Function at 0x3001d870
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
mov eax, dword [0x3021be88]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
push esi
push edi
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x3001d8c8
push str.WoW64fix:_Failed_to_get_OS_version
call fcn.30009b60
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
cmp eax, 6
jne 0x3001d919
cmp ecx, 1
ja 0x3001d91b
push 0x30272538
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [0x30272538], 0
jne 0x3001d941
push str.WoW64_not_detected._n
call fcn.30009b40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
jbe 0x3001d8da
push ecx
push eax
push str.WoW64fix:_Windows_version__d._d_not_supported._n
call fcn.30009b40
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
mov ecx, str.ntdll.dll
call fcn.3001d360
mov ecx, str.wow64.dll
mov esi, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], ebx
call fcn.3001d360
mov ecx, str.Wow64PrepareForException
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.3001d540
push ebx
push esi
mov ecx, str.KiUserExceptionDispatcher
mov dword [esp + 0x24], eax
mov edi, edx
call fcn.3001d540
push dword [esp + 0x20]
mov ebx, eax
mov esi, edx
push dword [esp + 0x30]
mov ecx, str.NtSetContextThread
mov dword [0x30272528], ebx
mov dword [0x3027252c], esi
call fcn.3001d540
push edi
mov edi, dword [esp + 0x30]
push edi
push edx
push eax
push esi
push ebx
push dword [esp + 0x40]
mov dword [0x30272520], eax
push dword [esp + 0x50]
mov dword [0x30272524], edx
push str.WoW64_detected:_64_bit_ntdll_base:_0x_x__KiUserExceptionDispatcher:_0x_x__NtSetContextThread:_0x_x__Wow64PrepareForException:_0x_x_n
call fcn.30009b40
mov edx, dword [0x30272520]
add esp, 0x3c
mov ecx, dword [0x30272528]
push edi
call fcn.3001d6e0
mov ecx, dword [0x30272528]
add esp, 4
mov dword [0x30272530], eax
sub eax, ecx
sub eax, 5
mov dword [0x30272534], edx
mov dword [esp + 0x15], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push dword [0x3027252c]
mov byte [esp + 0x20], 0xe9
push ecx
mov word [esp + 0x29], 0xcccc
mov byte [esp + 0x2b], 0xcc
mov dword [esp + 0x20], 0
call fcn.3001d480
add esp, 0x10
test eax, eax
jne 0x3001da3a
push str.VirtualProtectEx64_failed_to_set_PAGE_EXECUTE_READWRITE
jmp 0x3001da6e
mov ecx, dword [0x30272528]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push dword [0x3027252c]
push ecx
call fcn.3001d480
add esp, 0x10
test eax, eax
jne 0x3001da76
push str.VirtualProtect_failed_to_restore_dwOldProtect
call fcn.30009b60
add esp, 4
push dword [0x30272534]
push dword [0x30272530]
push str.WoW64_workaround:_KiUserExceptionDispatcher_hook_installed_at:_0x_x_n
call fcn.30009b40
mov ecx, dword [esp + 0xc8]
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret