Function at 0x18004c9e0
Capabilities:
Check os version
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov eax, dword [0x18009b3b8]
cmp eax, 1
jne 0x18004c9f6
xor eax, eax
add rsp, 0x28
ret
lea rcx, [0x18007e148]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x18004ca1f
mov eax, 0xe8000004
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.IsWow64Process
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009b558], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x18004cb1d
lea rdx, str.InitializeSRWLock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AcquireSRWLockExclusive
mov rcx, rbx
mov qword [0x18009b388], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AcquireSRWLockShared
mov rcx, rbx
mov qword [0x18009b390], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReleaseSRWLockExclusive
mov rcx, rbx
mov qword [0x18009b398], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ReleaseSRWLockShared
mov rcx, rbx
mov qword [0x18009b3a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetTickCount64
mov rcx, rbx
mov qword [0x18009b3a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x18009b388], 0
mov qword [0x18009b3b0], rax
je 0x18004d31f
cmp qword [0x18009b390], 0
je 0x18004d31f
cmp qword [0x18009b398], 0
je 0x18004d31f
cmp qword [0x18009b3a0], 0
je 0x18004d31f
cmp qword [0x18009b3a8], 0
je 0x18004d31f
test rax, rax
je 0x18004d31f
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 5
je 0x18004cb40
lea rdx, [0x18007e200]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009b5b8], rax
lea rcx, str.NTDLL.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x18004cb64
mov eax, 0xe8000005
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.ZwQueryInformationThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e248]
mov rcx, rbx
mov qword [0x18009b3c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwWriteVirtualMemory
mov rcx, rbx
mov qword [0x18009b3c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlInitUnicodeString
mov rcx, rbx
mov qword [0x18009b510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlFreeUnicodeString
mov rcx, rbx
mov qword [0x18009b418], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlCreateHeap
mov rcx, rbx
mov qword [0x18009b420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlAllocateHeap
mov rcx, rbx
mov qword [0x18009b428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlDestroyHeap
mov rcx, rbx
mov qword [0x18009b430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlFreeHeap
mov rcx, rbx
mov qword [0x18009b438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlUpcaseUnicodeChar
mov rcx, rbx
mov qword [0x18009b440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlDowncaseUnicodeChar
mov rcx, rbx
mov qword [0x18009b448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlUpcaseUnicodeString
mov rcx, rbx
mov qword [0x18009b450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlDowncaseUnicodeString
mov rcx, rbx
mov qword [0x18009b458], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlAnsiStringToUnicodeString
mov rcx, rbx
mov qword [0x18009b460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlUnicodeStringToAnsiString
mov rcx, rbx
mov qword [0x18009b468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e388]
mov rcx, rbx
mov qword [0x18009b470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwCreateSection
mov rcx, rbx
mov qword [0x18009b478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwOpenSection
mov rcx, rbx
mov qword [0x18009b480], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwMapViewOfSection
mov rcx, rbx
mov qword [0x18009b488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwUnmapViewOfSection
mov rcx, rbx
mov qword [0x18009b490], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009b498], rax
lea rdx, str.ZwReadFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwWriteFile
mov rcx, rbx
mov qword [0x18009b4a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwDeleteFile
mov rcx, rbx
mov qword [0x18009b4a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwQueryInformationFile
mov rcx, rbx
mov qword [0x18009b4b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwSetInformationFile
mov rcx, rbx
mov qword [0x18009b4b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwClose
mov rcx, rbx
mov qword [0x18009b4c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwCreateEvent
mov rcx, rbx
mov qword [0x18009b4c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwSetEvent
mov rcx, rbx
mov qword [0x18009b4d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwOpenEvent
mov rcx, rbx
mov qword [0x18009b4d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwWaitForSingleObject
mov rcx, rbx
mov qword [0x18009b4e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwResetEvent
mov rcx, rbx
mov qword [0x18009b4e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwQuerySystemInformation
mov rcx, rbx
mov qword [0x18009b3d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwQueryInformationProcess
mov rcx, rbx
mov qword [0x18009b3d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DbgPrint
mov rcx, rbx
mov qword [0x18009b3e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwQueryVirtualMemory
mov rcx, rbx
mov qword [0x18009b4f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwCreateThread
mov rcx, rbx
mov qword [0x18009b4f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwProtectVirtualMemory
mov rcx, rbx
mov qword [0x18009b500], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwWriteVirtualMemory
mov rcx, rbx
mov qword [0x18009b508], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwQueryObject
mov rcx, rbx
mov qword [0x18009b510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwOpenSymbolicLinkObject
mov rcx, rbx
mov qword [0x18009b518], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009b528], rax
lea rdx, str.ZwQuerySymbolicLinkObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwDuplicateObject
mov rcx, rbx
mov qword [0x18009b520], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwOpenDirectoryObject
mov rcx, rbx
mov qword [0x18009b530], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwOpenProcess
mov rcx, rbx
mov qword [0x18009b538], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e5c8]
mov rcx, rbx
mov qword [0x18009b540], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e5e0]
mov rcx, rbx
mov qword [0x18009b548], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwOpenKey
mov rcx, rbx
mov qword [0x18009b550], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e600]
mov rcx, rbx
mov qword [0x18009b560], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e610]
mov rcx, rbx
mov qword [0x18009b568], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e628]
mov rcx, rbx
mov qword [0x18009b570], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e638]
mov rcx, rbx
mov qword [0x18009b578], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e648]
mov rcx, rbx
mov qword [0x18009b580], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e658]
mov rcx, rbx
mov qword [0x18009b588], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e678]
mov rcx, rbx
mov qword [0x18009b590], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e690]
mov rcx, rbx
mov qword [0x18009b598], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwCreateKey
mov rcx, rbx
mov qword [0x18009b5a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ZwPlugPlayControl
mov rcx, rbx
mov qword [0x18009b5a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009b5b0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 5
jne 0x18004d32e
cmp qword [0x18009b3c8], 0
je 0x18004d31f
cmp qword [0x18009b3c0], 0
je 0x18004d31f
cmp qword [0x18009b510], 0
je 0x18004d31f
cmp qword [0x18009b418], 0
je 0x18004d31f
cmp qword [0x18009b420], 0
je 0x18004d31f
cmp qword [0x18009b428], 0
je 0x18004d31f
cmp qword [0x18009b430], 0
je 0x18004d31f
cmp qword [0x18009b438], 0
je 0x18004d31f
cmp qword [0x18009b440], 0
je 0x18004d31f
cmp qword [0x18009b448], 0
je 0x18004d31f
cmp qword [0x18009b458], 0
je 0x18004d31f
cmp qword [0x18009b460], 0
je 0x18004d31f
cmp qword [0x18009b468], 0
je 0x18004d31f
cmp qword [0x18009b470], 0
je 0x18004d31f
cmp qword [0x18009b478], 0
je 0x18004d31f
cmp qword [0x18009b480], 0
je 0x18004d31f
cmp qword [0x18009b488], 0
je 0x18004d31f
cmp qword [0x18009b490], 0
je 0x18004d31f
cmp qword [0x18009b498], 0
je 0x18004d31f
cmp qword [0x18009b4a0], 0
je 0x18004d31f
cmp qword [0x18009b4a8], 0
je 0x18004d31f
cmp qword [0x18009b4b0], 0
je 0x18004d31f
cmp qword [0x18009b4b8], 0
je 0x18004d31f
cmp qword [0x18009b4c0], 0
je 0x18004d31f
cmp qword [0x18009b4c8], 0
je 0x18004d31f
cmp qword [0x18009b4d0], 0
je 0x18004d31f
cmp qword [0x18009b4d8], 0
je 0x18004d31f
cmp qword [0x18009b4e0], 0
je 0x18004d31f
cmp qword [0x18009b4e8], 0
je 0x18004d31f
cmp qword [0x18009b3d0], 0
je 0x18004d31f
cmp qword [0x18009b3d8], 0
je 0x18004d31f
cmp qword [0x18009b4f0], 0
je 0x18004d31f
cmp qword [0x18009b4f8], 0
je 0x18004d31f
cmp qword [0x18009b500], 0
je 0x18004d31f
cmp qword [0x18009b508], 0
je 0x18004d31f
cmp qword [0x18009b518], 0
je 0x18004d31f
cmp qword [0x18009b3e0], 0
je 0x18004d31f
cmp qword [0x18009b520], 0
je 0x18004d31f
cmp qword [0x18009b528], 0
je 0x18004d31f
cmp qword [0x18009b530], 0
je 0x18004d31f
cmp qword [0x18009b538], 0
je 0x18004d31f
cmp qword [0x18009b540], 0
je 0x18004d31f
cmp qword [0x18009b548], 0
je 0x18004d31f
cmp qword [0x18009b550], 0
je 0x18004d31f
cmp qword [0x18009b560], 0
je 0x18004d31f
cmp qword [0x18009b568], 0
je 0x18004d31f
cmp qword [0x18009b570], 0
je 0x18004d31f
cmp qword [0x18009b580], 0
je 0x18004d31f
cmp qword [0x18009b588], 0
je 0x18004d31f
cmp qword [0x18009b598], 0
jne 0x18004d604
mov eax, 0xe8000007
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp qword [0x18009b3c8], 0
je 0x18004d31f
cmp qword [0x18009b3c0], 0
je 0x18004d31f
cmp qword [0x18009b510], 0
je 0x18004d31f
cmp qword [0x18009b418], 0
je 0x18004d31f
cmp qword [0x18009b420], 0
je 0x18004d31f
cmp qword [0x18009b428], 0
je 0x18004d31f
cmp qword [0x18009b430], 0
je 0x18004d31f
cmp qword [0x18009b438], 0
je 0x18004d31f
cmp qword [0x18009b440], 0
je 0x18004d31f
cmp qword [0x18009b448], 0
je 0x18004d31f
cmp qword [0x18009b450], 0
je 0x18004d31f
cmp qword [0x18009b458], 0
je 0x18004d31f
cmp qword [0x18009b460], 0
je 0x18004d31f
cmp qword [0x18009b468], 0
je 0x18004d31f
cmp qword [0x18009b470], 0
je 0x18004d31f
cmp qword [0x18009b478], 0
je 0x18004d31f
cmp qword [0x18009b480], 0
je 0x18004d31f
cmp qword [0x18009b488], 0
je 0x18004d31f
cmp qword [0x18009b490], 0
je 0x18004d31f
cmp qword [0x18009b498], 0
je 0x18004d31f
cmp qword [0x18009b4a0], 0
je 0x18004d31f
cmp qword [0x18009b4a8], 0
je 0x18004d31f
cmp qword [0x18009b4b0], 0
je 0x18004d31f
cmp qword [0x18009b4b8], 0
je 0x18004d31f
cmp qword [0x18009b4c0], 0
je 0x18004d31f
cmp qword [0x18009b4c8], 0
je 0x18004d31f
cmp qword [0x18009b4d0], 0
je 0x18004d31f
cmp qword [0x18009b4d8], 0
je 0x18004d31f
cmp qword [0x18009b4e0], 0
je 0x18004d31f
cmp qword [0x18009b4e8], 0
je 0x18004d31f
cmp qword [0x18009b3d0], 0
je 0x18004d31f
cmp qword [0x18009b3d8], 0
je 0x18004d31f
cmp qword [0x18009b4f0], 0
je 0x18004d31f
cmp qword [0x18009b4f8], 0
je 0x18004d31f
cmp qword [0x18009b500], 0
je 0x18004d31f
cmp qword [0x18009b508], 0
je 0x18004d31f
cmp qword [0x18009b518], 0
je 0x18004d31f
cmp qword [0x18009b3e0], 0
je 0x18004d31f
cmp qword [0x18009b520], 0
je 0x18004d31f
cmp qword [0x18009b528], 0
je 0x18004d31f
cmp qword [0x18009b530], 0
je 0x18004d31f
cmp qword [0x18009b538], 0
je 0x18004d31f
cmp qword [0x18009b540], 0
je 0x18004d31f
cmp qword [0x18009b548], 0
je 0x18004d31f
cmp qword [0x18009b550], 0
je 0x18004d31f
cmp qword [0x18009b560], 0
je 0x18004d31f
cmp qword [0x18009b568], 0
je 0x18004d31f
cmp qword [0x18009b570], 0
je 0x18004d31f
cmp qword [0x18009b578], 0
je 0x18004d31f
cmp qword [0x18009b580], 0
je 0x18004d31f
cmp qword [0x18009b588], 0
je 0x18004d31f
cmp qword [0x18009b590], 0
je 0x18004d31f
cmp qword [0x18009b598], 0
je 0x18004d31f
cmp qword [0x18009b5a0], 0
je 0x18004d31f
cmp qword [0x18009b5a8], 0
je 0x18004d31f
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 0x105
je 0x18004d61c
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 0x205
jne 0x18004d686
lea rdx, str.NtCreateKeyedEvent
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rbx
mov qword [0x18009b400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rbx
mov qword [0x18009b408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x18009b400], 0
mov qword [0x18009b410], rax
je 0x18004d31f
cmp qword [0x18009b408], 0
je 0x18004d31f
test rax, rax
je 0x18004d31f
mov rbx, qword [rsp + 0x20]
xor eax, eax
mov dword [0x18009b3b8], 1
add rsp, 0x28
ret