Function at 0x10006320
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1001c30b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d4
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x2c]
call fcn.10003b50
lea eax, [esp + 0x4c]
xor ebp, ebp
push eax
mov dword [esp + 0x1f0], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x50], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esp + 0x1fc]
mov edx, dword [esp + 0x1f8]
mov eax, dword [esp + 0x1f4]
push ecx
push edx
push eax
call fcn.10001ff0
mov esi, eax
add esp, 0xc
cmp esi, ebp
je 0x10006808
mov ebx, dword [esp + 0x200]
push 1
lea ecx, [esp + 0x30]
lea edi, [ebx + 0x118]
push edi
mov dword [esp + 0x20], edi
call fcn.10003c20
test eax, eax
je 0x10006808
push str.LayoutFile
push str.Version
lea ecx, [esp + 0x34]
xor esi, esi
call fcn.10003c90
test eax, eax
je 0x10006464
mov ebp, 1
push 0
lea ecx, [esp + 0xe4]
push 0x104
push ecx
push ebp
lea ecx, [esp + 0x3c]
call fcn.10004450
test eax, eax
je 0x10006434
mov al, byte [esp + 0xe0]
test al, al
je 0x10006434
mov edi, str.layout
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xe0]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.layout
push edx
call fcn.1001bd80
mov esi, eax
add esp, 0xc
neg esi
sbb esi, esi
inc esi
inc ebp
test esi, esi
je 0x100063d9
jmp 0x10006438
test esi, esi
je 0x10006460
mov dword [esp + 0x20], 0
call fcn.10001eb0
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
push eax
push edx
mov dword [esp + 0x1c], eax
call fcn.10001f40
add esp, 0xc
mov esi, eax
jmp 0x10006481
mov edi, dword [esp + 0x18]
push 0
push 2
push 0
push edi
call fcn.10001ef0
add esp, 0x10
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
setne cl
mov esi, ecx
test esi, esi
je 0x100067f2
mov eax, dword [esp + 0x228]
mov edi, dword [esp + 0x214]
test al, 0x10
jne 0x100065cc
mov edx, dword [esp + 0x230]
mov ecx, dword [esp + 0x22c]
push edx
push ecx
mov ecx, dword [esp + 0x218]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x38]
mov ebp, dword [esp + 0x208]
push edx
mov edx, dword [esp + 0x21c]
push eax
mov eax, dword [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x21c]
push edx
mov edx, dword [esp + 0x214]
push eax
mov eax, dword [esp + 0x214]
push ecx
push edi
push ebx
push ebp
push edx
push eax
call fcn.10006850
mov esi, eax
add esp, 0x38
test esi, esi
je 0x100067f2
cmp dword [0x10023600], 0x3e3
jne 0x10006546
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10001f80
add esp, 4
lea ecx, [esp + 0x2c]
call fcn.10003c60
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1ec], 0xffffffff
call fcn.100049b0
mov eax, 1
jmp 0x10006828
test byte [esp + 0x228], 4
jne 0x100065c5
test byte [esp + 0x22c], 8
jne 0x100065c5
cmp dword [esp + 0x5c], 2
jne 0x10006583
test dword [esp + 0x228], 0x7000000
je 0x10006583
lea edx, [esp + 0xe0]
push 0x1001d400
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10006585
xor eax, eax
mov edx, dword [esp + 0x1f8]
lea ecx, [esp + 0x2c]
push ecx
push eax
mov eax, dword [esp + 0x1fc]
push edi
push ebx
push ebp
push edx
push eax
call fcn.10007520
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x100065c5
mov ecx, dword [0x10023600]
mov dword [0x10023628], 0x231
mov dword [esp + 0x1c], ecx
jmp 0x100067f2
mov eax, dword [esp + 0x228]
test al, 0x80
jne 0x100067f2
mov eax, dword [esp + 0x21c]
mov ebp, dword [esp + 0x218]
mov ecx, dword [esp + 0x1fc]
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x1fc]
push eax
mov eax, dword [esp + 0x1fc]
push ebp
push 0
push edi
push ebx
push ecx
push edx
push eax
call fcn.10007680
add esp, 0x24
mov dword [esp + 0x14], eax
test eax, eax
je 0x100067b6
mov ecx, dword [esp + 0x1fc]
push ebp
lea eax, [ebx + 0x21c]
push 0
push edi
add ecx, 0x10c
add ebx, 0x18
push eax
push ecx
lea edx, [esp + 0x40]
push ebx
push edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ebx
call fcn.10013750
mov eax, dword [esp + 0x78]
add esp, 0x1c
cmp eax, 2
jne 0x10006671
cmp dword [esp + 0x50], 5
jb 0x10006671
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x230]
push ebp
push eax
push ecx
call fcn.100077e0
add esp, 0xc
mov ebx, dword [esp + 0x1f4]
push 0
push 0
push 0xffffffffffffffff
push 0x1210000
push 0xffff7fff
push ebx
call fcn.10002290
add esp, 0x18
test eax, eax
je 0x100066a8
mov edx, dword [esp + 0x1f8]
push edx
push ebx
push 2
call fcn.10002080
add esp, 0xc
cmp dword [esp + 0x5c], 2
jne 0x100066d9
cmp dword [esp + 0x50], 4
jae 0x100066d9
mov ebx, dword [esp + 0x228]
test bl, 0x20
je 0x100066e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x230]
push eax
push ecx
call fcn.10010a60
add esp, 8
jmp 0x100066e0
mov ebx, dword [esp + 0x228]
mov edx, dword [esp + 0x14]
push edx
call fcn.10010230
add esp, 4
test ebx, 0x10000
jne 0x10006702
push edi
call fcn.10010e20
add esp, 4
test eax, eax
jne 0x10006719
push ebp
call fcn.10010b20
add esp, 4
test eax, eax
jne 0x10006719
push ebp
push edi
call fcn.10013c90
add esp, 8
cmp dword [esp + 0x5c], 1
jne 0x1000677e
mov eax, dword [esp + 0x210]
mov ecx, dword [esp + 0x20c]
mov edx, dword [esp + 0x204]
push 0
push eax
mov eax, dword [esp + 0x234]
push ecx
mov ecx, dword [esp + 0x23c]
push edx
mov edx, ebx
push eax
mov eax, dword [esp + 0x2c]
or edx, 2
push ecx
mov ecx, dword [esp + 0x23c]
push edx
mov edx, dword [esp + 0x238]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x218]
push edx
push ebp
push edi
push eax
push ecx
call fcn.10005e10
add esp, 0x38
mov esi, eax
test esi, esi
je 0x100067f2
test ebx, 0x20000
jne 0x100067f2
cmp dword [esp + 0x5c], 2
jne 0x10006798
cmp dword [esp + 0x50], 5
jb 0x100067f2
mov edx, dword [esp + 0x230]
mov eax, dword [esp + 0x28]
push ebx
push ebp
push edx
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.100078b0
add esp, 0x14
jmp 0x100067f2
mov edx, dword [0x10023600]
xor esi, esi
push esi
lea eax, [esp + 0xe4]
push ebp
push eax
mov dword [0x10023628], 0x232
mov dword [esp + 0x28], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call fcn.100101f0
add esp, 8
test eax, eax
je 0x100067f2
push eax
call fcn.10010230
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10001f80
add esp, 4
lea ecx, [esp + 0x2c]
call fcn.10003c60
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
mov dword [0x10023600], edx
mov dword [esp + 0x1ec], 0xffffffff
call fcn.100049b0
mov eax, esi
mov ecx, dword [esp + 0x1e4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1e0
ret