Function at 0x140003dd8
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x200
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov qword [rsp + 0x38], rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x90
call sub.msvcrt.dll_memset
xor ebx, ebx
mov dword [rsp + 0x40], 0x94
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
mov edi, ebx
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
nop dword [rax + rax]
test eax, eax
jne 0x140003e6a
mov edi, 0x4b4
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov dword [rsp + 0x20], FDICopy
jmp 0x140004111
mov eax, dword [rsp + 0x50]
mov r15d, 2
mov r9d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x44]
sub eax, 1
je 0x140003ee9
cmp eax, 1
je 0x140003e8e
mov edi, 0x4ca
jmp 0x140003e53
mov r12d, 1
movzx eax, r15w
mov dword [0x14000e22c], r12d
mov dword [0x14000e228], r12d
mov word [0x14000fef8], ax
lea ecx, [r12 + 2]
cmp edx, ecx
ja 0x140003ed8
mov eax, r12d
mov word [0x14000fef8], ax
jb 0x140003eca
jne 0x140003f07
cmp r9d, 0x33
jae 0x140003f07
mov dword [0x14000e22c], ebx
mov dword [0x14000e228], ebx
jmp 0x140003f07
cmp edx, 5
jb 0x140003f07
movzx eax, cx
mov word [0x14000fef8], cx
jmp 0x140003f07
mov r12d, 1
mov word [0x14000fef8], bx
mov dword [0x14000e22c], r12d
movzx eax, bx
mov dword [0x14000e228], r12d
cmp dword [0x14000ed94], ebx
jne 0x14000411a
mov r10, qword [rsp + 0x38]
test r10, r10
je 0x14000411a
movzx r11d, word [rsp + 0x4c]
lea rsi, [r10 + 0x40]
neg ax
mov ecx, ebx
sbb rax, rax
and rax, 0xffffffffffffffc4
add rsi, rax
mov eax, ebx
or r14d, 0xffffffff
cdqe
lea r8, [rax + rax*2]
cmp edx, dword [rsi + r8*8]
jae 0x140003f51
mov ecx, r14d
jmp 0x140003f6b
jbe 0x140003f58
mov ecx, r12d
jmp 0x140003f6b
movsxd rax, ecx
lea rcx, [rax + rax*2]
cmp r9d, dword [rsi + rcx*8 + 4]
jb 0x140003f4c
mov ecx, ebx
seta cl
cmp edx, dword [rsi + r8*8 + 0xc]
jae 0x140003f77
mov eax, r14d
jmp 0x140003f8a
jbe 0x140003f7e
mov eax, r12d
jmp 0x140003f8a
cmp r9d, dword [rsi + r8*8 + 0x10]
jb 0x140003f72
mov eax, ebx
seta al
test ecx, ecx
js 0x140004000
test eax, eax
jg 0x140004000
test ecx, ecx
jne 0x140003fb4
test eax, eax
jne 0x140003fab
mov eax, r11d
cmp r11d, dword [rsi + r8*8 + 8]
jb 0x140003fbf
cmp eax, dword [rsi + r8*8 + 0x14]
jmp 0x140003fbd
cmp r11d, dword [rsi + r8*8 + 8]
jae 0x14000401c
jmp 0x140003fbf
test eax, eax
jne 0x14000401c
cmp r11d, dword [rsi + r8*8 + 0x14]
jbe 0x14000401c
test r13d, r13d
je 0x140004005
mov r14d, ebx
mov r15, rbx
mov r9, rbx
mov edi, 0x54c
test rsi, rsi
je 0x140004083
mov r15d, dword [rsi + 0x34]
mov eax, dword [rsi + 0x30]
add r15, 0x84
add r15, r10
test r12b, al
je 0x140004075
mov r14d, 0x104
jmp 0x140004083
cmp r13d, r12d
je 0x140003fc4
inc r13d
mov dword [rsp + 0x30], r13d
mov eax, r13d
mov ecx, r13d
cmp r13d, r15d
jl 0x140003f40
cmp dword [r10 + 0x7c], ebx
je 0x14000411a
lea r9, [rsp + 0x30]
mov rcx, r10
lea rdx, [rbp - 0x20]
call fcn.140002334
test eax, eax
jne 0x14000411a
mov r10, qword [rsp + 0x38]
lea r9, [rbp - 0x20]
movsxd r13, dword [rsp + 0x30]
mov edi, 0x54d
imul rsi, r13, 0x3c
mov edx, dword [r10 + 0x80]
mov r15, rbx
add rsi, 0x84
mov r14d, ebx
add rsi, r10
add rsi, rdx
jmp 0x140003fd2
and al, 2
neg al
sbb r14d, r14d
and r14d, 0x101
test byte [0x14000ed98], r12b
jne 0x1400040fe
test r15, r15
je 0x1400040fe
cmp byte [r15], bl
je 0x1400040fe
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
nop dword [rax + rax]
call fcn.140008cb0
test eax, eax
je 0x1400040bb
call fcn.140008bd4
test eax, eax
mov eax, 0x180030
jne 0x1400040c0
mov eax, 0x30
or eax, r14d
lea r8, [0x14000f5f8]
mov r9d, eax
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop dword [rax + rax]
test r14b, 4
je 0x1400040f0
cmp eax, 6
mov ecx, ebx
cmovne ecx, edi
mov edi, ecx
jmp 0x14000411a
test r12b, r14b
je 0x14000411a
cmp eax, r12d
jne 0x14000411a
mov edi, ebx
jmp 0x14000411a
mov dword [rsp + 0x28], ebx
lea r8, [0x14000f5f8]
mov dword [rsp + 0x20], 0x30
mov edx, edi
xor ecx, ecx
call fcn.1400061d8
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140008f40
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret