Function at 0x3001da30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
mov eax, dword [0x3021ae88]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
push esi
push edi
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x3001da88
push str.WoW64fix:_Failed_to_get_OS_version
call fcn.30009b20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
cmp eax, 6
jne 0x3001dad9
cmp ecx, 1
ja 0x3001dadb
push 0x30271478
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [0x30271478], 0
jne 0x3001db01
push str.WoW64_not_detected._n
call fcn.30009b00
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
jbe 0x3001da9a
push ecx
push eax
push str.WoW64fix:_Windows_version__d._d_not_supported._n
call fcn.30009b00
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
mov ecx, str.ntdll.dll
call fcn.3001d520
mov ecx, str.wow64.dll
mov esi, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], ebx
call fcn.3001d520
mov ecx, str.Wow64PrepareForException
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.3001d700
push ebx
push esi
mov ecx, str.KiUserExceptionDispatcher
mov dword [esp + 0x24], eax
mov edi, edx
call fcn.3001d700
push dword [esp + 0x20]
mov ebx, eax
mov esi, edx
push dword [esp + 0x30]
mov ecx, str.NtSetContextThread
mov dword [0x30271468], ebx
mov dword [0x3027146c], esi
call fcn.3001d700
push edi
mov edi, dword [esp + 0x30]
push edi
push edx
push eax
push esi
push ebx
push dword [esp + 0x40]
mov dword [0x30271460], eax
push dword [esp + 0x50]
mov dword [0x30271464], edx
push str.WoW64_detected:_64_bit_ntdll_base:_0x_x__KiUserExceptionDispatcher:_0x_x__NtSetContextThread:_0x_x__Wow64PrepareForException:_0x_x_n
call fcn.30009b00
mov edx, dword [0x30271460]
add esp, 0x3c
mov ecx, dword [0x30271468]
push edi
call fcn.3001d8a0
mov ecx, dword [0x30271468]
add esp, 4
mov dword [0x30271470], eax
sub eax, ecx
sub eax, 5
mov dword [0x30271474], edx
mov dword [esp + 0x15], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push dword [0x3027146c]
mov byte [esp + 0x20], 0xe9
push ecx
mov word [esp + 0x29], 0xcccc
mov byte [esp + 0x2b], 0xcc
mov dword [esp + 0x20], 0
call fcn.3001d640
add esp, 0x10
test eax, eax
jne 0x3001dbfa
push str.VirtualProtectEx64_failed_to_set_PAGE_EXECUTE_READWRITE
jmp 0x3001dc2e
mov ecx, dword [0x30271468]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push dword [0x3027146c]
push ecx
call fcn.3001d640
add esp, 0x10
test eax, eax
jne 0x3001dc36
push str.VirtualProtect_failed_to_restore_dwOldProtect
call fcn.30009b20
add esp, 4
push dword [0x30271474]
push dword [0x30271470]
push str.WoW64_workaround:_KiUserExceptionDispatcher_hook_installed_at:_0x_x_n
call fcn.30009b00
mov ecx, dword [esp + 0xc8]
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret