Function at 0x7fff25d6cc80
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rsi, r8
mov r15, rdx
xor ebx, ebx
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x58], ebx
mov dword [rax - 0x80], ebx
mov dword [rax + 0x20], ebx
mov dword [rsp + 0x5c], ebx
mov qword [rax - 0x70], rbx
mov qword [rax - 0x58], rbx
mov qword [rax - 0x50], rbx
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x60], ebx
test r9, r9
jne 0x7fff25de5e6c
test rdx, rdx
jne 0x7fff25d6cf32
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xf0]
call sym.KERNELBASE.dll_MapPredefinedHandleInternal
mov edi, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x7fff25d6ce66
test r15, r15
jne 0x7fff25d6cd16
test rsi, rsi
jne 0x7fff25d6cf47
mov r12, qword [rsp + 0x120]
mov rax, r12
neg rax
sbb r14, r14
lea rax, [rsp + 0x54]
and r14, rax
mov r13, qword [rsp + 0x140]
mov rax, r13
neg rax
sbb rcx, rcx
lea rax, [rsp + 0x60]
and rcx, rax
mov word [rsp + 0x80], bx
test rsi, rsi
jne 0x7fff25d6cee9
mov word [rsp + 0x82], bx
mov qword [rsp + 0x88], rbx
mov r15, qword [rsp + 0xf0]
test r15b, 1
jne 0x7fff25de5c88
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x64]
lea rdx, [rsp + 0x80]
mov rcx, r15
call fcn.7fff25d70300
mov edi, eax
mov dword [rsp + 0x50], eax
shr dword [rsp + 0x58], 1
test r14, r14
jne 0x7fff25d6ced3
shr dword [rsp + 0x108], 1
test rsi, rsi
jne 0x7fff25d6cf0c
mov rcx, qword [rsp + 0x110]
test rcx, rcx
jne 0x7fff25d6cea9
mov rcx, qword [rsp + 0x118]
test rcx, rcx
jne 0x7fff25d6cebe
test r12, r12
jne 0x7fff25d6cedc
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x7fff25d6ce2b
mov eax, dword [rsp + 0x68]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x7fff25d6ce41
mov eax, dword [rsp + 0x108]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x7fff25d6ce54
mov eax, dword [rsp + 0x5c]
mov dword [rcx], eax
test r13, r13
jne 0x7fff25d6cec9
mov rcx, qword [rsp + 0x148]
test rcx, rcx
jne 0x7fff25d6ceb4
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov r14, rbx
test rax, rax
jne 0x7fff25d6cfa5
mov rsi, qword [rsp + 0x98]
test rsi, rsi
jne 0x7fff25d6cf4e
mov eax, edi
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, dword [rsp + 0x64]
mov dword [rcx], eax
jmp 0x7fff25d6cdfe
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
jmp 0x7fff25d6ce66
mov eax, dword [rsp + 0x58]
mov dword [rcx], eax
jmp 0x7fff25d6ce0f
mov eax, dword [rsp + 0x60]
mov dword [r13], eax
jmp 0x7fff25d6ce59
shr dword [rsp + 0x54], 1
jmp 0x7fff25d6cddd
mov eax, dword [rsp + 0x54]
mov dword [r12], eax
jmp 0x7fff25d6ce18
cmp dword [rsi], ebx
je 0x7fff25d6cd59
movzx eax, word [rsi]
add ax, ax
mov word [rsp + 0x82], ax
mov qword [rsp + 0x88], r15
jmp 0x7fff25d6cd69
movzx eax, word [rsp + 0x80]
test ax, ax
je 0x7fff25d6cf40
mov ecx, 0xfffe
test cx, ax
je 0x7fff25de5e1e
shr eax, 1
dec eax
mov dword [rsi], eax
jmp 0x7fff25d6cded
test rsi, rsi
jne 0x7fff25d6ccdd
jmp 0x7fff25de5e6c
mov dword [rsi], ebx
jmp 0x7fff25d6cded
mov dword [rsi], ebx
jmp 0x7fff25d6cd16
lea rcx, [0x7fff25fd28a8]
call qword [sym.imp.ntdll.dll_RtlAcquireSRWLockExclusive]
nop dword [rax + rax]
add dword [rsi + 8], 0xffffffff
jne 0x7fff25d6cf84
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + 8]
cmp rsi, rcx
jne 0x7fff25de5e25
mov rax, qword [rax]
cmp qword [rsi], rax
jne 0x7fff25de5e25
lea rcx, [0x7fff25fd28a8]
call qword [sym.imp.ntdll.dll_RtlReleaseSRWLockExclusive]
nop dword [rax + rax]
test r14, r14
je 0x7fff25d6ce93
jmp 0x7fff25de5e3d
lea rcx, [rsp + 0xa0]
call fcn.7fff25daba24
jmp 0x7fff25d6ce82
call fcn.7fff25dcefc8
test al, al
je 0x7fff25d6cdd0
lea r14, [rsp + 0x54]
mov qword [rsp + 0x70], r14
mov rcx, r15
and rcx, 0xfffffffffffffffe
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x64]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ext_ms_win_advapi32_registry_l1_1_0.dll_RemoteRegQueryInfoKeyWrapper]
nop dword [rax + rax]
mov edi, eax
mov dword [rsp + 0x50], eax
jmp 0x7fff25de5d38
mov eax, 0xea
test edi, edi
je 0x7fff25de5e01
cmp edi, eax
je 0x7fff25de5e01
mov ecx, 0x7fff0000
test edi, edi
je 0x7fff25de5d5a
cmp edi, eax
jne 0x7fff25de5d64
cmp dword [rsp + 0x54], ecx
ja 0x7fff25de5e10
test edi, edi
je 0x7fff25de5d6c
cmp edi, eax
jne 0x7fff25de5d79
cmp dword [rsp + 0x108], ecx
ja 0x7fff25de5e10
test edi, edi
je 0x7fff25de5d81
cmp edi, eax
jne 0x7fff25de5d8b
cmp dword [rsp + 0x5c], ecx
ja 0x7fff25de5e10
test edi, edi
je 0x7fff25de5d93
cmp edi, eax
jne 0x7fff25de5d99
cmp dword [rsp + 0x60], ecx
ja 0x7fff25de5e10
test edi, edi
jne 0x7fff25d6cdd0
mov dword [rsp + 0x70], ebx
call fcn.7fff25dcefc8
test al, al
je 0x7fff25d6cdd0
and r15, 0xfffffffffffffffe
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.ext_ms_win_advapi32_registry_l1_1_0.dll_BaseRegGetVersion]
nop dword [rax + rax]
test eax, eax
jne 0x7fff25d6cdd0
mov eax, dword [rsp + 0x70]
add eax, 0xfffffffb
cmp eax, 5
jbe 0x7fff25d6cdd0
mov eax, dword [rsp + 0x108]
add eax, eax
mov dword [rsp + 0x108], eax
mov eax, dword [rsp + 0x5c]
add eax, eax
mov dword [rsp + 0x5c], eax
jmp 0x7fff25d6cdd0
mov ecx, 0x7fff0000
cmp dword [rsp + 0x58], ecx
jbe 0x7fff25de5d52
mov edi, 0xd
mov dword [rsp + 0x50], edi
jmp 0x7fff25d6ce66
mov eax, ebx
jmp 0x7fff25d6cf2b
mov r14, rsi
mov rdx, rsi
call fcn.7fff25db183c
mov rdx, qword [rsi + 0x10]
mov qword [rdx + 8], rax
jmp 0x7fff25d6cf84
mov rcx, qword [r14]
call sym.KERNELBASE.dll_RegCloseKey
mov rcx, qword gs:[0x60]
mov r8, r14
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edi, dword [rsp + 0x50]
jmp 0x7fff25d6ce93
mov eax, 0x57
jmp 0x7fff25d6ce95