Function at 0x50bc20d3
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x13c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x138], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [esp + 8], eax
mov eax, dword [0x50bc6450]
push esi
xor ebx, ebx
or eax, dword [0x50bc6454]
push edi
jne 0x50bc2201
cmp byte [0x50bc6444], bl
jne 0x50bc21a6
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x50bc2144
cmp dword [esp + 0x2c], 6
setb al
mov byte [0x50bc6445], al
cmp al, bl
jne 0x50bc219f
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x50bc2198
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EventWrite
push edi
call esi
mov dword [0x50bc6448], eax
cmp eax, ebx
je 0x50bc2198
push str.EventRegister
push edi
call esi
mov dword [0x50bc60f0], eax
cmp eax, ebx
je 0x50bc218e
push str.EventUnregister
push edi
call esi
mov dword [0x50bc644c], eax
cmp eax, ebx
jne 0x50bc219f
mov dword [0x50bc60f0], 0x50bc1c80
mov byte [0x50bc6445], 1
mov byte [0x50bc6444], 1
cmp byte [0x50bc6445], bl
jne 0x50bc21ca
push 0x50bc6450
push 0x50bc6458
push 0x50bc1c30
push 0x50bc483c
call dword [0x50bc60f0]
jmp 0x50bc2201
mov ecx, 0x50bc6458
push ecx
push ebx
mov eax, ecx
cdq
push ebx
mov dword [0x50bc6454], edx
lea edx, [esp + 0x2c]
push edx
push 1
mov dword [0x50bc6450], eax
mov eax, 0x50bc483c
push eax
push ecx
push 0x50bc1bc5
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov edi, 0x80000000
cmp dword [0x50bc647c], ebx
je 0x50bc225f
mov al, byte [0x50bc6480]
cmp byte [0x50bc6445], bl
je 0x50bc2223
cmp al, 4
jae 0x50bc2251
cmp al, bl
jmp 0x50bc224f
cmp al, 4
jae 0x50bc222b
cmp al, bl
jne 0x50bc225f
mov ecx, dword [0x50bc646c]
and ecx, edi
xor eax, eax
or eax, ecx
je 0x50bc225f
mov ecx, dword [0x50bc6474]
mov eax, ecx
xor edx, edx
and eax, edi
cmp edx, dword [0x50bc6470]
jne 0x50bc225f
cmp eax, ecx
jne 0x50bc225f
call fcn.50bc25a4
push edx
push eax
call fcn.50bc1de7
pop ecx
pop ecx
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
call fcn.50bc1f5f
pop ecx
mov esi, eax
call fcn.50bc1f3a
test al, al
je 0x50bc22c1
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x50bc22c1
cmp dword [esp + 0x18], 0
je 0x50bc22a2
push str.QQBrowserModuleEntry
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x50bc22a2
push esi
push dword [esp + 0x10]
call eax
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x50bc22ba
push esi
push dword [esp + 0x10]
call eax
jmp 0x50bc22c7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x50bc2386
mov eax, esi
call fcn.50bc1f3a
test al, al
je 0x50bc237c
cmp dword [esi + 8], 1
jne 0x50bc237c
cmp dword [0x50bc647c], ebx
je 0x50bc237c
mov al, byte [0x50bc6480]
cmp byte [0x50bc6445], bl
je 0x50bc230f
cmp al, 4
jae 0x50bc233d
test al, al
jmp 0x50bc233b
cmp al, 4
jae 0x50bc2317
test al, al
jne 0x50bc237c
mov ecx, dword [0x50bc646c]
and ecx, edi
xor eax, eax
or eax, ecx
je 0x50bc237c
mov ecx, dword [0x50bc6474]
mov eax, ecx
xor edx, edx
and eax, edi
cmp edx, dword [0x50bc6470]
jne 0x50bc237c
cmp eax, ecx
jne 0x50bc237c
call fcn.50bc1f15
mov ebx, eax
sub ebx, dword [esi + 0xf0]
mov edi, edx
sbb edi, dword [esi + 0xf4]
call fcn.50bc1f15
sub eax, dword [esi + 0xe8]
push edi
sbb edx, dword [esi + 0xec]
push ebx
push edx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.50bc1e64
add esp, 0x18
xor ebx, ebx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
je 0x50bc2393
mov ebx, esi
call fcn.50bc1fd6
xor ebx, ebx
cmp byte [0x50bc6444], 0
je 0x50bc23e9
mov esi, dword [0x50bc6450]
mov eax, dword [0x50bc6454]
mov ecx, esi
or ecx, eax
je 0x50bc23e9
cmp byte [0x50bc6445], 0
jne 0x50bc23c0
push eax
push esi
call dword [0x50bc644c]
jmp 0x50bc23dd
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [esi + 0x20], ebx
mov byte [esi + 0x28], 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [0x50bc6450], ebx
mov dword [0x50bc6454], ebx
mov ecx, dword [esp + 0x144]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.50bc2edb
mov esp, ebp
pop ebp
ret 8