Function at 0x18003dd60
Capabilities:
Check os version

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x1e8
mov rax, qword [0x18009b1a0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
add eax, 0xcd15c00
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
add eax, 0xd4f8f4e
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
cmp dword [0x1800a03cc], 0
jne 0x18003ddf4
movzx eax, byte [rsp + 0x1f0]
test eax, eax
jne 0x18003ddf4
lea rax, [0x1800e8b70]
jmp 0x18003e8f3
mov r8d, VarUI4FromDisp
xor edx, edx
lea rcx, [0x1800e8b70]
call fcn.18005afd0
mov dword [0x1800e8b70], 0x11c
mov eax, 5
mov word [rsp + 0x2c], ax
movsx rax, word [rsp + 0x2c]
lea rcx, [0x18009adc0]
cmp dword [rcx + rax*4], 1
jne 0x18003de51
movsx rax, word [rsp + 0x2c]
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x2c]
lea rdx, [0x18009adc0]
mov dword [rdx + rcx*4], eax
cmp qword [0x1800e75b8], 0
je 0x18003de6e
lea rcx, [0x1800e8b70]
call qword [0x1800e75b8]
mov dword [rsp + 0x50], eax
jmp 0x18003de76
mov dword [rsp + 0x50], 0
cmp dword [rsp + 0x50], 0
je 0x18003e804
mov dword [rsp + 0x60], 0
mov eax, dword [rsp + 0x60]
cmp eax, 0x12f6e701
jne 0x18003deaf
lea r8, [0x1800a03d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rsp + 0x98], rax
jmp 0x18003ded7
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
cmp dword [0x1800e8b74], 6
ja 0x18003defa
cmp dword [0x1800e8b74], 6
jne 0x18003e7ff
cmp dword [0x1800e8b78], 2
jb 0x18003e7ff
mov dword [rsp + 0x64], 8
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [rsp + 0x64]
movsxd rcx, ecx
lea rdx, [0x18009adc0]
mov dword [rdx + rcx*4], eax
cmp qword [0x1800e6b38], 0
je 0x18003df3d
mov r8b, 3
mov edx, 2
xor ecx, ecx
call qword [0x1800e6b38]
mov qword [rsp + 0x80], rax
jmp 0x18003df49
mov qword [rsp + 0x80], 0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x24], 1
xor eax, eax
mov word [rsp + 0x20], ax
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov edx, 4
imul rdx, rdx, 2
lea r8, [0x18009adc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx], eax
mov eax, 4
imul rax, rax, 2
lea rcx, [0x18009adc0]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x18009adc0]
mov edx, dword [r8 + rdx]
cmp dword [rcx + rax], edx
jae 0x18003dfe3
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov edx, dword [rcx + rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
mov eax, 6
mov word [rsp + 0x20], ax
jmp 0x18003dffc
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
cmp eax, 0x14
jge 0x18003e17d
mov eax, 4
imul rax, rax, 2
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff34f
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
mov r8d, 0x11c
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.18005afd0
mov dword [rsp + 0xb0], 0x11c
movzx eax, word [rsp + 0x20]
mov dword [rsp + 0xb4], eax
mov dword [rsp + 0xb8], 0
xor eax, eax
mov word [rsp + 0x1c4], ax
xor eax, eax
mov word [rsp + 0x1c6], ax
cmp qword [0x1800e75b0], 0
je 0x18003e0a8
mov r8, qword [rsp + 0x38]
mov edx, 2
lea rcx, [rsp + 0xb0]
call qword [0x1800e75b0]
mov dword [rsp + 0x4c], eax
jmp 0x18003e0b0
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x24], eax
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff332
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
cmp dword [rsp + 0x24], 0
jne 0x18003e0ef
jmp 0x18003e17d
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov edx, 4
imul rdx, rdx, 2
lea r8, [0x18009adc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx], eax
mov eax, 4
imul rax, rax, 2
lea rcx, [0x18009adc0]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x18009adc0]
mov edx, dword [r8 + rdx]
cmp dword [rcx + rax], edx
jae 0x18003e16d
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov edx, dword [rcx + rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
movzx eax, word [rsp + 0x20]
mov dword [0x1800e8b74], eax
jmp 0x18003dfef
cmp qword [0x1800e6b38], 0
je 0x18003e1a1
mov r8b, 1
mov edx, 2
xor ecx, ecx
call qword [0x1800e6b38]
mov qword [rsp + 0x88], rax
jmp 0x18003e1ad
mov qword [rsp + 0x88], 0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
cmp qword [0x1800e6b38], 0
je 0x18003e1de
mov r8b, 3
mov edx, 1
mov rcx, qword [rsp + 0x38]
call qword [0x1800e6b38]
mov qword [rsp + 0x68], rax
jmp 0x18003e1e7
mov qword [rsp + 0x68], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff310
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
xor eax, eax
mov word [rsp + 0x20], ax
jmp 0x18003e232
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
cmp eax, 0xa
jge 0x18003e47d
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff306
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
mov r8d, 0x11c
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.18005afd0
mov dword [rsp + 0xb0], 0x11c
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
add eax, 0x74d92fd
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
mov eax, dword [0x1800e8b74]
mov dword [rsp + 0xb4], eax
movzx eax, word [rsp + 0x20]
mov dword [rsp + 0xb8], eax
xor eax, eax
mov word [rsp + 0x1c4], ax
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff2ef
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
xor eax, eax
mov word [rsp + 0x1c6], ax
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov edx, 4
imul rdx, rdx, 2
lea r8, [0x18009adc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx], eax
mov eax, 4
imul rax, rax, 2
lea rcx, [0x18009adc0]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x18009adc0]
mov edx, dword [r8 + rdx]
cmp dword [rcx + rax], edx
jae 0x18003e38c
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov edx, dword [rcx + rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
mov dword [rsp + 0x54], SafeArrayGetElement
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [rsp + 0x54]
movsxd rcx, ecx
lea rdx, [0x18009adc0]
mov dword [rdx + rcx*4], eax
cmp qword [0x1800e75b0], 0
je 0x18003e3d3
mov r8, qword [rsp + 0x38]
mov edx, 3
lea rcx, [rsp + 0xb0]
call qword [0x1800e75b0]
mov dword [rsp + 0x44], eax
jmp 0x18003e3db
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x24], eax
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
add eax, 0x48229f0
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
cmp dword [rsp + 0x24], 0
jne 0x18003e417
jmp 0x18003e47d
movzx eax, word [rsp + 0x20]
mov dword [0x1800e8b78], eax
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
cmp eax, 0x5966b9
jne 0x18003e450
lea r8, [0x1800a0410]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rsp + 0xa0], rax
jmp 0x18003e478
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
jmp 0x18003e225
cmp qword [0x1800e6b38], 0
je 0x18003e4a1
mov r8b, 1
mov edx, 2
xor ecx, ecx
call qword [0x1800e6b38]
mov qword [rsp + 0x90], rax
jmp 0x18003e4ad
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
cmp qword [0x1800e6b38], 0
je 0x18003e4de
mov r8b, 1
mov edx, 1
mov rcx, qword [rsp + 0x38]
call qword [0x1800e6b38]
mov qword [rsp + 0x70], rax
jmp 0x18003e4e7
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
cmp qword [0x1800e6b38], 0
je 0x18003e515
mov r8b, 3
mov edx, 0x20
mov rcx, qword [rsp + 0x38]
call qword [0x1800e6b38]
mov qword [rsp + 0x78], rax
jmp 0x18003e51e
mov qword [rsp + 0x78], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
xor eax, eax
mov word [rsp + 0x20], ax
jmp 0x18003e53e
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
cmp eax, 0xa
jge 0x18003e7b9
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
add eax, 0xa341a98
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
mov r8d, 0x11c
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.18005afd0
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov edx, 4
imul rdx, rdx, 2
lea r8, [0x18009adc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx], eax
mov eax, 4
imul rax, rax, 2
lea rcx, [0x18009adc0]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x18009adc0]
mov edx, dword [r8 + rdx]
cmp dword [rcx + rax], edx
jae 0x18003e60a
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov edx, dword [rcx + rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
mov dword [rsp + 0xb0], 0x11c
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff28b
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
mov eax, dword [0x1800e8b74]
mov dword [rsp + 0xb4], eax
mov eax, dword [0x1800e8b78]
mov dword [rsp + 0xb8], eax
movzx eax, word [rsp + 0x20]
mov word [rsp + 0x1c4], ax
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff27e
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
xor eax, eax
mov word [rsp + 0x1c6], ax
cmp qword [0x1800e75b0], 0
je 0x18003e6c4
mov r8, qword [rsp + 0x38]
mov edx, 0x23
lea rcx, [rsp + 0xb0]
call qword [0x1800e75b0]
mov dword [rsp + 0x48], eax
jmp 0x18003e6cc
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x24], eax
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
add eax, 0x33a03d4
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
cmp dword [rsp + 0x24], 0
jne 0x18003e70b
jmp 0x18003e7b9
movzx eax, word [rsp + 0x20]
mov word [0x1800e8c84], ax
mov dword [rsp + 0x5c], SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [rsp + 0x5c]
movsxd rcx, ecx
lea rdx, [0x18009adc0]
mov dword [rdx + rcx*4], eax
mov eax, 4
imul rax, rax, 1
lea rcx, [0x18009adc0]
mov edx, 4
imul rdx, rdx, 2
lea r8, [0x18009adc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx], eax
mov eax, 4
imul rax, rax, 2
lea rcx, [0x18009adc0]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x18009adc0]
mov edx, dword [r8 + rdx]
cmp dword [rcx + rax], edx
jae 0x18003e7b4
mov eax, 4
imul rax, rax, 3
lea rcx, [0x18009adc0]
mov edx, dword [rcx + rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
jmp 0x18003e531
cmp dword [rsp + 0x24], 0
je 0x18003e7ff
mov eax, 1
mov word [rsp + 0x28], ax
movsx rax, word [rsp + 0x28]
lea rcx, [0x18009adc0]
cmp dword [rcx + rax*4], 1
jne 0x18003e7ff
movsx rax, word [rsp + 0x28]
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x28]
lea rdx, [0x18009adc0]
mov dword [rdx + rcx*4], eax
jmp 0x18003e8e2
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
and rax, 0xffff
movzx eax, ax
and rax, 0xff
movzx eax, al
mov dword [0x1800e8b74], eax
mov eax, dword [rsp + 0x40]
and rax, 0xffff
movzx eax, ax
shr rax, 8
and rax, 0xff
movzx eax, al
mov dword [0x1800e8b78], eax
cmp dword [rsp + 0x40], 0x80000000
jae 0x18003e8d9
mov eax, 4
imul rax, rax, 2
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff228
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x18009adc0]
mov dword [rdx + rcx], eax
mov eax, dword [rsp + 0x40]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [0x1800e8b7c], eax
mov eax, 3
mov word [rsp + 0x30], ax
movsx rax, word [rsp + 0x30]
lea rcx, [0x18009adc0]
cmp dword [rcx + rax*4], 1
jne 0x18003e8d9
movsx rax, word [rsp + 0x30]
lea rcx, [0x18009adc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x30]
lea rdx, [0x18009adc0]
mov dword [rdx + rcx*4], eax
xor eax, eax
mov word [0x1800e8c84], ax
mov dword [0x1800a03cc], 0
lea rax, [0x1800e8b70]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.18005afa0
add rsp, 0x1e8
ret