Function at 0x18004e790
Capabilities:
Check os version

Disassembly:
mov eax, dword [rcx]
and eax, 0xf000
cmp eax, 0x1000
je 0x18004e7d5
cmp eax, 0x2000
je 0x18004e7d0
cmp eax, 0x3000
je 0x18004e7cb
cmp eax, 0x4000
je 0x18004e7c5
cmp eax, 0x5000
je 0x18004e7c0
mov eax, 0xe800002b
ret
jmp 0x18005d850
mov eax, 0xc0000002
ret
jmp 0x18005d330
jmp 0x18005c2a0
jmp 0x180058d70
push rbx
sub rsp, 0x70
mov rbx, rcx
test rcx, rcx
je 0x180059129
cmp dword [rcx], 0x1600
jne 0x180059129
mov rcx, qword [rcx + 0x148]
mov qword [rsp + 0x60], r15
test rcx, rcx
je 0x180059119
cmp qword [rbx + 0x150], 0
je 0x180059119
cmp qword [rbx + 0x160], 0
je 0x180059119
cmp qword [rbx + 0x100], 0
je 0x180059119
xor edx, edx
mov qword [rsp + 0x90], rdi
call qword [0x18009b4d8]
mov edi, eax
test eax, eax
js 0x180058e94
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x68], r14
mov r14, qword [rbx + 0x170]
test r14, r14
je 0x18005910f
lea rsi, [rbx + 0xf0]
cmp qword [rsi], 0
je 0x18005910f
mov qword [rsp + 0x80], rbp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x98], r12
mov rcx, r14
call qword [0x18009b4e8]
xor r12d, r12d
mov ebp, eax
test eax, eax
js 0x180058e71
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 5
jne 0x180058e4d
mov edi, r12d
jmp 0x180058e71
mov r9d, 0x30
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r14
call qword [0x18009b3c8]
test eax, eax
mov ebp, eax
cmovns edi, dword [rsp + 0x30]
test ebp, ebp
jns 0x180058ea7
mov eax, ebp
mov r12, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x60]
add rsp, 0x70
pop rbx
ret
test edi, edi
jns 0x180058eaf
mov eax, edi
jmp 0x180058e77
mov rcx, qword [rbx + 0x170]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x170], r12
lea rbp, str.ptportpipe.c
test rsi, rsi
je 0x180058f14
mov r8, qword [rsi]
test r8, r8
je 0x180058f14
cmp byte [0x18009b380], r12b
je 0x180058f02
mov r9d, 0xa77
mov qword [rsp + 0x20], rbp
mov r8d, 0x50545250
lea rcx, [0x18009cc40]
mov rdx, rsi
call fcn.18004be40
jmp 0x180058f11
mov rcx, qword [0x18009ccf0]
xor edx, edx
call qword [0x18009b440]
mov qword [rsi], r12
lea rcx, [rbx + 0x160]
call fcn.180055a50
test eax, eax
js 0x180058e77
mov rcx, qword [rbx + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x100]
mov qword [rbx + 0x148], r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x150]
mov qword [rbx + 0x100], r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xa8]
mov qword [rbx + 0x150], r12
test rcx, rcx
je 0x180058f7d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xa8], r12
cmp byte [rbx + 0xe4], r12b
je 0x1800590c8
cmp qword [rbx + 0x78], r12
lea rdi, [rbx + 0x78]
je 0x1800590d4
lea rsi, [rbx + 0x88]
cmp qword [rsi], r12
je 0x1800590d4
lea r14, [rbx + 0x98]
cmp qword [r14], r12
je 0x1800590d4
cmp qword [rbx + 0x158], r12
je 0x1800590d4
test rdi, rdi
je 0x18005900f
mov r8, qword [rdi]
test r8, r8
je 0x18005900f
cmp byte [0x18009b380], r12b
je 0x180058ffd
mov r9d, 0xaa6
mov qword [rsp + 0x20], rbp
mov r8d, 0x50545250
lea rcx, [0x18009cc40]
mov rdx, rdi
call fcn.18004be40
jmp 0x18005900c
mov rcx, qword [0x18009ccf0]
xor edx, edx
call qword [0x18009b440]
mov qword [rdi], r12
test rsi, rsi
je 0x180059059
mov r8, qword [rsi]
test r8, r8
je 0x180059059
cmp byte [0x18009b380], r12b
je 0x180059047
mov r9d, 0xaa7
mov qword [rsp + 0x20], rbp
mov r8d, 0x50545250
lea rcx, [0x18009cc40]
mov rdx, rsi
call fcn.18004be40
jmp 0x180059056
mov rcx, qword [0x18009ccf0]
xor edx, edx
call qword [0x18009b440]
mov qword [rsi], r12
test r14, r14
je 0x1800590a3
mov r8, qword [r14]
test r8, r8
je 0x1800590a3
cmp byte [0x18009b380], r12b
je 0x180059091
mov r9d, 0xaa8
mov qword [rsp + 0x20], rbp
mov r8d, 0x50545250
lea rcx, [0x18009cc40]
mov rdx, r14
call fcn.18004be40
jmp 0x1800590a0
mov rcx, qword [0x18009ccf0]
xor edx, edx
call qword [0x18009b440]
mov qword [r14], r12
mov rcx, qword [rbx + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
mov qword [rbx + 0x158], r12
call fcn.18004f050
test eax, eax
jns 0x180059108
jmp 0x180058e77
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
jne 0x1800590de
mov eax, 0xe8000011
jmp 0x180058e77
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
mov qword [rbx + 0xb0], r12
call fcn.18004f4b0
test eax, eax
js 0x180058e77
xor eax, eax
jmp 0x180058e77
mov eax, 0xe8000011
jmp 0x180058e87
mov eax, 0xe8000011
mov r15, qword [rsp + 0x60]
add rsp, 0x70
pop rbx
ret
mov eax, 0xc00000ef
add rsp, 0x70
pop rbx
ret
push rbx
sub rsp, 0x70
mov rbx, rcx
test rcx, rcx
je 0x18005c58d
mov eax, dword [rcx]
and eax, 0xf000
cmp eax, 0x2000
jne 0x18005c58d
mov rcx, qword [rcx + 0x148]
mov qword [rsp + 0x68], r14
test rcx, rcx
je 0x18005c324
cmp qword [rbx + 0x150], 0
je 0x18005c324
cmp qword [rbx + 0xb0], 0
je 0x18005c324
cmp qword [rbx + 0xa8], 0
je 0x18005c324
cmp qword [rbx + 0x100], 0
je 0x18005c324
cmp qword [rbx + 0x160], 0
je 0x18005c324
cmp byte [rbx + 0xe4], 1
jne 0x18005c334
cmp qword [rbx + 0x170], 0
je 0x18005c324
cmp qword [rbx + 0x158], 0
jne 0x18005c352
mov eax, 0xe8000011
mov r14, qword [rsp + 0x68]
add rsp, 0x70
pop rbx
ret
cmp qword [rbx + 0x170], 0
je 0x18005c324
cmp qword [rbx + 0xd8], 0
je 0x18005c324
cmp qword [rbx + 0xd0], 0
je 0x18005c324
xor edx, edx
call qword [0x18009b4d8]
test eax, eax
js 0x18005c3b1
mov rcx, qword [rbx + 0x170]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x90], rdi
call qword [0x18009b4e8]
mov edi, eax
test eax, eax
js 0x18005c3a9
mov qword [rsp + 0x80], rbp
mov rbp, qword [rbx + 0x170]
mov qword [rsp + 0x60], r15
test rbp, rbp
jne 0x18005c3bc
mov eax, 0xc00000ef
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x68]
add rsp, 0x70
pop rbx
ret
xor r8d, r8d
mov qword [rsp + 0x88], rsi
xor edx, edx
mov rcx, rbp
call qword [0x18009b4e8]
xor r15d, r15d
mov esi, eax
test eax, eax
js 0x18005c412
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 5
jne 0x18005c3ec
mov edi, r15d
jmp 0x18005c410
mov r9d, 0x30
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbp
call qword [0x18009b3c8]
test eax, eax
mov esi, eax
cmovns edi, dword [rsp + 0x30]
mov eax, esi
test esi, esi
mov rsi, qword [rsp + 0x88]
js 0x18005c39c
test edi, edi
jns 0x18005c42d
mov eax, edi
jmp 0x18005c39c
mov rcx, qword [rbx + 0x170]
call qword [0x18009b4c8]
lea rdi, [rbx + 0x88]
mov qword [rbx + 0x170], r15
cmp qword [rdi], r15
je 0x18005c49e
test rdi, rdi
je 0x18005c49e
mov r8, qword [rdi]
test r8, r8
je 0x18005c49e
cmp byte [0x18009b380], r15b
je 0x18005c48c
lea rax, str.ptportshmem.c
mov r9d, 0x238
mov r8d, 0x4d545250
mov qword [rsp + 0x20], rax
mov rdx, rdi
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x18005c49b
mov rcx, qword [0x18009ccf0]
xor edx, edx
call qword [0x18009b440]
mov qword [rdi], r15
lea rcx, [rbx + 0x160]
call fcn.180055a50
test eax, eax
js 0x18005c39c
mov rcx, qword [rbx + 0x148]
call qword [0x18009b4c8]
mov rcx, qword [rbx + 0x150]
mov qword [rbx + 0x148], r15
call qword [0x18009b4c8]
mov rcx, qword [rbx + 0x100]
mov qword [rbx + 0x150], r15
call qword [0x18009b4c8]
cmp byte [rbx + 0xe4], 1
mov qword [rbx + 0x100], r15
jne 0x18005c50b
mov rcx, qword [rbx + 0x158]
call qword [0x18009b4c8]
mov qword [rbx + 0x158], r15
mov rdx, qword [rbx + 0xb0]
or rcx, 0xffffffffffffffff
call qword [0x18009b498]
test eax, eax
js 0x18005c39c
mov rcx, qword [rbx + 0xa8]
mov qword [rbx + 0xb0], r15
call qword [0x18009b4c8]
cmp byte [rbx + 0xe4], 1
mov qword [rbx + 0xa8], r15
jne 0x18005c555
mov rcx, rbx
call fcn.18004f050
jmp 0x18005c39c
mov rcx, qword [rbx + 0xd0]
xor edx, edx
call qword [0x18009b4d8]
test eax, eax
js 0x18005c39c
mov rcx, qword [rbx + 0xd0]
call qword [0x18009b4c8]
mov rcx, rbx
mov qword [rbx + 0xd0], r15
call fcn.18004f4b0
jmp 0x18005c39c
mov eax, 0xc00000ef
add rsp, 0x70
pop rbx
ret
push rbx
sub rsp, 0x40
mov rbx, rcx
test rcx, rcx
jne 0x18005d349
mov eax, 0xc00000ef
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x38], r14
lea r14, [rcx + 0x88]
cmp qword [r14], 0
je 0x18005d4ef
cmp qword [rcx + 0x160], 0
je 0x18005d4ef
cmp byte [rcx + 0xe4], 1
jne 0x18005d390
mov rbp, qword [rsp + 0x50]
mov eax, 0xc00000bb
mov r14, qword [rsp + 0x38]
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rcx + 0x148]
test rcx, rcx
je 0x18005d4ef
cmp qword [rbx + 0xb8], 0
je 0x18005d4ef
cmp dword [rbx + 0x1f0], 0
je 0x18005d3c5
cmp qword [rbx + 0x170], 0
je 0x18005d4ef
xor edx, edx
call qword [0x18009b4d8]
test eax, eax
js 0x18005d4df
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r15
xor r15d, r15d
mov edi, r15d
cmp dword [rbx + 0x1f0], r15d
jbe 0x18005d443
nop dword [rax]
nop word [rax + rax]
mov eax, edi
lea rsi, [rbx + rax*8]
mov rcx, qword [rsi + 0x170]
test rcx, rcx
je 0x18005d439
xor r8d, r8d
xor edx, edx
call qword [0x18009b4e8]
test eax, eax
js 0x18005d4d0
mov rcx, qword [rsi + 0x170]
call qword [0x18009b4c8]
mov qword [rsi + 0x170], r15
inc edi
cmp edi, dword [rbx + 0x1f0]
jb 0x18005d400
mov rcx, qword [rbx + 0xb8]
call qword [0x18009b4c8]
mov rcx, qword [rbx + 0x148]
mov qword [rbx + 0xb8], r15
call qword [0x18009b4c8]
lea rcx, [rbx + 0x160]
mov qword [rbx + 0x148], r15
call fcn.180055a50
test r14, r14
je 0x18005d4c8
mov r8, qword [r14]
test r8, r8
je 0x18005d4c8
cmp byte [0x18009b380], r15b
je 0x18005d4b6
lea rax, str.ptportflt.c
mov r9d, 0x58a
mov r8d, 0x46545250
mov qword [rsp + 0x20], rax
mov rdx, r14
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x18005d4c5
mov rcx, qword [0x18009ccf0]
xor edx, edx
call qword [0x18009b440]
mov qword [r14], r15
mov rcx, rbx
call fcn.18004f4b0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x38]
add rsp, 0x40
pop rbx
ret
mov rbp, qword [rsp + 0x50]
mov eax, 0xe8000011
mov r14, qword [rsp + 0x38]
add rsp, 0x40
pop rbx
ret
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xe4], 0
mov rbx, rcx
jne 0x18005d87f
mov rcx, qword [rcx + 0xa8]
test rcx, rcx
je 0x18005d87f
call qword [0x18009b4c8]
mov qword [rbx + 0xa8], 0
xor eax, eax
add rsp, 0x20
pop rbx
ret