn.012adf60
add esp, 0xc
push dword [ebp - 0x2080]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x12aec86
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01271180
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000024
je 0x12aec51
cmp eax, 0xc0000033
je 0x12aec51
cmp eax, 0xc0000022
je 0x12aec3b
cmp eax, 0xc0000043
je 0x12aec3b
push eax
call fcn.012a7bb0
add esp, 4
mov edi, eax
jmp 0x12aec7d
mov dword [ebp - 0x208c], 0xc0000365
mov dword [ebp - 0x2088], 0xffffffd5
jmp 0x12aec86
push eax
push 0x2078
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
lea eax, [ebp - 0x20b0]
push esi
push eax
call fcn.012ae000
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x12aefdf
cmp edi, 0x34
jne 0x12aefdf
push 0
lea eax, [ebp - 0x20d4]
push eax
lea eax, [ebp - 0x20cc]
push eax
push dword [ebp - 0x2084]
call fcn.012ade90
add esp, 0x10
mov edi, dword [ebp - 0x2090]
lea eax, [ebp - 0x20cc]
mov dword [ebp - 0x20b0], 0x18
mov dword [ebp - 0x20a8], eax
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x20ac], edi
push 0
push 0
push 0x4021
push 1
push 7
push 0x80
push 0
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20a4], 0x40
push eax
push 0x100001
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x20a0], 0
push eax
mov dword [ebp - 0x209c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 0x20b4], eax
test eax, eax
js 0x12aef5d
mov eax, dword fs:[0x30]
xor edx, edx
mov ecx, dword [eax + 0xa4]
mov eax, dword fs:[0x30]
or edx, dword [eax + 0xa8]
cmp ecx, 5
jb 0x12aed52
ja 0x12aed4b
test edx, edx
je 0x12aed52
mov edi, 0x25
jmp 0x12aed57
mov edi, 3
push 0
lea eax, [ebp - 0x20d4]
push eax
push 1
push edi
push 0x2078
lea eax, [ebp - 0x207c]
push eax
lea eax, [ebp - 0x208c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x12aef33
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0x2050]
push 0
push 0x64
push dword [ebp - 0x2070]
mov dword [esi], eax
mov eax, dword [ebp - 0x204c]
push dword [ebp - 0x2074]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2048]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.012b9c70
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.012b9c70
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.012b9c70
push 0
push 0x64
push dword [ebp - 0x2058]
add eax, 0xb3960000
push dword [ebp - 0x205c]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.012b9c70
push 0
push dword [ebp - 0x203c]
add eax, 0xb3960000
push dword [ebp - 0x2094]
adc edx, 0x5e6684f4
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
call sym.VBoxTray.exe_nocrt_strlen
add esp, 4
push eax
mov eax, dword [ebp - 0x2044]
push dword [ebp - 0x2094]
and eax, 0x7fff
shl eax, 0x10
push eax
call fcn.012afb80
add esp, 0x14
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
cmp ebx, 2
jne 0x12aef06
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 0
cmp edi, 0x25
jne 0x12aeeb9
mov eax, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x2018]
jmp 0x12aeebd
xor eax, eax
xor ecx, ecx
push 1
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x207c]
push 0x800
push eax
lea eax, [ebp - 0x208c]
mov dword [esi + 0x4c], ecx
push eax
push dword [ebp - 0x2080]
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x12aef06
mov eax, dword [ebp - 0x2074]
mov dword [esi + 0x44], eax
push ebx
push esi
push 0
call fcn.012adf60
add esp, 0xc
mov edi, eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01271180
mov esp, ebp
pop ebp
ret
push eax
call fcn.012a7bb0
add esp, 4
mov edi, eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01271180
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000033
je 0x12aef6e
cmp eax, 0xc0000024
je 0x12aef6e
push eax
jmp 0x12aefd5
mov ecx, dword [ebp - 0x2084]
push eax
push 0x2078
lea eax, [ebp - 0x207c]
mov dword [ebp - 0x20b0], 0x18
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20ac], edi
push ebx
push esi
push eax
mov dword [ebp - 0x20a4], 0x40
mov dword [ebp - 0x20a8], ecx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call fcn.012ae000
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x12aefdf
push dword [ebp - 0x20b4]
call fcn.012a7bb0
mov edi, eax
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01271180
mov esp, ebp
pop ebp
ret