Function at 0x1004784c
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
push esi
imul esi, dword [edx + 0x74], 0x4d6c6175
insd dword es:[edi], dx
outsd dx, dword [esi]
jb 0x100478b0
add byte [esi + 0x74], cl
inc esi
jb 0x100478a2
push esi
imul esi, dword [edx + 0x74], 0x4d6c6175
insd dword es:[edi], dx
outsd dx, dword [esi]
jb 0x100478c4
add byte [esi + 0x74], cl
dec edi
jo 0x100478b6
outsb dx, byte [esi]
push esp
push 0x64616572
add byte [esi + 0x74], cl
push esp
jb 0x100478cc
imul ebp, dword [esi + 0x61], 0x68546574
jb 0x100478cd
popal
add byte fs:[edi], cl
xchg esp, eax
add byte [ebx + 0x55], dl
push esi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x10047995
push eax
or byte [0x100463ad], 0xff
mov byte [0x10047ab0], 0x77
push 0x10047752
call ebx
test eax, eax
je 0x10047994
mov edi, eax
push 0x10047820
push edi
call esi
adc byte [edi - 1], dl
salc
mov dword [0x10048198], eax
push 0x100476dc
push edi
call esi
add dword [eax + edx], 0x476dc68
adc byte [edi - 1], dl
salc
mov dword [0x100485a0], eax
add al, 0x10
push 0x10047604
push edi
call esi
salc
mov dword [0x1004822a], eax
push 0x1004770a
push edi
call esi
mov dword [0x10048565], eax
push ebx
push 0x10047838
push edi
call esi
mov dword [0x100481d8], eax
mov ebx, 0x77f00000
mov ebp, 0x78000000
cmp eax, ebx
jb 0x1004791d
cmp eax, ebp
jae 0x1004791d
mov byte [0x100477e6], 0xcc
mov dword [0x100477ed], 0x50fc478d
mov byte [0x100477f1], 0x6a
mov dword [0x10047808], eax
push 0x100476f4
push edi
call esi
cmp eax, ebx
jb 0x1004795a
cmp eax, ebp
jae 0x1004795a
mov dword [0x10048715], eax
push 0x10047723
push edi
call esi
test eax, eax
mov dword [0x10047820], eax
je 0x1004795a
push 0x1004784c
push edi
call esi
test eax, eax
mov dword [fcn.10047824], eax
je 0x1004795a
inc byte [0x10047c12]
push 0x10047859
push edi
call esi
cmp eax, ebx
jb 0x10047986
cmp eax, ebp
jae 0x10047986
mov dword [0x10047761], eax
push 0x10047620
push edi
call esi
test eax, eax
mov dword [0x10047828], eax
je 0x10047986
inc byte [0x10047c13]
push 0x1004773c
push edi
call esi
mov dword [0x10048458], eax
pop ebx
pop eax
sub edx, edx
push eax
mov ebp, 0x10047b3e
mov dword [0x1004782c], eax
test eax, eax
jns 0x10047a08
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword fs:[0x30]
xor eax, ecx
mov edx, dword [ecx + 0x54]
mov dword [0x100486f1], eax
cmp byte [ecx], 6
jae 0x100479dd
mov al, 0x80
dec byte [0x100482bb]
add byte [0x1004854b], 8
add byte [0x10048271], al
add byte [0x100486d4], al
mov eax, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call ebp
sub eax, 0xe7
push 0x59
pop ecx
cmp byte [eax], 0x83
jne 0x100479fa
cmp dword [eax - 0xa], 0xfffff000
je 0x10047a00
dec eax
dec ecx
jne 0x100479ec
jmp 0x10047a08
add eax, dword [eax - 4]
mov dword [0x1004868f], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualQuery]
call ebp
mov dword [0x10047604], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call ebp
mov dword [0x10047608], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call ebp
mov dword [0x1004760c], eax
mov eax, esi
call ebp
mov dword [0x10047610], eax
mov dword [0x100476e4], eax
mov eax, ebx
call ebp
mov dword [0x10047614], eax
mov dword [0x100476dc], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebp
mov dword [0x1004762c], eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
call ebp
mov dword [0x10047620], eax
mov eax, dword [sym.imp.KERNEL32.dll_BaseThreadInitThunk]
call ebp
mov dword [fcn.10047630], eax
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call ebp
mov dword [0x100476e0], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalAlloc]
call ebp
mov dword [0x10047618], eax
mov eax, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call ebp
mov dword [0x10047628], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call ebp
mov dword [0x1004761c], eax
cmp dword [0x10047808], 0
jne 0x10047ac4
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call ebp
mov ecx, 0xbfe40000
cmp eax, ecx
jb 0x10047ac4
add ecx, 0x200000
cmp eax, ecx
jae 0x10047ac4
mov dword [0x10047808], eax
pop eax
test eax, eax
js 0x10047b0c
cmp al, 5
jae 0x10047ad4
mov byte [0x100488e3], 0xac
mov byte [0x1004611f], 0x40
mov byte [0x1004612b], 0xff
mov byte [0x10046318], 0x74
mov word [0x100463cc], 0x6aeb
mov ecx, fcn.10047814
mov eax, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ecx], 0x10048197
mov dword [ecx + 4], 0x100481d7
mov dword [ecx + 8], eax
sub eax, eax
mov edi, 0x10047830
mov ecx, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x10047b50
stosd dword es:[edi], eax
mov eax, 0x10047b68
stosd dword es:[edi], eax
sub eax, eax
mov cl, 6
rep stosd dword es:[edi], eax
mov cl, 0x1d
mov edi, 0x100476e8
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
pop ebx
mov byte [0x10047c10], 1
ret