Function at 0x14004fb10
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x1c0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x64], 0
mov dword [rsp + 0xa0], 0x11c
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jl 0x14004fe1e
mov r8d, 0x11c
lea rdx, [rsp + 0xa0]
lea rcx, [0x1400bda90]
call fcn.1400588c0
mov eax, dword [rsp + 0xa4]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x64]
call fcn.14004f798
movzx eax, word [rsp + 0x1b4]
mov ecx, dword [rsp + 0x64]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x54]
lea r8, [0x14005b3b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
cmp dword [rsp + 0x54], 6
jne 0x14004fbee
cmp dword [rsp + 0x58], 1
jb 0x14004fbf5
cmp dword [rsp + 0x54], 6
jae 0x14004fc04
mov dword [0x1400bd0e8], 0
jmp 0x14004fe1e
cmp dword [rsp + 0x54], 6
jne 0x14004fc21
cmp dword [rsp + 0x58], 1
jne 0x14004fc21
mov dword [0x1400bd0e8], 0x3d
jmp 0x14004fe1e
cmp dword [rsp + 0x54], 6
jne 0x14004fc3e
cmp dword [rsp + 0x58], 2
jne 0x14004fc3e
mov dword [0x1400bd0e8], 0x3e
jmp 0x14004fe1e
cmp dword [rsp + 0x54], 6
jne 0x14004fc5b
cmp dword [rsp + 0x58], 3
jne 0x14004fc5b
mov dword [0x1400bd0e8], 0x3f
jmp 0x14004fe1e
cmp dword [rsp + 0x54], 0xa
jne 0x14004fe14
cmp dword [rsp + 0x58], 0
jne 0x14004fe14
cmp dword [rsp + 0x50], 0x585d
jb 0x14004fc8a
mov dword [0x1400bd0e8], 0x74
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x57e4
jb 0x14004fca3
mov dword [0x1400bd0e8], 0x73
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x55f0
jb 0x14004fcbc
mov dword [0x1400bd0e8], 0x72
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x4a65
jb 0x14004fcd5
mov dword [0x1400bd0e8], 0x71
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x4a64
jb 0x14004fcee
mov dword [0x1400bd0e8], 0x70
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x4a63
jb 0x14004fd07
mov dword [0x1400bd0e8], 0x6f
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x4a62
jb 0x14004fd20
mov dword [0x1400bd0e8], 0x6e
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x4a61
jb 0x14004fd39
mov dword [0x1400bd0e8], 0x6d
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x47bb
jb 0x14004fd52
mov dword [0x1400bd0e8], 0x6c
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x47ba
jb 0x14004fd6b
mov dword [0x1400bd0e8], 0x6b
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x4563
jb 0x14004fd84
mov dword [0x1400bd0e8], 0x6a
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x42ee
jb 0x14004fd9a
mov dword [0x1400bd0e8], 0x69
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x3fab
jb 0x14004fdb0
mov dword [0x1400bd0e8], 0x68
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x3ad7
jb 0x14004fdc6
mov dword [0x1400bd0e8], 0x67
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x3839
jb 0x14004fddc
mov dword [0x1400bd0e8], 0x66
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x295a
jb 0x14004fdf2
mov dword [0x1400bd0e8], 0x65
jmp 0x14004fe12
cmp dword [rsp + 0x50], 0x2800
jb 0x14004fe08
mov dword [0x1400bd0e8], 0x64
jmp 0x14004fe12
mov dword [0x1400bd0e8], 0xffffffff
jmp 0x14004fe1e
mov dword [0x1400bd0e8], 0xffffffff
cmp dword [0x1400bd0e8], 0xffffffff
jne 0x14004fe2f
mov dword [rsp + 0x60], 0xc00000bb
cmp dword [rsp + 0x60], 0
jge 0x14004fef8
lea rax, [rsp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x5d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x5e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
call fcn.1400280c0
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x68], eax
mov r9b, byte [rsp + 0x5c]
mov r8b, byte [rsp + 0x5d]
mov dl, byte [rsp + 0x5e]
lea rcx, [rsp + 0x80]
call fcn.14004f718
mov rcx, rax
call fcn.14003b614
mov qword [rsp + 0x70], rax
movzx eax, word [rsp + 0x1b4]
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x28], eax
lea rax, [0x14005b3e0]
mov qword [rsp + 0x20], rax
mov r9d, 0x89
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
call fcn.140028148
mov eax, dword [rsp + 0x60]
add rsp, 0x1c0
pop rdi
ret