Function at 0x140049b30
Capabilities:
Check os version
Connect to wmi namespace via wbemlocator

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x440
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rsp + 0x480], rbx
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r14, rdx
mov rbx, rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rdx
xor edi, edi
mov dword [rsp + 0x50], edi
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xe0]
call fcn.140001678
nop
mov dword [rsp + 0x110], 0x114
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x114]
call fcn.140062200
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x114], 6
jae 0x140049be6
lea rdx, str.WinXP
lea rcx, [rsp + 0xe0]
call fcn.140002680
jmp 0x14004a32b
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
nop
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x140087158]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140087228]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140049d09
lea rdx, str.err2
lea rcx, [rsp + 0xe0]
call fcn.1400026b0
mov rcx, r14
call fcn.140018840
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140001678
lea r11, [rsp + 0xe0]
cmp rbx, r11
je 0x140049cf4
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140001678
mov r11, qword [rsp + 0xf8]
cmp r11, 8
jae 0x140049cc1
mov r8, qword [rsp + 0xf0]
inc r8
lea rdx, [rsp + 0xe0]
mov rcx, rbx
call fcn.14000195c
mov r11, qword [rsp + 0xf8]
jmp 0x140049cd4
mov rax, qword [rsp + 0xe0]
mov qword [rbx], rax
mov qword [rsp + 0xe0], rdi
mov rcx, qword [rsp + 0xf0]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], r11
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rdi
lea rcx, [rsp + 0xe0]
call fcn.140001624
mov rax, rbx
jmp 0x14004a3e7
mov qword [rsp + 0x60], rdi
mov ecx, 0x18
call fcn.14005baec
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140049d4f
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str.ROOTSecurityCenter2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
jne 0x140049d52
mov ecx, 0x8007000e
call fcn.1400790c0
mov rsi, rdi
mov qword [rsp + 0xd0], rsi
test rsi, rsi
jne 0x140049d6a
mov ecx, 0x8007000e
call fcn.1400790c0
nop
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
call qword [rax + 0x18]
mov r12d, eax
or ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
dec ecx
jne 0x140049dce
mov rcx, qword [rsi]
test rcx, rcx
je 0x140049db8
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140049dc6
call fcn.14005c954
mov rcx, rsi
call fcn.14005ba88
test r12d, r12d
jns 0x140049ea0
lea rdx, str.err3
lea rcx, [rsp + 0xe0]
call fcn.1400026b0
mov rcx, r14
call fcn.140018840
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140001678
lea r11, [rsp + 0xe0]
cmp rbx, r11
je 0x140049e8b
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140001678
mov r11, qword [rsp + 0xf8]
cmp r11, 8
jae 0x140049e58
mov r8, qword [rsp + 0xf0]
inc r8
lea rdx, [rsp + 0xe0]
mov rcx, rbx
call fcn.14000195c
mov r11, qword [rsp + 0xf8]
jmp 0x140049e6b
mov rax, qword [rsp + 0xe0]
mov qword [rbx], rax
mov qword [rsp + 0xe0], rdi
mov rax, qword [rsp + 0xf0]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], r11
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rdi
lea rcx, [rsp + 0xe0]
call fcn.140001624
mov rax, rbx
jmp 0x14004a3e7
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x140049faa
lea rdx, str.err4
lea rcx, [rsp + 0xe0]
call fcn.1400026b0
mov rcx, r14
call fcn.140018840
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140001678
lea r11, [rsp + 0xe0]
cmp rbx, r11
je 0x140049f95
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140001678
mov r11, qword [rsp + 0xf8]
cmp r11, 8
jae 0x140049f62
mov r8, qword [rsp + 0xf0]
inc r8
lea rdx, [rsp + 0xe0]
mov rcx, rbx
call fcn.14000195c
mov r11, qword [rsp + 0xf8]
jmp 0x140049f75
mov rax, qword [rsp + 0xe0]
mov qword [rbx], rax
mov qword [rsp + 0xe0], rdi
mov rax, qword [rsp + 0xf0]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], r11
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rdi
lea rcx, [rsp + 0xe0]
call fcn.140001624
mov rax, rbx
jmp 0x14004a3e7
mov qword [rsp + 0x78], rdi
mov ecx, 0x18
call fcn.14005baec
mov r12, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140049fe3
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str.Select__From_AntiVirusProduct
call fcn.140078f30
mov qword [r12], rax
jmp 0x140049fe6
mov r12, rdi
mov qword [rsp + 0xc8], r12
test r12, r12
jne 0x140049ffe
mov ecx, 0x8007000e
call fcn.1400790c0
nop
mov ecx, 0x18
call fcn.14005baec
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14004a031
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [0x1400907c8]
call fcn.140078f30
mov qword [rsi], rax
jmp 0x14004a034
mov rsi, rdi
mov qword [rsp + 0xd8], rsi
test rsi, rsi
jne 0x14004a04c
mov ecx, 0x8007000e
call fcn.1400790c0
nop
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdi
mov r9d, 0x30
mov r8, qword [r12]
mov rdx, qword [rsi]
call qword [rax + SHCreateDirectory]
mov r13d, eax
or ecx, 0xffffffff
lock xadd dword [rsi + 0x10], ecx
dec ecx
jne 0x14004a0aa
mov rcx, qword [rsi]
test rcx, rcx
je 0x14004a093
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14004a0a1
call fcn.14005c954
mov rcx, rsi
call fcn.14005ba88
nop
or eax, 0xffffffff
lock xadd dword [r12 + 0x10], eax
dec eax
jne 0x14004a0de
mov rcx, qword [r12]
test rcx, rcx
je 0x14004a0c7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14004a0d6
call fcn.14005c954
mov rcx, r12
call fcn.14005ba88
test r13d, r13d
jns 0x14004a1d1
lea rdx, str.err5
lea rcx, [rsp + 0xe0]
call fcn.1400026b0
mov rcx, r14
call fcn.140018840
lea r8, str.Query_for_operating_system_name_failed.
lea rdx, str.ERROR
mov rcx, r14
call fcn.140018920
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140001678
lea r11, [rsp + 0xe0]
cmp rbx, r11
je 0x14004a1bc
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140001678
mov r11, qword [rsp + 0xf8]
cmp r11, 8
jae 0x14004a189
mov r8, qword [rsp + 0xf0]
inc r8
lea rdx, [rsp + 0xe0]
mov rcx, rbx
call fcn.14000195c
mov r11, qword [rsp + 0xf8]
jmp 0x14004a19c
mov rax, qword [rsp + 0xe0]
mov qword [rbx], rax
mov qword [rsp + 0xe0], rdi
mov rax, qword [rsp + 0xf0]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], r11
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rdi
lea rcx, [rsp + 0xe0]
call fcn.140001624
mov rax, rbx
jmp 0x14004a3e7
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x50], edi
nop word [rax + rax]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14004a2f5
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov r8d, 1
or edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rsp + 0x50], 0
je 0x14004a2f5
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.displayName
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, str.productState
call qword [rax + 0x20]
mov r9d, dword [rsp + 0xb8]
lea r8, [0x140090864]
mov edx, 0x100
lea rcx, [rsp + 0x230]
call fcn.14005c318
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0xe0]
call fcn.140002680
lea rdx, [0x1400885a0]
mov rcx, rax
call fcn.140002680
lea rdx, [rsp + 0x230]
mov rcx, rax
call fcn.140002680
lea rdx, [0x14008a1a0]
mov rcx, rax
call fcn.140002680
lea rcx, [rsp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14004a1e0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14004a32b
lea rcx, [rsp + 0xe0]
call fcn.1400018c0
mov r8, rax
lea rdx, str.INFO
mov rcx, r14
call fcn.140018920
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140001678
lea r11, [rsp + 0xe0]
cmp rbx, r11
je 0x14004a3d7
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140001678
mov r11, qword [rsp + 0xf8]
cmp r11, 8
jae 0x14004a3a4
mov r8, qword [rsp + 0xf0]
inc r8
lea rdx, [rsp + 0xe0]
mov rcx, rbx
call fcn.14000195c
mov r11, qword [rsp + 0xf8]
jmp 0x14004a3b7
mov rax, qword [rsp + 0xe0]
mov qword [rbx], rax
mov qword [rsp + 0xe0], rdi
mov rax, qword [rsp + 0xf0]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], r11
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rdi
lea rcx, [rsp + 0xe0]
call fcn.140001624
mov rax, rbx
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14005ba60
mov rbx, qword [rsp + 0x480]
add rsp, 0x440
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret