Function at 0x1400019f0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x1f0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14003a9b8]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov r14, rdx
mov esi, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
mov r12d, 1
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edx, r12d
lea rcx, [0x1400019a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
xor r15d, r15d
cmp qword [section..data], r15
jne 0x140001bc2
mov edi, r15d
cmp byte [0x14003b204], r15b
jne 0x140001b4b
mov dword [rbp - 0x70], 0x114
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140001aad
cmp dword [rbp - 0x6c], 6
setb cl
mov byte [0x14003b1d0], cl
ja 0x140001aa2
jne 0x140001aa5
cmp dword [rbp - 0x68], r12d
jbe 0x140001aa5
mov edi, r12d
test cl, cl
jne 0x140001b44
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x140001adb
test edi, edi
je 0x140001b3d
lea rcx, str.api_ms_win_eventing_provider_l1_1_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140001b3d
lea rdx, str.EventWrite
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003b1e0], rax
test rax, rax
je 0x140001b3d
lea rdx, [0x1400254d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140039048], rax
test rax, rax
je 0x140001b2f
lea rdx, [0x1400254e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003b1c8], rax
test rax, rax
jne 0x140001b44
lea rax, [0x140001720]
mov qword [0x140039048], rax
mov byte [0x14003b1d0], r12b
mov byte [0x14003b204], r12b
lea rdx, [section..data]
cmp byte [0x14003b1d0], r15b
jne 0x140001b7e
mov r9, rdx
mov r8, rdx
lea rdx, [0x1400015e0]
lea rcx, [0x140025650]
mov rax, qword [0x140039048]
call qword [0x140024fd8]
jmp 0x140001bc2
mov qword [section..data], rdx
lea rax, [0x140025650]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, r12d
mov r8, rax
lea rcx, [0x140001470]
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rax, qword [0x140039060]
movups xmm0, xmmword [rax - 0x10]
movdqu xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x140039080], xmm1
lea r9, [0x140039078]
lea r8, [0x140039058]
lea rdx, [0x140001010]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_EventRegister]
mov r13d, 2
test eax, eax
jne 0x140001c80
mov rbx, qword [0x140039060]
movzx edi, word [rbx]
lea r8, [rsp + 0x48]
lea rdx, str.api_ms_win_eventing_provider_l1_1_0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x140001c46
lea r8, [rsp + 0x48]
lea rdx, str.advapi32
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x140001c80
lea rdx, str.EventSetInformation
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001c74
movzx r9d, di
mov r8, rbx
mov edx, r13d
mov rcx, qword [0x140039078]
call qword [0x140024fd8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov dword [rsp + 0x60], r15d
mov al, r15b
mov byte [rsp + 0x64], al
mov ebx, 3
lea edi, [rbx + 1]
mov ecx, dword [0x140039058]
cmp ecx, 5
jbe 0x140001cd3
lea rdx, [rsp + 0x68]
mov ecx, ebx
call qword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
movups xmm0, xmmword [rsp + 0x68]
movdqu xmmword [rsp + 0x78], xmm0
lea rdx, [rsp + 0x78]
mov ecx, edi
call qword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
mov al, r12b
mov byte [rsp + 0x64], al
mov ecx, dword [0x140039058]
jmp 0x140001cdf
xor edx, edx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0x60], r12d
cmp ecx, 5
jbe 0x140001d3a
test al, al
je 0x140001d0e
cmp dword [rsp + 0x78], r15d
jne 0x140001d07
cmp dword [rsp + 0x7c], r15d
jne 0x140001d07
cmp dword [rbp - 0x80], r15d
jne 0x140001d07
cmp dword [rbp - 0x7c], r15d
je 0x140001d0e
lea r9, [rsp + 0x78]
jmp 0x140001d11
mov r9, r15
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
lea r8, [rsp + 0x68]
lea rdx, [0x14002eb06]
lea rcx, [0x140039058]
call fcn.1400010a0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov r8, r14
mov edx, esi
lea rcx, [rbp + 0xb0]
call fcn.140001f44
mov dword [rsp + 0x40], eax
cmp dword [0x140039058], 5
jbe 0x140001da6
lea rax, [rsp + 0x40]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rdi
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14002ead7]
lea rcx, [0x140039058]
call fcn.1400010a0
cmp byte [rsp + 0x64], r15b
je 0x140001dba
lea rdx, [rsp + 0x78]
mov ecx, edi
call qword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
mov dword [rsp + 0x60], r13d
cmp dword [0x140039058], 5
jbe 0x140001df4
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [0x14002eabd]
lea rcx, [0x140039058]
call fcn.1400010a0
mov rcx, qword [0x140039078]
call qword [sym.imp.ADVAPI32.dll_EventUnregister]
mov qword [0x140039078], r15
mov dword [0x140039058], r15d
cmp byte [0x14003b204], r15b
je 0x140001e91
mov rcx, qword [section..data]
test rcx, rcx
je 0x140001e91
cmp byte [0x14003b1d0], r15b
jne 0x140001e3c
mov rax, qword [0x14003b1c8]
call qword [0x140024fd8]
jmp 0x140001e8a
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [0x140039020], r15d
mov byte [0x140039028], r15b
mov qword [0x140039008], r15
movzx eax, word [0x14003902a]
test ax, ax
je 0x140001e8a
movzx eax, ax
sub eax, r12d
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
add eax, r12d
movsxd r8, eax
shl r8, 2
xor edx, edx
mov rcx, qword [0x140039030]
call sub.msvcrt.dll_memset
mov qword [section..data], r15
mov ebx, dword [rsp + 0x40]
cmp dword [rsp + 0x60], r12d
jne 0x140001ec6
cmp byte [rsp + 0x64], r15b
je 0x140001eb0
lea rdx, [rsp + 0x78]
mov ecx, edi
call qword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
mov dword [rsp + 0x60], r13d
lea rdx, [rsp + 0x68]
lea rcx, [0x140039058]
call fcn.140004d40
mov eax, ebx
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14001f6f0
mov rbx, qword [rsp + 0x240]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret