Function at 0x18001d6f0
Capabilities:
Access pe header
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r8, qword gs:[0x30]
mov r12, rdx
mov rdi, rcx
mov rax, qword [r8 + 0x30]
mov r15d, 1
cmp qword [r8 + 0x28], rax
jne 0x18001d732
and qword [r8 + 0x28], 0
mov r14d, r15d
jmp 0x18001d735
xor r14d, r14d
lea rcx, [rsp + 0x30]
call qword [sym.imp.kERNEL32.dll_GetSystemTimeAsFileTime]
xor r8d, r8d
mov edx, 0x400000
xor ecx, ecx
call qword [sym.imp.kERNEL32.dll_HeapCreate]
mov qword [0x180035a68], rax
test rax, rax
jne 0x18001d764
lea ebx, [rax + 8]
jmp 0x18001d988
mov rax, qword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
shr rax, 8
mov edx, r15d
xor ecx, ecx
mov dword [0x180035a20], eax
call qword [sym.imp.kERNEL32.dll_CreateEventA]
mov qword [0x180035c88], rax
test rax, rax
je 0x18001d7ef
call qword [sym.imp.kERNEL32.dll_GetVersion]
cmp al, 5
jne 0x18001d7a7
movzx ecx, ax
shr cx, 8
test cl, cl
jne 0x18001d7a9
cmp al, al
jbe 0x18001d7e8
mov dword [0x180035c70], eax
call qword [sym.imp.kERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x10047a
mov r8d, eax
mov qword [0x180035c78], rdi
mov dword [0x180035c5c], eax
call qword [sym.imp.kERNEL32.dll_OpenProcess]
or rcx, 0xffffffffffffffff
test rax, rax
cmove rax, rcx
xor ebx, ebx
mov qword [0x180035c68], rax
jmp 0x18001d7f7
mov ebx, 0x32
jmp 0x18001d7f7
call qword [sym.imp.kERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x18001d988
and dword [rsp + 0x9c], ebx
lea rdx, [rsp + 0x98]
mov rcx, rdi
mov dword [rsp + 0x98], 0x7373622e
call fcn.180019ddc
test rax, rax
je 0x18001d83b
mov ebp, dword [rax + 0xc]
test ebp, ebp
je 0x18001d834
mov esi, dword [rax + 0x10]
test esi, esi
jne 0x18001d84e
mov ebx, 0xb
jmp 0x18001d840
mov ebx, 2
mov ebp, dword [rsp + 0x90]
mov esi, dword [rsp + 0x90]
test ebx, ebx
jne 0x18001d988
mov rcx, qword [0x180035a68]
mov eax, esi
mov r13d, ebx
test esi, 0xfff
mov r12d, ebp
setne r13b
shr eax, 0xc
xor edx, edx
add r13d, eax
add r12, rdi
mov r8d, r13d
shl r8d, 0xc
call qword [sym.imp.kERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18001d934
mov r8d, esi
mov rdx, r12
mov rcx, rax
call sub.ntdll.dll_memcpy
xor esi, esi
test r13d, r13d
je 0x18001d8fa
mov rbx, rdi
lea rax, [0x180039168]
mov r15, rdi
sub rbx, r12
add rbx, rax
mov r8d, ebp
mov edx, 0x1000
mov r9d, 1
sub r8d, esi
mov rcx, r15
sub r8d, 0x7e47c813
call fcn.1800283c4
mov eax, dword [rbx + 0xc]
inc esi
sub eax, dword [rbx + 8]
add r15, 0x1000
add eax, dword [rbx + 4]
cmp esi, r13d
jb 0x18001d8bb
mov r15d, 1
jmp 0x18001d901
mov eax, dword [rsp + 0x90]
lea ebx, [rax - 0x69b25f44]
test ebx, ebx
jne 0x18001d91d
sub rdi, r12
mov dword [0x180035c58], eax
mov qword [0x180035c60], rdi
jmp 0x18001d939
mov rcx, qword [0x180035a68]
mov r8, rdi
xor edx, edx
call qword [sym.imp.kERNEL32.dll_HeapFree]
mov ebx, r15d
jmp 0x18001d939
mov ebx, 8
mov r12, qword [rsp + 0x88]
test ebx, ebx
jne 0x18001d988
lea rdx, [0x180035c80]
xor r8d, r8d
xor ecx, ecx
call fcn.18000bb1c
test eax, eax
setne bl
test ebx, ebx
jne 0x18001d988
mov ecx, dword [0x180035c5c]
xor edx, edx
call fcn.180015700
mov ecx, dword [0x180035c74]
test eax, eax
cmovne ecx, r15d
mov dword [0x180035c74], ecx
mov rcx, r12
call fcn.18001c35c
mov ebx, eax
test r14d, r14d
je 0x18001d9e9
mov r9d, 8
lea rax, [rsp + 0x90]
lea r8, [rsp + 0x38]
lea edx, [r9 + 1]
mov rcx, 0xfffffffffffffffe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x18001d9e9
xor ecx, ecx
call qword [sym.imp.kERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x18001d9e9
mov ecx, dword [rax + 0x28]
add rcx, rdi
cmp qword [rsp + 0x38], rcx
jne 0x18001d9e9
mov ecx, ebx
call qword [sym.imp.kERNEL32.dll_ExitThread]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret