Function at 0x140003af8
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r12d, r12d
mov r14, rax
test rax, rax
je 0x140003d65
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140003d65
mov ecx, 0x104
call fcn.140001050
mov rsi, rax
lea rdx, [rbp - 0x59]
mov eax, 0x9c
mov ecx, eax
mov byte [rdx], r12b
inc rdx
sub rcx, 1
jne 0x140003b67
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x59], eax
call rbx
mov ebx, 0x11c
mov ecx, ebx
call fcn.140001050
mov r8b, 1
mov edx, 0x80
xor ecx, ecx
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], r12
mov dword [rax + 0x10], r12d
mov dword [rax + 0x114], r12d
mov word [rax + 0x118], r12w
mov byte [rax + 0x11a], 1
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, rbx
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
mov eax, dword [rbp - 0x55]
jne 0x140003cca
cmp eax, 5
jne 0x140003c24
cmp dword [rbp - 0x51], 2
jne 0x140003d57
mov eax, 0x8000
mov rcx, rsi
cmp word [rbp + 0x3f], ax
jne 0x140003c18
lea rdx, str.Windows_Home_Server
jmp 0x140003d51
lea rdx, str.Windows_Server_2003
jmp 0x140003d51
cmp eax, 6
jne 0x140003c67
mov eax, dword [rbp - 0x51]
test eax, eax
jne 0x140003c3c
lea rdx, str.Windows_Server_2008
jmp 0x140003d4e
cmp eax, 1
jne 0x140003c4d
lea rdx, str.Windows_Server_2008_R2
jmp 0x140003d4e
cmp eax, 2
je 0x140003c96
cmp eax, 3
jne 0x140003d57
lea rdx, str.Windows_Server_2012_R2
jmp 0x140003d4e
cmp eax, 0xa
jne 0x140003d57
cmp dword [rbp - 0x51], r12d
jne 0x140003d57
mov eax, dword [rbp - 0x4d]
mov ecx, 0x4f7c
mov edx, 0x4563
cmp eax, 0x3839
jb 0x140003ca2
cmp eax, edx
jae 0x140003ca6
cmp eax, ecx
jae 0x140003ca2
lea rdx, str.Windows_Server_2012
jmp 0x140003d4e
cmp eax, edx
jb 0x140003cb6
cmp eax, ecx
jae 0x140003cbe
lea rdx, str.Windows_Server_2019
jmp 0x140003d4e
cmp eax, ecx
jb 0x140003d57
lea rdx, str.Windows_Server_2022
jmp 0x140003d4e
cmp eax, 5
jne 0x140003ced
cmp dword [rbp - 0x51], 1
jne 0x140003cde
lea rdx, str.Windows_xp
jmp 0x140003d4e
cmp dword [rbp - 0x51], 2
jne 0x140003d57
lea rdx, str.Windows_XP_Professional_x64_Edition
jmp 0x140003d4e
cmp eax, 6
jne 0x140003d2c
mov eax, dword [rbp - 0x51]
test eax, eax
jne 0x140003d02
lea rdx, str.Windows_Vista
jmp 0x140003d4e
cmp eax, 1
jne 0x140003d10
lea rdx, str.Windows_7
jmp 0x140003d4e
cmp eax, 2
jne 0x140003d1e
lea rdx, str.Windows_8
jmp 0x140003d4e
cmp eax, 3
jne 0x140003d57
lea rdx, str.Windows_8.1
jmp 0x140003d4e
cmp eax, 0xa
jne 0x140003d57
cmp dword [rbp - 0x51], r12d
jne 0x140003d57
cmp dword [rbp - 0x4d], 0x55f0
lea rdx, str.Windows_10
jb 0x140003d4e
lea rdx, str.Windows_11
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rsi
jmp 0x140003d67
xor eax, eax
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret