Function at 0x101dff4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xbc
push ebx
push esi
push edi
mov ebx, ecx
push 0x25
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x6c], esi
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x70], esi
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x5c], esi
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x64], esi
mov dword [ebp + 0x50], esi
mov dword [ebp - 0x44], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x40], 4
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
ja 0x101e0b9
lea eax, [ebp + 0x6c]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call fcn.0101ca6d
test eax, eax
jne 0x101e0e3
lea eax, [ebp + 0x68]
push eax
push esi
push esi
push esi
mov ebx, str.CachePrimaryDomain
push ebx
push dword [ebp + 0x6c]
call fcn.0101cad1
test eax, eax
jne 0x101e0e3
mov eax, dword [ebp + 0x68]
cmp eax, esi
jbe 0x101e0e3
lea eax, [eax + eax + 2]
push eax
push 0x40
call edi
cmp eax, esi
mov dword [ebp + 0x5c], eax
je 0x101e357
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x5c]
push esi
push esi
push ebx
push dword [ebp + 0x6c]
call fcn.0101cad1
test eax, eax
jne 0x101e0e3
mov eax, dword [ebp + 0x5c]
cmp word [eax], si
je 0x101e0e3
jmp 0x101e0e0
mov eax, dword [ebx + 0x64]
cmp eax, esi
je 0x101e34e
lea ecx, [ebp + 0x74]
push ecx
push 0x80000000
push esi
push esi
push esi
push esi
mov dword [ebp + 0x74], esi
call eax
test eax, eax
jne 0x101e0e3
mov eax, dword [ebp + 0x74]
mov eax, dword [eax + 0x1c]
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0x60]
cmp eax, esi
je 0x101e14b
lea ecx, [ebp + 0x74]
push ecx
push 0x64
push esi
mov dword [ebp + 0x74], esi
call eax
test eax, eax
jne 0x101e14b
mov eax, dword [ebp + 0x74]
cmp eax, esi
je 0x101e14b
mov ebx, dword [eax + 8]
cmp ebx, esi
je 0x101e114
push ebx
call fcn.01012925
pop ecx
jmp 0x101e116
xor eax, eax
cmp eax, esi
je 0x101e13c
lea eax, [eax + eax + 2]
push eax
push 0x40
call edi
cmp eax, esi
mov dword [ebp + 0x58], eax
je 0x101e357
push ebx
mov ebx, eax
push ebx
call fcn.010124dc
pop ecx
pop ecx
mov dword [ebp + 0x64], ebx
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0x54]
cmp eax, esi
je 0x101e14b
push dword [ebp + 0x74]
call eax
mov eax, dword [ebp + 0x5c]
cmp eax, esi
je 0x101e172
cmp word [eax], si
je 0x101e172
cmp dword [ebp + 0x58], esi
je 0x101e172
push dword [ebp + 0x58]
push eax
call fcn.010125b2
test eax, eax
pop ecx
pop ecx
jne 0x101e172
mov dword [ebp + 0x50], 1
cmp dword [ebp + 0x64], esi
je 0x101e185
push dword [ebp + 0x64]
call fcn.01012925
pop ecx
mov dword [ebp + 0x68], eax
jmp 0x101e188
mov dword [ebp + 0x68], esi
cmp dword [ebp + 0x68], esi
jbe 0x101e357
cmp dword [ebp + 0x50], esi
je 0x101e27e
cmp dword [ebp + 0x6c], esi
je 0x101e27e
cmp dword [ebp - 0x40], 4
jae 0x101e213
lea eax, [ebp + 0x70]
push eax
push esi
push esi
push esi
push str.CacheTrustedDomains
push dword [ebp + 0x6c]
call fcn.0101cad1
test eax, eax
jne 0x101e357
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x70]
add ecx, eax
lea eax, [ecx + ecx + 4]
push eax
push 0x40
call edi
cmp eax, esi
mov dword [ebp + 0x60], eax
je 0x101e357
push dword [ebp + 0x64]
mov edi, eax
push edi
call fcn.010124dc
push edi
call fcn.01012925
lea eax, [edi + eax*2 + 2]
add esp, 0xc
mov word [eax], si
jmp 0x101e209
cmp word [eax], 0x2c
jne 0x101e207
mov word [eax], si
inc eax
inc eax
cmp word [eax], si
jne 0x101e1fe
jmp 0x101e357
jne 0x101e27e
lea eax, [ebp + 0x70]
push eax
push esi
push esi
push esi
mov ebx, str.DCache
push ebx
push dword [ebp + 0x6c]
call fcn.0101cad1
test eax, eax
jne 0x101e357
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x70]
add ecx, eax
lea eax, [ecx + ecx + 4]
push eax
push 0x40
call edi
cmp eax, esi
mov dword [ebp + 0x60], eax
je 0x101e357
push dword [ebp + 0x64]
mov edi, eax
push edi
call fcn.010124dc
push edi
call fcn.01012925
add esp, 0xc
lea ecx, [ebp + 0x70]
push ecx
lea eax, [edi + eax*2 + 2]
push eax
push esi
push esi
push ebx
mov word [eax], si
push dword [ebp + 0x6c]
call fcn.0101cad1
jmp 0x101e357
cmp dword [ebp - 0x40], 5
jb 0x101e357
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0x68]
cmp eax, esi
mov dword [ebp + 0x74], esi
je 0x101e357
lea ecx, [ebp + 0x74]
push ecx
push esi
mov dword [ebp + 0x70], esi
xor ebx, ebx
call eax
test eax, eax
jne 0x101e2db
mov ebx, dword [ebp + 0x74]
jmp 0x101e2d0
movzx eax, ax
inc eax
je 0x101e2d8
push ebx
call fcn.01012925
mov ecx, dword [ebp + 0x70]
lea eax, [ecx + eax + 1]
push ebx
mov dword [ebp + 0x70], eax
call fcn.01012925
pop ecx
pop ecx
lea ebx, [ebx + eax*2 + 2]
mov ax, word [ebx]
cmp ax, si
jne 0x101e2ae
mov ebx, dword [ebp + 0x74]
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x68]
add eax, ecx
lea eax, [eax + eax + 4]
push eax
push 0x40
call edi
cmp eax, esi
mov dword [ebp + 0x60], eax
je 0x101e357
push dword [ebp + 0x64]
mov edi, eax
push edi
call fcn.010124dc
push edi
call fcn.01012925
lea edi, [edi + eax*2 + 2]
add esp, 0xc
mov word [edi], si
cmp dword [ebp + 0x70], esi
je 0x101e357
jmp 0x101e33c
movzx eax, ax
inc eax
je 0x101e344
push ebx
push edi
call fcn.0101c144
push edi
call fcn.01012925
lea edi, [edi + eax*2]
mov word [edi], si
inc edi
push ebx
inc edi
call fcn.01012925
pop ecx
pop ecx
lea ebx, [ebx + eax*2 + 2]
mov ax, word [ebx]
cmp ax, si
jne 0x101e315
mov eax, dword [ebp + 0x54]
mov eax, dword [eax + 0x54]
cmp eax, esi
jne 0x101e352
xor eax, eax
jmp 0x101e382
push dword [ebp + 0x74]
call eax
cmp dword [ebp + 0x6c], esi
je 0x101e365
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x5c], esi
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x101e375
push dword [ebp + 0x5c]
call edi
cmp dword [ebp + 0x58], esi
je 0x101e37f
push dword [ebp + 0x58]
call edi
mov eax, dword [ebp + 0x60]
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret