Function at 0x1400013a0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x1f0
mov rax, qword [0x1400103c8]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rbp, qword gs:[0x30]
xor ecx, ecx
mov r12, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdi, [rsp + 0xc0]
mov rsi, rax
xor eax, eax
mov ecx, 0x114
rep stosb byte [rdi], al
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0xc0], 0x114
call qword [sym.imp.ntdll.dll_RtlGetVersion]
mov ecx, dword [rsp + 0xc4]
cmp ecx, 5
jne 0x14000142e
mov dword [0x14001233c], 1
mov dword [0x140012338], 0x160
jmp 0x140001441
cmp ecx, 6
jne 0x14000160e
mov dword [0x140012338], 0x208
mov dword [rsp + 0x60], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x60], 0
je 0x140001475
lea rcx, str._x__please_re_compiler_this_program_via_x64_platform_n
call fcn.140001b3c
jmp 0x140001549
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x140012310], eax
call fcn.1400010c0
mov qword [0x140012318], rax
test rax, rax
jne 0x1400014a3
lea rcx, str._x__can_not_get_address_of_PsLookupProcessByProcessId_n
call fcn.140001b3c
jmp 0x140001549
xor eax, eax
lea rdi, [rsp + 0x70]
mov ecx, 0x50
rep stosb byte [rdi], al
lea rax, [0x1400012e0]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x200], rbx
mov dword [rsp + 0x70], 0x50
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x90], rax
lea rax, str.zcgonvh
mov qword [rsp + 0xb0], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [rbp + 0x78]
mov qword [0x140012330], rcx
mov rcx, qword [r12 + 0x58]
mov edx, 8
add rcx, 0x1b0
lea r9, [rsp + 0x64]
lea r8d, [rdx + 0x38]
mov qword [0x140012328], rcx
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001575
lea rcx, str._x__can_not_fix_protect_n
call fcn.140001b3c
mov rbx, qword [rsp + 0x200]
xor eax, eax
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140001640
lea r11, [rsp + 0x1f0]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
mov rax, qword [0x140012328]
lea rcx, [0x140001350]
movzx edi, bx
xchg qword [rax], rcx
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov qword [0x140012320], rcx
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor ecx, ecx
mov edx, edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
cmp dword [0x140012314], 1
jne 0x1400015dc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400015e8
lea rcx, str._x__may_be_patched_n
call fcn.140001b3c
lea rcx, str.cd__UserProfile_pietty___UserProfile_piettypietty.exe
call fcn.140001a34
test bx, bx
je 0x140001541
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.USER32.dll_UnregisterClassW]
jmp 0x140001541
mov edx, dword [rsp + 0xcc]
lea rcx, str._x__this_version_of_system_was_not_supported_n
call fcn.140001b3c
jmp 0x140001549