Function at 0x140003efc
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x200
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov r13, rcx
lea rcx, [rsp + 0x40]
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x140003f58
mov edi, 0x4b4
jmp 0x140003f78
mov eax, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
mov ecx, 2
dec eax
je 0x140003fe5
dec eax
je 0x140003f8f
mov edi, 0x4ca
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov dword [rsp + 0x20], FDICopy
xor r8d, r8d
jmp 0x1400041da
mov esi, 1
movzx eax, cx
mov word [0x14000be54], cx
lea ecx, [rsi + 2]
mov dword [0x14000a1f4], esi
mov dword [0x14000a1bc], esi
cmp r8d, ecx
ja 0x140003fd3
mov eax, esi
mov word [0x14000be54], ax
jb 0x140003fc5
jne 0x140004000
cmp r11d, 0x33
jae 0x140004000
mov dword [0x14000a1f4], ebx
mov dword [0x14000a1bc], ebx
jmp 0x140004000
cmp r8d, 5
jb 0x140004000
movzx eax, cx
mov word [0x14000be54], cx
jmp 0x140004000
mov esi, 1
movzx eax, bx
mov word [0x14000be54], bx
mov dword [0x14000a1f4], esi
mov dword [0x14000a1bc], esi
cmp dword [0x14000abd4], ebx
jne 0x1400041e3
test r13, r13
je 0x1400041e3
lea r15, [r13 + 0x40]
test ax, ax
je 0x140004022
lea r15, [r13 + 4]
movzx r14d, word [rsp + 0x4c]
mov ecx, ebx
mov dword [rsp + 0x30], ebx
or r12d, 0xffffffff
movsxd r10, ecx
lea r9, [r10 + r10*2]
cmp r8d, dword [r15 + r9*8]
jae 0x140004044
mov edx, r12d
jmp 0x140004056
jbe 0x14000404a
mov edx, esi
jmp 0x140004056
cmp r11d, dword [r15 + r9*8 + 4]
jb 0x14000403f
mov edx, ebx
seta dl
cmp r8d, dword [r15 + r9*8 + 0xc]
jae 0x140004062
mov eax, r12d
jmp 0x140004074
jbe 0x140004068
mov eax, esi
jmp 0x140004074
cmp r11d, dword [r15 + r9*8 + 0x10]
jb 0x14000405d
mov eax, ebx
seta al
test edx, edx
js 0x140004112
test eax, eax
jg 0x140004112
test edx, edx
jne 0x1400040a6
test eax, eax
movzx eax, r14w
jne 0x140004099
cmp eax, dword [r15 + r9*8 + 8]
jb 0x1400040b5
jmp 0x1400040ae
cmp eax, dword [r15 + r9*8 + 8]
jae 0x140004125
jmp 0x1400040b5
test eax, eax
jne 0x140004125
movzx eax, r14w
cmp eax, dword [r15 + r9*8 + 0x14]
jbe 0x140004125
test ecx, ecx
je 0x140004116
mov edi, 0x54c
mov r9, rbx
mov r12, rbx
mov r14d, ebx
cmp edi, 0x54d
jne 0x1400040ee
mov edx, dword [r13 + 0x80]
movsxd rax, ecx
lea r9, [rbp - 0x20]
imul r15, rax, 0x3c
add r15, r13
add rdx, 0x84
add r15, rdx
test r15, r15
je 0x140004164
mov eax, dword [r15 + 0x34]
lea r12, [r13 + 0x84]
add r12, rax
mov eax, dword [r15 + 0x30]
test sil, al
je 0x140004156
mov r14d, 0x104
jmp 0x140004164
cmp ecx, esi
je 0x1400040b9
add ecx, esi
mov dword [rsp + 0x30], ecx
cmp ecx, 2
jl 0x140004032
cmp dword [r13 + 0x7c], ebx
je 0x1400041e3
lea r9, [rsp + 0x30]
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.140002b08
test eax, eax
jne 0x1400041e3
mov ecx, dword [rsp + 0x30]
mov edi, 0x54d
jmp 0x1400040be
and al, 2
neg al
sbb r14d, r14d
and r14d, 0x101
test byte [0x14000abd8], sil
jne 0x1400041c7
cmp byte [r12], bl
je 0x1400041c7
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
call fcn.140007de8
test eax, eax
je 0x140004193
call fcn.140007d24
mov r9d, 0x180000
test eax, eax
jne 0x140004196
mov r9d, ebx
or r9d, r14d
lea r8, [0x14000b558]
mov rdx, r12
or r9d, 0x30
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
test r14b, 4
je 0x1400041ba
cmp eax, 6
jmp 0x1400041c1
test sil, r14b
je 0x1400041e3
cmp eax, esi
jne 0x1400041e3
mov edi, ebx
jmp 0x1400041e3
mov dword [rsp + 0x28], ebx
lea r8, [0x14000b558]
mov dword [rsp + 0x20], 0x30
mov edx, edi
xor ecx, ecx
call fcn.140004fd8
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140008340
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret