Function at 0x3001e0f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
mov eax, dword [0x30215e88]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
push esi
push edi
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x3001e148
push str.WoW64fix:_Failed_to_get_OS_version
call fcn.3000a0f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
cmp eax, 6
jne 0x3001e199
cmp ecx, 1
ja 0x3001e19b
push 0x3026d8d8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [0x3026d8d8], 0
jne 0x3001e1c1
push str.WoW64_not_detected._n
call fcn.3000a0d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
jbe 0x3001e15a
push ecx
push eax
push str.WoW64fix:_Windows_version__d._d_not_supported._n
call fcn.3000a0d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
mov ecx, str.ntdll.dll
call fcn.3001dbe0
mov ecx, str.wow64.dll
mov esi, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], ebx
call fcn.3001dbe0
mov ecx, str.Wow64PrepareForException
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.3001ddc0
push ebx
push esi
mov ecx, str.KiUserExceptionDispatcher
mov dword [esp + 0x24], eax
mov edi, edx
call fcn.3001ddc0
push dword [esp + 0x20]
mov ebx, eax
mov esi, edx
push dword [esp + 0x30]
mov ecx, str.NtSetContextThread
mov dword [0x3026d8c8], ebx
mov dword [0x3026d8cc], esi
call fcn.3001ddc0
push edi
mov edi, dword [esp + 0x30]
push edi
push edx
push eax
push esi
push ebx
push dword [esp + 0x40]
mov dword [0x3026d8c0], eax
push dword [esp + 0x50]
mov dword [0x3026d8c4], edx
push str.WoW64_detected:_64_bit_ntdll_base:_0x_x__KiUserExceptionDispatcher:_0x_x__NtSetContextThread:_0x_x__Wow64PrepareForException:_0x_x_n
call fcn.3000a0d0
mov edx, dword [0x3026d8c0]
add esp, 0x3c
mov ecx, dword [0x3026d8c8]
push edi
call fcn.3001df60
mov ecx, dword [0x3026d8c8]
add esp, 4
mov dword [0x3026d8d0], eax
sub eax, ecx
sub eax, 5
mov dword [0x3026d8d4], edx
mov dword [esp + 0x15], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push dword [0x3026d8cc]
mov byte [esp + 0x20], 0xe9
push ecx
mov word [esp + 0x29], 0xcccc
mov byte [esp + 0x2b], 0xcc
mov dword [esp + 0x20], 0
call fcn.3001dd00
add esp, 0x10
test eax, eax
jne 0x3001e2ba
push str.VirtualProtectEx64_failed_to_set_PAGE_EXECUTE_READWRITE
jmp 0x3001e2ee
mov ecx, dword [0x3026d8c8]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push dword [0x3026d8cc]
push ecx
call fcn.3001dd00
add esp, 0x10
test eax, eax
jne 0x3001e2f6
push str.VirtualProtect_failed_to_restore_dwOldProtect
call fcn.3000a0f0
add esp, 4
push dword [0x3026d8d4]
push dword [0x3026d8d0]
push str.WoW64_workaround:_KiUserExceptionDispatcher_hook_installed_at:_0x_x_n
call fcn.3000a0d0
mov ecx, dword [esp + 0xc8]
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret