Function at 0x140001770
Capabilities:
Check os version
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
xor edx, edx
mov dword [rsp + 0x58], 0x4b005c
mov r8d, 0x208
mov dword [rsp + 0x5c], 0x6f006e
lea rcx, [rbp - 0x40]
mov dword [rsp + 0x60], 0x6e0077
mov dword [rsp + 0x64], 0x6c0044
xor r12d, r12d
mov dword [rsp + 0x68], 0x73006c
mov dword [rsp + 0x6c], 0x5c
call fcn.140002100
xorps xmm1, xmm1
mov qword [rbp + 0x228], r12
movups xmmword [rbp - 0x78], xmm1
mov qword [rbp + 0x230], r12
mov r14d, r12d
movups xmmword [rbp - 0x68], xmm1
mov dword [rbp + 0x220], r12d
mov r15d, r12d
movups xmmword [rbp - 0x58], xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov rdi, qword gs:[0x60]
cmp dword [rdi + 0x118], 0xa
jne 0x140001c5a
lea rdx, [0x1400041d0]
mov ecx, 0x34680c10
call section..text
test eax, eax
je 0x140001c5a
lea rdx, [0x1400041e8]
mov ecx, 0xa1f4eda3
call section..text
test eax, eax
je 0x140001c5a
lea rdx, [0x140004200]
mov ecx, 0xc4f94ea6
call section..text
test eax, eax
je 0x140001c5a
lea rdx, [0x140004170]
mov ecx, 0x206c9faf
call section..text
test eax, eax
je 0x140001c5a
lea rdx, [0x140004218]
mov ecx, 0xf93e03f4
call section..text
test eax, eax
je 0x140001c5a
lea rdx, [0x140004188]
mov ecx, 0x50766960
call section..text
test eax, eax
je 0x140001c5a
lea rdx, [0x1400041a0]
mov ecx, 0x2c2990f3
call section..text
test eax, eax
je 0x140001c5a
lea rdx, [0x1400041b8]
mov ecx, 0xfc9b10be
call section..text
test eax, eax
je 0x140001c5a
lea rdx, [0x140004230]
mov ecx, 0xa2dca869
call section..text
test eax, eax
je 0x140001c5a
lea rdx, [0x140004248]
mov ecx, 0xbd46162f
call section..text
test eax, eax
je 0x140001c5a
lea rdx, [0x140004260]
mov ecx, 0xa7537f54
call section..text
test eax, eax
je 0x140001c5a
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x2e8], rbx
mov rcx, qword [rax + 0x20]
mov rbx, qword [rcx]
cmp qword [rbx + 0x50], r12
je 0x140001c3d
mov qword [rsp + 0x2d8], r13
mov r13d, 0xec
mov qword [rsp + 0x2e0], rsi
nop word [rax + rax]
xor eax, eax
mov qword [rsp + 0x50], r12
lea rdi, [rsp + 0x70]
mov qword [rbp + 0x238], r12
mov ecx, 0x10
mov qword [rbp - 0x80], r12
rep stosb byte [rdi], al
lea rdi, [rbp - 0x78]
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdi, [rbp - 0x40]
mov ecx, 0x104
rep stosb byte [rdi], al
cmp word [rbx + 0x48], r13w
jae 0x140001c20
mov r9, qword [rbx + 0x50]
lea r8, [rsp + 0x58]
lea rdx, str._s_s
lea rcx, [rbp - 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp - 0x40]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400019c4
mov rdx, qword [0x1400041c8]
add ax, ax
mov ecx, dword [0x1400041b8]
xorps xmm0, xmm0
mov word [rsp + 0x70], ax
add ax, 2
mov word [rsp + 0x72], ax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x70]
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x78], 0x30
mov qword [rbp - 0x70], r12
mov dword [rbp - 0x60], 0x40
movdqu xmmword [rbp - 0x58], xmm0
mov rsi, qword [rbx + 0x20]
call fcn.140002130
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rsp + 0x50]
call fcn.140002152
test eax, eax
jns 0x140001a43
cmp eax, 0xc0000034
jne 0x140001bcf
mov rdx, qword [0x140004180]
mov ecx, dword [0x140004170]
call fcn.140002130
mov rcx, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x48], 2
lea r8, [rbp + 0x238]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r12
call fcn.140002152
test eax, eax
js 0x140001bcf
movsxd rdi, dword [rsi + 0x3c]
add rdi, rsi
cmp dword [rdi], 0x4550
jne 0x140001bcf
movzx r8d, word [rdi + 0x14]
mov rcx, r12
add r8, rdi
movzx edi, word [rdi + 6]
lea rdx, [r8 + 0x18]
test rdi, rdi
je 0x140001b19
nop dword [rax + rax]
mov eax, dword [rdx]
or eax, 0x20202020
cmp eax, 0x7865742e
je 0x140001aec
inc rcx
add rdx, 0x28
cmp rcx, rdi
jl 0x140001ad0
jmp 0x140001b19
lea rax, [rcx + rcx*4]
lea rcx, [r8 + rax*8]
mov eax, dword [r8 + rax*8 + 0x24]
add rax, rsi
mov qword [rbp + 0x228], rax
mov r14d, dword [rcx + 0x24]
mov r15d, dword [rcx + 0x20]
add r14, qword [rbp + 0x238]
mov qword [rbp + 0x230], r15
cmp qword [rbp + 0x228], r12
je 0x140001bcf
test r14, r14
je 0x140001bcf
cmp qword [rbp + 0x230], r12
je 0x140001bcf
mov rdx, qword [0x140004228]
mov ecx, dword [0x140004218]
call fcn.140002130
lea rax, [rbp + 0x220]
mov r9d, 0x40
lea r8, [rbp + 0x230]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x228]
mov rcx, 0xffffffffffffffff
call fcn.140002152
test eax, eax
js 0x140001bcf
mov rcx, qword [rbp + 0x228]
mov r8, r15
mov rdx, r14
call fcn.1400020a0
mov rdx, qword [0x140004228]
mov ecx, dword [0x140004218]
call fcn.140002130
mov r9d, dword [rbp + 0x220]
lea rax, [rbp + 0x220]
lea r8, [rbp + 0x230]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x228]
mov rcx, 0xffffffffffffffff
call fcn.140002152
cmp qword [rbp + 0x238], r12
je 0x140001bfd
mov rdx, qword [0x140004198]
mov ecx, dword [0x140004188]
call fcn.140002130
mov rdx, qword [rbp + 0x238]
mov rcx, 0xffffffffffffffff
call fcn.140002152
cmp qword [rsp + 0x50], r12
je 0x140001c20
mov rdx, qword [0x1400041b0]
mov ecx, dword [0x1400041a0]
call fcn.140002130
mov rcx, qword [rsp + 0x50]
call fcn.140002152
mov rbx, qword [rbx]
cmp qword [rbx + 0x50], r12
jne 0x140001960
mov r13, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2e0]
mov rbx, qword [rsp + 0x2e8]
mov eax, 1
add rsp, 0x2f0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x2f0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret