Function at 0x426b60
Capabilities:
Check os version
Create thread
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5878d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x5e6990]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push esi
push edi
mov eax, dword [0x5e6990]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call fcn.00465f11
mov eax, dword [esi + 0x20]
push 0
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.00471b12
mov ebx, eax
test ebx, ebx
je 0x426c66
call fcn.0045c778
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x426be1
push 0x80004005
call fcn.00402e90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x10], edi
push 0x65
mov dword [esp + 0xdc], 0
call fcn.0045daf0
test eax, eax
je 0x426c17
push 0x65
push eax
lea ecx, [esp + 0x18]
call fcn.004025b0
mov edi, dword [esp + 0x10]
cmp dword [edi - 0xc], 0
je 0x426c3f
mov ecx, dword [ebx + 4]
push 0
push 0
push 0x800
push ecx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov edx, dword [ebx + 4]
push edi
push 0x10
push 0
push edx
call dword [sym.imp.USER32.dll_AppendMenuA]
lea eax, [edi - 0x10]
mov dword [esp + 0xd8], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426c66
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x874]
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov ebx, 1
push ebx
push 0x80
push ecx
call edi
mov eax, dword [esi + 0x874]
mov edx, dword [esi + 0x20]
push eax
push 0
push 0x80
push edx
call edi
call dword [sym.imp.SkinH.dll_SkinH_Attach]
push 0x90
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x38], 0x94
call fcn.0055e260
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x30], 5
jne 0x426cda
cmp dword [esp + 0x34], ebx
jne 0x426cda
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x426ce3
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
movzx eax, ax
and eax, 0x3ff
mov edx, 9
lea edi, [esi + 0x358]
cmp dx, ax
jne 0x426d05
mov ecx, 2
mov dword [0x5efd3c], ecx
jmp 0x426d0d
mov dword [0x5efd3c], ebx
xor ecx, ecx
call fcn.00425dc0
mov ecx, esi
call fcn.0042d830
mov eax, dword [esi + 0x20]
push 0
push 0x3e8
push ebx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [esi]
mov eax, dword [edx + 0x6c]
mov ecx, esi
call eax
mov dword [esi + 0x190], eax
mov dword [esp + 0x18], vtable.CMenu.0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xd8], ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [esp + 0x1c]
call fcn.00471b47
mov ebx, 0x5baa00
call fcn.00407dc0
push eax
call dword [sym.imp.LanguageLib.dll_Ordinal_1]
add esp, 4
xor edi, edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x426dc8
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
jle 0x426dc8
lea eax, [ebx + 1]
push eax
call fcn.0045c711
mov edi, eax
add esp, 4
lea eax, [ebx + 1]
push eax
push 0
push edi
call fcn.0055e260
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x190]
mov eax, dword [eax + 4]
push edi
push edx
push 0x410
push 3
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
mov ecx, dword [esp + 0x1c]
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
push 0x5baa08
push 0x8033
push 0
push ecx
call edi
mov edx, dword [esp + 0x1c]
push str.English
push 0x8034
push 0
push edx
call edi
lea ecx, [esp + 0x18]
call fcn.00471b75
mov eax, dword [esi + 0x898]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push str.USART
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0x898]
push str.USB_DFU_
push 0
push 0x143
push ecx
call ebx
mov edx, dword [esi + 0x898]
push str.SWD_J_Link_
push 0
push 0x143
push edx
call ebx
mov eax, dword [esi + 0x898]
push str.HID_NS_Link_
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0x898]
push 0
push 0
push 0x14e
push ecx
call ebx
mov edx, dword [esi + 0x90c]
push str.2400
push 0
push 0x143
push edx
call ebx
mov eax, dword [esi + 0x90c]
push str.4800
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0x90c]
push str.9600
push 0
push 0x143
push ecx
call ebx
mov edx, dword [esi + 0x90c]
push str.14400
push 0
push 0x143
push edx
call ebx
push str.19200
push 0
mov eax, dword [esi + 0x90c]
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0x90c]
push str.38400
push 0
push 0x143
push ecx
call ebx
mov edx, dword [esi + 0x90c]
push str.57600
push 0
push 0x143
push edx
call ebx
mov eax, dword [esi + 0x90c]
push str.115200
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0x90c]
push str.128000
push 0
push 0x143
push ecx
call ebx
mov edx, dword [esi + 0x90c]
push str.256000
push 0
push 0x143
push edx
call ebx
mov eax, dword [esi + 0x90c]
push str.576000
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0x90c]
push str.921600
push 0
push 0x143
push ecx
call ebx
mov edx, dword [esi + 0x90c]
push str.923076
push 0
push 0x143
push edx
call ebx
mov eax, dword [esi + 0x90c]
push str.1000000
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0x90c]
push str.1500000
push 0
push 0x143
push ecx
call ebx
mov edx, dword [esi + 0x90c]
push str.2000000
push 0
push 0x143
push edx
call ebx
mov eax, dword [esi + 0x90c]
push str.2250000
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0x90c]
push str.2500000
push 0
push 0x143
push ecx
call ebx
mov edx, dword [esi + 0x90c]
push str.3000000
push 0
push 0x143
push edx
call ebx
mov eax, dword [esi + 0x90c]
push str.4000000
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0x90c]
push str.4500000
push 0
push 0x143
push ecx
call ebx
mov edx, dword [esi + 0x90c]
push 0
push 7
push 0x14e
push edx
call ebx
mov eax, dword [esi + 0xb54]
push str.56781
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0xb54]
push 0x5baa50
push 0
push 0x143
push ecx
call ebx
mov edx, dword [esi + 0xb54]
push 0x5baa54
push 0
push 0x143
push edx
call ebx
mov eax, dword [esi + 0xb54]
push 0x5baa58
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0xb54]
push 0
push 3
push 0x14e
push ecx
call ebx
push 0
lea ecx, [esi + 0xb34]
call fcn.004645c5
mov edx, dword [esi + 0xbc8]
push 0x5baa5c
push 0
push 0x143
push edx
call ebx
mov eax, dword [esi + 0xbc8]
push 0x5baa60
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esi + 0xbc8]
push 0x5baa64
push 0
push 0x143
push ecx
call ebx
mov edx, dword [esi + 0xbc8]
push 0
push 0
push 0x14e
push edx
call ebx
push 0
lea ecx, [esi + 0xba8]
call fcn.004645c5
lea esi, [esp + 0x10]
call fcn.00406330
mov byte [esp + 0xd8], 2
mov edi, dword [esp + 0x14]
lea esi, [edi + 0x870]
push eax
mov ecx, esi
call fcn.00402920
mov byte [esp + 0xd8], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42716d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.SysConfig.ini
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.0040b980
add esp, 0xc
lea ecx, [edi + 0x85c]
push eax
mov byte [esp + 0xdc], 3
call fcn.00402920
mov byte [esp + 0xd8], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4271bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Series_CFG_Table.ini
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.0040b980
add esp, 0xc
lea ecx, [edi + 0x864]
push eax
mov byte [esp + 0xdc], 4
call fcn.00402920
mov byte [esp + 0xd8], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42720b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, edi
call fcn.004277a0
mov ecx, edi
call fcn.00427840
call fcn.0045c778
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x427233
push 0x80004005
call fcn.00402e90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0xd8], 5
call fcn.0045c778
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x427265
push 0x80004005
call fcn.00402e90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0xd8], 6
xor eax, eax
lea esi, [edi + 0xfc]
inc eax
push eax
lea ecx, [esp + 0x14]
push str.user_d_id
push ecx
mov dword [esp + 0x2c], eax
call fcn.00403be0
mov eax, dword [edi + 0x85c]
mov edx, dword [esp + 0x1c]
add esp, 0xc
push eax
push 0xff
push edx
push str.dlparam
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
lea ecx, [esp + 0x14]
cmp ecx, eax
jae 0x427331
mov ebx, dword [esi]
mov edx, ecx
cmp ebx, edx
ja 0x427331
mov ecx, dword [esi + 8]
sub edx, ebx
sar edx, 2
mov dword [esp + 0x24], edx
cmp eax, ecx
jne 0x42731f
sub eax, ebx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x42741d
sub ecx, ebx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x42731f
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x42730d
xor ecx, ecx
jmp 0x42730f
add ecx, edx
cmp ecx, eax
jae 0x427315
mov ecx, eax
push ecx
call fcn.00435890
mov edx, dword [esp + 0x24]
mov eax, dword [esi]
lea edx, [eax + edx*4]
mov eax, dword [esi + 4]
test eax, eax
je 0x427382
mov ecx, dword [edx]
mov dword [eax], ecx
jmp 0x427382
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x427375
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x42741d
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x427375
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x427367
xor ecx, ecx
jmp 0x427369
add ecx, edx
cmp ecx, eax
jae 0x42736f
mov ecx, eax
push ecx
call fcn.00435890
mov eax, dword [esi + 4]
test eax, eax
je 0x427382
mov edx, dword [esp + 0x14]
mov dword [eax], edx
mov eax, dword [esp + 0x20]
add dword [esi + 4], 4
cmp eax, 3
jl 0x427285
mov ecx, edi
call fcn.00434f80
call fcn.0046e2ee
mov eax, dword [eax + 4]
mov edx, dword [eax]
mov edx, dword [edx + 0x84]
push 0x5b6d1b
push str.UCID
push str.Settings
lea ecx, [esp + 0x30]
push ecx
mov ecx, eax
call edx
mov byte [esp + 0xd8], 7
mov ecx, dword [eax]
mov esi, dword [edi + 0x390]
lea eax, [ecx - 0x10]
sub esi, 0x10
cmp eax, esi
je 0x427437
cmp dword [esi + 0xc], 0
jl 0x427427
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x427427
push eax
call fcn.00402b00
mov dword [esp + 0x24], eax
add esp, 4
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42740e
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x20]
add ecx, 0x10
mov dword [edi + 0x390], ecx
jmp 0x427437
push str.vector_T__too_long
call fcn.00574e94
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [edi + 0x390]
call fcn.00402d70
mov byte [esp + 0xd8], 6
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42745f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor esi, esi
push esi
push 4
push edi
push 0x42cc30
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x9c], eax
push esi
push 1
mov dword [edi + 0x3d4], esi
mov dword [edi + 0x3e0], esi
mov dword [edi + 0x3d8], esi
mov dword [edi + 0x3e4], esi
mov dword [edi + 0x3dc], esi
mov dword [edi + 0x3e8], esi
mov ecx, dword [edi + 0xd98]
push 0xf1
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push str.screen
push esi
push esi
mov dword [edi + 0x94], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x5f008c], eax
mov byte [esp + 0xd8], 5
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [edi + 0xa8], esi
mov dword [edi + 0xc0], esi
mov dword [edi + 0xd8], esi
mov dword [edi + 0x350], esi
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x427509
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xd8], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427531
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xd8], 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], vtable.CMenu.0
call fcn.00471ba1
mov eax, 1
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.0055a74e
mov esp, ebp
pop ebp
ret