Function at 0x4425bd90
Capabilities:
Check os version
Get memory capacity
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x134
call fcn.4427cde0
mov eax, dword [0x442bd0c0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x64], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ADVAPI32.DLL
call ebx
push str.KERNEL32.DLL
mov edi, eax
call ebx
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x4425be6c
movzx edx, byte [esp + 0x5a]
movzx eax, byte [esp + 0x5b]
movzx ecx, byte [esp + 0x5c]
push edx
movzx edx, byte [esp + 0x61]
push eax
movzx eax, byte [esp + 0x66]
push ecx
movzx ecx, byte [esp + 0x6b]
push edx
movzx edx, byte [esp + 0x68]
push eax
movzx eax, byte [esp + 0x6d]
push ecx
movzx ecx, word [esp + 0x6e]
push edx
movzx edx, word [esp + 0x70]
push eax
mov eax, dword [esp + 0x70]
push ecx
push edx
push eax
lea ecx, [esp + 0x124]
push str._08X_04X_04X_02X_02X_02X_02X_02X_02X_02X_02X
push ecx
call sub.MSVCR90.dll_sprintf
add esp, 0x34
mov eax, 8
call fcn.4427cde0
fld qword [0x4428f5f8]
lea edx, [esp + 0x100]
fstp qword [esp]
push 0x20
push edx
call fcn.4422f6a0
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x4425bf7a
push str.CryptAcquireContextW
push edi
call esi
push str.CryptGenRandom
push edi
mov ebx, eax
call esi
push str.CryptReleaseContext
push edi
mov dword [esp + 0x18], eax
call esi
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x4425bf6d
cmp dword [esp + 0x10], 0
je 0x4425bf6d
test eax, eax
je 0x4425bf6d
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call ebx
test eax, eax
je 0x4425bf10
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xf8]
push ecx
push 0x40
push edx
call dword [esp + 0x1c]
test eax, eax
je 0x4425bf05
mov eax, 8
call fcn.4427cde0
fldz
fstp qword [esp]
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.4422f6a0
add esp, 0x10
mov ecx, dword [esp + 0xc]
push 0
push ecx
call dword [esp + 0x1c]
push 0
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea edx, [esp + 0x1c]
push edx
call ebx
test eax, eax
je 0x4425bf6d
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xf8]
push eax
push 0x40
push ecx
call dword [esp + 0x1c]
test eax, eax
je 0x4425bf62
mov eax, 8
call fcn.4427cde0
fld qword [0x442a4f58]
fstp qword [esp]
lea edx, [esp + 0x100]
push 0x40
push edx
call fcn.4422f6a0
add esp, 0x10
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [esp + 0x70], 2
jne 0x4425bf8e
call fcn.44235050
test eax, eax
jne 0x4425c069
push str.USER32.DLL
call ebx
mov edi, eax
test edi, edi
je 0x4425c069
push str.GetForegroundWindow
push edi
call esi
push str.GetCursorInfo
push edi
mov ebx, eax
call esi
push 0x442a4f18
push edi
mov dword [esp + 0x18], eax
call esi
mov esi, eax
test ebx, ebx
je 0x4425bfe7
call ebx
mov dword [esp + 0x14], eax
mov eax, 8
call fcn.4427cde0
fldz
fstp qword [esp]
lea ecx, [esp + 0x1c]
push 4
push ecx
call fcn.4422f6a0
add esp, 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4425c035
cmp dword [esp + 0x70], 2
jne 0x4425bffd
cmp dword [esp + 0x64], 5
jb 0x4425c035
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x14
call eax
test eax, eax
je 0x4425c035
mov eax, 8
call fcn.4427cde0
fld qword [0x442a4f10]
mov eax, dword [esp + 0x24]
fstp qword [esp]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.4422f6a0
add esp, 0x10
test esi, esi
je 0x4425c062
push 0xbf
call esi
mov dword [esp + 0x18], eax
mov eax, 8
call fcn.4427cde0
fld1
fstp qword [esp]
lea edx, [esp + 0x20]
push 4
push edx
call fcn.4422f6a0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.4425bd10
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.4427cde0
fld1
fstp qword [esp]
lea ecx, [esp + 0x38]
push 0x20
push ecx
call fcn.4422f6a0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x18], eax
mov eax, 8
call fcn.4427cde0
fld1
fstp qword [esp]
lea edx, [esp + 0x20]
push 4
push edx
call fcn.4422f6a0
mov ecx, dword [esp + 0x14c]
add esp, 0x10
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.4427cc16
mov esp, ebp
pop ebp
ret