Function at 0x140011a9b
Capabilities:
Check os version

Disassembly:
jmp 0x140013db0
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x20]
lea rcx, [0x1400400a5]
call fcn.140011dc0
cmp qword [0x140029208], 0
je 0x140013df3
cmp qword [0x14002f218], 0
je 0x140013df3
cmp qword [0x140035228], 0
je 0x140013df3
mov eax, 1
jmp 0x1400140d5
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140013e2b
mov rax, qword [rbp + 0x28]
cmp dword [rax + 0x118], 0xa
je 0x140013e32
xor eax, eax
jmp 0x1400140d5
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x18]
mov qword [rbp + 8], rax
mov rax, qword [0x140035230]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x140013e6c
mov qword [rbp + 0xa8], 1
mov qword [0x140035230], 1
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x88]
cmp qword [rbp + 0x68], rax
je 0x140014040
mov rax, qword [rbp + 0x68]
sub rax, 0x10
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x60]
call fcn.140011771
mov qword [rbp + 0xe8], rax
movabs rax, 0x5dc35dc35dc35dff
cmp qword [rbp + 0xe8], rax
jne 0x140013ef1
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x30]
mov qword [0x14002f218], rax
jmp 0x140013f4b
movabs rax, 0x5dc35dc35dc35e22
cmp qword [rbp + 0xe8], rax
jne 0x140013f4b
mov rax, qword [rbp + 0x48]
mov rax, qword [rax + 0x30]
mov qword [0x140029208], rax
mov eax, 0x10
imul rax, rax, 0
lea rcx, [0x140035238]
mov rdx, qword [rbp + 0x48]
mov rdx, qword [rdx + 0x30]
mov qword [rcx + rax], rdx
mov eax, 0x10
imul rax, rax, 0
lea rcx, [0x140035238]
mov rdx, qword [rbp + 0xe8]
mov qword [rcx + rax + 8], rdx
mov dword [rbp + 0x104], 0
mov dword [rbp + 0x124], 0
jmp 0x140013f6f
mov eax, dword [rbp + 0x124]
inc eax
mov dword [rbp + 0x124], eax
mov eax, dword [rbp + 0x124]
cmp rax, qword [0x140035230]
jae 0x140013fca
mov eax, dword [rbp + 0x124]
imul rax, rax, 0x10
lea rcx, [0x140035238]
mov rdx, qword [rbp + 0x48]
mov rdx, qword [rdx + 0x30]
cmp qword [rcx + rax], rdx
je 0x140013fbc
mov eax, dword [rbp + 0x124]
imul rax, rax, 0x10
lea rcx, [0x140035238]
mov rax, qword [rcx + rax + 8]
cmp qword [rbp + 0xe8], rax
jne 0x140013fc8
mov dword [rbp + 0x104], 1
jmp 0x140013fca
jmp 0x140013f61
cmp dword [rbp + 0x104], 0
jne 0x14001401a
imul rax, qword [0x140035230], 0x10
lea rcx, [0x140035238]
mov rdx, qword [rbp + 0x48]
mov rdx, qword [rdx + 0x30]
mov qword [rcx + rax], rdx
imul rax, qword [0x140035230], 0x10
lea rcx, [0x140035238]
mov rdx, qword [rbp + 0xe8]
mov qword [rcx + rax + 8], rdx
mov rax, qword [0x140035230]
inc rax
mov qword [0x140035230], rax
cmp qword [0x140029208], 0
je 0x140014030
cmp qword [0x14002f218], 0
je 0x140014030
jmp 0x140014040
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
jmp 0x140013e8d
cmp qword [0x140029208], 0
jne 0x140014090
call fcn.140011316
mov qword [0x140029208], rax
mov eax, 0x10
imul rax, rax, 0
lea rcx, [0x140035238]
mov rdx, qword [0x140029208]
mov qword [rcx + rax], rdx
mov eax, 0x10
imul rax, rax, 0
lea rcx, [0x140035238]
movabs rdx, 0x5dc35dc35dc35e22
mov qword [rcx + rax + 8], rdx
cmp qword [0x140035228], 0
jne 0x1400140ae
lea rcx, str.kernelbase
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140035228], rax
cmp qword [0x140029208], 0
je 0x1400140d3
cmp qword [0x14002f218], 0
je 0x1400140d3
cmp qword [0x140035228], 0
je 0x1400140d3
mov eax, 1
jmp 0x1400140d5
xor eax, eax
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret