Function at 0x100017f54
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x180
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1000a1108]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rcx
mov qword [rsp + 0x38], rcx
xor ebp, ebp
mov dword [rcx + 0x1c0], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
call fcn.100049a34
nop
lea rax, [0x100003be8]
mov qword [rsi], rax
lea rax, [0x100003c08]
mov qword [rsi + 0x1b0], rax
lea rax, [0x100003c18]
mov qword [rsi + 0x1b8], rax
xor edx, edx
lea rcx, [rsi + 0x1c8]
call fcn.10005dd18
nop
mov rax, qword [0x1000a1180]
mov qword [rsi + 0x540], rax
mov qword [rsi + 0x548], rbp
mov qword [rsi + 0x550], rbp
mov byte [rsi + 0x558], bpl
mov dword [rsi + 0x55c], ebp
mov byte [rsi + 0x560], bpl
mov dword [rsi + 0x564], ebp
mov qword [rsi + 0x568], rbp
mov qword [rsi + 0x570], rbp
mov qword [rsi + 0x578], rbp
mov qword [rsi + 0x580], rbp
lea rdi, [rsi + 0x588]
mov qword [rsp + 0x20], rdi
mov qword [rdi + 8], rbp
lea rax, [rdi + 0x10]
mov qword [rsp + 0x30], rax
mov qword [rax + 0x18], rbp
mov qword [rdi + 0x30], rbp
mov dword [rdi + 0x38], ebp
lea rbx, [rdi + 0x40]
lea r15d, [rbp + 0x68]
mov r8, r15
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
mov dword [rbx], r15d
mov dword [rdi + 0x44], 0x80
mov rax, qword [0x1000a1d70]
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x50], 0xa37
lea r14, [0x10001bba0]
mov qword [rdi + 0x68], r14
lea rax, [0x100035cb8]
mov qword [rdi + 0x78], rax
mov qword [rdi + 0x70], rdi
mov qword [rdi + 0xb0], rbx
mov qword [rdi + 0xb8], rbp
mov qword [rdi + 0xc0], rbp
mov qword [rdi + 0xd0], rbp
lea rax, [0x100004098]
mov qword [rdi], rax
lea rax, [0x100004090]
mov qword [rdi + 0xa8], rax
mov qword [rdi + 0xd8], rbp
mov qword [rdi + 0xe0], rbp
mov rax, qword [0x1000a1180]
mov qword [rdi + 0xe8], rax
mov rax, qword [0x1000a1180]
mov qword [rdi + 0xf0], rax
lea rax, [0x100004058]
mov qword [rdi], rax
lea rax, [0x100004090]
mov qword [rdi + 0xa8], rax
mov qword [rdi + 0xf8], rsi
mov qword [rdi + 0x108], rbp
mov qword [rdi + 0x110], rbp
mov qword [rdi + 0x118], rbp
bts dword [rdi + 0x44], 0xc
lea rcx, [rsi + 0x6a8]
mov rdx, rsi
call fcn.10001f750
nop
lea rcx, [rsi + 0x9e8]
mov rdx, rsi
call fcn.100030344
nop
lea rcx, [rsi + 0xc38]
mov rdx, rsi
call fcn.100033478
nop
lea rcx, [rsi + 0xfa8]
mov rdx, rsi
call fcn.10003617c
nop
lea rdi, [rsi + 0x1538]
mov qword [rsp + 0x30], rdi
mov qword [rdi + 8], rbp
lea rax, [rdi + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rax + 0x18], rbp
mov qword [rdi + 0x30], rbp
mov dword [rdi + 0x38], ebp
lea rbx, [rdi + 0x40]
mov r8, r15
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
mov dword [rbx], r15d
mov dword [rdi + 0x44], 0x80
mov rax, qword [0x1000a1d70]
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x50], 0x92e
mov qword [rdi + 0x68], r14
lea rax, [0x100035cb8]
mov qword [rdi + 0x78], rax
mov qword [rdi + 0x70], rdi
mov qword [rdi + 0xb0], rbx
mov qword [rdi + 0xb8], rbp
mov qword [rdi + 0xc0], rbp
mov qword [rdi + 0xd0], rbp
lea rax, [0x100004348]
mov qword [rdi], rax
lea rax, [0x100004340]
mov qword [rdi + 0xa8], rax
mov qword [rdi + 0xd8], rbp
mov qword [rdi + 0xe0], rbp
mov rax, qword [0x1000a1180]
mov qword [rdi + 0xe8], rax
mov rax, qword [0x1000a1180]
mov qword [rdi + 0xf0], rax
lea rax, [0x100004308]
mov qword [rdi], rax
lea rax, [0x100004340]
mov qword [rdi + 0xa8], rax
mov qword [rdi + 0xf8], rsi
mov qword [rdi + 0x100], rbp
lea rax, [rdi + 0x108]
mov qword [rsp + 0x20], rax
mov qword [rax], rbp
lea rcx, [rdi + 0x110]
mov qword [rsp + 0x20], rcx
mov qword [rcx + 8], rbp
lea rax, [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov qword [rax + 0x18], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], ebp
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rcx + 0x40], rax
lea rax, [0x100003e58]
mov qword [rcx], rax
mov qword [rdi + 0x158], rbp
mov qword [rdi + 0x160], rbp
mov rax, qword [0x1000a1180]
mov qword [rdi + 0x168], rax
mov rax, qword [0x1000a1180]
mov qword [rdi + 0x170], rax
mov qword [rdi + 0x178], rbp
mov qword [rdi + 0x180], rbp
mov qword [rdi + 0x188], rbp
mov qword [rdi + 0x190], rbp
mov qword [rdi + 0x198], rbp
mov qword [rdi + 0x1a0], rbp
mov qword [rdi + 0x1a8], rbp
mov qword [rdi + 0x1c0], rbp
mov qword [rdi + 0x1c8], rbp
mov qword [rdi + 0x1d0], rbp
mov byte [rdi + 0x1d8], bpl
bts dword [rdi + 0x44], 0xc
lea rcx, [rsi + 0x1718]
mov rdx, rsi
call fcn.10003ef54
nop
mov qword [rsi + 0x1ba0], rbp
mov byte [rsi + 0x1ba8], 1
mov dword [rsi + 0x1bac], ebp
mov dword [rsi + 0x1bb0], ebp
mov dword [rsi + 0x1bb4], ebp
mov dword [rsi + 0x1bb8], ebp
mov byte [rsi + 0x1bbc], 1
mov byte [rsi + 0x1bbd], bpl
mov byte [rsi + 0x1bbe], 1
mov byte [rsi + 0x1bbf], bpl
mov dword [rsp + 0x50], VarUI4FromDisp
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x54], 6
setae al
mov byte [rsi + 0x1ba8], al
cmp al, bpl
je 0x1000183c3
or dword [rsi + 0x4c], 0x1c004034
mov qword [rsi + 0x60], 0x1db
mov qword [rsi + 0xa0], 0x1ce
mov dword [rsi + 0x1bb0], ebp
mov dword [rsi + 0x1bac], ebp
jmp 0x1000183de
or dword [rsi + 0x4c], 0x1088000
mov dword [rsi + 0x1bb0], 0x28a
mov dword [rsi + 0x1bac], 0x44c
mov byte [rsi + 0x560], bpl
movsd xmm0, qword [0x10000b478]
movsd qword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x20]
mov qword [rsi + 0x318], rax
lea rax, [0x10001ae60]
cmp rax, rbp
je 0x100018459
mov qword [rsi + 0x210], rax
mov qword [rsi + 0x218], rsi
call fcn.100064c18
cmp eax, 1
sete al
mov byte [rsi + 0x1bc0], al
mov ecx, 0x48
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x28], rax
cmp rax, rbp
je 0x100018449
mov rcx, rax
call fcn.1000415d4
mov rbp, rax
mov qword [rsi + 0x580], rbp
mov rcx, rsi
call fcn.10001b280
nop
mov rax, rsi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.10007a3b0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret