Function at 0x1001dec0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063873
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001e1ac
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1001dfb8
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001df63
mov ecx, dword [ebp - 0x24]
call fcn.10028c5d
movzx eax, al
test eax, eax
jne 0x1001dfb3
push dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x24]
call fcn.10028bec
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ecx]
mov dword [eax], ecx
push 1
push 0x62d9
push 0x745b
push dword [ebp - 0x28]
push 0x2c72
push 1
push 0
push 0x5e2a
push 0xc3f
push 0x5140
push 0x4523
push 0x56e6
push 0xac0
call fcn.1001e205
add esp, 0x34
jmp 0x1001e1aa
push 1
lea ecx, [ebp - 0x80]
call fcn.10004f00
and dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0x1ac8
mov dword [ebp - 0x64], str.ztrs_tcqu_kwrzn_gsynxh
cmp dword [ebp - 0x2c], 0x1c78
jle 0x1001e056
push 0
push 0x11ab
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
and dword [ebp - 0x20], 0
jmp 0x1001dffb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4aac
jge 0x1001e056
and dword [ebp - 0x18], 0
jmp 0x1001e011
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x54cd
jge 0x1001e054
and dword [ebp - 0x1c], 0
jmp 0x1001e027
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x709f
jge 0x1001e052
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], edx
push dword [ebp - 0x70]
push dword [ebp - 0x74]
mov ecx, 0x1007e2d8
call fcn.10004c4e
jmp 0x1001e020
jmp 0x1001e00a
jmp 0x1001dff4
mov dword [ebp - 0x6c], 0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2c], 0x1a15
jge 0x1001e077
mov edx, dword [ebp - 0x64]
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x1001e093
and dword [ebp - 4], 0
jmp 0x1001e09d
mov dword [ebp - 0x68], 1
push 3
lea ecx, [ebp - 0x8c]
call fcn.10004f00
mov byte [ebp - 4], 3
push 0x705f
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x80]
push eax
push 0x7c37
push 0x7dfb
push 0x3cd8
push 0
push 1
push 0x58ce
push 0x7b73
push 0x7d0e
push 0x6685
push 0x3053
call fcn.10027e74
add esp, 0x38
mov dword [ebp - 0x14], 0
jmp 0x1001e108
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1001e124
push dword [ebp - 0x14]
lea ecx, [ebp - 0x8c]
call fcn.10004f7e
mov dword [eax], 5
jmp 0x1001e101
push 0
lea ecx, [ebp - 0x80]
call fcn.10004f7e
and dword [eax], 0
jmp 0x1001e14b
push 0
lea ecx, [ebp - 0x80]
call fcn.10004f7e
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x80]
call fcn.10004f7e
cmp dword [eax], 0xa
je 0x1001e18f
mov dword [ebp - 0x34], 0xddbc3707
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0x56e
push 0
call fcn.1001a8da
add esp, 0x1c
cmp dword [ebp - 0x34], 0
je 0x1001e18d
jmp 0x1001e18f
jmp 0x1001e133
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8c]
call fcn.10004f62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.10004f62
jmp 0x1001e1b4
push 0
call fcn.10015683
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret