Function at 0x140024614
Capabilities:
Check os version
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x102c0]
mov eax, 0x103c0
call fcn.140064ea0
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x103e0], rbx
mov rax, qword [0x14009a008]
xor rax, rsp
mov qword [rbp + 0x102b0], rax
mov rsi, r8
mov rbx, rdx
mov edi, VarUI4FromDisp
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x190]
call fcn.1400463f0
mov dword [rbp + 0x190], edi
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edx, edx
lea r8d, [rdi - 0x1c]
cmp dword [rbp + 0x194], 6
jb 0x1400247f3
lea rcx, [rbp - 0x70]
call fcn.1400463f0
lea rcx, [rbp - 0x70]
call fcn.14002b1c0
nop
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.140030eec
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.14002b0c4
cmp qword [rax + 0x18], 8
jb 0x1400246c8
mov rax, qword [rax]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
lea r8d, [rbx + 3]
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, 0xc0120089
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.14002e888
cmp rdi, 0xffffffffffffffff
je 0x1400247c7
mov dword [rbp - 0x78], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x78]
mov r8d, 0x10000
lea rdx, [rbp + 0x2b0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140024799
cmp dword [rbp - 0x78], ebx
jbe 0x140024799
mov r8d, dword [rbp - 0x78]
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x40], bl
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x40]
call fcn.140009af4
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14002b050
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140024799
inc rdx
lea r8d, [rbx + 1]
mov rcx, qword [rsp + 0x40]
call fcn.1400068e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x28]
call fcn.14002b0e4
nop
lea rax, [0x14007c550]
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0x28]
call fcn.140043a40
nop
jmp 0x140024941
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rbp + 0x28]
call fcn.14002b0e4
nop
lea rax, [0x14007c550]
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0x28]
call fcn.140043a40
nop
jmp 0x140024975
lea rcx, [rbp + 0x90]
call fcn.1400463f0
lea rcx, [rbp + 0x90]
call fcn.14002b1c0
nop
lea rcx, [rbp + 0xa0]
call fcn.140030a88
mov rcx, rax
mov rdx, rbx
call fcn.140030eec
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x90]
call fcn.14002b0c4
cmp qword [rax + 0x18], 8
jb 0x14002483e
mov rax, qword [rax]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
lea r8d, [rbx + 3]
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, 0xc0120089
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.14002e888
cmp rdi, 0xffffffffffffffff
je 0x140024945
mov dword [rbp - 0x78], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x78]
mov r8d, 0x10000
lea rdx, [rbp + 0x2b0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002490f
cmp dword [rbp - 0x78], ebx
jbe 0x14002490f
mov r8d, dword [rbp - 0x78]
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x40], bl
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x40]
call fcn.140009af4
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14002b050
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14002490f
inc rdx
lea r8d, [rbx + 1]
mov rcx, qword [rsp + 0x40]
call fcn.1400068e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x128]
call fcn.14002b0e4
nop
lea rax, [0x14007c550]
mov qword [rbp + 0x128], rax
lea rcx, [rbp + 0x128]
call fcn.140043a40
nop
xor eax, eax
jmp 0x140024977
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rbp + 0x128]
call fcn.14002b0e4
nop
lea rax, [0x14007c550]
mov qword [rbp + 0x128], rax
lea rcx, [rbp + 0x128]
call fcn.140043a40
nop
mov eax, ebx
mov rcx, qword [rbp + 0x102b0]
xor rcx, rsp
call fcn.140041c20
mov rbx, qword [rsp + 0x103e0]
add rsp, 0x103c0
pop rdi
pop rsi
pop rbp
ret