Function at 0x1e6b7422610
Capabilities:
Check os version

Disassembly:
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x80]
lea rdx, [rbp + 0x40]
mov eax, 0
mov ecx, 0x12
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov dword [rbp + 0x40], 0x94
lea rax, [rbp + 0x40]
mov rcx, rax
call sub.KERNEL32.dll_GetVersionExA
test eax, eax
jne 0x1e6b742265f
mov eax, 0
jmp 0x1e6b74228ed
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0xe8], eax
mov eax, dword [rbp + 0x48]
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0x4c]
mov dword [rbp + 0xe0], eax
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0x13
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov dword [rbp - 0x60], 0x9c
mov eax, dword [rbp + 0xe8]
mov dword [rbp - 0x5c], eax
mov eax, dword [rbp + 0xe4]
mov dword [rbp - 0x58], eax
mov eax, dword [rbp + 0xe0]
mov dword [rbp - 0x54], eax
mov qword [rbp + 0xd8], 0
mov rax, qword [rbp + 0xd8]
mov r8d, 1
mov edx, pe_nt_image_headers64
mov rcx, rax
call sub.KERNEL32.dll_VerSetConditionMask
mov qword [rbp + 0xd8], rax
mov byte [rbp + 0x3a], 1
mov dword [rbp + 0xec], 0
cmp dword [rbp + 0xe8], 0xa
jne 0x1e6b742272f
cmp dword [rbp + 0xe4], 0
jne 0x1e6b742272f
cmp dword [rbp + 0xe0], 0x55ef
jle 0x1e6b7422720
mov dword [rbp + 0xec], 0xf
jmp 0x1e6b74227bd
mov dword [rbp + 0xec], 0xb
jmp 0x1e6b74227bd
cmp dword [rbp + 0xe8], 6
jne 0x1e6b742278c
cmp dword [rbp + 0xe4], 3
jne 0x1e6b742274d
mov dword [rbp + 0xec], 0xa
jmp 0x1e6b74227bd
cmp dword [rbp + 0xe4], 2
jne 0x1e6b7422762
mov dword [rbp + 0xec], 7
jmp 0x1e6b74227bd
cmp dword [rbp + 0xe4], 1
jne 0x1e6b7422777
mov dword [rbp + 0xec], 6
jmp 0x1e6b74227bd
cmp dword [rbp + 0xe4], 0
jne 0x1e6b74227bd
mov dword [rbp + 0xec], 3
jmp 0x1e6b74227bd
cmp dword [rbp + 0xe8], 5
jne 0x1e6b74227bd
cmp dword [rbp + 0xe4], 2
jne 0x1e6b74227aa
mov dword [rbp + 0xec], 2
jmp 0x1e6b74227bd
cmp dword [rbp + 0xe4], 1
jne 0x1e6b74227bd
mov dword [rbp + 0xec], 1
mov rdx, qword [rbp + 0xd8]
lea rax, [rbp - 0x60]
mov r8, rdx
mov edx, pe_nt_image_headers64
mov rcx, rax
call sub.KERNEL32.dll_VerifyVersionInfoA
test eax, eax
jne 0x1e6b74228e7
mov byte [rbp + 0x3a], 2
mov rdx, qword [rbp + 0xd8]
lea rax, [rbp - 0x60]
mov r8, rdx
mov edx, pe_nt_image_headers64
mov rcx, rax
call sub.KERNEL32.dll_VerifyVersionInfoA
test eax, eax
jne 0x1e6b74228e7
cmp dword [rbp + 0xe8], 0xa
jne 0x1e6b742286b
cmp dword [rbp + 0xe4], 0
jne 0x1e6b742286b
cmp dword [rbp + 0xe0], 0x4f7b
jle 0x1e6b7422834
mov dword [rbp + 0xec], 0xe
jmp 0x1e6b74228e6
cmp dword [rbp + 0xe0], 0x4562
jle 0x1e6b742284f
mov dword [rbp + 0xec], 0xd
jmp 0x1e6b74228e6
cmp dword [rbp + 0xe0], 0x3838
jle 0x1e6b74228e6
mov dword [rbp + 0xec], 0xc
jmp 0x1e6b74228e6
cmp dword [rbp + 0xe8], 6
jne 0x1e6b74228c8
cmp dword [rbp + 0xe4], 3
jne 0x1e6b7422889
mov dword [rbp + 0xec], 9
jmp 0x1e6b74228e7
cmp dword [rbp + 0xe4], 2
jne 0x1e6b742289e
mov dword [rbp + 0xec], 8
jmp 0x1e6b74228e7
cmp dword [rbp + 0xe4], 1
jne 0x1e6b74228b3
mov dword [rbp + 0xec], 5
jmp 0x1e6b74228e7
cmp dword [rbp + 0xe4], 0
jne 0x1e6b74228e7
mov dword [rbp + 0xec], 4
jmp 0x1e6b74228e7
cmp dword [rbp + 0xe8], 5
jne 0x1e6b74228e7
cmp dword [rbp + 0xe4], 2
jne 0x1e6b74228e7
mov dword [rbp + 0xec], 2
jmp 0x1e6b74228e7
nop
mov eax, dword [rbp + 0xec]
add rsp, 0x178
pop rdi
pop rbp
ret