Function at 0x11008
Capabilities:
Check os version

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x300
mov rax, qword [0x00018100]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
mov rdi, rdx
mov rbx, rcx
mov esi, 0x2a
lea rcx, [r11 - 0x60]
lea rdx, [0x00015850]
mov r8, rsi
call fcn.00014f10
lea r13d, [rsi - 2]
lea rax, [rsp + 0x2c8]
mov word [rsp + 0x9a], si
lea esi, [r13 - 6]
lea rcx, [rsp + 0x2a0]
lea rdx, [0x00015880]
mov r8, rsi
mov word [rsp + 0x98], r13w
mov qword [rsp + 0xa0], rax
call fcn.00014f10
lea rax, [rsp + 0x2a0]
lea r14d, [r13 - 8]
lea rcx, [rsp + 0x180]
mov qword [rsp + 0xb0], rax
mov word [rsp + 0xa8], r14w
mov word [rsp + 0xaa], si
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
lea ebp, [rsi - 0x20]
xor esi, esi
cmp eax, esi
jl 0x110ed
cmp dword [rsp + 0x184], 6
ja 0x110e3
jne 0x110ed
cmp dword [rsp + 0x188], ebp
jb 0x110ed
mov dword [0x000192e4], 0x200
lea rcx, [rsp + 0xb8]
call qword [sym.imp.HAL.dll_KeQueryPerformanceCounter]
movabs rax, 0x20c49ba5e353f7cf
mov r12d, 1
movdqu xmm0, xmmword [0x000164c0]
movdqu xmm1, xmmword [0x000164e0]
lea rcx, [rsp + 0xc8]
imul qword [rsp + 0xb8]
sar rdx, 7
mov r8, r14
mov rax, rdx
shr rax, 0x3f
movdqu xmmword [0x000181c0], xmm0
movdqu xmm0, xmmword [0x000164d0]
movdqu xmmword [0x00018220], xmm1
add rdx, rax
cmove rdx, r12
mov qword [0x000192e8], rdx
xor edx, edx
movdqu xmm1, xmmword [0x000164f0]
movdqu xmmword [0x00018280], xmm0
movdqu xmm0, xmmword [0x00016500]
movdqu xmmword [0x000182e0], xmm1
movdqu xmm1, xmmword [0x00016510]
movdqu xmmword [0x00018340], xmm0
movdqu xmm0, xmmword [0x000171c0]
movdqu xmmword [0x000183a0], xmm1
movdqu xmm1, xmmword [0x000171d0]
movdqu xmmword [0x000181d0], xmm0
movdqu xmm0, xmmword [0x000171e0]
movdqu xmmword [0x00018230], xmm1
movdqu xmm1, xmmword [0x000171f0]
movdqu xmmword [0x00018290], xmm0
movdqu xmm0, xmmword [0x00017200]
movdqu xmmword [0x000182f0], xmm1
movdqu xmm1, xmmword [0x00017210]
movdqu xmmword [0x00018350], xmm0
movdqu xmmword [0x000183b0], xmm1
call fcn.00015760
mov rcx, qword [0x00019098]
or dword [rsp + 0xe0], r12d
lea rax, [0x000116a4]
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0xc0]
mov rdx, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc8]
mov dword [rsp + 0xc8], r14d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xd0], rsi
call qword [0x000187b0]
cmp eax, esi
mov ebx, eax
jl 0x11668
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [0x00019098]
lea r8, [0x00016250]
call qword [0x000184d8]
mov qword [rsp + 0x30], rax
cmp rax, rsi
jne 0x1128f
mov ebx, 0xc000009a
jmp 0x11668
mov rcx, qword [0x00019098]
mov r8d, 0x12
mov rdx, rax
call qword [0x00018620]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x00019098]
mov r8d, 3
call qword [0x000185f8]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x00019098]
lea r8, [rsp + 0x98]
call qword [0x00018628]
cmp eax, esi
mov ebx, eax
jge 0x112f4
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x00019098]
call qword [0x000185c0]
jmp 0x11664
lea rax, [0x00011830]
mov r14d, 4
lea rcx, [rsp + 0x60]
mov qword [rsp + 0xf0], rax
lea rax, [0x000122cc]
lea edi, [r14 + 0x34]
mov qword [rsp + 0xf8], rax
lea rax, [0x000120b8]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0xe8], r13d
mov dword [rsp + 0x10c], r14d
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x108], ebp
call fcn.00015760
mov rax, qword [0x00018158]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x00019098]
mov qword [rsp + 0x90], rax
lea rax, [0x00012320]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xe8]
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x78], ebp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x7c], r14d
call qword [0x00018648]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x00019098]
lea r8, [0x00012b94]
call qword [0x00018660]
lea rcx, [rsp + 0x60]
mov r8, rdi
xor edx, edx
call fcn.00015760
mov rcx, qword [0x00019098]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x78], r12d
mov dword [rsp + 0x7c], r12d
call qword [0x00018668]
cmp eax, esi
mov ebx, eax
jl 0x112dd
lea ebx, [rdi + 0x20]
lea rcx, [rsp + 0x120]
xor edx, edx
mov r8, rbx
call fcn.00015760
lea rax, [0x00012dc8]
lea rcx, [rsp + 0x60]
or r13d, 0xffffffff
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x148], rax
mov dword [rsp + 0x120], ebx
mov dword [rsp + 0x128], ebp
mov byte [rsp + 0x12d], r12b
mov dword [rsp + 0x124], ebp
mov dword [rsp + 0x170], r13d
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], rsi
call fcn.00015760
mov rdx, qword [rsp + 0x58]
mov rcx, qword [0x00019098]
lea rax, [rsp + 0x110]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x78], ebp
mov dword [rsp + 0x7c], r14d
call qword [0x000188d0]
cmp eax, esi
mov ebx, eax
jl 0x11668
mov rdx, qword [rsp + 0x58]
mov rcx, qword [0x00019098]
lea r8, [rsp + 0xa8]
call qword [0x00018690]
cmp eax, esi
mov ebx, eax
jl 0x11668
mov rdx, qword [rsp + 0x58]
mov rcx, qword [0x00019098]
call qword [0x000184e8]
lea edi, [r14 + 8]
lea r8, [0x000192b8]
mov edx, edi
mov ecx, ebp
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, esi
mov ebx, eax
jl 0x11668
lea ecx, [rdi + 0xb]
lea r8, [0x000192c0]
mov edx, edi
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, esi
mov ebx, eax
jl 0x11668
xor eax, eax
lea rdx, [rsp + 0x48]
mov ebx, 0x76694457
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea eax, [rdi + 4]
xor ecx, ecx
mov byte [rsp + 0x48], 0x80
mov byte [rsp + 0x49], r12b
mov word [rsp + 0x4a], ax
mov byte [rsp + 0x4d], r12b
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x54], esi
call qword [sym.imp.NDIS.SYS_NdisAllocateNetBufferListPool]
mov qword [0x000192c8], rax
cmp rax, rsi
je 0x11285
xor eax, eax
lea rdx, [rsp + 0x38]
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
mov byte [rsp + 0x38], 0x80
mov byte [rsp + 0x39], r12b
mov word [rsp + 0x3a], di
mov dword [rsp + 0x3c], ebx
mov dword [rsp + 0x40], esi
call qword [sym.imp.NDIS.SYS_NdisAllocateNetBufferPool]
mov qword [0x000192d0], rax
cmp rax, rsi
je 0x11285
lea rax, [0x000192d8]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call sub.fwpkclnt.sys_FwpmEngineOpen0
cmp eax, esi
mov ebx, eax
jl 0x11668
mov rcx, qword [0x000192d8]
xor edx, edx
call sub.fwpkclnt.sys_FwpmTransactionBegin0
cmp eax, esi
mov ebx, eax
jl 0x11668
lea rcx, str.WinDivert1.4_SubLayerInboundNetworkIPv4
call fcn.000117ac
cmp eax, esi
mov ebx, eax
jl 0x11658
lea rcx, str.WinDivert1.4_SubLayerOutboundNetworkIPv4
call fcn.000117ac
cmp eax, esi
mov ebx, eax
jl 0x11658
lea rcx, str.WinDivert1.4_SubLayerInboundNetworkIPv6
call fcn.000117ac
cmp eax, esi
mov ebx, eax
jl 0x11658
lea rcx, str.WinDivert1.4_SubLayerOutboundNetworkIPv6
call fcn.000117ac
cmp eax, esi
mov ebx, eax
jl 0x11658
lea rcx, str.WinDivert1.4_SubLayerForwardNetworkIPv4
call fcn.000117ac
cmp eax, esi
mov ebx, eax
jl 0x11658
lea rcx, str.WinDivert1.4_SubLayerForwardNetworkIPv6
call fcn.000117ac
cmp eax, esi
mov ebx, eax
jl 0x11658
mov rcx, qword [0x000192d8]
call sub.fwpkclnt.sys_FwpmTransactionCommit0
mov ebx, eax
jmp 0x11664
mov rcx, qword [0x000192d8]
call sub.fwpkclnt.sys_FwpmTransactionAbort0
cmp ebx, esi
jge 0x1166d
call fcn.000116b0
mov eax, ebx
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.00014eb0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret