Function at 0x1400072b0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
xor eax, eax
mov rbx, rcx
lea rcx, [rsp + 0x34]
xor esi, esi
xor edx, edx
mov r8d, 0x118
mov edi, 0xc0000001
mov qword [rsp + 0x22], rax
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x20], si
mov word [rsp + 0x2e], ax
mov dword [rsp + 0x30], 0x11c
call fcn.14000aca0
lea rdx, str.RtlGetVersion
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
je 0x140007338
lea rcx, [rsp + 0x30]
call rax
mov edi, eax
test eax, eax
js 0x140007364
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
jmp 0x140007379
lea r8, [rsp + 0x3c]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x34]
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
test al, al
je 0x140007364
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
mov edi, esi
jmp 0x140007379
mov eax, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x168]
mov edx, dword [rsp + 0x168]
test edi, edi
js 0x140007394
cmp edx, 0xa28
jne 0x1400073ab
cmp ecx, 5
jne 0x14000738f
cmp eax, 1
je 0x140007394
mov edi, 0xc0000001
lea r11, [rsp + 0x150]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp edx, 0xece
jne 0x1400073e1
cmp ecx, 5
jne 0x14000738f
cmp eax, 2
jne 0x14000738f
mov dword [rbx], 0xd8
mov dword [rbx + 4], 0xe0
mov dword [rbx + 8], 0x268
mov dword [rbx + 0xc], 0x318
mov dword [rbx + 0x10], 0x1f0
jmp 0x140007394
cmp edx, 0x1770
je 0x1400073f9
cmp edx, 0x1771
je 0x1400073f9
cmp edx, 0x1772
jne 0x140007429
cmp ecx, 6
jne 0x14000738f
test eax, eax
jne 0x14000738f
mov dword [rbx], 0xe0
mov dword [rbx + 4], 0xe8
mov dword [rbx + 8], 0x238
mov dword [rbx + 0xc], 0x2e8
mov dword [rbx + 0x10], 0x1c8
jmp 0x140007394
cmp edx, 0x1db0
je 0x140007439
cmp edx, 0x1db1
jne 0x140007472
cmp ecx, 6
jne 0x14000738f
cmp eax, 1
jne 0x14000738f
mov dword [rbx], 0x180
mov dword [rbx + 4], 0x188
mov dword [rbx + 8], 0x2e0
mov dword [rbx + 0xc], 0x390
mov dword [rbx + 0x10], 0x268
jmp 0x140007394
cmp edx, 0x23f0
jne 0x1400074b3
cmp ecx, 6
jne 0x14000738f
cmp eax, 2
jne 0x14000738f
mov dword [rbx], 0x2e0
mov dword [rbx + 4], 0x2e8
mov dword [rbx + 8], 0x438
mov dword [rbx + 0xc], 0x450
mov dword [rbx + 0x10], 0x3a8
jmp 0x140007394
cmp edx, 0x2580
jne 0x1400074fb
cmp ecx, 6
jne 0x14000738f
cmp eax, 3
jne 0x14000738f
mov dword [rbx], 0x2e0
mov dword [rbx + 4], 0x2e8
mov dword [rbx + 8], 0x438
mov dword [rbx + 0xc], 0x450
mov dword [rbx + 0x10], 0x3a8
mov dword [rbx + 0x1c], 0x67a
jmp 0x140007394
cmp edx, 0x2800
jne 0x140007542
cmp ecx, 0xa
jne 0x14000738f
test eax, eax
jne 0x14000738f
mov dword [rbx], 0x2e8
mov dword [rbx + 4], 0x2f0
mov dword [rbx + 8], 0x448
mov dword [rbx + 0xc], 0x460
mov dword [rbx + 0x10], 0x3b8
mov dword [rbx + 0x1c], 0x6aa
jmp 0x140007394
cmp edx, 0x295a
jne 0x140007589
cmp ecx, 0xa
jne 0x14000738f
test eax, eax
jne 0x14000738f
mov dword [rbx], 0x2e8
mov dword [rbx + 4], 0x2f0
mov dword [rbx + 8], 0x450
mov dword [rbx + 0xc], 0x468
mov dword [rbx + 0x10], 0x3b8
mov dword [rbx + 0x1c], 0x6b2
jmp 0x140007394
cmp edx, 0x37d7
jne 0x1400075d0
cmp ecx, 0xa
jne 0x14000738f
test eax, eax
jne 0x14000738f
mov dword [rbx], 0x2e8
mov dword [rbx + 4], 0x2f0
mov dword [rbx + 8], 0x450
mov dword [rbx + 0xc], 0x468
mov dword [rbx + 0x10], 0x3b8
mov dword [rbx + 0x1c], 0x6ba
jmp 0x140007394
cmp edx, 0x3839
jne 0x140007617
cmp ecx, 0xa
jne 0x14000738f
test eax, eax
jne 0x14000738f
mov dword [rbx], 0x2e8
mov dword [rbx + 4], 0x2f0
mov dword [rbx + 8], 0x450
mov dword [rbx + 0xc], 0x468
mov dword [rbx + 0x10], 0x3b8
mov dword [rbx + 0x1c], 0x6c2
jmp 0x140007394
cmp edx, 0x3ad7
je 0x140007637
cmp edx, 0x3fab
je 0x140007637
cmp edx, 0x42ee
je 0x140007637
cmp edx, 0x4563
jne 0x140007676
cmp ecx, 0xa
jne 0x14000738f
test eax, eax
jne 0x14000738f
mov dword [rbx], 0x2e0
mov dword [rbx + 4], 0x2e8
mov dword [rbx + 8], 0x450
mov dword [rbx + 0xc], 0x468
mov dword [rbx + 0x10], 0x3b8
mov dword [rbx + 0x1c], 0x6ca
jmp 0x140007394
cmp edx, 0x47ba
je 0x140007686
cmp edx, 0x47bb
jne 0x1400076c5
cmp ecx, 0xa
jne 0x14000738f
test eax, eax
jne 0x14000738f
mov dword [rbx], 0x2e8
mov dword [rbx + 4], 0x2f0
mov dword [rbx + 8], 0x450
mov dword [rbx + 0xc], 0x468
mov dword [rbx + 0x10], 0x3c0
mov dword [rbx + 0x1c], 0x6fa
jmp 0x140007394
cmp edx, 0x4a61
je 0x140007701
cmp edx, 0x4a62
je 0x140007701
cmp edx, 0x4a63
je 0x140007701
cmp edx, 0x4a64
je 0x140007701
cmp edx, 0x4a65
je 0x140007701
cmp edx, 0x55f0
je 0x140007701
cmp edx, 0x585d
jne 0x14000738f
cmp ecx, 0xa
jne 0x14000738f
test eax, eax
jne 0x14000738f
mov dword [rbx], 0x440
mov dword [rbx + 4], 0x448
mov dword [rbx + 8], 0x5a8
mov dword [rbx + 0xc], 0x5c0
mov dword [rbx + 0x10], 0x518
mov dword [rbx + 0x1c], 0x87a
jmp 0x140007394