Function at 0x3987a20
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x3a2918b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x3a7682c]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x3a7682c]
xor eax, esp
push eax
lea eax, [esp + 0xc4]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x108]
mov eax, dword [esp + 0x100]
mov ebp, dword [esp + 0xd8]
mov esi, dword [esp + 0xe4]
mov edi, dword [esp + 0xe8]
mov ebx, dword [esp + 0xec]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.039efdc0
mov dword [esp + 0xcc], 0
mov edx, dword [esp + 0xe0]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.03984170
lea ecx, [esp + 0x24]
push esi
push ecx
call fcn.039e21d0
push edi
lea edx, [esp + 0x30]
push str._Iosb0x_x
push edx
call fcn.039f0800
add esp, 0x1c
cmp byte [esp + 0xd4], 0
je 0x3987b20
push ebx
lea eax, [esp + 0x20]
push str._AllocSize0x_x
push eax
call fcn.039f0800
add esp, 0xc
test ebx, ebx
je 0x3987b0b
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
push ecx
push edx
lea eax, [esp + 0x24]
push str._0x_08x_08x
push eax
call fcn.039f0800
add esp, 0x10
mov ecx, dword [esp + 0xf0]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.03984250
add esp, 8
mov eax, dword [esp + 0xf4]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.039841e0
add esp, 8
cmp byte [esp + 0xd4], 0
je 0x3987b93
mov ecx, dword [esp + 0xf8]
mov eax, str._unknown_
cmp ecx, 5
ja case.default.0x3987b50
jmp dword [ecx*4 + 0x3987ec8]
mov eax, str.FILE_SUPERSEDE
jmp case.default.0x3987b50
mov eax, str.FILE_OPEN
jmp case.default.0x3987b50
mov eax, str.FILE_CREATE
jmp case.default.0x3987b50
mov eax, str.FILE_OPEN_IF
jmp case.default.0x3987b50
mov eax, str.FILE_OVERWRITE
jmp case.default.0x3987b50
mov eax, str.FILE_OVERWRITE_IF
push eax
push ecx
lea edx, [esp + 0x24]
push str._CreateDisposition0x_x__ls
push edx
call fcn.039f0800
add esp, 0x10
mov ebx, dword [esp + 0xfc]
push ebx
lea eax, [esp + 0x20]
push str._Options0x_x
push eax
call fcn.039f0800
add esp, 0xc
test bl, 1
je 0x3987bc7
mov ecx, dword [0x3a56b80]
push ecx
push str._FILE_DIRECTORY_FILE
lea ecx, [esp + 0x24]
call fcn.039efdd0
test bl, 2
je 0x3987be1
mov edx, dword [0x3a56b80]
push edx
push str._FILE_WRITE_THROUGH
lea ecx, [esp + 0x24]
call fcn.039efdd0
test bl, 4
je 0x3987bfa
mov eax, dword [0x3a56b80]
push eax
push str._FILE_SEQUENTIAL_ONLY
lea ecx, [esp + 0x24]
call fcn.039efdd0
test bl, 8
je 0x3987c14
mov ecx, dword [0x3a56b80]
push ecx
push str._FILE_NO_INTERMEDIATE_BUFFERING
lea ecx, [esp + 0x24]
call fcn.039efdd0
test bl, 0x10
je 0x3987c2e
mov edx, dword [0x3a56b80]
push edx
push str._FILE_SYNCHRONOUS_IO_ALERT
lea ecx, [esp + 0x24]
call fcn.039efdd0
test bl, 0x20
je 0x3987c47
mov eax, dword [0x3a56b80]
push eax
push str._FILE_SYNCHRONOUS_IO_NONALERT
lea ecx, [esp + 0x24]
call fcn.039efdd0
test bl, 0x40
je 0x3987c61
mov ecx, dword [0x3a56b80]
push ecx
push str._FILE_NON_DIRECTORY_FILE
lea ecx, [esp + 0x24]
call fcn.039efdd0
test bl, bl
jns 0x3987c7a
mov edx, dword [0x3a56b80]
push edx
push str._FILE_CREATE_TREE_CONNECTION
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x100
je 0x3987c96
mov eax, dword [0x3a56b80]
push eax
push str._FILE_COMPLETE_IF_OPLOCKED
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x200
je 0x3987cb3
mov ecx, dword [0x3a56b80]
push ecx
push str._FILE_NO_EA_KNOWLEDGE
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x400
je 0x3987cd0
mov edx, dword [0x3a56b80]
push edx
push str._FILE_OPEN_FOR_RECOVERY
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x800
je 0x3987cec
mov eax, dword [0x3a56b80]
push eax
push str._FILE_RANDOM_ACCESS
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x1000
je 0x3987d09
mov ecx, dword [0x3a56b80]
push ecx
push str._FILE_DELETE_ON_CLOSE
lea ecx, [esp + 0x24]
call fcn.039efdd0
mov esi, ebx
and esi, 0x2000
je 0x3987d28
mov edx, dword [0x3a56b80]
push edx
push str._FILE_OPEN_BY_FILE_ID
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x4000
je 0x3987d44
mov eax, dword [0x3a56b80]
push eax
push str._FILE_OPEN_FOR_BACKUP_INTENT
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x8000
je 0x3987d61
mov ecx, dword [0x3a56b80]
push ecx
push str._FILE_NO_COMPRESSION
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x100000
je 0x3987d7e
mov edx, dword [0x3a56b80]
push edx
push str._FILE_RESERVE_OPFILTER
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x200000
je 0x3987d9a
mov eax, dword [0x3a56b80]
push eax
push str._FILE_OPEN_REPARSE_POINT
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x400000
je 0x3987db7
mov ecx, dword [0x3a56b80]
push ecx
push str._FILE_OPEN_NO_RECALL
lea ecx, [esp + 0x24]
call fcn.039efdd0
test ebx, 0x800000
je 0x3987dd4
mov edx, dword [0x3a56b80]
push edx
push str._FILE_OPEN_FOR_FREE_SPACE_QUERY
lea ecx, [esp + 0x24]
call fcn.039efdd0
test esi, esi
je 0x3987e05
mov eax, dword [0x3a56b80]
push eax
push str._FILE_OPEN_BY_FILE_ID
lea ecx, [esp + 0x24]
call fcn.039efdd0
test esi, esi
je 0x3987e05
mov ecx, dword [0x3a56b80]
push ecx
push str._FILE_OPEN_BY_FILE_ID
lea ecx, [esp + 0x24]
call fcn.039efdd0
mov bl, byte [esp + 0xd4]
test bl, bl
je 0x3987e2f
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x24]
push str._EaBuffer0x_x_EaLength0x_x
push ecx
call fcn.039f0800
add esp, 0x10
mov ecx, dword [esp + 0xdc]
mov eax, str._success_
test ecx, ecx
jge 0x3987e44
mov eax, 0x3a3fa6c
push eax
push ebp
push ecx
lea edx, [esp + 0x28]
push str.____0x_x_hFile_x__ls
push edx
call fcn.039f0800
add esp, 0x14
test bl, bl
je 0x3987e70
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push str.NtCreateFile__ls__ls_n
jmp 0x3987e81
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push eax
mov eax, dword [esp + 0x20]
push eax
push str.NtOpenFile__ls__ls_n
call fcn.0393dda0
add esp, 0xc
mov dword [esp + 0xcc], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.039ef660
mov ecx, dword [esp + 0xc4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.03a00f6a
add esp, 0xbc
ret