Function at 0x140002ec3
Capabilities:
Check os version
Get common file path

Disassembly:
jmp 0x14000a210
push rbx
push rdi
push r13
push r14
sub rsp, 0x168
mov rax, qword [0x14009a7a8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov r8b, 3
mov edx, 4
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x11c
mov rbx, rax
call fcn.140002be9
mov r14d, 0x23f0
lea rcx, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x3c], r14d
mov edx, 4
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
mov r13d, 0x1db0
cmovne r13d, r14d
cmp qword [rdi + 0x20], 0
jne 0x14000a75f
cmp qword [rdi], 0
jne 0x14000a75f
mov qword [rsp + 0x198], rbp
xor edi, edi
mov qword [rsp + 0x1a0], rsi
mov esi, 0x5c
mov qword [rsp + 0x1a8], r12
mov qword [rsp + 0x160], r15
cmp r13d, r14d
jae 0x14000a33c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
lea ecx, [rax + 1]
lea rdx, [rcx*2 + 0x14]
lea ecx, [rsi - 0x1c]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
jne 0x14000a2f4
mov ebp, edi
jmp 0x14000a343
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [rbp + rcx*2], si
je 0x14000a316
mov word [rbp + r9*2], si
inc r9d
mov r8d, edi
lea r10, str.msasn1.dll
mov edx, r8d
lea ecx, [r8 + r9]
inc r8d
movzx eax, word [r10 + rdx*2]
mov word [rbp + rcx*2], ax
cmp r8d, 0xa
jb 0x14000a320
jmp 0x14000a343
lea rbp, str.msasn1.dll
cmp r13d, r14d
jae 0x14000a3cc
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
lea ecx, [rax + 1]
lea rdx, [rcx*2 + 0x16]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
jne 0x14000a37b
mov r12, rdi
jmp 0x14000a3d3
mov edx, ebx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [r12 + rcx*2], si
je 0x14000a39c
mov word [r12 + r9*2], si
inc r9d
mov r8d, edi
lea r10, str.profapi.dll
nop word [rax + rax]
mov edx, r8d
lea ecx, [r8 + r9]
inc r8d
movzx eax, word [r10 + rdx*2]
mov word [r12 + rcx*2], ax
cmp r8d, 0xb
jb 0x14000a3b0
jmp 0x14000a3d3
lea r12, str.profapi.dll
cmp r13d, r14d
jae 0x14000a45c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
lea ecx, [rax + 1]
lea rdx, [rcx*2 + 0x18]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
jne 0x14000a40b
mov r15, rdi
jmp 0x14000a463
mov edx, ebx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [r15 + rcx*2], si
je 0x14000a42c
mov word [r15 + r9*2], si
inc r9d
mov r8d, edi
lea r10, str.wtsapi32.dll
nop word [rax + rax]
mov edx, r8d
lea ecx, [r8 + r9]
inc r8d
movzx eax, word [r10 + rdx*2]
mov word [r15 + rcx*2], ax
cmp r8d, 0xc
jb 0x14000a440
jmp 0x14000a463
lea r15, str.wtsapi32.dll
cmp r13d, r14d
jae 0x14000a4ec
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
lea ecx, [rax + 1]
lea rdx, [rcx*2 + 0x18]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x14000a49b
mov r14, rdi
jmp 0x14000a4f3
mov edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [r14 + rcx*2], si
je 0x14000a4bc
mov word [r14 + r9*2], si
inc r9d
mov r8d, edi
lea r10, str.msvcp140.dll
nop word [rax + rax]
mov edx, r8d
lea ecx, [r8 + r9]
inc r8d
movzx eax, word [r10 + rdx*2]
mov word [r14 + rcx*2], ax
cmp r8d, 0xc
jb 0x14000a4d0
jmp 0x14000a4f3
lea r14, str.msvcp140.dll
cmp r13d, 0x23f0
jae 0x14000a57b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
lea ecx, [rax + 1]
lea rdx, [rcx*2 + 0x16]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x14000a52b
mov rsi, rdi
jmp 0x14000a582
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x14000a551
mov eax, 0x5c
mov word [rsi + r9*2], ax
inc r9d
mov r8d, edi
lea r10, str.version.dll
nop dword [rax + rax]
mov edx, r8d
lea ecx, [r8 + r9]
inc r8d
movzx eax, word [r10 + rdx*2]
mov word [rsi + rcx*2], ax
cmp r8d, 0xb
jb 0x14000a560
jmp 0x14000a582
lea rsi, str.version.dll
cmp r13d, 0x23f0
jae 0x14000a61b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x40
mov edi, eax
lea edx, [rax + 1]
lea rdx, [rdx*2 + 0x10]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x14000a5c1
xor r11d, r11d
mov ebx, r11d
jmp 0x14000a625
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
lea ecx, [r9 - 1]
cmp word [rbx + rcx*2], 0x5c
je 0x14000a5e7
mov eax, 0x5c
mov word [rbx + r9*2], ax
inc r9d
xor r11d, r11d
lea r10, str.wldp.dll
mov r8d, r11d
nop dword [rax]
nop dword [rax + rax]
mov edx, r8d
lea ecx, [r8 + r9]
inc r8d
movzx eax, word [r10 + rdx*2]
mov word [rbx + rcx*2], ax
cmp r8d, 8
jb 0x14000a600
jmp 0x14000a625
lea rbx, str.wldp.dll
xor r11d, r11d
cmp r13d, 0x23f0
mov edi, 0x800
mov rcx, rbp
cmovb edi, r11d
xor edx, edx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x20], rax
test rax, rax
jne 0x14000a657
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, edi
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
test rax, rax
jne 0x14000a678
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, edi
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 8], rax
test rax, rax
jne 0x14000a69a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, edi
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
test rax, rax
jne 0x14000a6bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, edi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x18], rax
test rax, rax
jne 0x14000a6de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, edi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x28], rax
test rax, rax
jne 0x14000a700
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp r13d, 0x23f0
jae 0x14000a73f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, qword [rsp + 0x1a8]
mov rsi, qword [rsp + 0x1a0]
mov rbp, qword [rsp + 0x198]
mov r15, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140001d20
add rsp, 0x168
pop r14
pop r13
pop rdi
pop rbx
ret