Function at 0x14000a210
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address
Get system information on windows

Disassembly:
push rsi
push r12
sub rsp, 0x68
mov rax, qword [0x1400ecdc0]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.140009fd0
mov r12d, eax
test eax, eax
jns 0x14000a271
cmp eax, 0xc0000510
jne 0x14000a911
mov rax, qword [0x1400f24f0]
cmp word [rax], 2
jne 0x14000a267
movzx edx, word [rax + 2]
test dx, dx
jns 0x14000a267
mov ecx, 0x8001
cmp dx, cx
jne 0x14000a267
xor esi, esi
mov eax, esi
jmp 0x14000a911
mov eax, 0xc00000bb
jmp 0x14000a911
mov rax, qword [0x1400f24f0]
mov qword [rsp + 0x80], rbx
mov word [rax], 2
mov rax, qword [0x1400f24f0]
mov word [rax + 2], 0x8001
mov rax, qword [0x1400f24f0]
mov qword [rax + 0x70], rax
mov rcx, qword [0x1400f24f0]
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea r8, [rsp + 0x4c]
mov bl, 0xa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
mov eax, dword [rsp + 0x4c]
test eax, 0xf0000000
je 0x14000a2d7
movzx eax, ax
mov dword [rsp + 0x4c], eax
mov ecx, dword [rsp + 0x40]
sub ecx, 5
je 0x14000a3e8
sub ecx, 1
je 0x14000a36e
cmp ecx, 4
jne 0x14000a422
cmp dword [rsp + 0x48], 0
jne 0x14000a422
cmp eax, 0x2800
jb 0x14000a422
cmp eax, 0x3839
jb 0x14000a359
cmp eax, 0x3ad7
jb 0x14000a344
cmp eax, 0x55f0
mov rax, qword [0x1400f24f0]
jb 0x14000a336
mov edx, 0x138
mov byte [rax + 0x14], 9
jmp 0x14000a435
mov edx, 0x120
mov byte [rax + 0x14], 8
jmp 0x14000a435
mov rax, qword [0x1400f24f0]
mov edx, 0x120
mov byte [rax + 0x14], 7
jmp 0x14000a435
mov rax, qword [0x1400f24f0]
mov edx, pe_nt_image_headers64
mov byte [rax + 0x14], 6
jmp 0x14000a435
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x14000a3ce
sub ecx, 1
je 0x14000a3b9
sub ecx, 1
je 0x14000a3a9
cmp ecx, 1
jne 0x14000a422
cmp eax, 0x2580
jne 0x14000a422
mov rax, qword [0x1400f24f0]
mov edx, pe_nt_image_headers64
mov byte [rax + 0x14], 5
jmp 0x14000a435
cmp eax, 0x23f0
jne 0x14000a422
mov bl, 4
mov edx, 0x110
jmp 0x14000a426
sub eax, 0x1db0
je 0x14000a3c5
cmp eax, 1
jne 0x14000a422
mov bl, 3
mov edx, 0xe0
jmp 0x14000a426
sub eax, 0x1770
je 0x14000a3df
sub eax, 1
je 0x14000a3df
cmp eax, 1
jne 0x14000a422
mov bl, 2
mov edx, 0xc8
jmp 0x14000a426
mov ecx, dword [rsp + 0x48]
cmp ecx, 1
jne 0x14000a404
cmp eax, 0xa28
je 0x14000a410
mov rax, qword [0x1400f24f0]
mov byte [rax + 0x14], bl
jmp 0x14000a46a
cmp ecx, 2
jne 0x14000a422
cmp eax, 0xece
jne 0x14000a422
mov rax, qword [0x1400f24f0]
mov edx, 0x98
mov byte [rax + 0x14], 1
jmp 0x14000a435
mov edx, dword [rsp + 0x40]
mov rax, qword [0x1400f24f0]
mov byte [rax + 0x14], bl
cmp bl, 0xa
je 0x14000a46a
mov rax, qword [0x1400f24f0]
mov ecx, dword [rsp + 0x40]
mov dword [rax + 8], ecx
mov rax, qword [0x1400f24f0]
mov ecx, dword [rsp + 0x48]
mov dword [rax + 0xc], ecx
mov rax, qword [0x1400f24f0]
mov ecx, dword [rsp + 0x4c]
mov dword [rax + 0x10], ecx
mov rax, qword [0x1400f24f0]
mov word [rax + 0x16], dx
mov rax, qword [0x1400f24f0]
cmp byte [rax + 0x14], 0xa
jne 0x14000a491
mov rdx, rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, 0xc00000bb
jmp 0x14000a909
lea rcx, [rax + 0x88]
mov qword [rsp + 0x90], rdi
mov qword [rax + 0x48], rcx
xor esi, esi
mov rax, qword [0x1400f24f0]
add rcx, 0x20
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x60], r15
mov qword [rax + 0x50], rcx
add rcx, 8
mov rax, qword [0x1400f24f0]
mov qword [rax + 0x58], rcx
add rcx, 8
mov rax, qword [0x1400f24f0]
mov qword [rax + 0x60], rcx
add rcx, 0x90
mov rax, qword [0x1400f24f0]
mov qword [rax + 0x68], rcx
add rcx, 0xa8
mov rax, qword [0x1400f24f0]
mov qword [rax + 0x78], rcx
add rcx, 0x28
mov rax, qword [0x1400f24f0]
mov qword [rax + 0x80], rcx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x10
mov rdi, qword [r14]
cmp rdi, r14
je 0x14000a57a
mov rbx, rdi
lea rcx, [0x1400d96b8]
mov rdi, qword [rdi]
movzx r8d, word [rbx + 0x58]
mov rdx, qword [rbx + 0x60]
shr r8, 1
sub r8, 4
call fcn.140052d84
test eax, eax
je 0x14000a57d
movzx r8d, word [rbx + 0x58]
lea rcx, [0x1400d96b8]
mov rdx, qword [rbx + 0x60]
shr r8, 1
call fcn.140052d84
test eax, eax
je 0x14000a57d
cmp rdi, r14
jne 0x14000a533
mov rbx, rsi
mov rax, qword [0x1400f24f0]
mov r15, rsi
mov qword [rsp + 0x88], rbp
mov rcx, qword [rax + 0x48]
mov qword [rcx + 8], rbx
mov rdx, qword [0x1400f24f0]
mov rax, qword [rdx + 0x48]
mov r14, qword [rax + 8]
mov qword [rsp + 0x40], rsi
test r14, r14
je 0x14000a688
cmp dword [rdx + 8], 6
jne 0x14000a5c0
cmp dword [rdx + 0xc], 2
je 0x14000a5cd
mov eax, esi
seta al
test eax, eax
je 0x14000a688
lea rcx, [r14 + 0xc8]
mov qword [rsp + 0x40], rcx
mov rax, qword [rcx + 0x10]
and rax, 0xfffffffffffffff8
je 0x14000a602
nop dword [rax]
nop word [rax + rax]
mov rcx, rax
mov qword [rsp + 0x40], rax
mov rax, qword [rax + 0x10]
and rax, 0xfffffffffffffff8
jne 0x14000a5f0
test byte [rcx + 0x10], 1
jne 0x14000a688
mov rcx, qword [r14 + 0x30]
lea rax, [rsp + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x28], 8
lea rdx, [0x1400d96ac]
xor dil, dil
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140008540
test eax, eax
js 0x14000a681
movzx eax, dil
inc dil
test al, al
jne 0x14000a681
mov rcx, qword [r14 + 0x30]
lea r8, [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
lea rdx, [0x1400d96ac]
call fcn.140008540
test eax, eax
jns 0x14000a644
test rbp, rbp
je 0x14000a681
cmp qword [rbp], rsi
je 0x14000a681
cmp qword [rbp + 8], rsi
je 0x14000a681
mov r15, rbp
mov rdx, qword [0x1400f24f0]
mov rax, qword [rdx + 0x48]
lea rdx, str.RtlRbInsertNodeEx
mov qword [rax], r15
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f24f0]
mov rdx, qword [rcx + 0x48]
mov qword [rdx + 0x10], rax
lea rdx, str.RtlRbRemoveNode
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f24f0]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov rdx, qword [rcx + 0x48]
mov rbp, qword [rsp + 0x88]
mov qword [rdx + 0x18], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x30]
add rdx, 0x30
cmp rdx, rcx
je 0x14000a757
nop word [rax + rax]
mov rax, qword [rcx + 0x50]
lea rbx, [rcx + 0x50]
cmp rax, rbx
je 0x14000a722
cmp qword [rax], rbx
je 0x14000a72c
mov rcx, qword [rcx]
cmp rdx, rcx
jne 0x14000a710
jmp 0x14000a757
add rcx, 0x38
mov edx, 1
call fcn.140008020
mov rbx, qword [rbx]
neg eax
movsxd rcx, eax
shl rcx, 4
add rbx, rcx
mov rcx, rbx
call fcn.140009f50
test eax, eax
cmovne rsi, rbx
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x58]
mov qword [rcx], rsi
call fcn.140009cf0
mov rcx, qword [0x1400f24f0]
mov rdx, qword [rcx + 0x50]
mov qword [rdx], rax
mov rax, qword [0x1400f24f0]
mov dword [rax + 4], 0x65
mov rcx, qword [0x1400f24f0]
mov rax, qword [rcx + 0x48]
cmp qword [rax], 0
je 0x14000a7a2
or dword [rcx + 4], 2
mov rcx, qword [0x1400f24f0]
mov rax, qword [rcx + 0x58]
cmp qword [rax], 0
je 0x14000a7b7
or dword [rcx + 4], 8
mov rcx, qword [0x1400f24f0]
mov rax, qword [rcx + 0x50]
cmp qword [rax], 0
je 0x14000a7cc
or dword [rcx + 4], 0x10
mov rcx, qword [0x1400f24f0]
mov rax, qword [rcx + 0x78]
lea rcx, [fcn.140006450]
mov qword [rax], rcx
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x78]
lea rax, [fcn.140006f40]
mov qword [rcx + 8], rax
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x78]
lea rax, [0x1400072f0]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x78]
lea rax, [0x14000cf50]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x78]
lea rax, [fcn.14000cea0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x80]
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x80]
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x80]
add rcx, 0x38
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x80]
mov dword [rcx + 0x58], 1
mov rax, qword [0x1400f24f0]
mov rdx, qword [rax + 0x80]
mov rax, qword [rdx + 8]
lea rcx, [rdx + 0x38]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov qword [rdx + 8], rcx
call fcn.14000d380
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x68]
mov byte [rcx + 0x40], 0
mov rax, qword [0x1400f24f0]
mov rcx, qword [rax + 0x68]
mov eax, r12d
mov byte [rcx + 0x41], 0
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003e240
add rsp, 0x68
pop r12
pop rsi
ret