Function at 0x40e5b0
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
sub esp, 0x2a8
mov eax, dword [0x4efd34]
xor eax, esp
mov dword [esp + 0x2a4], eax
push esi
push edi
mov esi, ecx
call fcn.00407e80
push 0x9c
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00497ff0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x20]
sub eax, 1
push 0x4f1718
push 0x200
je 0x40e60f
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40e615
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [esi + 0xb8]
mov dword [edx + 0xd78], 0x6a
mov eax, dword [esi + 0xb8]
mov dword [eax + 0xd7c], 0x6b
mov ecx, dword [esi + 0xb8]
mov dword [ecx + 0xd80], 0x6c
mov edx, dword [esi + 0xb8]
push 1
lea eax, [esp + 0xc]
push eax
mov dword [edx + 0xd84], 0x6d
mov ecx, dword [esi + 0xb8]
push 0x4f1718
call fcn.00422110
test eax, eax
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
jne 0x40e727
cmp dword [esi + 0xe4], 0
jne 0x40e79e
mov eax, dword [esp + 8]
push eax
push eax
push str.The_error_code_0x_X___d__occurred_when_opening_the_driver._nDo_you_want_to_display_the_error_log_file__
lea ecx, [esp + 0xb8]
push 0x200
push ecx
call fcn.0049806a
add esp, 0x14
push 0x34
push str.CPU_Z_Driver_Error
lea edx, [esp + 0xb4]
push edx
push 0
call edi
cmp eax, 6
jne 0x40e79e
mov eax, dword [esi + 0xb8]
push 1
push 0
push 0
add eax, 0xb70
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x40e79e
mov ecx, dword [esi + 0xb8]
add ecx, 0xb70
push ecx
push str.Unable_to_open__s
lea edx, [esp + 0xb4]
push 0x200
push edx
call fcn.0049806a
add esp, 0x10
push 0x34
push str.CPU_Z_Driver_Error
lea eax, [esp + 0xb4]
push eax
push 0
call edi
jmp 0x40e79e
push 0x7d0
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0xb8]
call fcn.00421e90
test eax, eax
je 0x40e79e
mov ecx, dword [esi + 0xb8]
lea edx, [ecx + 0xd70]
push edx
call fcn.004223e0
mov ecx, dword [esi + 0xb8]
cmp dword [ecx + 0xd70], 0x132
je 0x40e799
push 0x30
push str.Driver_Error
push str.A_previous_version_of_the_device_driver_is_already_running._This_program_requires_version_1.32.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esi + 0xb8]
call fcn.00421f60
mov ecx, dword [esi + 0xb8]
push 1
push 1
push 1
call fcn.00421df0
jmp 0x40e89e
call fcn.00421f60
mov ecx, esi
call fcn.00408080
cmp dword [esi + 0xe4], 0
je case.default.0x40e7c4
mov eax, dword [esi + 0xe8]
add eax, 0xffffffff
cmp eax, 3
ja case.default.0x40e7c4
jmp dword [eax*4 + 0x40e8dc]
push 0x4b6804
push 0x4f1918
push 0x4f1a1c
call fcn.0049798f
add esp, 0xc
cmp dword [0x4f1a1c], 0
je case.default.0x40e7c4
mov ecx, esi
call fcn.00408620
mov eax, dword [0x4f1a1c]
push eax
call fcn.0049784f
add esp, 4
jmp case.default.0x40e7c4
push 0x4b6804
push 0x4f1918
push 0x4f1a1c
call fcn.0049798f
add esp, 0xc
cmp dword [0x4f1a1c], 0
je case.default.0x40e7c4
mov ecx, esi
call fcn.0040a470
mov ecx, dword [0x4f1a1c]
push ecx
call fcn.0049784f
add esp, 4
jmp case.default.0x40e7c4
mov ecx, esi
call fcn.00408c50
jmp case.default.0x40e7c4
mov ecx, dword [esi + 0xb8]
push 0x7d0
lea edx, [esp + 0xc]
push edx
call fcn.00421e90
test eax, eax
je case.default.0x40e7c4
mov ecx, dword [esi + 0xbc]
push 0
call fcn.0043cc90
mov ecx, dword [esi + 0xac]
push ecx
mov ecx, eax
call fcn.0043a910
mov ecx, dword [esi + 0xb8]
call fcn.00421f60
push 0x30
push 0x4b8e04
push str.Core_mask_set__please_restart_Windows_to_validate.
push 0
call edi
call fcn.00407e80
mov eax, dword [0x4f1a24]
test eax, eax
pop edi
pop esi
je 0x40e8c5
cmp dword [0x4f1a2c], 0
je 0x40e8c5
mov edx, dword [eax + 0x20]
push 0
push 0
push 0x41f
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x2a4]
xor ecx, esp
call fcn.004972eb
add esp, 0x2a8
ret