Function at 0x1800043c0
Capabilities:
Check os version
Enumerate pe sections

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180026008]
xor rax, rsp
mov qword [rsp + 0x148], rax
xor edx, edx
mov dword [rsp + 0x20], 0x11c
mov r8d, 0x118
lea rcx, [rsp + 0x24]
call fcn.18000a5a0
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
mov rax, qword [rsp + 0x20]
shr rax, 0x20
movzx ecx, al
movzx eax, byte [rsp + 0x28]
shl cx, 8
or cx, ax
mov eax, 0x602
cmp cx, ax
jbe 0x180004756
lea rcx, [0x180023170]
mov qword [rsp + 0x160], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetProcessMitigationPolicy
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x18000474c
mov dword [rsp + 0x140], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rsp + 0x140]
mov rcx, rax
lea edx, [r9 + 3]
call rbx
test eax, eax
je 0x18000474c
mov eax, dword [rsp + 0x140]
and eax, 1
je 0x18000474c
mov qword [rsp + 0x168], rbp
lea rcx, str.ntdll
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x150], r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebp, ebp
xor r14d, r14d
xor r8d, r8d
mov rbx, rax
movsxd rdx, dword [rax + 0x3c]
lea r11, [rax + 0x18]
add r11, rdx
movzx ecx, word [rdx + rax + 0x14]
movzx r10d, word [rdx + rax + 6]
add r11, rcx
test r10d, r10d
je 0x180004528
lea rdi, str..text
movsxd r9, r8d
xor ecx, ecx
lea rax, [r9 + r9*4]
lea rdx, [r11 + rax*8]
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rdi + rcx - 1]
jne 0x1800045e4
cmp rcx, 6
jne 0x180004500
lea rax, [r9 + r9*4]
mov ebp, dword [r11 + rax*8 + 0xc]
mov r14d, dword [r11 + rax*8 + 8]
add rbp, rbx
xor edx, edx
mov dword [rsp + 0x20], 0x11c
mov r8d, 0x118
lea rcx, [rsp + 0x24]
call fcn.18000a5a0
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
mov rax, qword [rsp + 0x28]
lea rsi, str.AQAPQRPH
shr rax, 0x20
mov ecx, 0x17
cmp eax, 0x3839
mov edi, 0x13
cmova edi, ecx
lea rcx, str.ASARAQAPQRPH
cmova rsi, rcx
test r14, r14
je 0x1800045a2
mov rbx, rbp
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.180019310
test eax, eax
je 0x1800045f5
inc rbx
mov rax, rbx
sub rax, rbp
cmp rax, r14
jb 0x180004582
xor eax, eax
mov rdi, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x168]
mov r14, qword [rsp + 0x150]
mov rbx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.180009470
add rsp, 0x158
ret
inc r8d
cmp r8d, r10d
jl 0x1800044f2
jmp 0x180004528
test rbx, rbx
je 0x1800045a2
mov edx, 5
mov dword [rsp + 0x140], 0
lea r9, [rsp + 0x140]
mov rcx, rbx
lea r8d, [rdx + 0x3b]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x180026cc4]
lea r9, [rsp + 0x140]
mov r8d, dword [rsp + 0x140]
mov edx, 5
mov dword [rbx], eax
mov rcx, rbx
movzx eax, byte [0x180026cc8]
mov byte [rbx + 4], al
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.msvcrt.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180004742
lea rdx, str.longjmp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
test rax, rax
je 0x180004742
movzx r8d, word [0x180026cd0]
mov rcx, rax
mov r9d, dword [0x180026ccc]
cmp dword [rcx], r9d
jne 0x18000469f
cmp word [rcx + 4], r8w
je 0x1800046b8
inc rcx
mov rax, rcx
sub rax, rdx
cmp rax, 0x14
jb 0x180004693
mov eax, 1
jmp 0x1800045a4
test rcx, rcx
je 0x180004742
movsxd rax, dword [rcx + 6]
lea rdx, [rcx + 0xa]
add rdx, rax
je 0x180004742
mov eax, 0x8b48
cmp word [rdx], ax
jne 0x180004742
cmp byte [rdx + 2], 5
jne 0x180004742
cmp dword [rdx + 7], 0x48d18b48
jne 0x180004742
movsxd rbx, dword [rdx + 0xd]
lea r9, [rsp + 0x140]
movsxd rdi, dword [rdx + 3]
add rbx, 0x11
add rdi, rdx
mov dword [rsp + 0x140], 0
add rbx, rdx
mov edx, 8
lea rcx, [rdi + 7]
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rdi + 7], rbx
lea r9, [rsp + 0x140]
mov r8d, dword [rsp + 0x140]
lea rcx, [rdi + 7]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 1
jmp 0x1800045a4
mov eax, 1
jmp 0x1800045c4
mov eax, 1
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.180009470
add rsp, 0x158
ret