Function at 0x14006dbf0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov eax, 4
mov eax, eax
mov ecx, dword [0x140326120]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rax + rcx]
cmp dword [0x140323168], eax
jle 0x14006dc64
lea rcx, [0x140323168]
call fcn.1401363d0
cmp dword [0x140323168], 0xffffffff
jne 0x14006dc64
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140323160], rax
lea rcx, [0x140323168]
call fcn.140136370
mov rax, qword [rsp + 0x50]
mov dword [rax], 0x114
cmp qword [0x140323160], 0
je 0x14006dc89
mov rax, qword [rsp + 0x50]
mov rcx, rax
call qword [0x140323160]
jmp 0x14006dc97
mov rax, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 4]
mov dword [rax + 0x114], ecx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 8]
mov dword [rax + 0x118], ecx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0xc]
mov dword [rax + 0x11c], ecx
mov rax, qword [rsp + 0x50]
add rax, 0x120
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x11c]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x118]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x50]
mov r9d, dword [rcx + 0x114]
lea r8, str._u._u._u
mov edx, SafeArrayAllocDescriptor
mov rcx, rax
call fcn.14006dea0
mov eax, 2
imul rax, rax, 0x1f
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
mov word [rdx + rax + 0x120], cx
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x160], 0
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x161], 0
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x162], 0
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x163], 0
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x164], 0
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x165], 0
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x166], 0
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x114]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 5
je 0x14006dda7
cmp dword [rsp + 0x30], 6
je 0x14006dde2
jmp 0x14006de6a
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x118], 1
jne 0x14006ddc3
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x160], 1
jmp 0x14006dddd
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x118], 2
jne 0x14006dddd
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x161], 1
jmp 0x14006de90
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x118], 0
jne 0x14006ddfe
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x162], 1
jmp 0x14006de5c
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x165], 1
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x118], 1
jne 0x14006de26
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x164], 1
jmp 0x14006de5c
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x118], 2
jne 0x14006de42
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x166], 1
jmp 0x14006de5c
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x118], 3
jne 0x14006de5c
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x167], 1
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x163], 1
jmp 0x14006de90
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x114], 6
jbe 0x14006de90
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x165], 1
mov rax, qword [rsp + 0x50]
mov byte [rax + 0x163], 1
add rsp, 0x40
pop rdi
ret