Function at 0x14002a740
Capabilities:
Check os version

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [r8], 0xffffffffffffffff
mov ecx, dword [rcx + 0x18]
test cl, 3
je 0x14002a7bc
lea rbx, [rsp + 0x24]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call sub.ntdll.dll_memset
mov dword [rbx - 4], 0x114
lea rcx, [rsp + 0x20]
call sub.ntdll.dll_RtlGetVersion
test eax, eax
js 0x14002a8a2
mov ecx, dword [rsi + 0x18]
test cl, 2
jne 0x14002a8a9
test cl, 1
jne 0x14002a8c4
test cl, 8
je 0x14002a7d0
xor ebx, ebx
test byte [0x140061a88], 1
je 0x14002a8f4
test cl, 0x40
je 0x14002a7e4
xor ebx, ebx
test byte [0x140061a88], 4
je 0x14002a8f4
test cl, 0x80
je 0x14002a7f8
xor ebx, ebx
test byte [0x140061a88], 8
je 0x14002a8f4
test cl, 0x10
je 0x14002a80c
xor ebx, ebx
test byte [0x140061a88], 1
jne 0x14002a8f4
mov rdx, qword [rsi + 0x10]
cmp rdx, 0xffffffffffffffff
je 0x14002a8df
mov rax, qword [rdi + 0x10]
mov ebx, 2
test rax, rax
je 0x14002a8f4
mov rbp, qword [rdi + 8]
test cl, 4
jne 0x14002a8e6
mov ecx, dword [rbp + 0x84]
cmp ecx, 0x10
mov edx, 0x10
cmovb edx, ecx
cmp edx, 3
jb 0x14002a8f4
mov r15, qword [rdi]
test r15, r15
je 0x14002a8f4
mov r10d, dword [rbp + 0x98]
lea r9, [r15 + r10]
cmp r9, rax
ja 0x14002a8f4
movzx ebp, word [r9 + 0xe]
test rbp, rbp
je 0x14002a8f4
movzx ecx, word [r9 + 0xc]
lea rdi, [r10 + rcx*8]
lea rdx, [r15 + rdi]
add rdx, 0x14
xor ecx, ecx
cmp word [rdx + rcx*8 - 4], 0x10
je 0x14002a916
inc rcx
cmp rbp, rcx
jne 0x14002a890
jmp 0x14002a8f4
mov ebx, 2
jmp 0x14002a8f4
xor ebx, ebx
cmp dword [rsp + 0x24], 6
ja 0x14002a8f4
jne 0x14002a7b3
cmp dword [rsp + 0x28], 2
ja 0x14002a8f4
jmp 0x14002a7b3
xor ebx, ebx
cmp dword [rsp + 0x24], 6
ja 0x14002a8f4
jne 0x14002a7bc
cmp dword [rsp + 0x28], 2
jae 0x14002a8f4
jmp 0x14002a7bc
mov ebx, 3
jmp 0x14002a8f4
mov eax, dword [rbp + 8]
xor ecx, ecx
cmp rdx, rax
setae cl
lea ebx, [rcx + rcx*2]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14002f4d0
mov eax, ebx
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
add rdi, r15
mov ebp, dword [rdi + rcx*8 + 0x14]
test ebp, ebp
jns 0x14002a8f4
and ebp, 0x7fffffff
lea rcx, [r9 + rbp]
cmp rcx, r15
jb 0x14002a8f4
cmp rcx, rax
ja 0x14002a8f4
movzx r8d, word [rcx + 0xe]
test r8, r8
je 0x14002a8f4
movzx ecx, word [rcx + 0xc]
lea rdx, [r10 + rcx*8]
add rdx, rbp
lea rbp, [r15 + rdx]
add rbp, 0x14
xor ecx, ecx
cmp word [rbp + rcx*8 - 4], 1
je 0x14002a966
inc rcx
cmp r8, rcx
jne 0x14002a954
jmp 0x14002a8f4
add rdx, r15
mov ecx, dword [rdx + rcx*8 + 0x14]
test ecx, ecx
jns 0x14002a8f4
and ecx, 0x7fffffff
add rcx, r9
xor ebp, ebp
cmp rcx, rax
mov rdx, rcx
cmova rdx, rbp
cmp rcx, r15
cmovb rdx, rbp
movzx ecx, word [rdx + 0xc]
add cx, word [rdx + 0xe]
je 0x14002a8f4
mov ecx, dword [rdx + 0x14]
test ecx, ecx
js 0x14002a8f4
add r9, rcx
cmp r9, r15
jb 0x14002a8f4
cmp r9, rax
ja 0x14002a8f4
mov ecx, dword [r9]
add r15, rcx
cmp r15, rax
ja 0x14002a8f4
movzx ebp, word [r15]
cmp bp, 0x26
jb 0x14002a8f4
movaps xmm0, xmmword [0x140054860]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x10], xmm0
movaps xmm0, xmmword [0x140054850]
movaps xmmword [rdx], xmm0
lea rcx, [r15 + 6]
mov r8d, 0x10
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, 0x10
jne 0x14002a8f4
cmp word [r15 + 2], 0x34
jne 0x14002a8f4
mov eax, 2
sub eax, r15d
and eax, 3
add rax, 0x26
cmp ax, bp
jae 0x14002a8f4
cmp dword [rax + r15], 0xfeef04bd
jne 0x14002a8f4
mov ecx, dword [r15 + rax + 8]
mov eax, dword [r15 + rax + 0xc]
shl rcx, 0x20
or rax, rcx
mov qword [r14], rax
xor ecx, ecx
cmp qword [rsi + 0x10], rax
jmp 0x14002a8ee