Function at 0x1400118a0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x420
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + reloc.mfc90u.dll_CObList::AddTail], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
call qword [0x14008a728]
nop
lea rcx, [rsp + 0x28]
call qword [0x14008a728]
nop
mov byte [rsp + 0xe0], 0
xor edx, edx
mov r8d, new[]
lea rcx, [rsp + 0xe1]
call sub.MSVCR90.dll_memset
mov r8d, new[]
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CUIntArray::CUIntArray]
nop
lea rcx, [rsp + 0x20]
call fcn.140011270
xor ebx, ebx
test eax, eax
je 0x140011ba3
cmp dword [0x1400ce808], ebx
jne 0x140011b7e
mov word [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], bx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x202]
call sub.MSVCR90.dll_memset
mov r8d, new[]
lea rdx, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140011b88
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0x50], 0x50
mov dword [rsp + 0x68], 2
mov dword [rsp + 0x70], 1
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x98], CDHtmlElementEventSink::AddRef
mov dword [rsp + 0xa0], 0x20
lea rax, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xc8], 0xaac56b
mov eax, 0xcd44
mov word [rsp + 0xcc], ax
mov eax, 0x11d0
mov word [rsp + 0xce], ax
mov byte [rsp + 0xd0], 0x8c
mov byte [rsp + 0xd1], SetErrorInfo
mov byte [rsp + 0xd2], bl
mov byte [rsp + 0xd3], 0xc0
mov byte [rsp + 0xd4], 0x4f
mov byte [rsp + 0xd5], SetErrorInfo
mov byte [rsp + 0xd6], 0x95
mov byte [rsp + 0xd7], 0xee
mov rax, qword [0x1400ce810]
test rax, rax
jne 0x140011aeb
lea rcx, str.Wintrust.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140011adb
lea rdx, str.WinVerifyTrust
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400ce810], rax
jmp 0x140011ae2
mov rax, qword [0x1400ce810]
test rax, rax
je 0x140011b88
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xc8]
xor ecx, ecx
call rax
mov ecx, ebx
test eax, eax
sete cl
mov dword [0x1400c27e4], ecx
test ecx, ecx
jne 0x140011b72
xor edx, edx
mov r8d, ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >
lea rcx, [rsp + 0xe4]
call sub.MSVCR90.dll_memset
mov dword [rsp + 0xe0], ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140011b43
mov ecx, ebx
jmp 0x140011b6c
mov eax, dword [rsp + 0xe4]
cmp eax, 6
jae 0x140011b56
mov ecx, 1
jmp 0x140011b6c
cmp eax, 6
jbe 0x140011b5f
mov ecx, ebx
jmp 0x140011b6c
mov ecx, ebx
cmp dword [rsp + 0xe8], 1
setbe cl
mov dword [0x1400c27e4], ecx
mov dword [0x1400ce808], 1
jmp 0x140011b84
mov ecx, dword [0x1400c27e4]
test ecx, ecx
je 0x140011ba3
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc90u.dll_CView::CView]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CView::CView]
jmp 0x140011ca0
mov eax, dword [0x1400cf03c]
test al, 1
jne 0x140011c6b
or eax, 1
mov dword [0x1400cf03c], eax
lea rdx, str.http:__boot.iboysoft.com_php_update2.php
lea rcx, [rsp + 0xc8]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
nop
lea rdx, [0x14008ac98]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
nop
lea rdx, [0x14008ece8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
nop
lea rdx, [0x14008ecf0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
nop
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xc8]
call fcn.140004aa0
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov rdx, qword [rsp + 0x30]
cmp dword [rdx - 0x10], 0
setg bl
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0xc8]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov dword [0x1400cf038], ebx
jmp 0x140011c71
mov ebx, dword [0x1400cf038]
test ebx, ebx
je 0x140011c8a
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5f6
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_PostMessageW]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.mfc90u.dll_CView::CView]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov rcx, qword [rsp + reloc.mfc90u.dll_CObList::AddTail]
xor rcx, rsp
call fcn.140077470
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret