Function at 0x434d90
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x47f806
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd8
mov eax, dword [0x4a8ae4]
xor eax, esp
push ebx
push ebp
push esi
mov esi, dword [esp + 0xf8]
push edi
xor ebx, ebx
push ebx
mov dword [esp + 0xe8], eax
call sym.GuardianEdgeRemovableStorageAccess.exe_void___cdecl_GERSLOG::SetLogFile_enum_GERSLOG::_PROJECT_CONFIG_
push 0x48c768
push 3
push 0x5fe
push str.getFEK
push str..RSUtil.cpp
call sym.GuardianEdgeRemovableStorageAccess.exe_void___cdecl_GERSLOG::LogMsg_unsigned_short_int_const___unsigned_short_int_const___int__enum_GERSLOG::_TRACE_LEVEL__unsigned_short_int_const__
add esp, 0x18
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
call fcn.00434bd0
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x40]
mov dword [esp + 0x100], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], ebx
call fcn.00434bd0
push ebx
mov byte [esp + 0xf4], 1
mov dword [esp + 0x30], esi
mov dword [esp + 0x1c], ebx
call fcn.0044b775
call sub.KERNEL32.dll_GetCurrentProcessId
lea eax, [esp + 0x68]
push eax
call fcn.00434aa0
add esp, 8
push 1
mov ecx, 0x10
lea esi, [esp + 0x68]
lea edi, [esp + 0xa8]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x18]
push ecx
push 0x40
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], bl
call fcn.00434bd0
mov ebp, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
mov ecx, 0x10
lea esi, [esp + 0xa8]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x28]
push ebx
push esi
push ebp
call fcn.00486450
cmp eax, 5
jne 0x434ebc
mov ecx, dword [esp + 0x18]
push 1
push ebx
lea eax, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0x20], bl
call fcn.00434bd0
mov edi, dword [esp + 0x30]
lea edx, [esp + 0x18]
push edx
push edi
push esi
push ebp
call fcn.00486450
mov eax, dword [esp + 0xf8]
cmp eax, 1
jne 0x434ee0
mov eax, 0x10
jmp 0x434ef5
cmp eax, 2
jne 0x434f76
mov dword [esp + 0x14], 0x20
mov eax, dword [esp + 0x14]
cmp eax, 0x14
mov ebp, 0x14
jg 0x434f01
mov ebp, eax
sub eax, ebp
push 0x14
mov dword [esp + 0x18], eax
lea eax, [esp + 0x40]
push eax
push 0x14
lea ecx, [esp + 0x5c]
push ecx
push edi
call fcn.00483ea0
test eax, eax
jne 0x434f80
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x5c], edx
mov ecx, ebp
mov edx, ecx
shr ecx, 2
mov edi, eax
lea esi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
add eax, ebp
mov ecx, edx
and ecx, 3
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x14], ebx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x30]
jle 0x434fa6
jmp 0x434ef1
mov dword [esp + 0x1c], 0x80004005
jmp 0x434faa
push str.EpclRngOut_failed
push 2
push 0x674
push str.getFEK
push str..RSUtil.cpp
mov dword [esp + 0x30], 0x80004005
call sym.GuardianEdgeRemovableStorageAccess.exe_void___cdecl_GERSLOG::LogMsg_unsigned_short_int_const___unsigned_short_int_const___int__enum_GERSLOG::_TRACE_LEVEL__unsigned_short_int_const__
add esp, 0x14
mov ebp, dword [esp + 0x20]
push 0x48c718
push 3
push 0x67a
push str.getFEK
push str..RSUtil.cpp
call sym.GuardianEdgeRemovableStorageAccess.exe_void___cdecl_GERSLOG::LogMsg_unsigned_short_int_const___unsigned_short_int_const___int__enum_GERSLOG::_TRACE_LEVEL__unsigned_short_int_const__
add esp, 0x14
cmp edi, ebx
je 0x434fd5
push edi
call fcn.004620d3
add esp, 4
push ebp
call fcn.004620d3
mov ecx, dword [esp + 0xec]
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xd8]
pop ebx
xor ecx, esp
call fcn.0044a318
add esp, 0xe4
ret