Function at 0x1000c633
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov dword [ebp - 0xa4], 0
push 0x9c
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.10012110
add esp, 0xc
mov dword [ebp - 0x9c], 0x9c
lea ecx, [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1000c786
cmp dword [ebp - 0x8c], 2
jne 0x1000c786
cmp dword [ebp - 0x98], 5
jbe 0x1000c786
mov dword [ebp - 0xac], 0
lea edx, [ebp - 0xac]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000c786
mov dword [ebp - 0xb0], 0
lea eax, [ebp - 0xb0]
push eax
push 0
push 0
push 0x19
mov ecx, dword [ebp - 0xac]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1000c779
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000c779
mov edx, dword [ebp - 0xb0]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x1000c779
lea eax, [ebp - 0xb0]
push eax
mov ecx, dword [ebp - 0xb0]
push ecx
mov edx, dword [ebp - 0xb4]
push edx
push 0x19
mov eax, dword [ebp - 0xac]
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1000c76c
mov ecx, dword [ebp - 0xb4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
xor ecx, ecx
mov cl, byte [eax]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0xb4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [eax]
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0xb4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xb8], ecx
cmp dword [ebp - 0xb8], 0x2000
ja 0x1000c7c1
cmp dword [ebp - 0xb8], 0x2000
je 0x1000c7ec
cmp dword [ebp - 0xb8], 0
je 0x1000c81f
cmp dword [ebp - 0xb8], 0x1000
je 0x1000c7db
jmp 0x1000c82e
cmp dword [ebp - 0xb8], 0x3000
je 0x1000c7fd
cmp dword [ebp - 0xb8], 0x4000
je 0x1000c80e
jmp 0x1000c82e
push 0x1003a5f0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000c82e
push 0x1003a5f4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000c82e
push 0x1003a5f8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000c82e
push 0x1003a5fc
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000c82e
push 0x1003a600
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa8], 0
lea ecx, [ebp - 0xa8]
push ecx
lea edx, [ebp - 0xa0]
push edx
push str.PromptOnSecureDesktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push closesocket
call fcn.1000c53d
add esp, 0x14
cmp dword [ebp - 0xa8], 0
jbe 0x1000c896
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 1
jne 0x1000c896
push str._uac
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0xbc], eax
jmp 0x1000c8ab
push str._UAC
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0xbc], eax
mov eax, 1
mov esp, ebp
pop ebp
ret