Function at 0x10031d60
Capabilities:
Check os version
Get file attributes
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20d4
call fcn.10001050
mov eax, dword [0x100ad00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x2090], ecx
mov dword [ebp - 0x2084], edx
mov dword [ebp - 0x2094], eax
mov dword [ebp - 0x2080], 0xffffffff
mov dword [ebp - 0x208c], 0xc0000365
mov dword [ebp - 0x2088], 0xffffffd5
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp ebx, 2
je 0x10031fac
mov edi, dword [0x100ae118]
test edi, edi
je 0x10031fac
lea eax, [ebp - 0x207c]
mov dword [ebp - 0x20ac], ecx
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20b0], 0x18
push eax
mov ecx, edi
mov dword [ebp - 0x20a4], 0x40
mov dword [ebp - 0x20a8], edx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call dword [section..rdata]
call edi
test eax, eax
js 0x10031f3b
test dword [ebp - 0x204c], 0x400
jne 0x10031fa0
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0x2050]
push 0
push 0x64
push dword [ebp - 0x2078]
mov dword [esi], eax
mov eax, dword [ebp - 0x205c]
push dword [ebp - 0x207c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2058]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.10068110
push 0
push 0x64
push dword [ebp - 0x2070]
add eax, 0xb3960000
push dword [ebp - 0x2074]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.10068110
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.10068110
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.10068110
mov edi, dword [ebp - 0x2094]
add eax, 0xb3960000
push 0
adc edx, 0x5e6684f4
mov dword [esi + 0x20], eax
push 0
push edi
mov dword [esi + 0x24], edx
call sym.IntelFirmwareInterfaceInstallHelper.dll_nocrt_strlen
add esp, 4
push eax
mov eax, dword [ebp - 0x204c]
and eax, 0x7fff
shl eax, 0x10
push edi
push eax
call fcn.100313c0
push ebx
push esi
push 0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
call fcn.10031930
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000024
je 0x10031f6b
cmp eax, 0xc0000033
je 0x10031f6b
cmp eax, 0xc000000d
je 0x10031f6b
cmp eax, 0xc0000022
je 0x10031fa0
cmp eax, 0xc0000043
je 0x10031fa0
push eax
call fcn.1000cb90
add esp, 4
mov edi, eax
jmp 0x10031f97
push eax
push 0x2078
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
lea eax, [ebp - 0x20b0]
push esi
push eax
call fcn.100319d0
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x10032751
cmp edi, 0x34
jne 0x1003274f
mov edx, dword [ebp - 0x2084]
mov ecx, dword [ebp - 0x2090]
mov eax, dword [0x100ad8f8]
mov edi, 0x4020
mov dword [ebp - 0x2098], eax
test eax, eax
je 0x10031fcb
test byte [ebp + 0x18], 2
jne 0x10031fcb
mov edi, 0x204020
push 0
push 0
push edi
push 1
push 7
push 0x80
push 0
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x20b0], 0x18
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20ac], ecx
push eax
push 0x100080
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x20a4], 0x40
push eax
mov dword [ebp - 0x20a8], edx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x1003203d
cmp eax, 0xc00000f7
jne 0x10032095
cmp dword [ebp - 0x2098], 0xffffffff
jne 0x10032095
test edi, 0x200000
je 0x10032095
push 0
push 0
and edi, 0xffdfffff
lea eax, [ebp - 0x208c]
push edi
push 1
push 7
push 0x80
push 0
push eax
lea eax, [ebp - 0x20b0]
push eax
push 0x100080
lea eax, [ebp - 0x2080]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
cmp eax, 0xc000000d
je 0x10032095
mov dword [0x100ad8f8], 0
test eax, eax
js 0x10032382
push 0x23
push 8
lea eax, [ebp - 0x20bc]
push eax
lea eax, [ebp - 0x208c]
push eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x100320d1
xor edi, edi
xor eax, eax
mov dword [ebp - 0x20b8], edi
mov dword [ebp - 0x20bc], eax
jmp 0x100320dd
mov edi, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x20bc]
test eax, 0x400
je 0x10032175
cmp edi, 0xa000000c
je 0x10032175
mov eax, dword [ebp + 0x18]
test al, 2
jne 0x10032175
push 0
push 0
push 0x4020
push 1
push 7
push 0x80
push 0
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x208c], 0xc0000365
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x2088], 0xffffffd5
push eax
push 0x100080
lea eax, [ebp - 0x20b4]
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x1003216f
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0x20b4]
xor edi, edi
mov dword [ebp - 0x2080], eax
mov dword [ebp - 0x20b8], edi
mov dword [ebp - 0x20bc], edi
jmp 0x1003217b
mov edi, dword [ebp - 0x20b8]
mov eax, dword [ebp - 0x2080]
push 0x12
push 0x68
lea ecx, [ebp - 0x207c]
mov dword [ebp - 0x2098], eax
push ecx
lea ecx, [ebp - 0x20c4]
mov dword [ebp - 0x20c4], 0xc0000365
push ecx
push eax
mov dword [ebp - 0x20c0], 0xffffffd5
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x100321c7
cmp eax, 0x80000005
je 0x100321c7
push eax
call fcn.1000cb90
add esp, 4
jmp 0x10032359
mov eax, dword [ebp - 0x204c]
mov ecx, dword [ebp - 0x2048]
push 0
push 0x64
push dword [ebp - 0x2078]
mov dword [esi], eax
mov eax, dword [ebp - 0x2054]
push dword [ebp - 0x207c]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2050]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.10068110
push 0
push 0x64
push dword [ebp - 0x2070]
add eax, 0xb3960000
push dword [ebp - 0x2074]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.10068110
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.10068110
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.10068110
add eax, 0xb3960000
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x2094]
adc edx, 0x5e6684f4
mov dword [esi + 0x24], edx
test eax, eax
je 0x10032297
push eax
call sym.IntelFirmwareInterfaceInstallHelper.dll_nocrt_strlen
add esp, 4
jmp 0x10032299
xor eax, eax
push 0
push edi
push eax
mov eax, dword [ebp - 0x205c]
push dword [ebp - 0x2094]
and eax, 0x7fff
shl eax, 0x10
push eax
call fcn.100313c0
add esp, 0x14
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
cmp ebx, 2
jne 0x1003234d
mov eax, dword [ebp - 0x2044]
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
cmp eax, 1
ja 0x100322e7
mov eax, 1
mov ecx, dword [ebp - 0x2038]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0x203c]
push 1
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x207c]
push 0x800
push eax
lea eax, [ebp - 0x20c4]
mov dword [esi + 0x44], 0
push eax
push dword [ebp - 0x2098]
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
jns 0x10032344
cmp eax, 0x80000005
jne 0x1003234d
mov eax, dword [ebp - 0x2074]
mov dword [esi + 0x44], eax
push ebx
push esi
push 0
call fcn.10031930
add esp, 0xc
push dword [ebp - 0x2080]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x100323f6
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000024
je 0x100323c1
cmp eax, 0xc0000033
je 0x100323c1
cmp eax, 0xc0000022
je 0x100323ab
cmp eax, 0xc0000043
je 0x100323ab
push eax
call fcn.1000cb90
add esp, 4
mov edi, eax
jmp 0x100323ed
mov dword [ebp - 0x208c], 0xc0000365
mov dword [ebp - 0x2088], 0xffffffd5
jmp 0x100323f6
push eax
push 0x2078
lea eax, [ebp - 0x207c]
push eax
mov eax, dword [ebp + 0x18]
push eax
push ebx
lea eax, [ebp - 0x20b0]
push esi
push eax
call fcn.100319d0
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x1003274f
cmp edi, 0x34
jne 0x1003274f
push 0
lea eax, [ebp - 0x20d4]
push eax
lea eax, [ebp - 0x20cc]
push eax
push dword [ebp - 0x2084]
call fcn.10031860
add esp, 0x10
mov edi, dword [ebp - 0x2090]
lea eax, [ebp - 0x20cc]
mov dword [ebp - 0x20b0], 0x18
mov dword [ebp - 0x20a8], eax
lea eax, [ebp - 0x208c]
mov dword [ebp - 0x20ac], edi
push 0
push 0
push 0x4021
push 1
push 7
push 0x80
push 0
push eax
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20a4], 0x40
push eax
push 0x100001
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x20a0], 0
push eax
mov dword [ebp - 0x209c], 0
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 0x20b4], eax
test eax, eax
js 0x100326cd
mov eax, dword fs:[0x30]
xor edx, edx
mov ecx, dword [eax + 0xa4]
mov eax, dword fs:[0x30]
or edx, dword [eax + 0xa8]
cmp ecx, 5
jb 0x100324c2
ja 0x100324bb
test edx, edx
je 0x100324c2
mov edi, 0x25
jmp 0x100324c7
mov edi, 3
push 0
lea eax, [ebp - 0x20d4]
push eax
push 1
push edi
push 0x2078
lea eax, [ebp - 0x207c]
push eax
lea eax, [ebp - 0x208c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
js 0x100326a3
mov eax, dword [ebp - 0x2054]
mov ecx, dword [ebp - 0x2050]
push 0
push 0x64
push dword [ebp - 0x2070]
mov dword [esi], eax
mov eax, dword [ebp - 0x204c]
push dword [ebp - 0x2074]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x2048]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
call fcn.10068110
push 0
push 0x64
push dword [ebp - 0x2068]
add eax, 0xb3960000
push dword [ebp - 0x206c]
adc edx, 0x5e6684f4
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edx
call fcn.10068110
push 0
push 0x64
push dword [ebp - 0x2060]
add eax, 0xb3960000
push dword [ebp - 0x2064]
adc edx, 0x5e6684f4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.10068110
push 0
push 0x64
push dword [ebp - 0x2058]
add eax, 0xb3960000
push dword [ebp - 0x205c]
adc edx, 0x5e6684f4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
call fcn.10068110
push 0
push dword [ebp - 0x203c]
add eax, 0xb3960000
push dword [ebp - 0x2094]
adc edx, 0x5e6684f4
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
call sym.IntelFirmwareInterfaceInstallHelper.dll_nocrt_strlen
add esp, 4
push eax
mov eax, dword [ebp - 0x2044]
push dword [ebp - 0x2094]
and eax, 0x7fff
shl eax, 0x10
push eax
call fcn.100313c0
add esp, 0x14
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
cmp ebx, 2
jne 0x10032676
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 1
mov dword [esi + 0x44], 0
cmp edi, 0x25
jne 0x10032629
mov eax, dword [ebp - 0x201c]
mov ecx, dword [ebp - 0x2018]
jmp 0x1003262d
xor eax, eax
xor ecx, ecx
push 1
mov dword [esi + 0x48], eax
lea eax, [ebp - 0x207c]
push 0x800
push eax
lea eax, [ebp - 0x208c]
mov dword [esi + 0x4c], ecx
push eax
push dword [ebp - 0x2080]
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
call dword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x10032676
mov eax, dword [ebp - 0x2074]
mov dword [esi + 0x44], eax
push ebx
push esi
push 0
call fcn.10031930
add esp, 0xc
mov edi, eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
push eax
call fcn.1000cb90
add esp, 4
mov edi, eax
push dword [ebp - 0x2080]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001210
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000033
je 0x100326de
cmp eax, 0xc0000024
je 0x100326de
push eax
jmp 0x10032745
mov ecx, dword [ebp - 0x2084]
push eax
push 0x2078
lea eax, [ebp - 0x207c]
mov dword [ebp - 0x20b0], 0x18
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x20ac], edi
push ebx
push esi
push eax
mov dword [ebp - 0x20a4], 0x40
mov dword [ebp - 0x20a8], ecx
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x209c], 0
call fcn.100319d0
mov edi, eax
add esp, 0x1c
test edi, edi
jns 0x1003274f
push dword [ebp - 0x20b4]
call fcn.1000cb90
mov edi, eax
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001210
mov esp, ebp
pop ebp
ret