Function at 0x140001fc4
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x180
mov rax, qword [0x14000c038]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x114
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0x114
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov qword [rsp + 0x20], 0
cmp dword [rsp + 0x44], 6
ja 0x140002036
mov edx, 0xffffffa5
lea rcx, [0x1400039a0]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
jmp 0x1400021eb
cmp dword [rsp + 0x44], 6
jbe 0x1400021eb
cmp dword [rsp + 0x4c], 0x3839
jne 0x140002066
mov edx, 0xffffffb9
lea rcx, [0x140003a80]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
jmp 0x1400021eb
cmp dword [rsp + 0x4c], 0x3ad7
jne 0x14000208b
mov edx, 0xffffffb9
lea rcx, [0x140003a80]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
jmp 0x1400021eb
cmp dword [rsp + 0x4c], 0x3fab
jne 0x1400020ce
mov edx, 0xffffffb8
lea rcx, [0x140003a80]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400020c9
mov edx, 0xffffffb8
lea rcx, [0x140003b50]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
jmp 0x1400021eb
cmp dword [rsp + 0x4c], 0x42ee
jne 0x1400020f3
mov edx, 0xffffffc4
lea rcx, [0x140003c20]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
jmp 0x1400021eb
cmp dword [rsp + 0x4c], 0x4563
jne 0x140002118
mov edx, 0xffffffc1
lea rcx, [0x140003cd0]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
jmp 0x1400021eb
cmp dword [rsp + 0x4c], 0x47ba
je 0x14000212c
cmp dword [rsp + 0x4c], 0x47bb
jne 0x140002147
mov edx, 0xffffffbf
lea rcx, [0x140003d90]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
jmp 0x1400021eb
cmp dword [rsp + 0x4c], 0x4a61
je 0x140002179
cmp dword [rsp + 0x4c], 0x4a62
je 0x140002179
cmp dword [rsp + 0x4c], 0x4a63
je 0x140002179
cmp dword [rsp + 0x4c], 0x4a64
je 0x140002179
cmp dword [rsp + 0x4c], 0x4a65
jne 0x140002191
mov edx, 0xffffffb5
lea rcx, [0x140003e40]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
jmp 0x1400021eb
cmp dword [rsp + 0x4c], 0x55f0
jne 0x1400021b3
mov edx, 0xffffffb7
lea rcx, [0x140003f00]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
jmp 0x1400021eb
cmp dword [rsp + 0x4c], 0x585d
jne 0x1400021d5
mov edx, 0xffffffb5
lea rcx, [0x140003fc0]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
jmp 0x1400021eb
mov edx, 0xffffffb8
lea rcx, [0x140003b50]
call fcn.140002f0c
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400021fa
xor eax, eax
jmp 0x1400022fd
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
xor r8d, r8d
mov edx, 0x40
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmMapIoSpace]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x168]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov byte [rsp + 0x160], 0x48
mov byte [rsp + 0x161], 0xc7
mov byte [rsp + 0x162], 0xc0
mov byte [rsp + 0x163], 1
mov byte [rsp + 0x164], 0
mov byte [rsp + 0x165], 0
mov byte [rsp + 0x166], 0
mov byte [rsp + 0x167], 0xc3
cmp qword [rsp + 0x28], 0
je 0x1400022a7
mov r8d, 8
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x168]
call fcn.1400035c0
mov r8d, 8
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x28]
call fcn.1400035c0
mov rdx, qword [rsp + 0x198]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x28], 0
je 0x1400022ec
mov r8d, 8
lea rdx, [rsp + 0x168]
mov rcx, qword [rsp + 0x28]
call fcn.1400035c0
mov edx, 0x40
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmUnmapIoSpace]
cmp qword [rsp + 0x30], 0
je 0x1400022fb
mov rax, qword [rsp + 0x30]
jmp 0x1400022fd
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140003490
add rsp, 0x180
pop rdi
ret