Function at 0x1400295a0
Capabilities:
Check os version
Enumerate process modules

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1250]
mov eax, 0x1350
call fcn.140247340
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1388], rbx
mov qword [rsp + 0x1390], rsi
mov rbx, rcx
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0xc14]
call fcn.140249b10
cmp dword [rbx + 0xc], 0
jne 0x1400299ff
mov dword [rbx + 0xc], 1
mov edx, dword [rbx + 8]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400299ff
mov dword [rbp + 0xc10], 0x238
lea rdx, [rbp + 0xc10]
mov rcx, rax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x1400299f6
lea r15, vtable.CSABOSVersion.0
mov qword [rbp + 0x350], r15
lea r12, vtable.CSABString.0
mov qword [rbp + 0xbf8], r12
xor r14d, r14d
mov qword [rbp + 0xc00], r14
mov dword [rbp + 0xc08], r14d
lea ecx, [r14 + 0x10]
call fcn.140247068
mov qword [rbp + 0xc00], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0xc0c], 1
mov dword [rbp + 0x358], 0x9c
mov dword [rbp + 0xbf4], 0xffffffff
lea rcx, [rbp + 0x358]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rbp + 0x35c], 6
jne 0x1400297ad
cmp dword [rbp + 0x360], 2
jne 0x1400297ad
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400297ad
mov dword [rsp + 0x50], 0x11c
lea rcx, [rsp + 0x50]
call rax
mov eax, dword [rsp + 0x60]
mov dword [rbp + 0x368], eax
mov eax, dword [rsp + 0x5c]
mov dword [rbp + 0x364], eax
mov eax, dword [rsp + 0x54]
mov dword [rbp + 0x35c], eax
mov eax, dword [rsp + 0x58]
mov dword [rbp + 0x360], eax
movzx eax, byte [rbp + 0x6a]
mov byte [rbp + 0x3f2], al
movzx eax, byte [rbp + 0x6b]
mov byte [rbp + 0x3f3], al
movzx eax, word [rbp + 0x64]
mov word [rbp + 0x3ec], ax
movzx eax, word [rbp + 0x66]
mov word [rbp + 0x3ee], ax
movzx eax, word [rbp + 0x68]
mov word [rbp + 0x3f0], ax
lea rcx, [rsp + 0x64]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140029763
lea r9d, [rax + 1]
lea rcx, [rbp + 0x1280]
mov qword [rsp + 0x38], rcx
lea rcx, [0x1402860c8]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x36c]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x64]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rbp + 0xbf8]
lea rcx, [rbp + 0x350]
call fcn.140006130
nop
cmp byte [rbp + 0xd40], 0
je 0x1400297e3
lea rdx, [0x14028b028]
lea rcx, [rbp + 0xd40]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x1400297fc
lea rdx, [rbp + 0xc10]
mov rcx, rdi
call sub.KERNEL32.dll_Module32Next
test eax, eax
je 0x1400299ce
jmp 0x1400297c1
mov esi, dword [rbp + 0xc38]
add esi, dword [rbx + 0x10]
cmp dword [rbp + 0x35c], 4
jne 0x140029943
mov eax, dword [rbp + 0x360]
test eax, eax
je 0x140029826
cmp eax, 0xa
je 0x140029833
cmp eax, 0x5a
jmp 0x14002982d
cmp dword [rbp + 0x368], 1
jne 0x140029943
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x50]
call fcn.140249b10
mov edx, esi
mov qword [rsp + 0x20], r14
mov r9d, 0x100
lea r8, [rsp + 0x50]
mov ecx, dword [rbx + 8]
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
test eax, eax
je 0x1400299ce
mov edx, dword [rsp + 0x51]
mov qword [rsp + 0x20], r14
mov r9d, 0x100
lea r8, [rsp + 0x50]
mov ecx, dword [rbx + 8]
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
test eax, eax
je 0x1400299ce
mov edx, dword [rsp + 0x50]
mov qword [rsp + 0x20], r14
mov r9d, 0x100
lea r8, [rsp + 0x50]
mov ecx, dword [rbx + 8]
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
test eax, eax
je 0x1400299ce
mov esi, dword [rsp + 0x50]
lea edx, [rsi + 0xc0]
mov qword [rsp + 0x20], r14
mov r9d, 0x100
lea r8, [rsp + 0x50]
mov ecx, dword [rbx + 8]
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
test eax, eax
je 0x1400299ce
mov eax, dword [rsp + 0x50]
mov qword [rsp + 0x20], r14
mov r9d, 0x100
lea r8, [rsp + 0x50]
mov ecx, dword [rbx + 8]
test eax, eax
je 0x140029900
mov edx, eax
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
jmp 0x1400299ce
lea edx, [rsi + 0x40]
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
test eax, eax
je 0x1400299ce
mov edx, dword [rsp + 0x50]
add edx, 8
mov qword [rsp + 0x20], r14
mov r9d, 0x100
lea r8, [rsp + 0x50]
mov ecx, dword [rbx + 8]
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
test eax, eax
je 0x1400299ce
mov edx, dword [rsp + 0x50]
mov r9d, 0x200
jmp 0x1400299b5
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x50]
call fcn.140249b10
mov edx, esi
mov qword [rsp + 0x20], r14
mov r9d, 0x100
lea r8, [rsp + 0x50]
mov ecx, dword [rbx + 8]
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
test eax, eax
je 0x1400299ce
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xe50]
call fcn.140249b10
mov edx, dword [rsp + 0x51]
mov qword [rsp + 0x20], r14
mov r9d, 0x100
lea r8, [rbp + 0xe50]
mov ecx, dword [rbx + 8]
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
test eax, eax
je 0x1400299ce
mov edx, dword [rbp + 0xe50]
mov r9d, 0x3ff
mov qword [rsp + 0x20], r14
lea r8, [rbx + 0x20]
mov ecx, dword [rbx + 8]
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
test eax, eax
je 0x1400299ce
mov dword [rbx + 0xc], r14d
mov qword [rbp + 0x350], r15
mov qword [rbp + 0xbf8], r12
add dword [rbp + 0xc0c], 0xffffffff
jne 0x1400299f6
mov rcx, qword [rbp + 0xc00]
test rcx, rcx
je 0x1400299f6
call fcn.140247060
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x1350]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret