Function at 0x1400033f0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rdx]
mov rbx, rdx
lea r8, [rcx + 4]
mov rdi, rcx
lea rdx, str.ShowGridLines
xor r9d, r9d
mov rcx, rbx
call qword [rax + htons]
mov r11, qword [rbx]
lea r8, [rdi + 8]
lea rdx, str.SaveFilterIndex
xor r9d, r9d
mov rcx, rbx
call qword [r11 + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r11, qword [rbx]
lea r8, [rdi + 0x57c]
lea rdx, str.ShowKeys
mov r9d, 0xffff
mov rcx, rbx
call qword [r11 + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r11, qword [rbx]
lea r8, [rdi + 0x588]
lea rdx, str.MarkOddEvenRows
xor r9d, r9d
mov rcx, rbx
call qword [r11 + htons]
mov r11, qword [rbx]
lea r8, [rdi + 0x578]
lea rdx, str.RegistrySource
mov r9d, 1
mov rcx, rbx
call qword [r11]
mov r11, qword [rbx]
lea r8, [rdi + 0xc]
lea r9, [0x140027e59]
lea rdx, str.SoftwareKeyFile
mov rcx, rbx
mov dword [rsp + 0x20], 0x104
call qword [r11 + 0x20]
mov r11, qword [rbx]
lea r8, [rdi + 0x420]
lea r9, [0x140027e59]
lea rdx, str.Domain
mov rcx, rbx
mov dword [rsp + 0x20], 0x104
call qword [r11 + 0x20]
mov r11, qword [rbx]
lea r8, [rdi + 0x111]
lea r9, [0x140027e59]
lea rdx, str.RemoteComputer
mov rcx, rbx
mov dword [rsp + 0x20], 0x104
call qword [r11 + 0x20]
mov r11, qword [rbx]
lea r8, [rdi + 0x216]
lea r9, [0x140027e59]
lea rdx, str.RemoteFile
mov rcx, rbx
mov dword [rsp + 0x20], 0x104
call qword [r11 + 0x20]
mov r11, qword [rbx]
lea r8, [rdi + 0x31b]
lea r9, [0x140027e59]
lea rdx, str.WinDir
mov rcx, rbx
mov dword [rsp + 0x20], 0x104
call qword [r11 + 0x20]
mov r11, qword [rbx]
lea r8, [rdi + 0x584]
lea rdx, str.AddExportHeaderLine
xor r9d, r9d
mov rcx, rbx
call qword [r11 + htons]
mov r11, qword [rbx]
lea r8, [rdi + 0x58c]
lea rdx, str.ShowTimeInGMT
xor r9d, r9d
mov rcx, rbx
call qword [r11 + htons]
mov r11, qword [rbx]
lea r8, [rdi + 0x525]
lea r9, str.192.168.0.1
lea rdx, str.FromIPAddress
mov rcx, rbx
mov dword [rsp + 0x20], 0x1f
call qword [r11 + 0x20]
mov r11, qword [rbx]
lea r8, [rdi + 0x545]
lea r9, str.192.168.0.254
lea rdx, str.ToIPAddress
mov rcx, rbx
mov dword [rsp + 0x20], 0x1f
call qword [r11 + 0x20]
mov r11d, dword [0x14002fa84]
test r11d, r11d
jne 0x1400035f3
lea rcx, [0x14002fa80]
mov dword [0x14002fa80], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r11d, dword [0x14002fa84]
cmp dword [0x14002fa90], 2
jne 0x14000360a
cmp r11d, 5
jb 0x14000360a
mov r9d, 1
jmp 0x14000360d
xor r9d, r9d
mov rax, qword [rbx]
lea r8, [rdi + 0x568]
lea rdx, str.UsePing
mov rcx, rbx
call qword [rax + htons]
mov r11, qword [rbx]
lea r8, [rdi + 0x56c]
lea rdx, str.PingTimeout
mov r9d, gethostbyname
mov rcx, rbx
call qword [r11 + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r11, qword [rbx]
lea r8, [rdi + 0x570]
lea rdx, str.IPResolve
mov r9d, 1
mov rcx, rbx
call qword [r11 + htons]
mov r11, qword [rbx]
lea r8, [rdi + 0x5a0]
lea rdx, str.OfficeProductNameMode
mov r9d, 2
mov rcx, rbx
call qword [r11 + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r11, qword [rbx]
lea r8, [rdi + 0x574]
lea rdx, str.StartRemoteRegistry
xor r9d, r9d
mov rcx, rbx
call qword [r11 + htons]
mov r11, qword [rbx]
lea r8, [rdi + 0x580]
lea rdx, str.ExtractWindowsEdition
mov r9d, 1
mov rcx, rbx
call qword [r11 + htons]
mov r11, qword [rbx]
lea r8, [rdi + 0x590]
lea rdx, str.UseDefaultProductKey
xor r9d, r9d
mov rcx, rbx
call qword [r11 + htons]
mov r11, qword [rbx]
lea r8, [rdi + 0x594]
lea rdx, str.AutoSizeColumnsOnLoad
mov r9d, 1
mov rcx, rbx
call qword [r11 + htons]
mov r11, qword [rbx]
lea r8, [rdi + 0x598]
lea rdx, str.ExtractWMIPartialKey
xor r9d, r9d
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [r11 + htons]