Function at 0x140006fd4
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor esi, esi
cmp qword [section..data], rsi
jne 0x140007175
mov edi, esi
cmp byte [0x1403c4dec], sil
jne 0x1400070fb
mov dword [rsp + 0x70], VarUI4FromDisp
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000705d
cmp dword [rsp + 0x74], 6
setb cl
mov byte [0x1403c4dd0], cl
ja 0x140007050
jne 0x140007055
cmp dword [rsp + 0x78], 1
jbe 0x140007055
mov edi, 1
test cl, cl
jne 0x1400070f4
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x14000708b
test edi, edi
je 0x1400070ed
lea rcx, [0x14017a300]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x1400070ed
lea rdx, str.EventWrite
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403c4dd8], rax
test rax, rax
je 0x1400070ed
lea rdx, [0x14017a360]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d5048], rax
test rax, rax
je 0x1400070df
lea rdx, [0x14017a370]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403c4da0], rax
test rax, rax
jne 0x1400070f4
lea rax, [0x140004ea0]
mov qword [0x1401d5048], rax
mov byte [0x1403c4dd0], 1
mov byte [0x1403c4dec], 1
lea rdx, [section..data]
cmp byte [0x1403c4dd0], sil
jne 0x14000712e
mov r9, rdx
mov r8, rdx
lea rdx, [0x140004d60]
lea rcx, [0x14017a3d0]
mov rax, qword [0x1401d5048]
call qword [case.0x1400b5e20.0]
jmp 0x140007175
mov qword [section..data], rdx
lea rax, [0x14017a3d0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8, rax
lea rcx, [0x140004bf0]
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
test byte [0x1403c4dc0], 1
je 0x14000718a
lea rdx, [0x14017a3c0]
call fcn.140007aa4
mov edi, 0x48
mov ecx, edi
call fcn.14011006c
mov rbx, rax
mov r8d, edi
xor edx, edx
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, vtable.CNisPlatform.0
mov qword [rbx], rax
mov dword [rbx + 0x18], esi
lea rax, vtable.CommonUtil::CMpShutterWait.0
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x20], rsi
mov byte [rbx + 0x28], sil
mov byte [rbx + 0x29], sil
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], rsi
mov eax, dword [rbx + 8]
test eax, eax
jne 0x1400071e2
mov dword [rbx + 8], 1
jmp 0x1400071e6
lock inc dword [rbx + 8]
mov rcx, qword [0x1401d51e8]
mov qword [0x1401d51e8], rbx
mov qword [rsp + 0x40], rcx
test rcx, rcx
je 0x140007229
mov eax, dword [rcx + 8]
cmp eax, 1
jne 0x14000720b
mov dword [rcx + 8], esi
jmp 0x140007218
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
sub eax, 1
jg 0x140007229
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x1400b5e20.0]
cmp dword [0x1403c4df0], esi
setne dl
mov rcx, qword [0x1401d51e8]
call fcn.140005cac
nop
mov eax, 1
jmp 0x140007248
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14010fb20
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret