Function at 0x14000474c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc0
mov rax, qword [0x14004f068]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r12, qword [rbp + 0x7f]
xor ebx, ebx
xorps xmm0, xmm0
mov byte [rbp - 0x71], r9b
mov r15, rcx
mov qword [rbp - 0x51], rbx
movq rax, xmm0
mov qword [rbp - 0x49], rbx
lea rcx, [rdx + 4]
mov qword [rbp - 0x59], rbx
mov r13b, r9b
mov r14d, r8d
mov rdi, rdx
mov esi, ebx
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x69], rbx
cmp rax, qword [rcx]
jne 0x1400047bd
mov rax, qword [rbp - 0x19]
cmp rax, qword [rcx + 8]
je 0x1400047d2
lea rdx, [rbp - 0x49]
call fcn.14000b3e4
mov ebx, eax
test eax, eax
js 0x140004c6c
xor ebx, ebx
mov ecx, dword [rdi]
test r13b, r13b
je 0x140004813
mov eax, ecx
sub eax, 2
je 0x14000480a
sub eax, 1
je 0x140004801
sub eax, 1
je 0x1400047f8
cmp eax, 3
jne 0x14000481a
lea rsi, str.vmbus
jmp 0x14000481a
lea rsi, str.ramdisk
jmp 0x14000481a
lea rsi, str.file
jmp 0x14000481a
lea rsi, str.partition
jmp 0x14000481a
lea rsi, [0x14003be08]
lea eax, [rcx - 3]
mov edx, 1
cmp eax, edx
jbe 0x140004ba6
cmp ecx, 2
jne 0x14000486c
lea r9, [rbp - 0x69]
mov rdx, rdi
mov rcx, r15
call fcn.14000654c
mov ebx, eax
test eax, eax
js 0x140004c20
mov qword [rbp - 0x11], rsi
mov rax, qword [rbp - 0x69]
lea rdx, str._1_2
mov qword [rbp - 9], rax
mov r8, r12
lea r9, [rbp - 0x11]
mov ecx, 0x2000
jmp 0x140004c19
cmp ecx, edx
jne 0x14000488e
xor r9d, r9d
lea rdx, str.boot
mov r8, r12
mov ecx, 0x2000
call fcn.1400012d4
mov ebx, eax
jmp 0x140004a5d
cmp ecx, 8
jne 0x1400049e0
cmp dword [rdi + 0x18], ebx
je 0x1400049b0
mov r14d, dword [rdi + 0x18]
add r14, rdi
cmp dword [r14], 3
jne 0x1400049b0
cmp dword [r14 + 0x14], ebx
je 0x1400049b0
mov r13d, dword [r14 + 0x14]
add r13, r14
mov eax, dword [r13]
cmp eax, ecx
je 0x1400048d4
dec eax
cmp eax, edx
ja 0x1400049ac
lea r9, [rbp - 0x69]
mov rdx, rdi
mov rcx, r15
call fcn.14000654c
xor edi, edi
mov ebx, eax
test eax, eax
js 0x140004c20
lea r9, [rbp - 0x59]
mov rdx, r13
mov rcx, r15
call fcn.14000654c
mov ebx, eax
test eax, eax
js 0x140004c20
cmp byte [rbp - 0x71], dil
lea rax, str.vhd
cmove rax, rsi
mov qword [rbp - 0x11], rax
mov rax, qword [rbp - 0x59]
mov qword [rbp - 9], rax
cmp dword [r13], 8
jne 0x140004953
cmp byte [0x14004f758], dil
je 0x140004947
mov rax, qword [rbp - 0x69]
lea rdx, str._1_locate__2_locate_3
mov qword [rbp - 1], rax
jmp 0x14000485b
lea rdx, str._1_locate__2
jmp 0x14000485b
lea r9, [rbp - 0x51]
mov rdx, r14
mov rcx, r15
call fcn.14000654c
mov ebx, eax
test eax, eax
js 0x140004c20
cmp byte [0x14004f758], dil
mov rax, qword [rbp - 0x51]
mov qword [rbp - 1], rax
je 0x14000498a
mov rax, qword [rbp - 0x69]
lea rdx, str._1__2__3_locate_4
jmp 0x1400049a3
mov rax, qword [rbp - 0x49]
lea rdx, str._1__2__3
test rax, rax
lea rcx, str._1__2__3__4
cmovne rdx, rcx
mov qword [rbp + 7], rax
jmp 0x14000485b
mov r13b, byte [rbp - 0x71]
lea r9, [rbp - 0x69]
mov rdx, rdi
mov rcx, r15
call fcn.14000654c
mov ebx, eax
test eax, eax
js 0x140004c20
test r13b, r13b
lea rax, [0x14003bbf8]
cmove rax, rsi
mov qword [rbp - 0x11], rax
jmp 0x14000484c
cmp ecx, 7
je 0x14000482f
cmp ecx, 9
jne 0x140004aca
test r13b, r13b
lea r14, str.uri
lea rdx, [rdi + 0x14]
lea rcx, [rbp - 0x31]
cmove r14, rsi
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
nop dword [rax + rax]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax + 0x14], bl
jne 0x140004a18
mov word [rbp - 0x41], bx
inc ax
add ax, ax
xor edx, edx
movzx r8d, ax
mov word [rbp - 0x3f], r8w
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x39], rax
test rax, rax
jne 0x140004a64
mov ebx, 0xc0000017
xor esi, esi
jmp 0x140004c6c
xor r8d, r8d
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x140004aa2
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x39]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x140004a5d
mov rax, qword [rbp - 0x39]
lea r9, [rbp - 0x11]
mov r8, r12
mov qword [rbp - 9], rax
lea rdx, str._1_2
mov qword [rbp - 0x11], r14
mov ecx, 0x2000
call fcn.1400012d4
mov ebx, eax
jmp 0x140004a81
cmp ecx, 5
jne 0x140004b9c
cmp byte [0x14004f75a], bl
je 0x140004b7c
lea rsi, [rdi + 0x14]
mov dword [rbp - 0x61], ebx
mov rcx, rsi
lea r8, [rbp - 0x61]
xor edx, edx
call fcn.14002f69c
mov ebx, eax
cmp eax, 0xc0000023
je 0x140004b0a
xor esi, esi
test eax, eax
js 0x140004b5f
mov ebx, 0xc0000001
jmp 0x140004b5f
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rbp - 0x61]
add r8, r8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140004b3e
mov ebx, 0xc000009a
jmp 0x140004a5d
lea r8, [rbp - 0x61]
mov rdx, rdi
mov rcx, rsi
call fcn.14002f69c
mov ebx, eax
xor esi, esi
mov rax, qword [rbp - 0x69]
test ebx, ebx
cmovns rax, rdi
mov qword [rbp - 0x69], rax
test ebx, ebx
js 0x140004c22
mov rax, qword [rbp - 0x69]
lea rdx, [0x14003bc14]
mov qword [rbp - 0x11], rax
lea r9, [rbp - 0x11]
jmp 0x140004b88
lea rdx, str.unknown
mov r9, rbx
xor esi, esi
mov r8, r12
mov ecx, 0x2000
call fcn.1400012d4
mov ebx, eax
jmp 0x140004c22
mov ebx, 0xc000000d
jmp 0x140004a5d
lea r9, [rbp - 0x69]
mov rdx, rdi
mov rcx, r15
call fcn.14000654c
mov ebx, eax
test eax, eax
js 0x140004c20
mov edx, dword [rdi + 0x14]
lea rax, [rbp - 0x59]
add rdx, rdi
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, r14d
mov rcx, r15
call fcn.14000474c
mov ebx, eax
test eax, eax
js 0x140004c20
mov rax, qword [rbp - 0x59]
lea r9, [rbp - 0x11]
mov qword [rbp - 9], rax
lea rdx, str._1__2__3
mov rax, qword [rbp - 0x69]
mov r8, r12
mov qword [rbp - 1], rax
mov ecx, 0x2000
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x11], rsi
mov qword [rbp + 7], rax
test rax, rax
je 0x140004c19
lea rdx, str._1__2__3__4
call fcn.1400012d4
mov ebx, eax
xor esi, esi
cmp qword [rbp - 0x69], rsi
je 0x140004c47
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x69]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
cmp qword [rbp - 0x51], rsi
je 0x140004c6c
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x51]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
cmp qword [rbp - 0x59], rsi
je 0x140004c91
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x59]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140030000
mov rbx, qword [rsp + 0x118]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret