Function at 0x4388d0
Capabilities:
Check os version
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6d0
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
xor ebx, ebx
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x3c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x3c], 6
jb 0x43891d
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0xd4]
push edx
lea eax, [esp + 0x28]
push eax
push str.WinSock2LspDll
push str.SystemCurrentControlSetServicesVxDKaseya
push 0x80000002
mov dword [esp + 0x3c], 0x105
call fcn.0044b2c0
add esp, 0x18
test eax, eax
jne 0x438d15
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x438968
cmp eax, 2
jne 0x438d15
lea eax, [esp + 0xd0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x438972
sub eax, edx
cmp eax, ebx
jle 0x438d15
lea ecx, [esp + 0xd0]
push 0x25
push ecx
call fcn.004590c0
add esp, 8
test eax, eax
je 0x4389d4
push 0x105
lea edx, [esp + 0x1dc]
push edx
lea eax, [esp + 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
jle 0x4389d4
cmp eax, 0x104
jae 0x4389d4
xor eax, eax
mov cl, byte [esp + eax + 0x1d8]
mov byte [esp + eax + 0xd0], cl
inc eax
test cl, cl
jne 0x4389c1
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea ecx, [esp + 0xe8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x438a00
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xd0]
push str.kaseyasp.dll
push edx
call fcn.0044db90
add esp, 8
cmp eax, ebx
je 0x438d08
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x438a20
sub eax, edx
cmp eax, 0xc
jne 0x438d08
cmp esi, 0xffffffff
je 0x438d08
lea edi, [esp + 0x18]
call fcn.00436ca0
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], edi
jne 0x438a6a
push str.EnumerateProviders:_Unable_to_enumerate_Winsock_catalog_n
call fcn.00436bd0
mov ebp, 0xfffffff6
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ebp, dword [esp + 0x18]
test ebp, ebp
jle 0x438b7f
lea edx, [edi + 0x14]
lea esp, [esp]
mov eax, dword [edx + 0x14]
test eax, eax
jne 0x438aaa
mov ecx, 0x10
mov edi, 0x486f0c
mov esi, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x438a9e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x438b3e
mov edi, dword [esp + 0x10]
inc ebx
add edx, 0x274
cmp ebx, ebp
jl 0x438a80
test ebp, ebp
jle 0x438b7f
lea esi, [edi + 0x74]
mov eax, dword [esi - 0x4c]
test eax, eax
je 0x438b72
mov eax, dword [esi - 0x28]
cmp eax, 2
je 0x438ae8
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x438b72
cmp eax, 0x17
jne 0x438b72
push str.RSVP
push esi
call fcn.0045bcda
add esp, 8
test eax, eax
jne 0x438b72
push str.Rsvp
push esi
call fcn.0045bcda
add esp, 8
test eax, eax
jne 0x438b72
push str.rsvp
push esi
call fcn.0045bcda
add esp, 8
test eax, eax
jne 0x438b72
mov eax, dword [esp + 0x14]
cmp eax, 0x100
jae 0x438b61
mov ecx, dword [esi - 0x50]
mov dword [esp + eax*4 + 0x2e0], ecx
inc eax
mov dword [esp + 0x14], eax
jmp 0x438b72
mov ecx, dword [esp + 0x10]
push ecx
push 0
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi - 0x50]
push edx
push str.Maximum_providers_exceeded__Ignoring_provider__d_n
call fcn.00436bd0
add esp, 8
add esi, 0x274
dec ebp
jne 0x438ac0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x438bb7
push str._n_nError__Must_specify_at_least_one_provider_to_layer_over__n_n
call fcn.00436bd0
mov ebp, 0xfffffff5
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x2e0]
push str.KASEYA_LSP
call fcn.00436d30
mov esi, eax
add esp, 4
test esi, esi
jne 0x438bfd
push str.CreateDummyEntry_failed__n
call fcn.00436bd0
add esp, 4
mov ebp, 0xfffffff4
test esi, esi
je 0x438b57
push esi
push 0
call edi
push eax
call ebx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push 0x479c80
push 0x486f0c
mov edx, esi
call fcn.00437050
add esp, 0xc
test eax, eax
je 0x438c2b
push str.Unable_to_install_the_dummy_LSP_entry__n
call fcn.00436bd0
add esp, 4
mov ebp, 0xfffffff3
jmp 0x438be3
push esi
push 0
call edi
push eax
call ebx
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ebp
lea ecx, [esp + 0x2e8]
push ecx
push 0x486f0c
push str.KASEYA_LSP
call fcn.00436e10
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x438c74
push str.Unable_to_create_layered_provider_entries__n
call fcn.00436bd0
add esp, 4
mov ebp, 0xfffffff2
jmp 0x438be3
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x438ca1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UuidCreate_failed:__d_n
call fcn.00436bd0
add esp, 8
mov ebp, 0xfffffff1
jmp 0x438be3
push ebp
lea eax, [esp + 0x2c]
push 0x479c80
push eax
mov edx, esi
call fcn.00437050
add esp, 0xc
test eax, eax
je 0x438cd1
push str.Unable_to_install_layered_chain_entries__n
call fcn.00436bd0
add esp, 4
mov ebp, 0xfffffff0
jmp 0x438be3
mov ecx, dword [esp + 0x10]
call fcn.004372e0
test eax, eax
je 0x438cf5
push str.Unable_to_reorder_Winsock_catalog__n
call fcn.00436bd0
add esp, 4
mov ebp, 0xffffffef
jmp 0x438be3
push esi
xor ebp, ebp
push ebp
call edi
push eax
call ebx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret