Function at 0x1800ed30c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
test dword [rcx + 0x74], 0x1000000
mov r15b, r8b
mov rsi, rdx
mov rdi, rcx
je 0x1800ed349
mov rax, qword [0x180156438]
call qword [section..00cfg]
jmp 0x1800edb70
test dword [rcx + 0x70], 0x61000000
mov r10d, 1
setne cl
bt dword [rdi + 0x70], 0x1c
setae al
xor r12d, r12d
test al, cl
je 0x1800ed386
mov rcx, rdi
call fcn.180100ef8
test al, al
jne 0x1800ed380
mov dword [rbp + 0x30], 0xc000000d
jmp 0x1800edb1e
mov r10d, 1
mov rcx, qword [rsi]
mov ebx, 0x2000
mov dword [rbp + 0x30], r12d
mov r14d, 0x1000
mov r9d, 2
test rcx, rcx
jne 0x1800ed3ab
mov rdx, rdi
jmp 0x1800ed5d6
mov eax, 0x1002
test word [rsi + 0x12], ax
je 0x1800ed46b
movzx edx, word [rsi + 0x12]
and dx, r9w
je 0x1800ed3e2
cmp byte [rdi + 0x182], r9b
jne 0x1800ed3d6
mov rax, qword [rdi + 0x178]
jmp 0x1800ed3d9
mov rax, r12
cmp rcx, rax
je 0x1800ed5d3
test r15b, r15b
je 0x1800ed3f5
test dx, dx
je 0x1800ed3f5
mov rbx, qword [rcx + 0x40]
jmp 0x1800ed6bf
mov rax, qword [rsi + 8]
lea rbx, [rcx + rax]
test word [rsi + 0x12], r14w
je 0x1800ed42f
lea rdx, [rdi + 0x120]
mov rax, qword [rdx]
lea r8, [rcx - 0x30]
jmp 0x1800ed427
lea rcx, [rax - 0x18]
cmp qword [rcx + 0x30], r8
ja 0x1800ed424
cmp r8, qword [rcx + 0x48]
jbe 0x1800ed42f
mov rax, qword [rax]
cmp rax, rdx
jne 0x1800ed414
mov rcx, r12
test r15b, r15b
je 0x1800ed43e
cmp rbx, qword [rcx + 0x48]
jb 0x1800ed6bf
mov rdx, qword [rcx + 0x18]
lea rax, [rdi + 0x120]
cmp rdx, rax
jne 0x1800ed5cd
cmp byte [rdi + 0x182], r9b
jne 0x1800ed5d3
mov rdx, qword [rdi + 0x178]
jmp 0x1800ed5d6
cmp byte [rdi + 0x182], r9b
jne 0x1800ed47d
mov rax, qword [rdi + 0x178]
jmp 0x1800ed480
mov rax, r12
test rax, rax
je 0x1800ed4a8
mov rdx, rsi
mov rcx, rdi
call fcn.180102a9c
test al, al
je 0x1800ed49e
test word [rsi + 0x12], bx
je 0x1800edb1e
mov r10d, 1
lea r9d, [r10 + 1]
mov rbx, qword [rsi]
test byte [rsi + 0x12], r10b
je 0x1800ed549
add rbx, 0xfffffffffffffff0
prefetchw byte [rbx]
cmp byte [rbx + 0xf], 5
jne 0x1800ed4cd
movzx eax, byte [rbx + 0xe]
shl rax, 4
sub rbx, rax
cmp byte [rbx + 0xf], 4
jne 0x1800ed4e3
mov rbx, qword [rbx - 0x30]
lea rax, [rdi + 0x110]
jmp 0x1800ed5e8
mov al, byte [rbx + 0xe]
test al, al
je 0x1800ed507
movzx eax, al
mov rdx, rbx
shl rax, 0x10
and rdx, 0xffffffffffff0000
sub rdx, rax
add rdx, 0x10000
jmp 0x1800ed50a
mov rdx, rdi
test rdx, rdx
je 0x1800edb17
cmp byte [rbx + 0xf], 3
je 0x1800ed5ab
cmp dword [rdi + 0x7c], r12d
je 0x1800ed53d
mov eax, dword [rbx + 8]
mov dword [rbp - 0x28], eax
test dword [rdi + 0x7c], eax
je 0x1800ed537
xor eax, dword [rdi + 0x88]
mov dword [rbp - 0x28], eax
movzx eax, word [rbp - 0x28]
jmp 0x1800ed541
movzx eax, word [rbx + 8]
movzx eax, ax
jmp 0x1800ed6b8
add rbx, 0xffffffffffffffe0
cmp dword [rdi + 0x7c], r12d
je 0x1800ed56d
mov eax, dword [rbx + 8]
mov dword [rbp - 0x18], eax
test dword [rdi + 0x7c], eax
je 0x1800ed567
xor eax, dword [rdi + 0x88]
mov dword [rbp - 0x18], eax
movzx ecx, word [rbp - 0x18]
jmp 0x1800ed571
movzx ecx, word [rbx + 8]
mov al, byte [rbx + 0xe]
test al, al
je 0x1800ed595
movzx eax, al
mov rdx, rbx
shl rax, 0x10
and rdx, 0xffffffffffff0000
sub rdx, rax
add rdx, 0x10000
jmp 0x1800ed598
mov rdx, rdi
test rdx, rdx
je 0x1800edb17
cmp byte [rbx + 0xf], 3
jne 0x1800ed6b5
lea rcx, [rbx + 0x40]
add rcx, qword [rbx + 0x38]
cmp rcx, qword [rdx + 0x48]
jb 0x1800ed696
mov rdx, qword [rdx + 0x18]
lea rax, [rdi + 0x120]
cmp rdx, rax
je 0x1800ed5d3
add rdx, 0xffffffffffffffe8
jmp 0x1800ed5d6
mov rdx, r12
mov rbx, r12
test rdx, rdx
jne 0x1800ed5fa
lea rax, [rdi + 0x110]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1800ed7b3
add rbx, 0x30
jmp 0x1800ed6bf
cmp byte [rdi + 0x182], r9b
jne 0x1800ed60c
mov rax, qword [rdi + 0x178]
jmp 0x1800ed60f
mov rax, r12
cmp rdx, rax
je 0x1800ed7bf
mov qword [rsi], rdx
cmp dword [rdi + 0x7c], r12d
je 0x1800ed63b
mov eax, dword [rdx + 8]
mov dword [rbp - 8], eax
test dword [rdi + 0x7c], eax
je 0x1800ed635
xor eax, dword [rdi + 0x88]
mov dword [rbp - 8], eax
movzx eax, word [rbp - 8]
jmp 0x1800ed63f
movzx eax, word [rdx + 8]
movzx eax, ax
shl rax, 4
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 0x20000
mov eax, dword [rdx + 0x38]
sub eax, dword [rdx + 0x50]
shl eax, 0xc
mov dword [rsi + 0x18], eax
mov eax, dword [rdx + 0x50]
shl eax, 0xc
mov dword [rsi + 0x1c], eax
test byte [rdx + 0x14], r9b
je 0x1800ed672
add eax, r14d
mov dword [rsi + 0x1c], eax
mov rax, qword [rdx + 0x40]
mov cl, byte [rax + 0xa]
not cl
and rcx, r10
add rcx, r10
shl rcx, 4
add rcx, rax
mov qword [rsi + 0x20], rcx
mov rax, qword [rdx + 0x48]
mov qword [rsi + 0x28], rax
jmp 0x1800ed6bf
mov rax, qword [rbx + 0x30]
mov qword [rsi], rax
mov rax, qword [rbx + 0x38]
mov rbx, r12
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 0x10000000
mov qword [rsi + 0x24], r12
jmp 0x1800ed6bf
movzx eax, cx
shl rax, 4
add rbx, rax
test rbx, rbx
je 0x1800edb1e
mov al, byte [rbx + 0xf]
test al, 0x40
je 0x1800ed6de
movzx eax, al
and eax, 0x3f
shl rax, 4
add rax, rbx
jmp 0x1800ed6eb
cmp al, 4
jne 0x1800ed6e8
movzx eax, byte [rbx + 0xe]
jmp 0x1800ed6d5
mov rax, rbx
add rax, 0x10
mov word [rsi + 0x12], r10w
mov qword [rsi], rax
cmp byte [rdi + 0x182], r9b
jne 0x1800ed709
mov rax, qword [rdi + 0x178]
jmp 0x1800ed70c
mov rax, r12
test rax, rax
je 0x1800ed748
mov rdx, rsi
mov rcx, rdi
call fcn.180102a9c
test al, al
je 0x1800ed73e
mov ebx, 0x2000
test word [rsi + 0x12], bx
je 0x1800edb1e
mov r9d, 2
lea r10d, [r9 - 1]
jmp 0x1800ed46b
mov r9d, 2
lea r10d, [r9 - 1]
mov eax, dword [rdi + 0x7c]
shr eax, 0x14
and al, byte [rdi + 0x8a]
xor al, byte [rbx + 0xa]
test r10b, al
je 0x1800edac4
mov al, byte [rbx + 0xf]
test al, 0x40
je 0x1800ed776
movzx eax, al
and eax, 0x3f
shl rax, 4
add rax, rbx
jmp 0x1800ed783
cmp al, 4
jne 0x1800ed780
movzx eax, byte [rbx + 0xe]
jmp 0x1800ed76d
mov rax, rbx
add rax, 0x10
mov qword [rsi], rax
mov cl, byte [rbx + 0xf]
cmp cl, 4
je 0x1800ed98e
cmp cl, 3
je 0x1800ed972
cmp cl, r10b
jne 0x1800ed7d3
mov word [rsi + 0x12], r10w
mov ebx, 0x2000
jmp 0x1800ed46b
mov dword [rbp + 0x30], 0x8000001a
jmp 0x1800edb1e
lea r8, [rbp + 0x30]
mov rdx, rsi
mov rcx, rdi
call fcn.1801030dc
jmp 0x1800edb1e
mov edx, dword [rdi + 0x7c]
test edx, edx
je 0x1800ed7fa
mov eax, dword [rbx + 8]
mov edx, dword [rdi + 0x7c]
mov dword [rbp - 8], eax
test eax, edx
je 0x1800ed7f0
xor eax, dword [rdi + 0x88]
mov dword [rbp - 8], eax
movzx r8d, word [rbp - 8]
mov cl, byte [rbx + 0xf]
jmp 0x1800ed7ff
movzx r8d, word [rbx + 8]
cmp cl, 5
jne 0x1800ed817
movzx ecx, word [rdi + 0x8c]
movzx eax, word [rbx + 0xc]
xor rcx, rax
jmp 0x1800ed89b
test cl, 0x40
je 0x1800ed82c
movzx eax, cl
and eax, 0x3f
add rax, rax
movzx ecx, word [rbx + rax*8 + 0xc]
jmp 0x1800ed89b
mov al, cl
and al, 0x3f
cmp al, 0x3f
je 0x1800ed83c
movzx ecx, cl
and ecx, 0x3f
jmp 0x1800ed89b
test cl, cl
jns 0x1800ed86f
mov rcx, rbx
shr rcx, 4
xor ecx, dword [rbx + 8]
xor ecx, edi
xor ecx, dword [0x18015d458]
test cx, cx
je 0x1800ed85c
mov rax, r12
jmp 0x1800ed869
shr rcx, 0xc
mov rax, rbx
sub rax, rcx
mov rax, qword [rax]
movzx eax, word [rax + 0x24]
jmp 0x1800ed891
test edx, edx
je 0x1800ed88d
mov eax, dword [rbx + 8]
mov dword [rbp - 8], eax
test dword [rdi + 0x7c], eax
je 0x1800ed887
xor eax, dword [rdi + 0x88]
mov dword [rbp - 8], eax
movzx eax, word [rbp - 8]
jmp 0x1800ed891
movzx eax, word [rbx + 8]
movzx eax, ax
add rax, rax
mov rcx, qword [rbx + rax*8]
movzx eax, r8w
shl rax, 4
sub rax, rcx
mov qword [rsi + 8], rax
mov al, byte [rbx + 0xe]
mov byte [rsi + 0x11], al
mov word [rsi + 0x12], r10w
mov cl, byte [rbx + 0xf]
cmp cl, 5
jne 0x1800ed8d0
movzx ecx, word [rdi + 0x8c]
movzx eax, word [rbx + 0xc]
xor rcx, rax
jmp 0x1800ed958
test cl, 0x40
je 0x1800ed8e6
movzx eax, cl
and eax, 0x3f
shl rax, 4
movzx ecx, word [rax + rbx + 0xc]
jmp 0x1800ed958
mov al, cl
and al, 0x3f
cmp al, 0x3f
je 0x1800ed8f6
movzx ecx, cl
and ecx, 0x3f
jmp 0x1800ed958
test cl, cl
jns 0x1800ed929
mov rcx, rbx
shr rcx, 4
xor ecx, dword [rbx + 8]
xor ecx, edi
xor ecx, dword [0x18015d458]
test cx, cx
je 0x1800ed916
mov rax, r12
jmp 0x1800ed923
shr rcx, 0xc
mov rax, rbx
sub rax, rcx
mov rax, qword [rax]
movzx eax, word [rax + 0x24]
jmp 0x1800ed94d
cmp dword [rdi + 0x7c], r12d
je 0x1800ed949
mov eax, dword [rbx + 8]
mov dword [rbp - 8], eax
test dword [rdi + 0x7c], eax
je 0x1800ed943
xor eax, dword [rdi + 0x88]
mov dword [rbp - 8], eax
movzx eax, word [rbp - 8]
jmp 0x1800ed94d
movzx eax, word [rbx + 8]
movzx eax, ax
shl rax, 4
mov rcx, qword [rax + rbx]
movzx r14d, word [rsi + 0x12]
mov byte [rsi + 0x10], cl
test r9b, r14b
jne 0x1800eda08
mov qword [rsi + 0x24], rcx
jmp 0x1800eda08
mov rax, qword [rbx + 0x30]
mov qword [rsi], rax
mov rax, qword [rbx + 0x38]
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 0x10000000
mov qword [rsi + 0x24], r12
jmp 0x1800eda08
cmp dword [rdi + 0x7c], r12d
je 0x1800ed9ae
mov eax, dword [rbx + 8]
mov dword [rbp - 8], eax
test dword [rdi + 0x7c], eax
je 0x1800ed9a8
xor eax, dword [rdi + 0x88]
mov dword [rbp - 8], eax
movzx eax, word [rbp - 8]
jmp 0x1800ed9b2
movzx eax, word [rbx + 8]
mov rcx, qword [rbx - 0x10]
movzx eax, ax
sub rcx, rax
mov byte [rsi + 0x11], 0x40
mov eax, 0x4001
mov qword [rsi + 8], rcx
mov word [rsi + 0x12], ax
cmp dword [rdi + 0x7c], r12d
je 0x1800ed9f1
mov eax, dword [rbx + 8]
mov dword [rbp - 8], eax
test dword [rdi + 0x7c], eax
je 0x1800ed9e7
xor eax, dword [rdi + 0x88]
mov dword [rbp - 8], eax
movzx ecx, word [rbp - 8]
movzx eax, word [rsi + 0x12]
jmp 0x1800ed9f5
movzx ecx, word [rbx + 8]
movzx ecx, cx
mov byte [rsi + 0x10], cl
test r9b, al
jne 0x1800eda04
mov qword [rsi + 0x24], rcx
movzx r14d, ax
cmp dword [rdi + 0x7c], r12d
je 0x1800eda26
mov eax, dword [rbx + 8]
test dword [rdi + 0x7c], eax
je 0x1800eda1c
xor eax, dword [rdi + 0x88]
movzx r14d, word [rsi + 0x12]
shr eax, 0x10
jmp 0x1800eda29
mov al, byte [rbx + 0xa]
test r9b, al
je 0x1800eda70
mov rdx, rbx
mov rcx, rdi
call fcn.1800ec770
mov rcx, qword [rax + 8]
mov qword [rsi + 0x18], rcx
mov rcx, qword gs:[0x60]
test dword [rcx + 0xbc], 0x800
jne 0x1800eda5c
movzx eax, r12w
jmp 0x1800eda60
movzx eax, word [rax + 2]
mov word [rsi + 0x20], ax
or word [rsi + 0x12], 0x10
movzx r14d, word [rsi + 0x12]
jmp 0x1800eda94
mov rax, qword gs:[0x60]
test dword [rax + 0xbc], 0x800
jne 0x1800eda8c
mov word [rsi + 0x20], r12w
jmp 0x1800eda94
movzx eax, byte [rbx + 0xb]
mov word [rsi + 0x20], ax
cmp dword [rdi + 0x7c], r12d
je 0x1800edab2
mov eax, dword [rbx + 8]
test dword [rdi + 0x7c], eax
je 0x1800edaa8
xor eax, dword [rdi + 0x88]
movzx r14d, word [rsi + 0x12]
shr eax, 0x10
jmp 0x1800edab5
mov al, byte [rbx + 0xa]
and al, 0xe0
movzx eax, al
or ax, r14w
mov word [rsi + 0x12], ax
jmp 0x1800edb1e
lea rax, [rbx + 0x20]
mov qword [rsi], rax
cmp dword [rdi + 0x7c], r12d
je 0x1800edaeb
mov eax, dword [rbx + 8]
mov dword [rbp - 8], eax
test dword [rdi + 0x7c], eax
je 0x1800edae5
xor eax, dword [rdi + 0x88]
mov dword [rbp - 8], eax
movzx eax, word [rbp - 8]
jmp 0x1800edaef
movzx eax, word [rbx + 8]
movzx eax, ax
shl rax, 4
sub rax, 0x20
mov qword [rsi + 8], rax
mov al, byte [rbx + 0xe]
mov byte [rsi + 0x11], al
mov word [rsi + 0x12], r12w
mov byte [rsi + 0x10], 0x20
mov qword [rsi + 0x24], 0x20
jmp 0x1800edb1e
mov dword [rbp + 0x30], 0xc0000141
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800edb40
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x1800edb45
mov ecx, 0x7ffe0380
cmp byte [rcx], r12b
je 0x1800edb6d
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x1800edb6d
cmp dword [rbp + 0x30], 0x8000001a
je 0x1800edb6d
mov rcx, rdi
call fcn.1800fe984
mov eax, dword [rbp + 0x30]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret