Function at 0x140003e3c
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x200
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov r13, rcx
lea rcx, [rsp + 0x40]
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x140003e98
mov edi, 0x4b4
jmp 0x140003eb8
mov eax, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
mov ecx, 2
dec eax
je 0x140003f25
dec eax
je 0x140003ecf
mov edi, 0x4ca
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov dword [rsp + 0x20], FDICopy
xor r8d, r8d
jmp 0x14000411a
mov esi, 1
movzx eax, cx
mov word [0x14000ae54], cx
lea ecx, [rsi + 2]
mov dword [0x1400091f4], esi
mov dword [0x1400091bc], esi
cmp r8d, ecx
ja 0x140003f13
mov eax, esi
mov word [0x14000ae54], ax
jb 0x140003f05
jne 0x140003f40
cmp r11d, 0x33
jae 0x140003f40
mov dword [0x1400091f4], ebx
mov dword [0x1400091bc], ebx
jmp 0x140003f40
cmp r8d, 5
jb 0x140003f40
movzx eax, cx
mov word [0x14000ae54], cx
jmp 0x140003f40
mov esi, 1
movzx eax, bx
mov word [0x14000ae54], bx
mov dword [0x1400091f4], esi
mov dword [0x1400091bc], esi
cmp dword [0x140009bd4], ebx
jne 0x140004123
test r13, r13
je 0x140004123
lea r15, [r13 + 0x40]
test ax, ax
je 0x140003f62
lea r15, [r13 + 4]
movzx r14d, word [rsp + 0x4c]
mov ecx, ebx
mov dword [rsp + 0x30], ebx
or r12d, 0xffffffff
movsxd r10, ecx
lea r9, [r10 + r10*2]
cmp r8d, dword [r15 + r9*8]
jae 0x140003f84
mov edx, r12d
jmp 0x140003f96
jbe 0x140003f8a
mov edx, esi
jmp 0x140003f96
cmp r11d, dword [r15 + r9*8 + 4]
jb 0x140003f7f
mov edx, ebx
seta dl
cmp r8d, dword [r15 + r9*8 + 0xc]
jae 0x140003fa2
mov eax, r12d
jmp 0x140003fb4
jbe 0x140003fa8
mov eax, esi
jmp 0x140003fb4
cmp r11d, dword [r15 + r9*8 + 0x10]
jb 0x140003f9d
mov eax, ebx
seta al
test edx, edx
js 0x140004052
test eax, eax
jg 0x140004052
test edx, edx
jne 0x140003fe6
test eax, eax
movzx eax, r14w
jne 0x140003fd9
cmp eax, dword [r15 + r9*8 + 8]
jb 0x140003ff5
jmp 0x140003fee
cmp eax, dword [r15 + r9*8 + 8]
jae 0x140004065
jmp 0x140003ff5
test eax, eax
jne 0x140004065
movzx eax, r14w
cmp eax, dword [r15 + r9*8 + 0x14]
jbe 0x140004065
test ecx, ecx
je 0x140004056
mov edi, 0x54c
mov r9, rbx
mov r12, rbx
mov r14d, ebx
cmp edi, 0x54d
jne 0x14000402e
mov edx, dword [r13 + 0x80]
movsxd rax, ecx
lea r9, [rbp - 0x20]
imul r15, rax, 0x3c
add r15, r13
add rdx, 0x84
add r15, rdx
test r15, r15
je 0x1400040a4
mov eax, dword [r15 + 0x34]
lea r12, [r13 + 0x84]
add r12, rax
mov eax, dword [r15 + 0x30]
test sil, al
je 0x140004096
mov r14d, 0x104
jmp 0x1400040a4
cmp ecx, esi
je 0x140003ff9
add ecx, esi
mov dword [rsp + 0x30], ecx
cmp ecx, 2
jl 0x140003f72
cmp dword [r13 + 0x7c], ebx
je 0x140004123
lea r9, [rsp + 0x30]
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.140002a88
test eax, eax
jne 0x140004123
mov ecx, dword [rsp + 0x30]
mov edi, 0x54d
jmp 0x140003ffe
and al, 2
neg al
sbb r14d, r14d
and r14d, 0x101
test byte [0x140009bd8], sil
jne 0x140004107
cmp byte [r12], bl
je 0x140004107
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
call fcn.140007c4c
test eax, eax
je 0x1400040d3
call fcn.140007b88
mov r9d, 0x180000
test eax, eax
jne 0x1400040d6
mov r9d, ebx
or r9d, r14d
lea r8, [0x14000a558]
mov rdx, r12
or r9d, 0x30
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
test r14b, 4
je 0x1400040fa
cmp eax, 6
jmp 0x140004101
test sil, r14b
je 0x140004123
cmp eax, esi
jne 0x140004123
mov edi, ebx
jmp 0x140004123
mov dword [rsp + 0x28], ebx
lea r8, [0x14000a558]
mov dword [rsp + 0x20], 0x30
mov edx, edi
xor ecx, ecx
call fcn.140004ed8
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140008180
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret