Function at 0x401d20
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0xd0c
push ebx
push esi
push str._nHandle_V1.3_n
mov ebx, pe_overlay
call fcn.004024b5
push str.Copyright__C__1997_2000_Mark_Russinovich_n
call fcn.004024b5
push str.Systems_Internals___http:__www.sysinternals.com_n_n
call fcn.004024b5
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
add esp, 0xc
call esi
cmp al, 4
sete al
mov byte [0x40c364], al
call esi
mov cl, byte [0x40c364]
cmp al, 5
sete al
test cl, cl
mov byte [0x40c365], al
jne 0x401d81
test al, al
jne 0x401d81
mov byte [0x409e33], 1
mov ecx, dword [esp + 0xd1c]
mov edx, dword [esp + 0xd18]
push ecx
push edx
call fcn.00401a70
add esp, 8
test al, al
jne 0x401dae
call fcn.00401a30
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xd0c
ret
lea eax, [esp + 0x410]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x410]
push str.NTHANDLE.SYS
push ecx
lea edx, [esp + 0x214]
push str._sSystem32Drivers_s
push edx
call fcn.00402463
lea eax, [esp + 0x21c]
push eax
push str.RCBIN
call fcn.004010f0
add esp, 0x18
test al, al
jne 0x401e11
push str.Initialization_error:_nMake_sure_that_you_are_an_administrator._n
call fcn.004024b5
add esp, 4
xor eax, eax
pop esi
pop ebx
add esp, 0xd0c
ret
lea ecx, [esp + 0x20c]
push 0x408180
push ecx
push str.NTHANDLE
call fcn.00401170
add esp, 0xc
test eax, eax
jne 0x401e57
push str.Error_loading_driver:_n
call fcn.004024b5
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401430
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0xd0c
ret
call fcn.00401bd0
test al, al
jne 0x401e79
push str.Incorrect_version_of_NT_n
call fcn.004024b5
add esp, 4
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0xd0c
ret
push edi
call fcn.00401540
mov edx, 0x408e50
lea edi, [edx - 0x120]
or ecx, 0xffffffff
xor eax, eax
add edx, 0x124
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, 0x4092e0
mov dword [edx - 0x124], ecx
jl 0x401e84
mov edx, 0x408c08
lea edi, [edx - 0x120]
or ecx, 0xffffffff
xor eax, eax
add edx, 0x124
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, 0x408e50
mov dword [edx - 0x124], ecx
jl 0x401ead
call fcn.00401740
call fcn.004018e0
mov eax, dword [0x40a100]
xor esi, esi
mov dword [esp + 0xc], esi
cmp dword [eax], esi
jbe 0x4022bf
push ebp
mov ax, word [esi + eax + 4]
cmp ax, bx
je 0x401ffe
lea edx, [esp + 0x114]
push 0x100
push edx
lea ecx, [esp + 0x320]
push 0x100
lea edx, [esp + 0x20]
push ecx
push edx
push eax
call fcn.004017b0
mov al, byte [0x409e31]
add esp, 0x18
test al, al
jne 0x401ff3
mov al, byte [0x409e32]
test al, al
je 0x401f65
mov edi, 0x40a000
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x14]
push ecx
push eax
push 0x40a000
call fcn.00406900
add esp, 0xc
test eax, eax
jne 0x401ff3
push 0x409444
call fcn.004024b5
mov cl, byte [esp + 0x118]
mov bl, byte [esp + 0x31c]
add esp, 4
test cl, cl
jne 0x401f91
test bl, bl
jne 0x401f91
xor al, al
mov edx, 0x409e34
jmp 0x401fac
test cl, cl
mov al, 1
mov edx, 0x409440
je 0x401fac
test bl, bl
je 0x401fac
mov ecx, 0x40943c
mov eax, 0x409438
jmp 0x401fc1
test al, al
mov ecx, 0x409e34
je 0x401fbc
mov eax, 0x409438
jmp 0x401fc1
mov eax, 0x409e34
push edx
lea edx, [esp + 0x31c]
push edx
push ecx
lea ecx, [esp + 0x120]
xor edx, edx
push ecx
push eax
mov eax, dword [0x40a100]
lea ecx, [esp + 0x28]
mov dx, word [esi + eax + 4]
push edx
push ecx
push str._s_pid:__d__s_s_s_s_s_n
call fcn.004024b5
add esp, 0x20
mov edx, dword [0x40a100]
mov bx, word [esi + edx + 4]
mov al, byte [0x409e32]
test al, al
je 0x402031
mov edi, 0x40a000
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x14]
push ecx
push eax
push 0x40a000
call fcn.00406900
add esp, 0xc
test eax, eax
jne 0x4022a3
mov ecx, dword [0x40a100]
mov dl, byte [0x40c364]
xor eax, eax
mov al, byte [esi + ecx + 8]
test dl, dl
je 0x402051
cmp eax, 0x17
je 0x402086
cmp eax, 0xf
je 0x402086
mov dl, byte [0x40c365]
test dl, dl
je 0x402065
cmp eax, 0x1a
je 0x402086
cmp eax, 0x11
je 0x402086
mov dl, byte [0x409e33]
test dl, dl
je 0x402079
cmp eax, 0x15
je 0x402086
cmp eax, 0xd
je 0x402086
mov al, byte [0x409e30]
test al, al
je 0x4022a3
mov byte [esp + 0x51c], 0
mov eax, dword [esi + ecx + 0xc]
lea edx, [esp + 0x51c]
push 0x800
push edx
push eax
call fcn.00401710
mov al, byte [0x409e30]
add esp, 0xc
test al, al
jne 0x4020c0
mov al, byte [esp + 0x51c]
test al, al
je 0x4022a3
mov al, byte [0x40c364]
test al, al
mov eax, dword [0x40a100]
je 0x4020d5
cmp byte [esi + eax + 8], 0x10
je 0x4020f7
mov cl, byte [0x40c365]
test cl, cl
je 0x4020e6
cmp byte [esi + eax + 8], 0x12
je 0x4020f7
mov cl, byte [0x409e33]
test cl, cl
je 0x402106
cmp byte [esi + eax + 8], 0xe
jne 0x402106
lea ecx, [esp + 0x51c]
push ecx
call fcn.00401940
jmp 0x402113
lea edx, [esp + 0x51c]
push edx
call fcn.00401660
mov al, byte [0x409e30]
add esp, 4
test al, al
jne 0x40213e
lea eax, [esp + 0x51c]
push 7
push eax
push str.Device
call fcn.00406900
add esp, 0xc
test eax, eax
je 0x4022a3
mov al, byte [0x409e31]
test al, al
je 0x40221f
mov edi, 0x40a120
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x51c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jb 0x4022a3
mov edi, 0x40a120
or ecx, 0xffffffff
xor ebp, ebp
mov edx, 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x51c]
sub edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
test edx, edx
jle 0x4022a3
mov edi, 0x40a120
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ebp + 0x51c]
push ecx
push 0x40a120
push eax
call fcn.00406900
add esp, 0xc
test eax, eax
jne 0x4021ee
mov edx, ebx
lea ecx, [esp + 0x51c]
and edx, 0xffff
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push str.__18s_pid:___6d__s_n
call fcn.004024b5
add esp, 0x10
mov edi, 0x40a120
or ecx, 0xffffffff
xor eax, eax
inc ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, 1
sub edx, ecx
lea edi, [esp + 0x51c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
cmp ebp, edx
jl 0x4021a2
jmp 0x4022a3
mov al, byte [0x40c364]
test al, al
je 0x402246
mov eax, dword [0x40a100]
xor edx, edx
lea ecx, [esp + 0x51c]
mov dl, byte [esi + eax + 8]
push ecx
shl edx, 5
add edx, 0x4084e4
jmp 0x40228d
mov al, byte [0x40c365]
test al, al
mov eax, dword [0x40a100]
je 0x402276
xor ecx, ecx
lea edx, [esp + 0x51c]
mov cl, byte [esi + eax + 8]
push edx
shl ecx, 5
add ecx, 0x408184
xor edx, edx
mov dx, word [esi + eax + 0xa]
push ecx
push edx
jmp 0x402296
xor edx, edx
lea ecx, [esp + 0x51c]
mov dl, byte [esi + eax + 8]
push ecx
shl edx, 5
add edx, 0x4087e4
xor ecx, ecx
push edx
mov cx, word [esi + eax + 0xa]
push ecx
push str.____4x:___13s__s_n
call fcn.004024b5
add esp, 0x10
mov eax, dword [0x40a100]
mov ecx, dword [esp + 0x10]
inc ecx
add esi, 0x10
mov edx, dword [eax]
mov dword [esp + 0x10], ecx
cmp ecx, edx
jb 0x401eef
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xd0c
ret