Function at 0x1400012ad
Capabilities:
Check os version

Disassembly:
jmp 0x14000f950
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x140065210]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edi, edi
lea r13, [0x140056f3c]
mov r14, rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x48], rdi
mov r15, r13
lea rsi, [rcx + 0x4d70]
sub r15, rcx
mov dword [rcx + 0x50], edi
mov dword [rcx + 0x54], 1
mov dword [rcx + 0x58], edi
mov dword [rcx + 0x5c], edi
mov dword [rcx + 0x60], edi
lea r8, [r15 - 0xb1f0]
lea r9, [r15 - 0x6c]
mov dword [rcx + 0x64], edi
mov dword [rcx + 0x68], edi
lea rbx, [rcx + 0xb170]
lea rbp, [rcx + 0xa70]
lea r10, [rcx + 0xb1f0]
lea r11, [rcx + 0x6c]
lea r12d, [rdi + 0x20]
nop word [rax + rax]
mov edx, 0x28
mov rcx, r11
nop dword [rax + rax]
lea rax, [rdx + 0x7fffffd6]
test rax, rax
je 0x14000fa45
movzx eax, word [r9 + rcx]
test ax, ax
je 0x14000fa45
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000fa20
jmp 0x14000fa4a
test rdx, rdx
jne 0x14000fa4e
sub rcx, 2
mov word [rcx], di
mov edx, 0x104
lea rcx, [r10 - 0xa600]
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14000fa89
movzx eax, word [rcx + r8 + 0xa600]
test ax, ax
je 0x14000fa89
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000fa60
jmp 0x14000fa8e
test rdx, rdx
jne 0x14000fa92
sub rcx, 2
mov word [rcx], di
mov edx, 0x104
mov rcx, r10
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14000fac5
movzx eax, word [rcx + r8]
test ax, ax
je 0x14000fac5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000faa0
jmp 0x14000faca
test rdx, rdx
jne 0x14000face
sub rcx, 2
mov word [rcx], di
mov dword [rbx - 0x6480], edi
mov qword [rbp], rdi
mov dword [rbx], edi
mov rax, rsi
mov ecx, 0xc
nop word [rax + rax]
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
add rax, 0x40
dec rcx
mov qword [rax - 0x28], rdi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x10], rdi
mov qword [rax - 8], rdi
jne 0x14000faf0
mov qword [rax], rdi
mov qword [rax + 8], rdi
add r11, 0x50
add r10, 0x208
sub r9, 0x50
sub r8, 0x208
add rbp, 8
add rbx, 4
add rsi, 0x320
sub r12, 1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
jne 0x14000fa10
mov esi, 0x64
mov dword [r14 + 0xf370], edi
lea r11, [r14 + 0x17074]
lea r10, [r14 + 0x17528]
lea r9, [r14 + 0x131f4]
lea r8, [r15 - 0x131f4]
mov rbx, rsi
mov edx, 0x50
lea rcx, [r9 - 0x3e80]
nop dword [rax]
lea rax, [rdx + 0x7fffffae]
test rax, rax
je 0x14000fbb9
movzx eax, word [r8 + rcx + 0x3e80]
test ax, ax
je 0x14000fbb9
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000fb90
jmp 0x14000fbbe
test rdx, rdx
jne 0x14000fbc2
sub rcx, 2
mov word [rcx], di
mov edx, 0x50
mov rcx, r9
nop dword [rax]
lea rax, [rdx + 0x7fffffae]
test rax, rax
je 0x14000fbf5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000fbf5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000fbd0
jmp 0x14000fbfa
test rdx, rdx
jne 0x14000fbfe
sub rcx, 2
mov word [rcx], di
mov qword [r10 - 0x320], rdi
mov qword [r10], rdi
mov dword [r11], edi
add r11, 4
add r9, 0xa0
sub r8, 0xa0
add r10, 8
sub rbx, 1
jne 0x14000fb81
lea rcx, [r14 + 0x17848]
mov dword [r14 + 0x85ff0], edi
mov dword [r14 + 0x85ff4], edi
sub r13, rcx
mov edx, 0x104
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14000fc76
movzx eax, word [r13 + rcx]
test ax, ax
je 0x14000fc76
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000fc50
jmp 0x14000fc7b
test rdx, rdx
jne 0x14000fc7f
sub rcx, 2
mov word [rcx], di
lea r11, [r14 + 0x24570]
lea r10, [r14 + 0x17a50]
lea r8, [r15 - 0x24570]
lea r9, [r15 - 0x17a50]
nop
mov edx, 0x104
mov rcx, r10
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14000fcd5
movzx eax, word [r9 + rcx]
test ax, ax
je 0x14000fcd5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000fcb0
jmp 0x14000fcda
test rdx, rdx
jne 0x14000fcde
sub rcx, 2
mov word [rcx], di
mov edx, 0x7d0
mov rcx, r11
nop dword [rax]
lea rax, [rdx + 0x7ffff82e]
test rax, rax
je 0x14000fd15
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000fd15
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000fcf0
jmp 0x14000fd1a
test rdx, rdx
jne 0x14000fd1e
sub rcx, 2
add r10, 0x208
add r11, 0xfa0
sub r9, 0x208
sub r8, 0xfa0
sub rsi, 1
mov word [rcx], di
jne 0x14000fca0
cmp dword [r14 + 0x58], edi
jne 0x14000fdb0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x14000fdb0
mov eax, dword [rsp + 0x24]
cmp eax, 5
jne 0x14000fd80
cmp dword [rsp + 0x28], edi
seta dil
inc edi
mov dword [r14 + 0x58], edi
jmp 0x14000fdb0
cmp eax, 6
jne 0x14000fda6
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x14000fd97
mov dword [r14 + 0x58], 4
jmp 0x14000fdb0
cmp eax, 1
jne 0x14000fda6
mov dword [r14 + 0x58], 8
jmp 0x14000fdb0
jbe 0x14000fdb0
mov dword [r14 + 0x58], 0x80
mov rax, r14
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14001e890
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret