Function at 0x410100
Capabilities:
Check os version
Print debug messages

Disassembly:
mov r11, rsp
sub rsp, 0x1b8
mov rax, qword [0x00424338]
mov qword [rsp + 0x170], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
xor esi, esi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x28], r14
mov qword [r11 - 0x30], r15
mov rbx, rcx
mov r8, rcx
mov r15, rdx
lea r9d, [rsi - 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea ecx, [rax + 1]
movsxd rcx, ecx
add rcx, rcx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea r9d, [rsi - 1]
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov r14, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea r8d, [rsi + 0x50]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rdx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x40]
mov ebp, 1
lea rcx, [rsp + 0xd4]
xor edx, edx
mov r8d, 0x98
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x40], 0x20
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x60], 0x50
mov dword [rsp + 0x78], 2
mov dword [rsp + 0x7c], esi
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x90], ebp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0xd0], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x410237
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0xd0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
jmp 0x41025c
cmp dword [rsp + 0xe0], 2
jne 0x410276
mov eax, dword [rsp + 0xd4]
cmp eax, 5
jb 0x410276
cmp eax, 5
jne 0x410276
cmp dword [rsp + 0xd8], 2
jae 0x410276
lea rcx, str.get_sign_config_is_xp
mov dword [rsp + 0xa8], reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x41028e
lea rcx, str.get_sign_config_is_not_xp
mov dword [rsp + 0xa8], 0x1000
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0xc0]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x1a0], r12
mov dword [rsp + 0xc0], 0xaac56b
mov word [rsp + 0xc4], 0xcd44
mov qword [rsp + 0x198], r13
mov word [rsp + 0xc6], 0x11d0
mov byte [rsp + 0xc8], 0x8c
mov byte [rsp + 0xc9], 0xc2
mov byte [rsp + 0xca], sil
mov byte [rsp + 0xcb], 0xc0
mov byte [rsp + 0xcc], 0x4f
mov byte [rsp + 0xcd], 0xc2
mov byte [rsp + 0xce], 0x95
mov byte [rsp + 0xcf], 0xee
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
mov edi, eax
jne 0x41046e
mov rcx, qword [rsp + 0x98]
call sub.WINTRUST.dll_WTHelperProvDataFromStateData
test rax, rax
je 0x41044c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call sub.WINTRUST.dll_WTHelperGetProvSignerFromChain
test rax, rax
mov rdi, rax
je 0x41044c
lea rcx, [rax + 4]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor edx, edx
mov rcx, rdi
call sub.WINTRUST.dll_WTHelperGetProvCertFromChain
test rax, rax
mov r12, rax
je 0x41042a
mov rcx, qword [rax + 8]
xor r8d, r8d
lea r9, [rsp + 0x30]
lea edx, [r8 + 4]
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x20], rsi
call qword [sym.imp.CRYPT32.dll_CertGetNameStringA]
test eax, eax
mov r13d, eax
je 0x410491
lea ecx, [rax + 1]
mov ebx, ecx
call qword [sym.imp.msvcrt.dll_malloc]
mov r8, rbx
mov rcx, rax
xor edx, edx
mov rsi, rax
call sub.msvcrt.dll_memset
mov rcx, qword [r12 + 8]
xor r8d, r8d
lea r9, [rsp + 0x30]
lea edx, [r8 + 4]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.CRYPT32.dll_CertGetNameStringA]
xor eax, eax
mov rdi, r15
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rsi + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x410410
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
jmp 0x410491
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x0041d6b0]
mov r8d, 0x32d
mov r9d, eax
mov ecx, 4
call fcn.0040e440
jmp 0x410491
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._Sign__Error__d_:_0x_x_n
mov r8d, 0x332
mov r9d, eax
mov ecx, 4
call fcn.0040e440
jmp 0x410491
lea rdx, str._Sign_WinVerifyTrust_Error__d_:_0x_x
mov r9d, eax
mov r8d, 0x337
mov ecx, 4
call fcn.0040e440
cmp edi, 0x800b0100
cmove ebp, esi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0xc0]
mov rcx, 0xffffffffffffffff
mov dword [rsp + 0x78], 2
mov dword [rsp + 0x90], 2
call sub.WINTRUST.dll_WinVerifyTrust
mov rcx, r14
call fcn.00419af0
mov r15, qword [rsp + 0x188]
mov r14, qword [rsp + 0x190]
mov r13, qword [rsp + 0x198]
mov r12, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x1a8]
mov rsi, qword [rsp + 0x1b0]
mov rbx, qword [rsp + 0x1d0]
mov eax, ebp
mov rbp, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x170]
call fcn.00419e60
add rsp, 0x1b8
ret