Function at 0x63bc9350
Capabilities:
Check os version

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
lea eax, [ebp - 0xac]
push ebx
push ecx
sub esp, 0xcc
mov ebx, dword [ecx]
mov dword [ebp - 0xac], 0x94
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
sub esp, 4
test eax, eax
je 0x63bc950d
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x9c]
cmp ebx, 0x25
ja case.default.0x63bc93a7
jmp dword [ebx*4 + 0x63bcd624]
cmp eax, 2
sete dl
xor eax, eax
cmp ecx, 4
seta al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
jne 0x63bc9bbe
mov eax, esi
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
cmp ecx, 3
seta dl
cmp eax, 2
sete al
movzx eax, al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], str.__lx__ret__d_n
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 3
call fcn.63bc2700
lea esp, [ebp - 0xc]
mov eax, esi
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
cmp eax, 2
sete al
movzx eax, al
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 1
jmp 0x63bc9408
cmp eax, 1
setbe al
movzx eax, al
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
jmp 0x63bc9408
cmp eax, 1
sete al
movzx eax, al
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 2
jmp 0x63bc9408
cmp eax, 2
sete dl
xor eax, eax
cmp ecx, 5
seta al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x25
jmp 0x63bc9408
test byte [0x63bcb034], 1
jne 0x63bc9b57
xor esi, esi
jmp 0x63bc93cf
test byte [0x63bcb034], 1
je 0x63bc950d
mov dword [esp + 0xc], str._OS_MEDIACENTER__What_should_we_return_here__n
xor esi, esi
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 0
call fcn.63bc2700
jmp 0x63bc93cf
cmp eax, 2
sete al
movzx eax, al
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x15
jmp 0x63bc9408
cmp eax, 2
sete al
movzx eax, al
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x1d
jmp 0x63bc9408
test byte [0x63bcb034], 1
jne 0x63bc9bcb
mov esi, 1
jmp 0x63bc93cf
test byte [0x63bcb034], 1
je 0x63bc950d
mov dword [esp + 0xc], str._OS_WELCOMELOGONUI__What_should_we_return_here__n
xor esi, esi
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 0
call fcn.63bc2700
jmp 0x63bc93cf
test byte [0x63bcb034], 1
je 0x63bc95bd
mov dword [esp + 0xc], str._OS_FASTUSERSWITCHING__What_should_we_return_here__n
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 0
call fcn.63bc2700
jmp 0x63bc95bd
test edx, edx
setne dl
cmp eax, 2
sete al
and edx, eax
xor eax, eax
cmp ecx, 4
seta al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x19
jmp 0x63bc9408
cmp eax, 2
sete al
movzx eax, al
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x18
jmp 0x63bc9408
cmp eax, 2
sete al
movzx eax, al
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x17
jmp 0x63bc9408
cmp eax, 2
sete dl
xor eax, eax
cmp ecx, 4
seta al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x16
jmp 0x63bc9408
test byte [0x63bcb034], 1
je 0x63bc950d
mov dword [esp + 0xc], str._OS_TABLETPC__What_should_we_return_here__n
xor esi, esi
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 0
call fcn.63bc2700
jmp 0x63bc93cf
cmp eax, 2
sete al
movzx eax, al
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x20
jmp 0x63bc9408
test byte [0x63bcb034], 1
je 0x63bc950d
mov dword [esp + 0xc], str._OS_SERVERADMINUI__What_should_we_return_here__n
xor esi, esi
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 0
call fcn.63bc2700
jmp 0x63bc93cf
cmp eax, 2
sete al
movzx eax, al
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x1f
jmp 0x63bc9408
lea eax, [ebp - 0xb0]
mov dword [esp], 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsWow64Process]
mov esi, dword [ebp - 0xb0]
sub esp, 8
jmp 0x63bc93cf
test byte [0x63bcb034], 1
je 0x63bc950d
mov dword [esp + 0xc], str._OS_EMBEDDED__What_should_we_return_here__n
xor esi, esi
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 0
call fcn.63bc2700
jmp 0x63bc93cf
cmp edx, 1
setbe dl
cmp eax, 2
sete al
movzx eax, al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0xc
jmp 0x63bc9408
cmp edx, 1
setbe dl
cmp eax, 2
sete al
movzx eax, al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0xb
jmp 0x63bc9408
cmp edx, 1
setbe dl
cmp eax, 2
sete al
movzx eax, al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0xa
jmp 0x63bc9408
cmp edx, 1
setbe dl
cmp eax, 2
sete al
movzx eax, al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 9
jmp 0x63bc9408
cmp eax, 2
sete dl
xor eax, eax
cmp ecx, 4
seta al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 8
jmp 0x63bc9408
cmp edx, 0xa
sete dl
cmp eax, 1
sete al
movzx eax, al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 6
jmp 0x63bc9408
cmp edx, 9
seta dl
cmp eax, 1
sete al
movzx eax, al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 5
jmp 0x63bc9408
cmp eax, 1
sete cl
xor eax, eax
cmp edx, 0x59
seta al
and eax, ecx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x11
jmp 0x63bc9408
test edx, edx
sete dl
cmp eax, 1
sete al
movzx eax, al
and eax, edx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x10
jmp 0x63bc9408
test byte [0x63bcb034], 1
je 0x63bc950d
mov dword [esp + 0xc], str._OS_TERMINALREMOTEADMIN__What_should_we_return_here__n
xor esi, esi
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 0
call fcn.63bc2700
jmp 0x63bc93cf
test byte [0x63bcb034], 1
je 0x63bc950d
mov dword [esp + 0xc], str._OS_TERMINALCLIENT__What_should_we_return_here__n
xor esi, esi
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 0
call fcn.63bc2700
jmp 0x63bc93cf
cmp eax, 2
sete al
cmp ecx, 4
seta cl
and ecx, eax
xor eax, eax
test edx, edx
setne al
and eax, ecx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x13
jmp 0x63bc9408
cmp eax, 2
sete al
movzx eax, al
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x14
jmp 0x63bc9408
cmp eax, 2
sete al
cmp ecx, 4
seta cl
and ecx, eax
xor eax, eax
test edx, edx
setne al
and eax, ecx
mov esi, eax
test byte [0x63bcb034], 8
je 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x12
jmp 0x63bc9408
mov dword [esp + 0xc], str._OS_APPLIANCE__What_should_we_return_here__n
xor esi, esi
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 0
call fcn.63bc2700
jmp 0x63bc93cf
test byte [0x63bcb034], 4
je 0x63bc950d
mov dword [esp + 0x10], ebx
xor esi, esi
mov dword [esp + 0xc], str.__lx__unknown_parameter_n
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 2
call fcn.63bc2700
jmp 0x63bc93cf
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
jmp 0x63bc9408
mov dword [esp + 0xc], str._OS_DOMAINMEMBER__What_should_we_return_here__n
mov dword [esp + 8], str.IsOS
mov dword [esp + 4], 0x63bcb034
mov dword [esp], 0
call fcn.63bc2700
jmp 0x63bc95bd