Function at 0x1003530
Capabilities:
Check os version
Read file via mapping

Disassembly:
push dword [ebp - 0xadc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x1005e0d
cmp dword [ebp - 0xab8], ebx
jl 0x1005e2a
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xae8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x1005e81
jmp 0x1005e1d
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x1005e91
push 0x60
call dword [0x1015428]
cmp eax, ebx
je 0x1004327
mov ecx, eax
call fcn.010029f0
push eax
lea ecx, [ebp - 0xae0]
call fcn.0100a5cd
cmp dword [ebp - 0xae0], ebx
je 0x1005b92
cmp dword [ebp - 0xab8], ebx
jl 0x1005bbf
push 1
push ebx
lea ecx, [ebp - 0xafc]
mov dword [ebp - 0xafc], ebx
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xaec], ebx
call fcn.01004211
lea eax, [ebp - 0xabc]
push eax
push 0x11
mov dword [ebp - 0xabc], ebx
call fcn.01004a81
jmp 0x1005ba1
mov eax, dword [ebp - 0xac4]
push dword [eax + 0x14]
call esi
cmp eax, 0x10000
pop ecx
mov dword [ebp - 0xacc], eax
jbe 0x1005c8c
jmp 0x1005c82
push 1
push ebx
push ebx
push dword [ebp - 0xabc]
lea eax, [ebp - 0xac0]
push esi
push eax
call dword [sym.imp.ole32.dll_CoGetMarshalSizeMax]
jmp 0x1005d31
mov eax, dword [ebp - 0xac0]
cmp eax, dword [ebp - 0xacc]
ja 0x1005d41
jmp 0x1005d4b
push dword [ebp - 0xac0]
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
jmp 0x1005d5f
lea eax, [ebp - 0xad0]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp eax, ebx
mov dword [ebp - 0xab8], eax
jl 0x1005d82
jmp 0x1005d8d
xor edi, edi
inc edi
push edi
push ebx
push ebx
push dword [ebp - 0xabc]
push esi
push dword [ebp - 0xad0]
call dword [sym.imp.ole32.dll_CoMarshalInterface]
jmp 0x1005da4
mov eax, dword [ebp - 0xac0]
add eax, 4
push eax
push ebx
push ebx
push 2
push dword [ebp - 0xad4]
mov dword [ebp - 0xacc], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x1005db7
jmp 0x100433f
push dword [ebp - 0xac4]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x1005dc7
cmp dword [ebp - 0xab8], ebx
jl 0x100434d
mov eax, dword [ebp - 0xac0]
mov dword [esi], eax
push dword [ebp - 0xac0]
lea eax, [esi + 4]
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 0xac4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x1005de1
jmp 0x100434d
push dword [ebp - 0xabc]
call dword [0x1015424]
lea ecx, [ebp - 0xafc]
call fcn.0100270a
jmp 0x1005bbf
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x1005b3c
call fcn.01002f5f
jmp 0x1005b47
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xafc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 0xac4], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
jmp 0x10059e3
push 2
call fcn.01003574
jmp 0x1005b2a
push 1
push dword [ebp - 0xabc]
lea ecx, [ebp - 0xafc]
call fcn.01003f1b
push ebx
push ebx
push ebx
push 2
push 2
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0xafc]
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
jmp 0x1005bb4
lea ecx, [ebp - 0xac8]
call fcn.0100435b
jmp 0x1005dff
xor eax, eax
jmp 0x100248e
cmp dword [ebp - 0xabc], ebx
jne 0x10026e9
jmp 0x10026f5
cmp dword [ebp - 0xab8], ebx
jge 0x1002698
jmp 0x1004317
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x1004317
cmp byte [0x1015561], bl
jne 0x1005ab3
lea eax, [ebp - 0x174]
push eax
mov dword [ebp - 0x174], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1005a21
cmp dword [ebp - 0x170], 6
setb al
cmp al, bl
mov byte [0x1015562], al
jne 0x1005aaa
push 0x100600c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x1005a7f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1006000
push edi
call esi
cmp eax, ebx
mov dword [0x1015564], eax
je 0x1005a7f
push 0x1005ff0
push edi
call esi
cmp eax, ebx
mov dword [0x101544c], eax
je 0x1005a75
push 0x1005fe0
push edi
call esi
cmp eax, ebx
mov dword [0x1015450], eax
jne 0x1005a88
mov dword [0x1015450], 0x100a3a9
mov dword [0x101544c], 0x100a360
mov al, 1
mov byte [0x1015562], al
jmp 0x1005aaa
push 0x1005fd0
push edi
call esi
cmp eax, ebx
mov dword [0x1015454], eax
jne 0x1005aa5
mov dword [0x1015454], 0x100a3f0
jmp 0x1005a6b
mov al, byte [0x1015562]
mov byte [0x1015561], 1
jmp 0x1005ab8
mov al, byte [0x1015562]
mov cl, al
neg cl
push 0x1015558
sbb ecx, ecx
and ecx, 0x1015540
neg al
push ecx
sbb eax, eax
and eax, 0x100a2f6
push eax
push 0x1005f90
call dword [0x101544c]
mov esi, 0x1005fb0
push esi
push dword [0x101555c]
push dword [0x1015558]
call dword [0x1015454]
test al, al
je 0x1005b19
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1005fa0
push esi
push dword [0x101555c]
push dword [0x1015558]
call fcn.0100a429
push 0x1006020
push 0xffffffffffffffff
call fcn.0100e973
jmp 0x1003563
test eax, eax
jl 0x1005b35
push 1
jmp 0x1002f45
push 3
jmp 0x1002f45
call dword [sym.imp.MSSHooks.dll_LoadMSSearchHooks]
jmp 0x1002f50
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebx
mov dword [ebp - 0xab8], eax
jl 0x1005f2d
xor eax, eax
cmp dword [ebp + 8], 7
lea edi, [ebp - 0xae8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xad4], ebx
mov dword [ebp - 0xad0], ebx
je 0x1002477
mov dword [ebp - 0xab8], 0x80070667
jmp 0x1002477
mov dword [ebp - 0xab8], 0x8007000e
jmp 0x10024a6
cmp eax, ebx
mov dword [ebp - 0xab8], eax
jge 0x1003ee7
jmp 0x100432e
mov dword [ebp - 0xab8], eax
jmp 0x100432e
cmp dword [ebp - 0xab8], ebx
mov esi, dword [sym.imp.msvcrt.dll__wtoi]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov dword [ebp - 0xad8], ebx
jl 0x1005c6e
mov eax, dword [ebp - 0xac4]
push dword [eax + 8]
call esi
pop ecx
lea ecx, [ebp - 0xad8]
push ecx
push eax
mov dword [ebp - 0xae8], eax
call edi
test eax, eax
jne 0x1005c08
call fcn.0100379d
mov dword [ebp - 0xab8], eax
cmp dword [ebp - 0xab8], ebx
jl 0x1005c6e
mov eax, dword [ebp - 0xac4]
push dword [eax + 0xc]
call esi
pop ecx
lea ecx, [ebp - 0xad8]
push ecx
push eax
mov dword [ebp - 0xadc], eax
call edi
test eax, eax
jne 0x1005c3b
call fcn.0100379d
mov dword [ebp - 0xab8], eax
cmp dword [ebp - 0xab8], ebx
jl 0x1005c6e
mov eax, dword [ebp - 0xac4]
push dword [eax + 0x10]
call esi
pop ecx
lea ecx, [ebp - 0xad8]
push ecx
push eax
mov dword [ebp - 0xad4], eax
call edi
test eax, eax
jne 0x1005c6e
call fcn.0100379d
mov dword [ebp - 0xab8], eax
cmp dword [ebp - 0xab8], ebx
mov dword [ebp - 0xacc], ebx
jge 0x10024f7
jmp 0x1005cbf
mov dword [ebp - 0xab8], 0x80070057
cmp dword [ebp - 0xab8], ebx
jl 0x1005cbf
mov eax, dword [ebp - 0xac4]
push dword [eax + 0x18]
call esi
pop ecx
lea ecx, [ebp - 0xad8]
push ecx
push eax
mov dword [ebp - 0xae4], eax
call edi
test eax, eax
jne 0x1005cbf
call fcn.0100379d
mov dword [ebp - 0xab8], eax
cmp dword [ebp - 0xab8], ebx
mov dword [ebp - 0xabc], ebx
jl 0x1005d18
lea eax, [ebp - 0xac4]
push eax
call fcn.0100c8e0
cmp eax, ebx
mov dword [ebp - 0xab8], eax
jl 0x1005d18
mov esi, dword [ebp - 0xac4]
mov eax, dword [esi]
push esi
call dword [eax + 4]
push dword [ebp - 0xae0]
mov ecx, esi
call fcn.0100253b
cmp eax, ebx
mov dword [ebp - 0xab8], eax
jl 0x1005d12
push esi
lea ecx, [ebp - 0xabc]
call fcn.01001559
mov eax, dword [esi]
push esi
call dword [eax + 8]
cmp dword [ebp - 0xab8], ebx
mov dword [ebp - 0xac0], ebx
mov esi, 0x1006038
jge 0x1002519
jmp 0x1005d4b
cmp eax, ebx
mov dword [ebp - 0xab8], eax
jge 0x10025fe
jmp 0x1005d4b
mov dword [ebp - 0xab8], 0x80028016
cmp dword [ebp - 0xab8], ebx
mov dword [ebp - 0xac4], ebx
jge 0x1002615
jmp 0x1005d8d
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0xac4], edi
jne 0x1005d76
call fcn.0100379d
mov dword [ebp - 0xab8], eax
cmp dword [ebp - 0xab8], ebx
jge 0x1002628
cmp edi, ebx
je 0x1005d8d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0xab8], ebx
mov dword [ebp - 0xacc], ebx
jge 0x100264b
jmp 0x1004317
cmp eax, ebx
mov dword [ebp - 0xab8], eax
jge 0x1002669
jmp 0x1004317
call fcn.0100379d
mov dword [ebp - 0xab8], eax
jmp 0x100433f
mov edi, eax
cmp edi, ebx
jne 0x10026a9
call fcn.0100379d
mov dword [ebp - 0xab8], eax
jmp 0x10026a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100434d
call fcn.0100379d
mov dword [ebp - 0xab8], eax
jmp 0x100434d
cmp dword [ebp - 0xab8], ebx
jge 0x1001345
jmp 0x1005e2a
call fcn.0100379d
mov dword [ebp - 0xab8], eax
jmp 0x1001359
call fcn.0100379d
mov dword [ebp - 0xab8], eax
jmp 0x1005e81
push 3
push 0x10075a0
lea ecx, [ebp - 0x60]
call fcn.0100e92b
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0xab4]
call fcn.0100a6bf
push dword [ebp - 0xab8]
lea ecx, [ebp - 0xab4]
call fcn.0100de21
push ebx
lea eax, [ebp - 0xab4]
push 0xc0000c1c
push eax
call fcn.0100a2d9
add esp, 0xc
lea ecx, [ebp - 0xab4]
call fcn.0100a7d2
lea ecx, [ebp - 0x60]
call fcn.0100e953
lea ecx, [ebp - 0xac8]
call fcn.010013a0
jmp 0x1001385
mov eax, dword [ebp + esi*4 - 0xae8]
cmp eax, ebx
je 0x1005e9f
push eax
call edi
inc esi
cmp esi, 2
jb 0x1005e91
mov eax, dword [ebp - 0xad0]
cmp eax, ebx
je 0x1005ed3
cmp dword [ebp - 0xacc], ebx
je 0x1005ed3
mov edx, dword [eax]
push ebx
push ebx
push ebx
xor ecx, ecx
push ecx
push eax
call dword [edx + 0x14]
test eax, eax
jl 0x1005ed3
push dword [ebp - 0xad0]
call dword [sym.imp.ole32.dll_CoReleaseMarshalData]
cmp dword [ebp - 0xadc], ebx
je 0x1005ee3
push dword [ebp - 0xadc]
call edi
cmp dword [ebp - 0xad4], ebx
je 0x1005ef3
push dword [ebp - 0xad4]
call edi
call sub.query.dll_void___stdcall_CIShutdown_void_
mov eax, dword [ebp - 0xabc]
cmp eax, ebx
je 0x1005f08
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xae0]
cmp ecx, ebx
je 0x1005f17
call fcn.0100a7fb
mov eax, dword [ebp - 0xad0]
cmp eax, ebx
je 0x1005f27
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 0x1005fc0
push esi
push dword [0x101555c]
push dword [0x1015558]
call dword [0x1015454]
test al, al
je 0x1005f67
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1005fa0
push esi
push dword [0x101555c]
push dword [0x1015558]
call fcn.0100a429
push dword [0x101555c]
push dword [0x1015558]
call dword [0x1015450]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xab8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010014d9
leave
ret