Function at 0x1400039a0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x200
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov r13, rcx
mov dword [rsp + 0x40], 0x94
xor ebx, ebx
lea rcx, [rsp + 0x40]
mov edi, ebx
call qword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
jne 0x1400039ff
mov edi, 0x4b4
jmp 0x140003c25
mov eax, dword [rsp + 0x50]
mov ecx, 2
mov r14d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x44]
sub eax, 1
je 0x140003a79
sub eax, 1
je 0x140003a25
mov edi, 0x4ca
jmp 0x140003c25
mov esi, 1
mov word [0x14000de78], cx
movzx eax, cx
mov dword [0x14000c1ac], esi
mov dword [0x14000c1a8], esi
lea ecx, [rsi + 2]
cmp edx, ecx
ja 0x140003a68
mov eax, esi
mov word [0x14000de78], ax
jb 0x140003a5a
jne 0x140003a94
cmp r14d, 0x33
jae 0x140003a94
mov dword [0x14000c1ac], ebx
mov dword [0x14000c1a8], ebx
jmp 0x140003a94
cmp edx, 5
jb 0x140003a94
movzx eax, cx
mov word [0x14000de78], cx
jmp 0x140003a94
mov esi, 1
mov word [0x14000de78], bx
mov dword [0x14000c1ac], esi
movzx eax, bx
mov dword [0x14000c1a8], esi
cmp dword [0x14000cd14], ebx
jne 0x140003cce
test r13, r13
je 0x140003cce
movzx r15d, word [rsp + 0x4c]
lea r12, [r13 + 0x40]
neg ax
mov dword [rsp + 0x30], ebx
mov r10d, ebx
mov r11d, ebx
sbb rax, rax
and rax, 0xffffffffffffffc4
add r12, rax
movsxd r9, r11d
or eax, 0xffffffff
lea r8, [r9 + r9*2]
cmp edx, dword [r12 + r8*8]
jae 0x140003ade
mov ecx, eax
jmp 0x140003af0
jbe 0x140003ae4
mov ecx, esi
jmp 0x140003af0
cmp r14d, dword [r12 + r8*8 + 4]
jb 0x140003ada
mov ecx, ebx
seta cl
cmp edx, dword [r12 + r8*8 + 0xc]
jb 0x140003b09
jbe 0x140003afd
mov eax, esi
jmp 0x140003b09
cmp r14d, dword [r12 + r8*8 + 0x10]
jb 0x140003b09
mov eax, ebx
seta al
test ecx, ecx
js 0x140003bbd
test eax, eax
jg 0x140003bbd
test ecx, ecx
jne 0x140003b3b
test eax, eax
movzx eax, r15w
jne 0x140003b2e
cmp eax, dword [r12 + r8*8 + 8]
jb 0x140003b52
jmp 0x140003b47
cmp eax, dword [r12 + r8*8 + 8]
jae 0x140003be2
jmp 0x140003b52
test eax, eax
jne 0x140003be2
movzx eax, r15w
cmp eax, dword [r12 + r8*8 + 0x14]
jbe 0x140003be2
test r11d, r11d
je 0x140003bc2
mov edi, 0x54c
mov r9, rbx
mov r15, rbx
mov r14d, ebx
cmp edi, 0x54d
jne 0x140003b8c
mov edx, dword [r13 + 0x80]
lea r9, [rbp - 0x20]
movsxd rax, r10d
add rdx, 0x84
imul r12, rax, 0x3c
add r12, r13
add r12, rdx
test r12, r12
je 0x140003c4a
mov eax, dword [r12 + 0x34]
lea r15, [r13 + 0x84]
add r15, rax
mov eax, dword [r12 + 0x30]
test sil, al
je 0x140003c3c
mov r14d, 0x104
jmp 0x140003c4a
cmp r11d, esi
je 0x140003bd9
lea r10d, [r11 + 1]
mov dword [rsp + 0x30], r10d
mov r11d, r10d
cmp r10d, 2
jge 0x140003bde
jmp 0x140003aca
mov edi, 0x54c
test edi, edi
jne 0x140003c0f
cmp dword [r13 + 0x7c], ebx
je 0x140003cce
lea r9, [rsp + 0x30]
mov rcx, r13
lea rdx, [rbp - 0x20]
call fcn.140002628
test eax, eax
jne 0x140003cce
mov r10d, dword [rsp + 0x30]
mov edi, 0x54d
lea eax, [rdi - 0x54c]
cmp eax, esi
jbe 0x140003b5c
test edi, edi
je 0x140003cd0
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov dword [rsp + 0x20], FDIIsCabinet
jmp 0x140003cc5
and al, 2
neg al
sbb r14d, r14d
and r14d, 0x101
test byte [0x14000cd18], sil
jne 0x140003cb1
test r15, r15
je 0x140003cb1
cmp byte [r15], bl
je 0x140003cb1
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
call fcn.1400076d8
test eax, eax
je 0x140003c7c
call fcn.140007614
test eax, eax
mov eax, 0x180030
jne 0x140003c81
mov eax, 0x30
or eax, r14d
lea r8, [0x14000d578]
mov r9d, eax
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
test r14b, 4
je 0x140003ca4
cmp eax, 6
jmp 0x140003cab
test sil, r14b
je 0x140003cce
cmp eax, esi
jne 0x140003cce
mov edi, ebx
jmp 0x140003cce
mov eax, 0x30
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
lea r8, [0x14000d578]
mov edx, edi
xor ecx, ecx
call fcn.140004a70
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140007c20
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret