Function at 0x401b50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x506e9a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x200
push ebx
push esi
push edi
lea eax, [esp + 0xe8]
push eax
mov dword [esp + 0xec], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xec], 6
jb 0x401ba1
cmp dword [esp + 0xf0], 2
jb 0x401bb8
xor eax, eax
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004027a0
mov dword [esp + 0x10], eax
mov byte [eax + 0x29], 1
mov eax, dword [esp + 0x10]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x10]
mov dword [eax], eax
mov eax, dword [esp + 0x10]
xor ebx, ebx
mov dword [eax + 8], eax
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x218], ebx
call fcn.00401a70
cmp dword [esp + 0x14], ebx
je 0x401c2f
push 0x523240
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x218], 1
call fcn.004f66a0
add esp, 4
test eax, eax
lea ecx, [esp + 0x20]
jne 0x401c5d
mov byte [esp + 0x214], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea eax, [esp + 0xc]
mov dword [esp + 0x214], 0xffffffff
call fcn.00401e50
mov eax, 1
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.LayeredBlackList.xml
call dword [0x509758]
lea ecx, [esp + 0x60]
call fcn.00402ae0
mov byte [esp + 0x214], 2
mov ecx, dword [esp + 0x24]
mov esi, 8
cmp dword [esp + 0x38], esi
jae 0x401c8c
lea ecx, [esp + 0x24]
push ecx
mov eax, esp
mov dword [eax], ecx
lea ecx, [esp + 0x64]
mov dword [esp + 0x1c], esp
call fcn.004efc50
movzx eax, al
cmp eax, ebx
jne 0x401cbf
lea ecx, [esp + 0x60]
mov byte [esp + 0x214], 1
call fcn.004edb80
lea ecx, [esp + 0x20]
jmp 0x401c22
push ecx
mov eax, esp
lea ecx, [esp + 0x64]
mov dword [esp + 0x1c], esp
mov dword [eax], str.ProcessList
call fcn.004ebd30
movzx eax, al
cmp eax, ebx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x60]
jne 0x401cfa
mov byte [esp + 0x214], 1
call fcn.004edb80
lea ecx, [esp + 0x20]
jmp 0x401c22
call fcn.004eb230
nop
push ecx
mov eax, esp
lea ecx, [esp + 0x64]
mov dword [esp + 0x20], esp
mov dword [eax], str.process
call fcn.004ebd30
cmp al, bl
je 0x401dee
push ecx
mov eax, esp
mov dword [eax], 0x523570
lea eax, [esp + 0xd0]
mov dword [esp + 0x20], esp
push eax
lea ecx, [esp + 0x68]
call fcn.00402ab0
mov byte [esp + 0x214], 3
cmp dword [eax + 0x18], esi
jb 0x401d4e
mov eax, dword [eax + 4]
jmp 0x401d51
add eax, 4
push eax
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0xcc]
mov byte [esp + 0x214], 5
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp dword [esp + 0x54], esi
mov eax, dword [esp + 0x40]
jae 0x401d7f
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x50]
add ecx, 1
push ecx
push eax
call dword [sym.imp.MSVCR80.dll__wcsupr_s]
mov edi, dword [esp + 0x18]
add esp, 8
lea edx, [esp + 0x58]
push edx
lea ebx, [esp + 0x40]
lea esi, [esp + 0x10]
call fcn.00402040
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x401db7
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x401dbd
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov byte [esp + 0x214], 2
cmp dword [esi + 4], edi
lea ecx, [esp + 0x3c]
jne 0x401dde
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor ebx, ebx
lea esi, [ebx + 8]
jmp 0x401d00
mov dword [esp + 0x18], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor ebx, ebx
lea ecx, [esp + 0x60]
call fcn.004eb250
lea ecx, [esp + 0x60]
mov byte [esp + 0x214], 1
call fcn.004edb80
lea ecx, [esp + 0x20]
mov byte [esp + 0x214], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea eax, [esp + 0xc]
mov dword [esp + 0x214], 0xffffffff
call fcn.00401e50
mov ecx, dword [esp + 0x20c]
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret