Function at 0x14003f5f0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor edi, edi
mov r15, rcx
mov ebx, edi
mov dword [rsp + 0x44], edi
cmp qword [0x140155158], rbx
mov esi, edi
mov r14d, edi
mov word [rsp + 0x48], di
mov word [rsp + 0x40], di
jne 0x14003f668
lea rcx, str.Kernel32
call fcn.140009360
mov rcx, rax
lea rdx, str.IsWow64Process2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140155158], rax
xorps xmm0, xmm0
lea r13, [r15 + 0x1a]
movups xmmword [r15], xmm0
xor eax, eax
lea rdx, str.Windows_Undefined
movups xmmword [r15 + 0x10], xmm0
mov rcx, r13
movups xmmword [r15 + 0x20], xmm0
lea r8d, [rax + 0x12]
movups xmmword [r15 + 0x30], xmm0
movups xmmword [r15 + 0x40], xmm0
movups xmmword [r15 + 0x50], xmm0
movups xmmword [r15 + 0x60], xmm0
movups xmmword [r15 + 0x70], xmm0
movups xmmword [r15 + 0x80], xmm0
mov qword [r15 + 0x90], rax
mov dword [r15 + 0x98], eax
call fcn.140093550
xorps xmm0, xmm0
mov byte [r13 + 0x11], bl
xor eax, eax
mov dword [rsp + 0x50], 0x9c
lea rcx, [rsp + 0x50]
mov qword [rbp - 0x1c], rax
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14003f757
xorps xmm0, xmm0
mov dword [rsp + 0x50], 0x94
xor eax, eax
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x54], xmm0
mov qword [rbp - 0x1c], rax
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x14003fd6a
cmp dword [rsp + 0x60], 2
jne 0x14003fa23
cmp dword [rsp + 0x54], 6
ja 0x14003f77a
jne 0x14003f8ad
cmp dword [rsp + 0x58], 2
jb 0x14003f8b8
mov r8b, 1
mov qword [rsp + 0x1d8], r12
mov edx, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov esi, dword [rsp + 0x54]
mov r12, rax
cmp esi, 9
ja 0x14003f8a5
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
mov dword [rbp - 0x10], 0x9c
xor eax, eax
mov dword [rbp - 0xc], esi
mov r8, r12
mov dword [rbp + 0x88], eax
lea rcx, [rbp - 0x10]
movups xmmword [rbp - 8], xmm0
lea edx, [rax + 2]
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
jne 0x14003f809
inc esi
cmp esi, 9
jbe 0x14003f7b0
jmp 0x14003f8a5
cmp dword [rsp + 0x54], esi
jae 0x14003f817
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x58], edi
mov r8b, 1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r14d, dword [rsp + 0x58]
mov r12, rax
cmp r14d, 9
ja 0x14003f8a5
nop word [rax + rax]
xorps xmm0, xmm0
lea rcx, [rbp - 0x10]
xor eax, eax
mov r8, r12
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp + 0x80], rax
movups xmmword [rbp], xmm0
lea edx, [rax + 1]
mov dword [rbp + 0x88], eax
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp - 0x10], 0x9c
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp - 8], r14d
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
jne 0x14003f8a0
inc r14d
cmp r14d, 9
jbe 0x14003f840
jmp 0x14003f8a5
mov dword [rsp + 0x58], r14d
mov r12, qword [rsp + 0x1d8]
cmp dword [rsp + 0x54], 0xf
ja 0x14003fa23
mov eax, dword [rsp + 0x58]
cmp eax, 0xf
ja 0x14003fa23
cmp byte [rbp - 0x16], 1
mov edx, edi
mov r8d, dword [rsp + 0x54]
setbe dl
shl r8d, 4
or r8d, eax
mov dword [r15], r8d
lea eax, [r8 - 0x51]
cmp eax, 0x5f
ja case.0x14003f905.83
lea r9, [0x140000000]
movzx eax, byte [r9 + rax + 0x3fdc0]
mov ecx, dword [r9 + rax*4 + 0x3fd98]
add rcx, r9
jmp rcx
lea rbx, [0x1400e5a4c]
jmp 0x14003fa23
test edx, edx
je 0x14003f923
lea rbx, str.XP_64
jmp 0x14003fa23
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
lea rcx, str.Server_2003
lea rbx, str.Server_2003_R2
cmove rbx, rcx
jmp 0x14003fa23
test edx, edx
lea rax, str.Vista
lea rbx, str.Server_2008
cmovne rbx, rax
jmp 0x14003fa23
test edx, edx
lea rax, [0x1400e5a8c]
lea rbx, str.Server_2008_R2
cmovne rbx, rax
jmp 0x14003fa23
test edx, edx
lea rax, [0x1400e5aa0]
lea rbx, str.Server_2012
cmovne rbx, rax
jmp 0x14003fa23
test edx, edx
lea rax, [0x1400e5ab4]
lea rbx, str.Server_2012_R2
cmovne rbx, rax
jmp 0x14003fa23
test edx, edx
lea rax, str.10__Preview_1_
lea rbx, str.Server_10__Preview_1_
cmovne rbx, rax
jmp 0x14003fa23
mov eax, dword [rsp + 0x5c]
cmp eax, 0x4e20
jae 0x14003f9ef
test edx, edx
je 0x14003f9d6
lea rbx, [0x1400e5af0]
jmp 0x14003fa23
cmp eax, 0x4563
lea rcx, str.Server_2016
lea rbx, str.Server_2019
cmovb rbx, rcx
jmp 0x14003fa23
mov dword [r15], 0xb0
mov esi, 0xb
test edx, edx
lea rax, [0x1400e5b14]
lea rbx, str.Server_2022
cmovne rbx, rax
jmp 0x14003fa23
cmp r8d, 0x51
jae 0x14003fa1c
mov dword [r15], edi
jmp 0x14003fa23
lea rbx, str.12_or_later
cmp qword [0x140155158], rdi
mov dword [r15 + 4], esi
mov dword [r15 + 8], r14d
je 0x14003fa5d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
call qword [0x140155158]
test eax, eax
je 0x14003fa5d
movzx eax, word [rsp + 0x40]
mov word [r15 + 0x18], ax
jmp 0x14003fa73
mov eax, 0x8664
lea rcx, str.Note:_Underlying_Windows_architecture_was_guessed_and_may_be_incorrect...
mov word [r15 + 0x18], ax
call fcn.140041aa0
movzx ecx, word [r15 + 0x18]
sub ecx, 0x14c
je 0x14003fab9
sub ecx, 0x74
je 0x14003fab0
sub ecx, 0x84a4
je 0x14003faa7
cmp ecx, 0x2400
je 0x14003fa9e
lea rsi, str.unknown
jmp 0x14003fac0
lea rsi, str.arm64
jmp 0x14003fac0
lea rsi, [0x1400df454]
jmp 0x14003fac0
lea rsi, [0x1400df464]
jmp 0x14003fac0
lea rsi, [0x1400df458]
movzx r9d, word [rbp - 0x1a]
lea rax, [rsp + 0x44]
movzx r8d, word [rbp - 0x1c]
mov edx, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x54]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
test rbx, rbx
jne 0x14003fb24
cmp dword [rsp + 0x60], 2
lea rax, [0x1400e5b9c]
mov qword [rsp + 0x38], rsi
lea rcx, [0x1400e5ba0]
cmove rcx, rax
lea r9, str._s__u._u__s
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
jmp 0x14003fbb3
movzx eax, word [rbp - 0x1a]
test ax, ax
je 0x14003fb47
movzx ecx, word [rbp - 0x1c]
lea r9, str._s_SP_u._u__s
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
jmp 0x14003fbae
movzx eax, word [rbp - 0x1c]
test ax, ax
je 0x14003fb79
mov edx, 0x76
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
lea r9, str._s_SP_u__s
lea rcx, [r15 + 0x22]
mov qword [rsp + 0x20], rbx
lea r8, [rdx - 0x77]
call fcn.1400034e0
jmp 0x14003fbc7
mov ecx, dword [rsp + 0x44]
call fcn.14003edf0
cmp dword [rsp + 0x44], edi
lea rdx, [0x1400e05a4]
mov qword [rsp + 0x38], rsi
lea rcx, [0x1400d756a]
cmovne rcx, rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea r9, str._s_s_s__s
mov qword [rsp + 0x20], rbx
mov r8, 0xffffffffffffffff
lea rcx, [r15 + 0x22]
lea edx, [r8 + 0x77]
call fcn.1400034e0
mov eax, dword [rsp + 0x44]
lea r9, [rsp + 0x4c]
mov byte [r15 + 0x97], dil
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionUBR
mov dword [r15 + 0x14], eax
mov rcx, 0xffffffff80000002
mov eax, dword [rsp + 0x5c]
mov dword [r15 + 0xc], eax
call fcn.14003e990
mov r8d, dword [rsp + 0x4c]
mov dword [r15 + 0x10], r8d
test r13, r13
jne 0x14003fc0d
lea rcx, [r15 + 0x1a]
mov rax, rdi
jmp 0x14003fc39
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rax + r13], dil
jne 0x14003fc14
lea rcx, [r15 + 0x1a]
add rcx, rax
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rax + r13], dil
jne 0x14003fc30
mov esi, 0x7f
mov r10, rcx
mov edx, esi
mov rbx, r13
sub rdx, rax
mov eax, dword [r15 + 0xc]
lea r14, [rcx + rdx]
test r8d, r8d
je 0x14003fc71
mov dword [rsp + 0x28], r8d
lea r9, str.__Build__lu._lu_
lea r8, [rsi - 0x80]
mov dword [rsp + 0x20], eax
call fcn.1400034e0
jmp 0x14003fc88
lea r9, str.__Build__lu_
mov dword [rsp + 0x20], eax
mov r8, 0xffffffffffffffff
call fcn.1400034e0
mov byte [r14 - 1], dil
test r13, r13
jne 0x14003fc97
add r15, 0x1a
jmp 0x14003fcc0
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rbx + rdi], 0
jne 0x14003fca0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x14003fcb0
add r15, 0x1a
add r15, rax
mov rax, qword [0x1401551a8]
sub rsi, rdi
test rax, rax
jne 0x14003fd1b
lea rcx, str.Wldp
call fcn.140009360
mov rcx, rax
lea rdx, str.WldpQueryWindowsLockdownMode
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401551a8], rax
test rax, rax
jne 0x14003fd1b
call fcn.140041e50
mov r9, rax
lea r8, str.Wldp
lea rdx, str.WldpQueryWindowsLockdownMode
lea rcx, str.Unable_to_locate__s___in__s.dll:__s
call fcn.140041aa0
jmp 0x14003fd6a
lea rcx, [rsp + 0x4c]
call rax
test eax, eax
je 0x14003fd44
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140041e50
mov rdx, rax
lea rcx, str.Could_not_detect_S_Mode:__s
call fcn.140041aa0
jmp 0x14003fd6a
cmp dword [rsp + 0x4c], 0
je 0x14003fd6a
lea r9, str._in_S_Mode
mov r8, 0xffffffffffffffff
mov rdx, rsi
mov rcx, r15
call fcn.1400034e0
mov byte [rsi + r15 - 1], 0
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140092060
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret