Function at 0x14002f68c
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor esi, esi
mov r13, r9
mov edi, r8d
mov rax, rdx
mov r12, rcx
cmp dword [rbp + 0x60], esi
jne 0x14002fb23
cmp r8d, 0x110
jne 0x14002f6e9
add rcx, 0xfffffffffffffff8
call fcn.140289b84
mov rcx, qword [rbp + 0x58]
mov qword [rcx], rax
mov eax, 1
jmp 0x14002fb25
cmp r8d, 0x407
jne 0x14002f700
add rcx, 0xfffffffffffffff8
mov rdx, r9
call fcn.140288954
jmp 0x14002f6d8
cmp r8d, 0x408
jne 0x14002f71e
add rcx, 0xc0
call fcn.140031154
mov r11, qword [rbp + 0x58]
mov qword [r11], rsi
jmp 0x14002f6df
cmp r8d, 0x136
jne 0x14002f734
mov ecx, 0x676767
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
jmp 0x14002f6d8
mov r14, qword [rbp + 0x58]
mov r15, qword [rbp + 0x50]
mov ebx, 1
cmp r8d, 0x111
jne 0x14002f87e
cmp bx, r9w
jne 0x14002f777
lea rdx, [rbp + 0x60]
add rcx, 0xfffffffffffffff8
mov dword [rbp + 0x60], ebx
call fcn.14028ca24
mov qword [r14], rax
cmp dword [rbp + 0x60], esi
je 0x14002f7f7
mov eax, ebx
jmp 0x14002fb25
mov edx, 2
cmp dx, r9w
jne 0x14002f793
add rcx, 0xfffffffffffffff8
call fcn.14028c994
mov rcx, r14
mov qword [rcx], rax
jmp 0x14002f770
mov ecx, 0x3e8
cmp cx, r9w
jne 0x14002f7c2
mov rax, r9
shr rax, 0x10
cmp si, ax
jne 0x14002f7f7
xor edx, edx
lea rcx, [r12 - 8]
mov rax, qword [rcx]
call qword [rax + 0xa8]
mov r11, r14
mov qword [r14], rsi
jmp 0x14002f770
mov ecx, 0x3ea
cmp cx, r9w
jne 0x14002f7e0
mov rax, r9
shr rax, 0x10
cmp si, ax
jne 0x14002f7f7
mov edx, 3
jmp 0x14002f7ac
mov ecx, 0x3e9
cmp cx, r9w
jne 0x14002f811
mov rax, r9
shr rax, 0x10
cmp si, ax
je 0x14002f7ac
mov rax, qword [rbp + 0x38]
cmp edi, dword [0x14048ac74]
jne 0x14002fa18
xor edx, edx
xor ecx, ecx
call fcn.1400c744c
int3
mov ecx, 0x3eb
cmp cx, r9w
jne 0x14002f837
mov rax, r9
shr rax, 0x10
cmp si, ax
jne 0x14002f7f7
lea rcx, [r12 - 8]
call fcn.140288264
jmp 0x14002f78b
mov ecx, 0x428
cmp cx, r9w
jne 0x14002f85d
mov rax, r9
shr rax, 0x10
cmp si, ax
jne 0x14002f7f7
lea rcx, [r12 - 8]
call fcn.140288ba4
jmp 0x14002f78b
mov ecx, 0x429
cmp cx, r9w
jne 0x14002f7fb
mov rax, r9
shr rax, 0x10
cmp si, ax
jne 0x14002f7f7
call fcn.1402899a4
jmp 0x14002f78b
cmp r8d, 0x411
jne 0x14002f8a2
lea r9, [rbp + 0x60]
add rcx, 0xfffffffffffffff8
mov r8, r15
mov rdx, r13
mov dword [rbp + 0x60], ebx
call fcn.14028b7c4
jmp 0x14002f764
cmp r8d, 0x412
jne 0x14002f8b9
add rcx, 0xfffffffffffffff8
call fcn.140288fd4
jmp 0x14002f78b
cmp r8d, 0x413
jne 0x14002f8dd
lea r9, [rbp + 0x60]
add rcx, 0xfffffffffffffff8
mov r8, r15
mov rdx, r13
mov dword [rbp + 0x60], ebx
call fcn.14028d2a4
jmp 0x14002f764
cmp r8d, 0x414
jne 0x14002f8f4
add rcx, 0xfffffffffffffff8
call fcn.140288e74
jmp 0x14002f78b
cmp r8d, 0x41a
jne 0x14002f915
call fcn.1400045d4
cmp qword [rax + 0x28], rsi
mov rax, r14
setne sil
mov qword [rax], rsi
jmp 0x14002f770
cmp r8d, 0x41b
jne 0x14002f92c
add rcx, 0xfffffffffffffff8
call fcn.140286814
jmp 0x14002f78b
mov edx, VarUI4FromDisp
cmp r8d, edx
jne 0x14002f94a
add rcx, 0xfffffffffffffff8
mov r9, r15
mov r8, r13
call fcn.140289164
jmp 0x14002f78b
cmp r8d, 0x417
jne 0x14002f967
add rcx, 0xfffffffffffffff8
mov r8, r15
mov rdx, r9
call fcn.140286f14
jmp 0x14002f78b
cmp r8d, 0x418
jne 0x14002f984
add rcx, 0xfffffffffffffff8
mov r8, r15
mov rdx, r9
call fcn.140286d84
jmp 0x14002f78b
cmp r8d, 0x113
jne 0x14002f9a5
lea r8, [rbp + 0x60]
add rcx, 0xfffffffffffffff8
mov rdx, r9
mov dword [rbp + 0x60], ebx
call fcn.140286914
jmp 0x14002f764
cmp r8d, 0x419
jne 0x14002f9bf
add rcx, 0xfffffffffffffff8
mov rdx, r9
call fcn.14028ab14
jmp 0x14002f78b
cmp r8d, 0x41c
jne 0x14002f9d6
add rcx, 0xfffffffffffffff8
call fcn.140288ec4
jmp 0x14002f78b
cmp r8d, 0x219
jne 0x14002f9fa
lea r9, [rbp + 0x60]
add rcx, 0xfffffffffffffff8
mov r8, r15
mov rdx, r13
mov dword [rbp + 0x60], ebx
call fcn.140286d44
jmp 0x14002f764
cmp r8d, 0x41d
jne 0x14002f7fb
add rcx, 0xfffffffffffffff8
mov rdx, r9
call fcn.140288dd4
jmp 0x14002f78b
cmp edi, dword [0x14048cc48]
jne 0x14002fa81
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx edi, al
call qword [sym.imp.KERNEL32.dll_GetVersion]
shr ax, 8
cmp edi, 6
ja 0x14002fa46
jne 0x14002fada
test al, al
je 0x14002fada
add r12, 0x198
mov rcx, qword [r12]
test rcx, rcx
je 0x14002fa60
mov qword [r12], rsi
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edx, edx
lea r9, [0x140354df8]
lea rcx, [0x1403291f0]
lea r8d, [rdx + 0x17]
mov qword [rsp + 0x20], r12
call qword [sym.imp.ole32.dll_CoCreateInstance]
jmp 0x14002fada
cmp edi, dword [0x14048ac64]
jne 0x14002faad
mov rcx, qword [r12 + 0x198]
test rcx, rcx
je 0x14002fada
mov rdx, qword [r12 + 0x190]
mov rax, qword [rcx]
mov r8d, r13d
mov rdx, qword [rdx + 0x10]
call qword [rax + 0x50]
jmp 0x14002fada
cmp edi, dword [0x14048ac68]
jne 0x14002fae2
mov rcx, qword [r12 + 0x198]
test rcx, rcx
je 0x14002fada
mov rdx, qword [r12 + 0x190]
mov rax, qword [rcx]
mov r9, r15
mov rdx, qword [rdx + 0x10]
mov r8, r13
call qword [rax + 0x48]
mov qword [r14], rsi
jmp 0x14002f770
mov dword [rsp + 0x30], esi
mov r9, r13
mov r8d, edi
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.14004bac4
test eax, eax
jne 0x14002f770
lea rcx, [r12 + 0x108]
cmp edi, dword [rcx + 0x58]
jne 0x14002fb23
call fcn.14022f15c
mov qword [r14], rax
jmp 0x14002f770
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret