Function at 0x1400559de
Capabilities:
Check os version

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x548
movaps xmmword [rsp + 0x530], xmm6
mov r15, r9
mov r13, r8
mov r14, rdx
mov rdi, rcx
mov eax, dword [r9 + 0xa8]
lea ecx, [rax - 0x1f]
cmp cx, 4
setae dl
cmp cx, 1
sete bl
or bl, dl
cmp bl, 1
jne 0x140055a34
cmp ax, 0xf
jne 0x140055a34
lea r12, [r15 + 0x18]
lea rsi, [r14 + 0x68]
jmp 0x140055a9f
lea rax, [0x1401b1580]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
lea r8, [0x1401af95a]
lea rsi, [rsp + 0x168]
mov r9d, 1
mov rcx, rsi
mov rdx, r15
call fcn.14004d956
mov al, byte [rsi]
mov ecx, dword [rsi + 1]
mov dword [rsp + 0x440], ecx
mov ecx, dword [rsi + 4]
mov dword [rsp + 0x443], ecx
mov r12, qword [rsi + 8]
movups xmm0, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x350], xmm0
cmp al, 0x14
jne 0x140055cd7
lea rsi, [r14 + 0x68]
test bl, bl
je 0x140055aae
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
mov rcx, rsi
call fcn.14004ffaf
cmp qword [r12 + 0x10], 0
je 0x140055afe
mov rsi, qword [r13]
mov bl, 1
lea rdx, [rsp + 0x168]
mov byte [rdx], bl
mov byte [rdx + 2], 0x10
mov word [rdx + 0xa8], 0x1f
mov word [rdx + 0xb8], 4
cmp byte [rsi + 0x40], 2
sete r8b
mov rcx, rsi
call fcn.14004663f
mov byte [rsi + 0x141], bl
mov byte [rdi], 2
mov byte [rdi + 8], 4
jmp 0x140055cfd
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x50], rdi
mov rsi, qword [r12 + 0x18]
mov qword [rsp + 0x40], r12
mov rax, qword [r12 + 0x28]
lea r14, [rax + rax*2]
shl r14, 4
add r14, rsi
lea rbx, [rsp + 0x170]
xorps xmm6, xmm6
mov edi, 2
lea r12, [rsp + 0x168]
mov qword [rsp + 0x38], r13
cmp rsi, r14
je 0x140055d3e
mov eax, dword [0x14024aad0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x60], 0
jne 0x140055b73
call fcn.14009ac24
mov eax, dword [0x14024aad0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x68]
mov rdx, qword [rax + 0x70]
lea r8, [rcx + 1]
mov qword [rax + 0x68], r8
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x190], rdx
lea rax, [0x1401dd660]
mov qword [rsp + 0x168], rax
movups xmmword [rbx], xmm6
mov qword [rbx + 0x10], 0
mov r15, qword [rsi + 0x28]
test r15, r15
je 0x140055c5d
mov r13, qword [rsi + 0x18]
shl r15, 5
xor ebx, ebx
mov ecx, dword [r13 + rbx + 0x18]
lea eax, [rcx - 0x26]
cmp ax, 2
cmovae eax, edi
test ax, ax
je 0x140055c02
movzx eax, ax
cmp eax, 1
jne 0x140055c08
mov cx, 0x11
jmp 0x140055c06
mov cx, 5
jmp 0x140055c0e
movzx edx, word [r13 + rbx + 0x1a]
call case.0x14003d96b.425
mov ebp, eax
mov rcx, r12
mov edx, eax
call fcn.14003b22a
test al, al
jne 0x140055c66
mov rcx, r12
mov edx, ebp
call fcn.14003b2e3
add rbx, 0x20
cmp r15, rbx
jne 0x140055be0
mov rdx, qword [rsp + 0x170]
test rdx, rdx
mov r13, qword [rsp + 0x38]
lea rbx, [rsp + 0x170]
je 0x140055c5d
mov rcx, qword [rsp + 0x168]
call fcn.14003aea2
add rsi, 0x30
jmp 0x140055b49
mov rdx, qword [rsp + 0x170]
test rdx, rdx
je 0x140055c80
mov rcx, qword [rsp + 0x168]
call fcn.14003aea2
mov rdi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x38]
mov rsi, qword [r13]
mov bl, 1
lea rdx, [rsp + 0x168]
mov byte [rdx], bl
mov byte [rdx + 2], 0x1a
mov word [rdx + 0xa8], 0x1f
mov word [rdx + 0xb8], 4
cmp byte [rsi + 0x40], 2
sete r8b
mov rcx, rsi
call fcn.14004663f
mov byte [rsi + 0x141], bl
mov word [rdi], pe_nt_image_headers64
mov r14, qword [rsp + 0x30]
jmp 0x140055cfd
mov ecx, dword [rsp + 0x440]
mov edx, dword [rsp + 0x443]
mov dword [rdi + 4], edx
mov dword [rdi + 1], ecx
movaps xmm0, xmmword [rsp + 0x350]
movups xmmword [rdi + 0x10], xmm0
mov byte [rdi], al
mov qword [rdi + 8], r12
mov rcx, r15
call fcn.140040b89
mov rcx, r14
call fcn.140056366
mov rcx, qword [0x14024a5f8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x530]
add rsp, 0x548
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x140055ef9
mov rbx, qword [rcx + 0x18]
lea r14, [rax + rax*2]
shl r14, 4
add r14, rbx
mov rcx, rbx
mov rdi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
mov rdx, qword [rcx + 0x28]
test rdx, rdx
je 0x140055dad
mov r8, qword [rcx + 0x18]
shl rdx, 5
xor r9d, r9d
movzx r10d, word [r8 + r9 + 0x18]
mov r11d, r10d
and r11d, 0x3e
cmp r11w, 0x26
je 0x140055da4
cmp r10d, 0x11
je 0x140055da4
cmp r10d, 5
jne 0x140055c8f
add r9, 0x20
cmp rdx, r9
jne 0x140055d80
add rcx, 0x30
cmp rcx, r14
jne 0x140055d6c
mov qword [rsp + 0x168], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
test rax, rax
je 0x140055f10
mov r15d, 8
lea r13, [rsp + 0x168]
xor r12d, r12d
mov rsi, qword [rbx]
mov rdi, qword [rbx + 0x10]
mov rcx, rdi
xor edx, edx
call fcn.14002cc95
mov rbp, rax
mov qword [rsp + 0x38], rdx
mov rcx, rax
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
cmp r12, qword [rsp + 0x170]
jne 0x140055e33
mov rcx, r13
mov rdx, r12
call fcn.14003a8ed
mov r15, qword [rsp + 0x168]
mov r12, qword [rsp + 0x178]
lea rax, [r12 + r12*2]
mov qword [r15 + rax*8], rbp
mov rcx, qword [rsp + 0x38]
mov qword [r15 + rax*8 + 8], rcx
mov qword [r15 + rax*8 + 0x10], rdi
mov r12, qword [rsp + 0x178]
inc r12
mov qword [rsp + 0x178], r12
add rbx, 0x30
cmp rbx, r14
jne 0x140055de7
mov r11, qword [rsp + 0x40]
cmp qword [r11 + 0x28], 0
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x360], rax
movups xmm0, xmmword [rsp + 0x168]
movaps xmmword [rsp + 0x350], xmm0
je 0x140055f40
mov rax, qword [r11 + 0x18]
mov rcx, qword [rax + 0x28]
test rcx, rcx
mov r14, qword [rsp + 0x30]
je 0x1400561e2
mov rax, qword [rax + 0x18]
shl rcx, 5
mov edx, 2
mov r9d, dword [rax + 0x18]
lea r8d, [r9 - 0x26]
cmp r8w, 2
cmovae r8d, edx
cmp r8w, 1
je 0x140055eea
movzx r10d, r8w
cmp r10d, 2
jne 0x1400561d8
cmp r9w, 5
je 0x1400561d8
add rax, 0x20
add rcx, 0xffffffffffffffe0
jne 0x140055eb9
jmp 0x1400561e2
mov qword [rsp + 0x168], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x360], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x358], rax
mov r15d, 1
xor ebx, ebx
xor ebp, ebp
xor r12d, r12d
mov r14, qword [rsp + 0x30]
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [rsp + 0x350]
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x98], r15
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0xc0], rdi
test r12, r12
je 0x140055fe3
mov al, 0x19
test rdi, rdi
je 0x1400561b6
shl rdi, 3
lea rcx, [rdi + rdi*2]
test rcx, rcx
je 0x140055fd5
add rcx, 0xffffffffffffffe8
cmp qword [r12 + 0x10], 0
lea r12, [r12 + 0x18]
jne 0x140055fba
jmp 0x1400561b6
cmp byte [r14 + 0x380], 0
je 0x1400561b4
mov rbx, qword [r14 + 0x58]
movups xmm0, xmmword [r14 + 0x38]
movups xmm1, xmmword [r14 + 0x48]
movups xmmword [rsp + 0x158], xmm1
movups xmmword [rsp + 0x148], xmm0
movups xmm0, xmmword [r14 + 0x340]
movups xmm1, xmmword [r14 + 0x350]
movups xmm2, xmmword [r14 + 0x360]
movups xmm3, xmmword [r14 + 0x370]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xf0], xmm2
movaps xmmword [rsp + 0x100], xmm3
mov rdi, r14
mov r14, qword [r14 + 0x60]
lea rsi, [rsp + 0x350]
mov r8d, 0xf0
mov rcx, rsi
mov rdx, qword [rsp + 0x78]
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rdi + 0x158]
lea rcx, [rsp + 0x168]
mov r8d, 0x1e8
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmm2, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x120], xmm1
movaps xmmword [rsp + 0x130], xmm2
mov rax, qword [rdi + 0x30]
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x440]
mov r8d, 0xf0
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov al, byte [0x14024a6a0]
mov ecx, 0x3c8
call fcn.140010290
test rax, rax
je 0x140056355
mov r12, rax
lea rsi, [rsp + 0x110]
mov ecx, 0xb
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov qword [rax + 0x58], rbx
mov qword [rax + 0x60], r14
lea rcx, [rax + 0x68]
lea rdx, [rsp + 0x440]
mov r8d, 0xf0
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r12 + 0x158]
lea rdx, [rsp + 0x168]
mov r8d, 0x1e8
call sub.VCRUNTIME140.dll_memcpy
mov rdi, r12
add rdi, 0x340
lea rsi, [rsp + 0x80]
mov ecx, 9
rep movsq qword [rdi], qword [rsi]
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmm1, xmmword [rsp + 0xe0]
movaps xmm2, xmmword [rsp + 0xf0]
movaps xmm3, xmmword [rsp + 0x100]
movups xmmword [r12 + 0x3b8], xmm3
movups xmmword [r12 + 0x3a8], xmm2
movups xmmword [r12 + 0x398], xmm1
movups xmmword [r12 + 0x388], xmm0
mov rdi, qword [rsp + 0x50]
mov qword [rdi + 8], r12
lea rax, fcn.1400563bb
mov qword [rdi + 0x10], rax
mov byte [rdi], 0x14
mov rcx, qword [rsp + 0x48]
call fcn.140040b89
mov r14, qword [rsp + 0x30]
jmp 0x140055d0d
mov al, 0x3f
mov rdi, qword [rsp + 0x50]
mov byte [rdi], 8
mov byte [rdi + 1], al
lea rcx, [rsp + 0x80]
call fcn.140051e48
mov r15, qword [rsp + 0x48]
jmp 0x140055cfd
test r8w, r8w
je 0x14005630d
mov r15d, 1
xor ebx, ebx
xor ebp, ebp
mov rax, qword [r11 + 0x18]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14005623d
mov rax, qword [rax + 0x18]
shl rcx, 5
mov edx, 2
xor r12d, r12d
mov r9d, dword [rax + 0x18]
lea r8d, [r9 - 0x26]
cmp r8w, 2
cmovae r8d, edx
test r8w, r8w
je 0x140056231
movzx r10d, r8w
cmp r10d, 2
jne 0x140056245
cmp r9w, 0x11
je 0x140056245
add rax, 0x20
add rcx, 0xffffffffffffffe0
jne 0x140056209
jmp 0x140056240
xor r12d, r12d
jmp 0x140055f52
mov rdi, qword [rax + 0x10]
cmp r8w, 1
jne 0x140056305
mov rsi, qword [rax]
mov rcx, rdi
call fcn.140037b7e
mov r12, rax
test rdx, rdx
je 0x14005634d
mov r13, rdx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rbx
lea rax, [rdi*8]
lea rax, [rax + rax*2]
mov qword [rsp + 0x70], rax
xor r14d, r14d
mov r15, rdx
cmp qword [rsp + 0x70], r14
je 0x1400562ec
lea rbx, [rsi + 0x18]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
mov rsi, qword [rsi + 0x10]
mov rcx, rsi
xor edx, edx
call fcn.14002cc95
mov rbp, rax
mov qword [rsp + 0x40], rdx
mov rcx, rax
mov rdx, qword [rsp + 0x38]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [r12 + r14], rbp
mov rax, qword [rsp + 0x40]
mov qword [r12 + r14 + 8], rax
mov qword [r12 + r14 + 0x10], rsi
add r14, 0x18
mov rsi, rbx
dec r15
jne 0x140056294
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
mov r15, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
jmp 0x140055f52
xor r12d, r12d
jmp 0x140056240
mov rsi, qword [rax]
mov rbx, qword [rax + 0x10]
mov rdi, r11
xor r12d, r12d
mov rcx, rbx
xor edx, edx
call fcn.14002cc95
mov r15, rax
mov rbp, rdx
mov rcx, rax
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rdi + 0x28], 0
je 0x140056240
mov r11, qword [rsp + 0x40]
jmp 0x1400561ec
xor r13d, r13d
jmp 0x140055f52
mov ecx, 8
mov edx, 0x3c8
call fcn.14018c620
ud2