Function at 0x14009fe30
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r12d, r8d
mov rsi, rdx
mov rdi, rcx
cmp r8d, 4
jb 0x1400a0289
nop word [rax + rax]
movzx eax, byte [rsi + 2]
movzx r14d, byte [rsi + 3]
shl r14d, 8
or r14d, eax
lea eax, [r12 - 4]
cmp r14d, eax
ja 0x1400a0598
movzx ecx, byte [rsi + 1]
movzx eax, byte [rsi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x4453
ja 0x1400a010d
je 0x14009ff22
cmp ecx, 9
je 0x1400a01eb
cmp ecx, 0xc
je 0x14009febb
cmp ecx, 0x334d
je 0x1400a0129
jmp 0x1400a026d
movzx eax, byte [rsi + 6]
lea r8d, [r14 - 4]
movzx ebx, byte [rsi + 7]
lea rdx, [rsi + 8]
shl ebx, 8
xor ecx, ecx
add ebx, eax
movzx eax, byte [rsi + 5]
shl ebx, 8
add ebx, eax
movzx eax, byte [rsi + 4]
shl ebx, 8
add ebx, eax
call fcn.1400a3320
cmp ebx, eax
je 0x1400a026d
lea rdx, str._bad_CRC_for_extended_attributes_n
lea rcx, [rdi + 0xb08]
call fcn.140092700
mov r8d, eax
lea rdx, [rdi + 0xb08]
mov r9d, 1
mov rcx, rdi
call qword [rdi + 0x10df0]
jmp 0x1400a026d
cmp r14d, 5
jb 0x1400a02d2
cmp byte [rsi + 8], 0
jbe 0x14009ff3c
mov ebx, 0x4001
jmp 0x14009ffd6
movzx eax, byte [rsi + 6]
movzx ebx, byte [rsi + 7]
shl ebx, 8
add ebx, eax
movzx eax, byte [rsi + 5]
shl ebx, 8
add ebx, eax
movzx eax, byte [rsi + 4]
shl ebx, 8
add ebx, eax
je 0x14009ff6a
cmp r14d, 0xb
ja 0x14009ff6a
mov ebx, 0x4f
jmp 0x14009ffd6
mov ecx, ebx
call fcn.14012d1e8
mov rbp, rax
test rax, rax
jne 0x14009ff7e
lea ebx, [rax + 7]
jmp 0x14009ffd6
lea eax, [r14 - 5]
mov r8d, ebx
lea r9, [rsi + 9]
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, rdi
call fcn.1400a0620
mov ebx, eax
test eax, eax
jne 0x14009ffce
mov eax, dword [0x1402b84f8]
cmp eax, 0xffffffff
jne 0x14009ffe3
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x14009ffc2
mov dword [0x1402b84f8], 1
jmp 0x14009ffe7
mov dword [0x1402b84f8], 0
xor ebx, ebx
mov rcx, rbp
call fcn.140122088
test ebx, ebx
jne 0x1400a02d7
jmp 0x1400a026d
test eax, eax
je 0x14009ffcc
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
jne 0x14009fff9
lea ebx, [rax + 1]
jmp 0x14009ffce
lea r9, [rsp + 0x98]
mov rcx, rbp
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x1400a0020
lea ebx, [rax + 1]
jmp 0x14009ffce
cmp dword [rsp + 0x90], 0
je 0x1400a003e
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
jne 0x1400a003e
lea ebx, [rax + 1]
jmp 0x14009ffce
lea r9, [rsp + 0x98]
mov rcx, rbp
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
jne 0x1400a0068
lea ebx, [rax + 1]
jmp 0x14009ffce
cmp dword [rsp + 0x90], 0
je 0x1400a0089
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
jne 0x1400a0089
lea ebx, [rax + 1]
jmp 0x14009ffce
lea r8, [rsp + 0x98]
mov rcx, rbp
lea rdx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
test eax, eax
jne 0x1400a00ab
lea ebx, [rax + 1]
jmp 0x14009ffce
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400a00c7
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x1400a00c7
lea ebx, [rax + 1]
jmp 0x14009ffce
lea r8, [rsp + 0x98]
mov rcx, rbp
lea rdx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
test eax, eax
jne 0x1400a00e9
lea ebx, [rax + 1]
jmp 0x14009ffce
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14009ffcc
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x14009ffcc
lea ebx, [rax + 1]
jmp 0x14009ffce
cmp ecx, 0x4c41
je 0x1400a0129
cmp ecx, 0x6542
je 0x1400a0129
cmp ecx, 0x7441
jne 0x1400a026d
cmp ecx, 9
je 0x1400a01eb
cmp ecx, 0x334d
je 0x1400a01a8
cmp ecx, 0x4c41
je 0x1400a01eb
cmp ecx, 0x6542
je 0x1400a0165
cmp ecx, 0x7441
je 0x1400a0165
cmp r13d, 4
jb 0x1400a026d
jmp 0x1400a01f1
cmp r14d, 5
jb 0x1400a01a0
test byte [rsi + 8], 1
je 0x1400a01a0
movzx eax, byte [rsi + 6]
movzx ecx, byte [rsi + 7]
shl ecx, 8
add ecx, eax
movzx eax, byte [rsi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [rsi + 4]
shl ecx, 8
add ecx, eax
lea eax, [r14 - 5]
cmp ecx, eax
jne 0x1400a01a0
xor r13d, r13d
jmp 0x1400a026d
mov r13d, 5
jmp 0x1400a01f1
cmp r14d, 0xe
jb 0x1400a01e3
test byte [rsi + 8], 4
je 0x1400a01e3
movzx eax, byte [rsi + 6]
movzx ecx, byte [rsi + 7]
shl ecx, 8
add ecx, eax
movzx eax, byte [rsi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [rsi + 4]
shl ecx, 8
add ecx, eax
lea eax, [r14 - 0xe]
cmp ecx, eax
jne 0x1400a01e3
xor r13d, r13d
jmp 0x1400a026d
mov r13d, reloc.WS2_32.dll_ntohl
jmp 0x1400a01f1
mov r13d, 4
cmp r14d, 4
jb 0x1400a0468
movzx eax, byte [rsi + 6]
movzx ebx, byte [rsi + 7]
shl ebx, 8
add ebx, eax
movzx eax, byte [rsi + 5]
shl ebx, 8
add ebx, eax
movzx eax, byte [rsi + 4]
shl ebx, 8
add ebx, eax
je 0x1400a0229
lea eax, [r13 + 6]
cmp r14d, eax
jbe 0x1400a0468
mov ecx, ebx
call fcn.14012d1e8
mov r15, rax
test rax, rax
je 0x1400a0461
mov edx, r14d
lea r9d, [r13 + 4]
sub edx, r13d
add r9, rsi
mov dword [rsp + 0x20], edx
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.1400a0620
mov rcx, r15
mov ebp, eax
call fcn.140122088
test ebp, ebp
jne 0x1400a046d
mov eax, 0xfffffffc
lea ecx, [r14 + 4]
sub eax, r14d
add rsi, rcx
add r12d, eax
cmp r12d, 4
jae 0x14009fe60
cmp dword [rdi + 0x44], 0
jne 0x1400a02b8
lea rdx, str._OK_n
lea rcx, [rdi + 0xb08]
call fcn.140092700
mov r8d, eax
lea rdx, [rdi + 0xb08]
xor r9d, r9d
mov rcx, rdi
call qword [rdi + 0x10df0]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x4f
cmp dword [rdi + 0x44], 0
lea rbp, [rdi + 0xb08]
je 0x1400a031e
lea rdx, [rdi + 0x8b08]
lea rcx, [rdi + 0x10c5c]
call fcn.1400a0870
mov r8, rax
lea rdx, [0x14019c838]
mov rcx, rbp
call fcn.140092700
mov r8d, eax
mov r9d, 1
mov rdx, rbp
mov rcx, rdi
call qword [rdi + 0x10df0]
cmp ebx, 7
jg 0x1400a0370
cmp ebx, 6
jge 0x1400a035c
mov ecx, ebx
sub ecx, 1
je 0x1400a0348
cmp ecx, 1
jne 0x1400a0381
lea rdx, str._invalid_compressed_data_for_EAs_n
mov rcx, rbp
call fcn.140092700
jmp 0x1400a0445
lea rdx, str._EAs_fail_security_check_n
mov rcx, rbp
call fcn.140092700
jmp 0x1400a0445
lea rdx, str._out_of_memory_while_inflating_EAs_n
mov rcx, rbp
call fcn.140092700
jmp 0x1400a0445
cmp ebx, 0x4f
je 0x1400a042b
cmp ebx, 0x4001
je 0x1400a03f6
mov rcx, rbp
cmp bl, 2
je 0x1400a03b1
lea rdx, str._unknown_error_on_extended_attributes_n
call fcn.140092700
mov r8d, eax
mov r9d, 1
mov rdx, rbp
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebx
jmp 0x1400a02ba
mov eax, ebx
sar eax, 8
cmp ax, 8
jne 0x1400a03e4
lea rdx, str._bad_CRC_for_extended_attributes_n
call fcn.140092700
mov r8d, eax
mov r9d, 1
mov rdx, rbp
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebx
jmp 0x1400a02ba
movzx r8d, ax
lea rdx, str._unknown_compression_method_for_EAs___u__n
call fcn.140092700
jmp 0x1400a03c8
movzx r8d, byte [rsi + 8]
lea rdx, str._unsupported_NTSD_EAs_version__d_n
mov rcx, rbp
call fcn.140092700
mov r8d, eax
mov r9d, 1
mov rdx, rbp
mov rcx, rdi
call qword [rdi + 0x10df0]
mov ebx, 1
mov eax, ebx
jmp 0x1400a02ba
lea r8d, [r14 - 0xb]
mov rcx, rbp
lea r9, reloc.WS2_32.dll_ioctlsocket
lea rdx, str._compressed_WinNT_security_data_missing___d_bytes__s
call fcn.140092700
mov r9d, 1
mov r8d, eax
mov rdx, rbp
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebx
jmp 0x1400a02ba
mov ebp, 7
jmp 0x1400a046d
mov ebp, 0x4f
cmp dword [rdi + 0x44], 0
lea rbx, [rdi + 0xb08]
je 0x1400a04b4
lea rdx, [rdi + 0x8b08]
lea rcx, [rdi + 0x10c5c]
call fcn.1400a0870
mov r8, rax
lea rdx, [0x14019c838]
mov rcx, rbx
call fcn.140092700
mov r8d, eax
mov r9d, 1
mov rdx, rbx
mov rcx, rdi
call qword [rdi + 0x10df0]
cmp ebp, 2
je 0x1400a056d
cmp ebp, 5
jle 0x1400a04f7
cmp ebp, 7
jle 0x1400a04ee
cmp ebp, 0x4f
jne 0x1400a04f7
sub r14d, r13d
lea r9, reloc.WS2_32.dll_ioctlsocket
lea rdx, str._compressed_EA_data_missing___d_bytes__s
mov rcx, rbx
lea r8d, [r14 - 6]
call fcn.140092700
jmp 0x1400a057c
lea rdx, str._out_of_memory_while_inflating_EAs_n
jmp 0x1400a0574
mov rcx, rbx
cmp bpl, 2
je 0x1400a0528
lea rdx, str._unknown_error_on_extended_attributes_n
call fcn.140092700
mov r8d, eax
mov r9d, 1
mov rdx, rbx
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebp
jmp 0x1400a02ba
mov eax, ebp
sar eax, 8
cmp ax, 8
jne 0x1400a055b
lea rdx, str._bad_CRC_for_extended_attributes_n
call fcn.140092700
mov r8d, eax
mov r9d, 1
mov rdx, rbx
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebp
jmp 0x1400a02ba
movzx r8d, ax
lea rdx, str._unknown_compression_method_for_EAs___u__n
call fcn.140092700
jmp 0x1400a053f
lea rdx, str._invalid_compressed_data_for_EAs_n
mov rcx, rbx
call fcn.140092700
mov r9d, 1
mov r8d, eax
mov rdx, rbx
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebp
jmp 0x1400a02ba
cmp dword [rdi + 0x44], 0
je 0x1400a05e0
lea rdx, [rdi + 0x8b08]
lea rcx, [rdi + 0x10c5c]
call fcn.1400a0870
mov r8, rax
lea rdx, [0x14019c838]
lea rcx, [rdi + 0xb08]
call fcn.140092700
mov r8d, eax
lea rdx, [rdi + 0xb08]
mov r9d, 1
mov rcx, rdi
call qword [rdi + 0x10df0]
lea r9d, [r12 - 4]
mov r8d, r14d
lea rdx, str.bad_extra_field_entry:_n______EF_block_length___u_bytes__exceeds_remaining_EF_data___u_bytes__n
lea rcx, [rdi + 0xb08]
call fcn.140092700
mov r8d, eax
lea rdx, [rdi + 0xb08]
mov r9d, 1
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, 2
jmp 0x1400a02ba