Function at 0x143e0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x218
mov dword [rsp + 0xe8], 0
mov rax, qword [rsp + 0x220]
mov byte [rax], 0
mov rax, qword [rsp + 0x220]
mov dword [rax + 4], 0
mov rax, qword [rsp + 0x220]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x28], 0
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x30], 0
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x38], 0
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x40], 0
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x48], 0
mov dword [rsp + 0xf0], 0x114
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
shr eax, 0x1e
cmp eax, 3
jne 0x144c8
jmp 0x14810
cmp dword [rsp + 0xf4], 5
jne 0x144dc
cmp dword [rsp + 0xf8], 0
je 0x144e6
cmp dword [rsp + 0xf4], 4
jne 0x144eb
jmp 0x14810
lea rdx, [0x000112a0]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
call fcn.0002ca60
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x30]
call fcn.0002cc10
movzx eax, al
test eax, eax
je 0x14745
lea rcx, [rsp + 0x30]
call fcn.0002cf80
movzx eax, al
test eax, eax
je 0x14745
lea rcx, [rsp + 0x30]
call fcn.0002ea60
mov qword [rsp + 0xd8], rax
cmp qword [rsp + 0xd8], 0
je 0x14745
lea r9, [0x00014360]
lea r8, [0x000142d0]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x30]
call fcn.0002e5b0
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x14745
lea rdx, [0x000112e8]
mov rcx, qword [rsp + 0xd8]
call fcn.0002fc80
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x145ce
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xc0]
add rcx, rax
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x10], rcx
lea rdx, [0x000112f8]
mov rcx, qword [rsp + 0xd8]
call fcn.0002fc80
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14623
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xc0]
add rcx, rax
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x18], rcx
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xc0]
add rcx, rax
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x20], rcx
lea rdx, [0x00011308]
mov rcx, qword [rsp + 0xd8]
call fcn.0002fc80
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1465d
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xc0]
add rcx, rax
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x28], rcx
lea rdx, [0x00011318]
mov rcx, qword [rsp + 0xd8]
call fcn.0002fc80
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14697
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xc0]
add rcx, rax
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x30], rcx
lea rdx, [0x00011328]
mov rcx, qword [rsp + 0xd8]
call fcn.0002fc80
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x146d1
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xc0]
add rcx, rax
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x38], rcx
lea rdx, [0x00011340]
mov rcx, qword [rsp + 0xd8]
call fcn.0002fc80
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1470b
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xc0]
add rcx, rax
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x40], rcx
lea rdx, [0x00011358]
mov rcx, qword [rsp + 0xd8]
call fcn.0002fc80
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14745
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xc0]
add rcx, rax
mov rax, qword [rsp + 0x220]
mov qword [rax + 0x48], rcx
mov rax, qword [rsp + 0x220]
cmp qword [rax + 0x10], 0
je 0x14806
mov rax, qword [rsp + 0x220]
cmp qword [rax + 0x18], 0
je 0x14806
mov rax, qword [rsp + 0x220]
cmp qword [rax + 0x20], 0
je 0x14806
mov rax, qword [rsp + 0x220]
cmp qword [rax + 0x28], 0
je 0x14806
mov rax, qword [rsp + 0x220]
cmp qword [rax + 0x30], 0
je 0x14806
mov rax, qword [rsp + 0x220]
cmp qword [rax + 0x38], 0
je 0x14806
mov rax, qword [rsp + 0x220]
cmp qword [rax + 0x40], 0
je 0x14806
mov rax, qword [rsp + 0x220]
cmp qword [rax + 0x48], 0
je 0x14806
mov rax, qword [rsp + 0x220]
cmp dword [rax + 4], 5
jne 0x147e6
mov cl, 1
mov rax, qword [rsp + 0x220]
call qword [rax + 0x18]
jmp 0x147fb
lea rdx, [rsp + 0xe8]
mov cl, 1
mov rax, qword [rsp + 0x220]
call qword [rax + 0x20]
mov rax, qword [rsp + 0x220]
mov byte [rax], 1
lea rcx, [rsp + 0x30]
call fcn.0002cb50
mov rax, qword [rsp + 0x220]
add rsp, 0x218
ret