Function at 0x1800012a0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x78
mov rax, rcx
xor ebp, ebp
lea rsi, str.clr.dll
mov rdi, rdx
mov ecx, 8
mov rbx, r8
repe cmpsw word [rsi], word [rdi]
mov r13, rdx
mov r12d, ebp
je 0x1800017d9
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x1800017d9
lea r8d, [rbp + 2]
xor r9d, r9d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r15, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1800017bb
lea edx, [rbp + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1800017aa
movsxd rbp, dword [rax + 0x3c]
lea r9d, [r12 + 4]
xor ecx, ecx
add rbp, rax
mov r8d, 0x3000
mov edx, dword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rbp + 0x54]
mov rsi, r14
mov rdi, rax
mov r12, rax
mov qword [rsp + 0x48], rax
xor eax, eax
rep movsb byte [rdi], byte [rsi]
movsxd rdx, dword [r14 + 0x3c]
mov r8d, eax
cmp ax, word [rbp + 6]
jae 0x1800013e0
lea rdx, [rdx + r14 + 0x11c]
nop dword [rax + rax]
mov esi, dword [rdx]
mov edi, dword [rdx - 8]
mov ecx, dword [rdx - 4]
add rsi, r14
add rdi, r12
inc r8d
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rbp + 6]
add rdx, 0x28
cmp r8d, eax
jb 0x1800013c0
movsxd r10, dword [r12 + 0x3c]
add r10, r12
mov r8, qword [r10 + 0x30]
mov qword [r10 + 0x30], rbx
mov ecx, dword [r10 + 0xb4]
test ecx, ecx
je 0x180001511
mov eax, dword [r10 + 0xb0]
add rcx, rax
lea r9, [rax + r12]
add rcx, r12
cmp r9, rcx
jae 0x180001511
nop dword [rax]
mov eax, dword [r9 + 4]
test eax, eax
je 0x180001511
mov edx, dword [r9]
lea rsi, [rax - 8]
lea rdi, [r9 + 8]
shr rsi, 1
add rdx, r12
test esi, esi
je 0x1800014ed
nop word [rax + rax]
movzx ecx, word [rdi]
dec esi
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x18000147a
and ecx, 0xfff
sub qword [rcx + rdx], r8
movzx eax, word [rdi]
and eax, 0xfff
add qword [rax + rdx], rbx
jmp 0x1800014e1
cmp ax, 3
jne 0x180001497
and ecx, 0xfff
sub dword [rcx + rdx], r8d
movzx eax, word [rdi]
and eax, 0xfff
add dword [rax + rdx], ebx
jmp 0x1800014e1
cmp ax, 1
jne 0x1800014c4
and ecx, 0xfff
mov rax, r8
shr rax, 0x10
sub word [rcx + rdx], ax
movzx ecx, word [rdi]
mov rax, rbx
and ecx, 0xfff
shr rax, 0x10
add word [rcx + rdx], ax
jmp 0x1800014e1
cmp ax, 2
jne 0x1800014e1
and ecx, 0xfff
sub word [rcx + rdx], r8w
movzx eax, word [rdi]
and eax, 0xfff
add word [rax + rdx], bx
add rdi, 2
test esi, esi
jne 0x180001450
mov eax, dword [r9 + 4]
mov ecx, dword [r10 + 0xb4]
add r9, rax
mov eax, dword [r10 + 0xb0]
add rax, r12
add rcx, rax
cmp r9, rcx
jb 0x180001420
cmp dword [r10 + 0x94], 0
je 0x18000179c
mov r15d, dword [r10 + 0x90]
add r15, r12
cmp dword [r15], 0
je 0x180001797
movabs rbp, 0x8000000000000000
nop dword [rax]
mov edi, dword [r15 + 0xc]
mov edx, 0x104
add rdi, r12
mov rcx, rdi
call fcn.180002de0
mov edx, 2
lea rcx, [rax + 1]
mov rsi, rax
call fcn.180002af0
mov r14, rax
test rax, rax
je 0x180001784
lea r8, [rsi + 1]
lea rcx, [rsp + 0x60]
mov r9, rdi
mov rdx, rax
mov qword [rsp + 0x20], rsi
call fcn.180003168
lea rdx, str.api_
mov r8d, 4
mov rcx, r14
call fcn.180002cf0
test eax, eax
je 0x1800015c0
lea rdx, str.ext_
mov r8d, 4
mov rcx, r14
call fcn.180002cf0
test eax, eax
jne 0x180001719
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x68]
mov qword [rsp + 0xc8], rdx
mov eax, dword [rcx]
cmp eax, 6
jne 0x1800016ad
mov rax, qword gs:[0x60]
mov r13d, edx
mov rbp, qword [rax + 0x68]
cmp dword [rbp + 0xc], edx
jbe 0x180001681
lea r12, [rbp + 0x28]
nop
mov ecx, dword [r12 - 8]
mov r8d, dword [r12]
mov rdx, r14
add rcx, rbp
shr r8, 1
call fcn.180002cf0
test eax, eax
jne 0x180001672
mov ecx, dword [r12 + 4]
mov eax, dword [r12 + 8]
add rcx, rbp
dec eax
movsxd rdi, eax
js 0x180001672
lea rax, [rdi + rdi*4]
lea rsi, [rcx + rax*4 + 8]
nop dword [rax + rax]
mov ecx, dword [rsi - 4]
mov ebx, dword [rsi + 4]
mov eax, dword [rsi]
add rcx, rbp
add rbx, rbp
test eax, eax
je 0x1800016a5
mov rdx, qword [rsp + 0xb8]
mov r8d, eax
shr r8, 1
call fcn.180002cf0
test eax, eax
je 0x1800016a5
sub rsi, 0x14
dec rdi
jns 0x180001640
inc r13d
add r12, 0x18
cmp r13d, dword [rbp + 0xc]
jb 0x180001600
xor edx, edx
mov rdi, qword [rsp + 0xc8]
mov rbx, rdx
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0xb8]
movabs rbp, 0x8000000000000000
jmp 0x1800016ea
mov edi, dword [rsi + 8]
shr rdi, 1
jmp 0x18000168c
cmp eax, 4
jne 0x1800016c7
lea r8, [rsp + 0xc8]
mov rdx, r14
mov rcx, r13
call section..text
jmp 0x1800016df
cmp eax, 2
jne 0x180001719
lea r8, [rsp + 0xc8]
mov rdx, r14
mov rcx, r13
call fcn.180001100
mov rdi, qword [rsp + 0xc8]
mov rbx, rax
test rbx, rbx
je 0x180001719
mov rcx, r14
call fcn.180002ab0
lea rcx, [rdi + 1]
mov edx, 2
call fcn.180002af0
mov r14, rax
test rax, rax
je 0x180001784
lea rcx, [rdi + rdi]
mov rsi, rbx
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r14
call fcn.1800017f0
mov rbx, rax
test rax, rax
je 0x18000177c
mov eax, dword [r15]
test eax, eax
je 0x180001736
lea rdi, [r12 + rax]
jmp 0x18000173d
mov edi, dword [r15 + 0x10]
add rdi, r12
mov esi, dword [r15 + 0x10]
mov rax, qword [rdi]
add rsi, r12
test rax, rax
je 0x18000177c
nop dword [rax]
mov r8, r14
mov rcx, rbx
movzx edx, ax
test rbp, rax
jne 0x180001763
lea rdx, [rax + r12 + 2]
call fcn.1800019f0
add rdi, 8
add rsi, 8
mov qword [rsi - 8], rax
mov rax, qword [rdi]
test rax, rax
jne 0x180001750
mov rcx, r14
call fcn.180002ab0
add r15, 0x14
cmp dword [r15], 0
jne 0x180001540
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rdi, qword [rsp + 0x58]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x70]
mov rax, r12
add rsp, 0x78
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, rbp
add rsp, 0x78
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret