Function at 0x1800515c0
Capabilities:
Check os version

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x410
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0x400], rax
mov r14, r9
mov qword [rsp + 0xa0], r9
mov r15d, r8d
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0x80], rcx
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0x490]
mov qword [rsp + 0xb8], rcx
xor edi, edi
mov qword [r11 - 0x3b8], rdi
mov qword [r11 - 0x378], rdi
mov qword [r11 - 0x370], rdi
mov qword [r11 - 0x388], rdi
mov qword [r11 - 0x380], rdi
mov byte [rsp + 0x78], dil
mov eax, r8d
and eax, 0x40
mov dword [rsp + 0xa8], eax
mov byte [rsp + 0x79], dil
mov byte [rsp + 0x7a], dil
mov dword [rsp + 0x108], 0x4c004a
lea rax, str.LdrpResSearchResourceMappedFile_Enter
mov qword [r11 - 0x338], rax
mov dword [rsp + 0x128], 0x4a0048
lea rax, str.LdrpResSearchResourceMappedFile_Exit
mov qword [r11 - 0x318], rax
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800b63aa
mov eax, 0x7ffe0385
mov ecx, eax
mov al, byte [rcx]
mov r13d, 1
test r13b, al
jne 0x1800b63c6
mov r12d, 0x7ffe0384
mov word [rsp + 0x70], di
mov ebx, r15d
and ebx, 0x80
mov esi, dword [rsp + 0x470]
cmp esi, 3
je 0x180051956
mov r14d, ebx
test r15b, 0x10
je 0x180051a1e
mov eax, r14d
mov ecx, 0x60000
and eax, ecx
cmp eax, ecx
je 0x1800b640e
mov ecx, r14d
not ecx
mov eax, r15d
not eax
test al, 0x10
setne dl
bt ecx, 0x13
setb al
and dl, al
bt ecx, 0x11
setb al
and dl, al
setne r12b
mov word [rsp + 0x140], r13w
mov word [rsp + 0x144], di
test dl, dl
jne 0x1800519a7
cmp esi, 3
je 0x1800519a7
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x98]
mov eax, r14d
not eax
bt eax, 0x12
setae cl
test r15b, 0x10
sete al
and cl, al
bt r14d, 0x13
setae al
test al, cl
je 0x180051aaf
bt r14d, 0x11
mov ecx, edi
movzx eax, r12b
cmovae ecx, eax
mov r12b, cl
mov byte [rsp + 0x7c], cl
mov byte [rsp + 0x7b], cl
mov esi, edi
mov dword [rsp + 0x74], edi
mov qword [rsp + 0x88], rdi
mov word [rsp + 0x70], di
mov ebx, edi
movzx eax, word [rsp + 0x140]
cmp ebx, eax
jae 0x1800518e1
test r12b, r12b
jne 0x180051b07
mov qword [rsp + 0xe8], rdi
lea r11, [rsp + 0x70]
test r12b, r12b
cmovne r11, rdi
mov r10d, r15d
or r10d, 0x20
test r12b, r12b
cmove r10d, r15d
lea rax, [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
cmovne rax, rcx
mov rdx, qword [rsp + 0xc0]
test r12b, r12b
cmovne rdx, qword [rsp + 0xc8]
mov r9, qword [rsp + 0xd0]
cmovne r9, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x98]
cmovne r8, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
cmovne rcx, qword [rsp + 0x90]
mov qword [rsp + 0x60], r11
mov dword [rsp + 0x58], r10d
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x470]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.1800520d4
mov esi, eax
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0xa8], edi
jne 0x1800b6455
test esi, esi
jns 0x180051a08
test r12b, r12b
jne 0x1800b64eb
test esi, esi
jns 0x180051a08
test r12b, r12b
jne 0x180051c17
test esi, esi
jns 0x18005190a
mov al, byte [rsp + 0x7c]
mov r12b, al
test al, al
jne 0x180051c78
test esi, esi
jns 0x18005190a
test r12b, r12b
jne 0x18005179c
mov r12d, 0x7ffe0384
mov ebx, 1
mov r14d, 0x7ffe0385
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
jne 0x1800b6685
test byte [r14], bl
jne 0x1800b66a5
mov eax, esi
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.18008b0e0
add rsp, 0x410
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, word [r14 + 0x10]
mov word [rsp + 0x70], ax
test qword [r14], 0xffffffffffff0000
jne 0x18005196e
mov al, dil
jmp 0x180051984
lea rdx, [0x180114610]
mov rcx, qword [r14]
call sym.ntdll.dll__wcsicmp
test eax, eax
mov al, r13b
jne 0x180051969
mov byte [rsp + 0x78], al
jmp 0x180051701
test r15b, 0x10
je 0x1800519b7
test r15b, 0x20
jne 0x180051767
mov ecx, r15d
mov eax, r14d
or eax, 4
and cl, 4
cmove eax, r14d
mov r14d, eax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
mov r9d, r14d
movzx r8d, word [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov rdx, rsi
mov rbx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.180053480
test eax, eax
jns 0x180051777
jmp 0x1800b641c
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x1800518e1
jmp 0x1800b657b
mov r14d, ebx
cmp esi, r13d
jl 0x18005170e
cmp esi, 3
jg 0x18005170e
mov r14, qword [rsp + 0xa0]
jne 0x1800b6407
movzx ecx, word [r14 + 0x10]
mov rax, qword [r14]
sub rax, 0x10
test rax, 0xfffffffffffffff7
jne 0x180051c4c
mov eax, r15d
not eax
test al, 8
jne 0x180051adf
mov byte [rsp + 0x20], r13b
mov r9d, r15d
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
call sym.ntdll.dll_LdrResGetRCConfig
mov esi, eax
mov dword [rsp + 0x74], eax
test eax, eax
jns 0x180051bf9
cmp eax, 0xc000008a
jne 0x180051910
mov r14d, ebx
bts r14d, 0x13
mov esi, dword [rsp + 0x470]
jmp 0x18005170e
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
mov r8d, r15d
mov rdx, rsi
mov rcx, rbx
call sym.ntdll.dll_LdrpResGetResourceDirectory
test eax, eax
jns 0x18005179c
jmp 0x180051933
mov eax, 0xf3ff
test ax, cx
jne 0x180051a62
mov eax, 0xc00
cmp cx, ax
je 0x180051a62
or r15d, 0x10
mov r14d, ebx
jmp 0x18005170e
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], rdi
mov eax, ebx
movzx ecx, word [rsp + rax*8 + 0x144]
test cx, cx
je 0x180051be4
cmp dword [rsp + rax*8 + 0x148], 0xa
je 0x180051bee
mov word [rsp + 0x70], cx
test r12b, r12b
je 0x1800517e3
mov eax, r14d
bts eax, 0xc
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x90]
movzx edx, cx
mov rcx, qword [rsp + 0x80]
call sym.ntdll.dll_LdrLoadAlternateResourceModuleEx
mov esi, eax
mov dword [rsp + 0x74], eax
test eax, eax
js 0x180051c5c
mov byte [rsp + 0x79], r13b
cmp qword [rsp + 0x88], rdi
je 0x1800b642c
bt r15d, 0xc
jae 0x180051ba1
test esi, esi
js 0x1800518e1
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
mov r8d, r15d
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
call sym.ntdll.dll_LdrpResGetResourceDirectory
mov esi, eax
mov dword [rsp + 0x74], eax
test eax, eax
jns 0x1800517e3
add ebx, r13d
jmp 0x1800517ca
cmp dword [rsp + rax*8 + 0x148], 2
je 0x180051bdc
mov esi, 0xc000000d
mov dword [rsp + 0x74], esi
jmp 0x180051bdc
mov r9d, r15d
mov rdx, r14
mov rcx, qword [rsp + 0x80]
call fcn.180033ae0
mov r14d, eax
or r14d, ebx
jmp 0x180051aa3
bt r15d, 0x15
jb 0x1800518ea
mov r9d, dword [rsp + 0x470]
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
call fcn.18007a164
jmp 0x1800518ea
cmp byte [rsp + 0x78], dil
je 0x180051a62
jmp 0x180051a59
cmp eax, 0xc0000034
je 0x180051c6e
cmp eax, 0xc000003a
jne 0x180051bdc
mov esi, 0xc00b0001
jmp 0x180051bf3
cmp byte [rsp + 0x7a], dil
jne 0x180051c9b
cmp byte [rsp + 0x79], 0
jne 0x180051c9b
mov rcx, qword [rsp + 0x80]
call fcn.180054094
test eax, eax
jns 0x1800b6676
bt r14d, 0x12
jb 0x180051cb1
bts r14d, 0x11
mov r12b, byte [rsp + 0x7b]
jmp 0x1800518fd
mov r12b, dil
jmp 0x1800518fd
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22b
jmp 0x1800516cc
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov r12d, 0x7ffe0384
test eax, eax
je 0x1800b63ee
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22a
jmp 0x1800b63f1
mov rcx, r12
movzx edx, byte [rcx]
lea rcx, [rsp + 0x108]
call fcn.1800dbab0
nop
jmp 0x1800516e3
mov ecx, edi
jmp 0x180051a46
mov esi, 0xc000008a
mov dword [rsp + 0x74], esi
jmp 0x180051910
bt r15d, 0xc
jb 0x180051933
jmp 0x180051777
mov r9b, r13b
mov r8d, 0x200
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
call sym.ntdll.dll_LdrpResGetMappingSize
mov esi, eax
mov dword [rsp + 0x74], eax
jmp 0x180051b92
mov eax, r14d
not eax
bt eax, 0x12
jae 0x1800518c8
test esi, esi
js 0x1800518d0
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1800518c8
test r12b, r12b
je 0x1800518c8
mov rax, qword [rsp + 0xe0]
test rax, rax
je 0x1800b6498
mov r8, qword [rax]
jmp 0x1800b64a0
mov r8, qword [rsp + 0xe8]
mov byte [rsp + 0x20], r13b
mov rax, qword [rsp + 0xa0]
mov r9d, dword [rax + 0x18]
mov rdx, qword [rcx]
mov rcx, qword [rsp + 0x90]
call fcn.180069e8c
mov esi, eax
mov dword [rsp + 0x74], eax
test eax, eax
jns 0x1800518c8
mov rax, qword [rsp + 0xb0]
mov qword [rax], rdi
cmp esi, 0xc000007b
je 0x18005190a
jmp 0x1800518c8
mov byte [rsp + 0x20], r13b
mov r9d, 0x1000
lea r8, [rsp + 0x100]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
call sym.ntdll.dll_LdrResGetRCConfig
test eax, eax
js 0x180051bdc
mov byte [rsp + 0x20], dil
mov r9d, 0x1000
lea r8, [rsp + 0xf8]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
call sym.ntdll.dll_LdrResGetRCConfig
test eax, eax
js 0x180051bdc
mov rcx, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
mov rax, qword [rdx + 0x1c]
sub rax, qword [rcx + 0x1c]
jne 0x1800b656d
mov rax, qword [rdx + 0x24]
sub rax, qword [rcx + 0x24]
test rax, rax
je 0x1800518e1
jmp 0x180051bdc
cmp word [rsp + 0x70], di
jne 0x1800b658f
mov word [rsp + 0x350], di
mov r13d, edi
jmp 0x1800b65e7
lea rax, [rsp + 0x350]
mov qword [rsp + 0x120], rax
mov eax, 0xac
mov word [rsp + 0x11a], ax
movzx ecx, word [rsp + 0x70]
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x118]
call sym.ntdll.dll_RtlLcidToLocaleName
mov esi, eax
mov dword [rsp + 0x74], eax
test eax, eax
js 0x18005190a
movzx r13d, word [rsp + 0x118]
shr r13d, 1
mov rcx, qword [rsp + 0xb8]
cmp r13d, dword [rcx]
jae 0x1800b6638
mov r9, qword [rsp + 0xf0]
test r9, r9
je 0x1800b6638
mov eax, r13d
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [rsp + 0x350]
mov rcx, r9
call sym.ntdll.dll_RtlCopyMemory
lea eax, [r13 + 1]
mov rcx, qword [rsp + 0xb8]
mov dword [rcx], eax
mov rax, qword [rsp + 0xf0]
mov word [rbx + rax], di
mov r13d, 1
jmp 0x1800518e1
lea eax, [r13 + 1]
mov dword [rcx], eax
mov esi, 0xc0000023
mov dword [rsp + 0x74], esi
mov ebx, 1
mov r12d, 0x7ffe0384
lea r14d, [r12 + 1]
jmp 0x18005191b
bts r14d, 0x16
mov byte [rsp + 0x7a], r13b
jmp 0x180051ca7
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x90]
add r14, 0x22b
mov esi, dword [rsp + 0x74]
jmp 0x180051928
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800b66c9
mov rax, qword gs:[0x60]
mov r12, qword [rax + 0x90]
add r12, 0x22a
mov esi, dword [rsp + 0x74]
movzx edx, byte [r12]
lea rcx, [rsp + 0x128]
call fcn.1800dbab0
nop
jmp 0x180051931