Function at 0x140009890
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rbx, rcx
mov qword [rbp - 0x30], 0x11c
xor r14d, r14d
xor edx, edx
mov r8d, VarUI4FromDisp
lea rcx, [rbp - 0x28]
call fcn.14014e180
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14000990a
mov byte [rbp + 0xea], 1
mov r8d, 6
mov dword [rbp - 0x2c], r8d
mov dword [rbp - 0x28], 1
mov eax, 0x1db1
mov dword [rbp - 0x24], eax
lea rdx, str.Windows_NT__u._u._u
jmp 0x140009973
mov r8d, dword [rbp - 0x2c]
cmp r8d, 0xa
jne 0x140009954
cmp byte [rbp + 0xea], 1
jne 0x140009969
mov eax, dword [rbp - 0x24]
cmp eax, 0x6590
jb 0x14000993a
mov r8d, recv
mov dword [rbp - 0x2c], r8d
lea rdx, str.Windows_NT__u._u._u
jmp 0x140009973
cmp eax, 0x55f0
jb 0x140009960
mov r8d, recv
mov dword [rbp - 0x2c], r8d
lea rdx, str.Windows_NT__u._u._u
jmp 0x140009973
cmp byte [rbp + 0xea], 1
jne 0x140009969
mov eax, dword [rbp - 0x24]
lea rdx, str.Windows_NT__u._u._u
jmp 0x140009973
mov eax, dword [rbp - 0x24]
lea rdx, str.Windows_Server__u._u._u
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x28]
mov rcx, rbx
call fcn.1400038c0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400099ce
mov edx, dword [rbx + 0x10]
lea eax, [rdx + 5]
cmp eax, dword [rbx + 0x14]
jae 0x1400099ce
lea rdx, [rcx + rdx*2]
lea rsi, str.__x64
mov rdi, rdx
mov ecx, 2
rep movsd dword [rdi], dword [rsi]
lea rdi, [rdx + 8]
lea rsi, [0x1401ba6a0]
mov ecx, 2
rep movsb byte [rdi], byte [rsi]
add dword [rbx + 0x10], 5
mov ecx, dword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov word [rax + rcx*2], r14w
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x44], 0x40
mov word [rsp + 0x48], r14w
lea rax, [0x1401b76b8]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.1400096d0
test al, al
je 0x140009ac5
mov edx, dword [rsp + 0x40]
cmp edx, 1
jb 0x140009ac5
mov r8, qword [rsp + 0x38]
test r8, r8
je 0x140009ac5
cmp word [r8], 0
je 0x140009ac5
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x140009a6e
mov esi, dword [rbx + 0x10]
lea eax, [rsi + 2]
cmp eax, dword [rbx + 0x14]
jae 0x140009a6e
lea rdi, [rdi + rsi*2]
lea rsi, [0x1401ba820]
mov ecx, 1
rep movsd dword [rdi], dword [rsi]
add dword [rbx + 0x10], 2
mov ecx, dword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov word [rax + rcx*2], r14w
mov edx, dword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009ac5
test edx, edx
je 0x140009ac5
mov edi, dword [rbx + 0x10]
lea eax, [rdi + rdx]
cmp eax, dword [rbx + 0x14]
jae 0x140009ac5
lea eax, [rdx + rdx]
mov edx, eax
lea r9, [rcx + rdi*2]
mov ecx, eax
shr rcx, 2
mov rdi, r9
mov rsi, r8
rep movsd dword [rdi], dword [rsi]
mov ecx, eax
and ecx, 3
je 0x140009ab2
and rdx, 0xfffffffffffffffc
lea rsi, [rdx + r8]
lea rdi, [rdx + r9]
rep movsb byte [rdi], byte [rsi]
mov edx, dword [rbx + 0x10]
add edx, dword [rsp + 0x40]
mov dword [rbx + 0x10], edx
mov rax, qword [rbx + 8]
mov word [rax + rdx*2], r14w
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret