Function at 0x14009b660
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9a0
mov qword [rsp + 0x120], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14028b7c8]
xor rax, rsp
mov qword [rsp + 0x990], rax
mov r13, rcx
mov qword [rsp + 0xd8], rcx
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x48], ebx
mov r12, qword [rcx + 0x110]
mov qword [rsp + 0x100], r12
cmp r12, r14
jne 0x14009b6cd
xor eax, eax
jmp 0x14009c383
mov rax, qword [r12 + 8]
mov rdi, qword [rax + 0x38]
cmp rdi, r14
jne 0x14009b6e2
xor eax, eax
jmp 0x14009c383
mov dword [rcx + 0x118], 1
mov esi, DllRegisterServer
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x4f0]
call fcn.140158a90
mov dword [rsp + 0x4f0], esi
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov rcx, r12
call fcn.140055a44
mov r15, rax
mov qword [rsp + 0xe8], rax
cmp dword [rsp + 0x4f4], 6
jb 0x14009b749
cmp dword [rsp + 0x4f4], 6
jne 0x14009b750
cmp dword [rsp + 0x4f8], 2
jae 0x14009b750
mov dword [r13 + 0x118], r14d
mov rax, qword [rdi + 0x128]
cmp rax, r14
je 0x14009c381
cmp qword [rdi + 0x118], r14
je 0x14009c381
cmp qword [rdi + 0x130], r14
je 0x14009c381
cmp qword [rdi + 0x110], r14
je 0x14009c381
cmp qword [rdi + 0x108], r14
je 0x14009c381
cmp qword [rdi + 0x190], r14
je 0x14009c381
cmp qword [rdi + 0x1a0], r14
je 0x14009c381
cmp qword [rdi + 0x1a8], r14
je 0x14009c381
cmp qword [rdi + 0x1b0], r14
je 0x14009c381
cmp qword [rdi + 0x1b8], r14
je 0x14009c381
mov r9d, 0x12
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401d4240]
call rax
mov rbp, rax
mov qword [rsp + 0xf8], rax
or rax, 0xffffffffffffffff
cmp rbp, rax
je 0x14009c37d
mov esi, r14d
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x460], 0x20
lea rax, [rsp + 0x460]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x1401d4240]
xor edx, edx
mov rcx, rbp
call qword [rdi + 0x108]
cmp eax, r14d
je 0x14009c374
mov dword [rsp + 0x460], 0x20
mov dword [rsp + 0x4c], r14d
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x460]
mov rcx, rbp
call qword [rdi + 0x118]
cmp eax, r14d
jne 0x14009c33f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14009c339
mov edx, dword [rsp + 0x4c]
lea ecx, [rax - 0x3a]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
mov qword [rsp + 0xe0], rax
mov dword [rax], 8
mov dword [rsp + 0x480], 0x20
lea rax, [rsp + 0x480]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x4c]
mov r8, r14
lea rdx, [rsp + 0x460]
mov rcx, rbp
call qword [rdi + 0x118]
test eax, eax
je 0x14009c327
mov ecx, 0x6a8
call fcn.14013f12c
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14009b912
mov rcx, rax
call fcn.14005f6d0
mov rbx, rax
jmp 0x14009b914
xor ebx, ebx
mov dword [rbx + 0x504], esi
mov dword [rsp + 0x40], 0x40
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x480]
mov rcx, rbp
call qword [rdi + 0x130]
test eax, eax
jne 0x14009b9b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14009b9b0
mov ecx, dword [rsp + 0x40]
call fcn.14013f170
mov rsi, rax
and qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x480]
mov rcx, rbp
call qword [rdi + 0x130]
test eax, eax
je 0x14009b9a8
lea rcx, [rbx + 0x20]
mov r8, rsi
mov edx, 0x100
call fcn.140044464
mov rcx, rsi
call fcn.14013f178
lea rdx, str.ven_
lea rcx, [r14 + 4]
call fcn.140158078
test rax, rax
je 0x14009b9e7
lea r8, [rsp + 0x44]
lea rdx, str.ven__X
mov rcx, rax
call fcn.1401581b0
test eax, eax
jle 0x14009b9e7
mov eax, dword [rsp + 0x44]
mov dword [rbx + 0x528], eax
lea rdx, str.dev_
lea rcx, [r14 + 4]
call fcn.140158078
test rax, rax
je 0x14009ba1e
lea r8, [rsp + 0x44]
lea rdx, str.dev__X
mov rcx, rax
call fcn.1401581b0
test eax, eax
jle 0x14009ba1e
mov eax, dword [rsp + 0x44]
mov dword [rbx + 0x52c], eax
lea rdx, str.rev_
lea rcx, [r14 + 4]
call fcn.140158078
test rax, rax
je 0x14009ba55
lea r8, [rsp + 0x44]
lea rdx, str.rev__X
mov rcx, rax
call fcn.1401581b0
test eax, eax
jle 0x14009ba55
mov eax, dword [rsp + 0x44]
mov dword [rbx + 0x530], eax
lea rdx, str.subsys_
lea rcx, [r14 + 4]
call fcn.140158078
test rax, rax
je 0x14009ba9b
lea r8, [rsp + 0x44]
lea rdx, str.subsys__X
mov rcx, rax
call fcn.1401581b0
test eax, eax
jle 0x14009ba9b
mov ecx, dword [rsp + 0x44]
movzx eax, cx
mov dword [rbx + 0x534], eax
sar ecx, 0x10
movzx eax, cx
mov dword [rbx + 0x538], eax
mov dword [rsp + 0x28], 0x200
lea rax, [rsp + 0x590]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [r14 + 4]
lea edx, [r9 + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r11, [rsp + 0x590]
mov qword [rsp + 0x90], r11
lea rcx, [rsp + 0x90]
call qword [rdi + 0x190]
test eax, eax
jne 0x14009c2ea
mov rax, qword [rsp + 0x9c]
mov qword [rbx + 0x514], rax
test r15, r15
je 0x14009bb45
mov qword [rsp + 0x108], r15
lea rcx, [rsp + 0x108]
call qword [rdi + 0x1b8]
test eax, eax
jne 0x14009bb45
mov eax, dword [rbx + 0x518]
cmp dword [rsp + 0x118], eax
jne 0x14009bb45
mov eax, dword [rbx + 0x514]
cmp dword [rsp + 0x114], eax
jne 0x14009bb45
mov dword [rbx + 0x4f8], 1
mov qword [r12 + 0x38], rbx
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 6
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rsp + 0x50]
call qword [rdi + 0x1b0]
test eax, eax
jne 0x14009bba8
mov eax, dword [rsp + 0xc8]
cmp eax, 0xffffffff
je 0x14009bba8
mov dword [rbx + 0x51c], eax
mov eax, dword [rsp + 0xcc]
mov dword [rbx + 0x520], eax
mov eax, dword [rsp + 0xd0]
mov dword [rbx + 0x524], eax
mov esi, 4
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140158a90
mov r11d, dword [rsp + 0x98]
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x54], 0xd
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], esi
lea rcx, [rsp + 0x50]
call qword [rdi + 0x1b0]
test eax, eax
jne 0x14009bbf8
mov eax, dword [rsp + 0x70]
mov dword [rbx + 0x4dc], eax
mov esi, 8
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.140158a90
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0xf0]
call fcn.140158a90
mov r11d, dword [rsp + 0x98]
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x54], 0x12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], esi
lea rcx, [rsp + 0x50]
call qword [rdi + 0x1b0]
test eax, eax
jne 0x14009bc90
mov rax, qword [rsp + 0x78]
movzx r8d, ax
shr eax, 0x10
movzx edx, word [rsp + 0x7c]
mov ecx, dword [rsp + 0x7c]
shr rcx, 0x10
movzx r9d, cx
lea rcx, [rbx + 0x480]
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea r8, str._u._u._u._u
lea edx, [rsi + 0x18]
call fcn.140044464
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 0x31
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], esi
lea rcx, [rsp + 0x50]
call qword [rdi + 0x1b0]
xor edx, edx
mov r8d, 0x328
lea rcx, [rsp + 0x130]
call fcn.140158a90
and dword [rsp + 0x130], 0
mov rax, qword [rsp + 0x9c]
mov qword [rsp + 0x134], rax
lea rcx, [rsp + 0x130]
call qword [rdi + 0x1a8]
test eax, eax
jne 0x14009c2b0
mov eax, dword [rsp + 0x14c]
mov dword [rbx + 0x50c], eax
mov eax, dword [rsp + 0x148]
mov dword [rbx + 0x508], eax
mov esi, dword [rbx + 0x50c]
mov eax, 0x48
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14013f170
mov r11, rax
test rax, rax
je 0x14009bd79
lea ecx, [rsi - 1]
xor esi, esi
cmp ecx, esi
jl 0x14009bd7e
add rax, 0x28
or rdx, 0xffffffffffffffff
mov qword [rax - 8], rsi
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov dword [rax + 0x10], edx
mov dword [rax + 0x14], edx
mov dword [rax + 0x18], edx
mov byte [rax - 0x28], sil
add rax, 0x48
sub ecx, 1
jns 0x14009bd56
jmp 0x14009bd7e
xor esi, esi
mov r11, rsi
mov qword [rbx + 0x550], r11
mov ecx, 0x48
call fcn.14013f12c
cmp rax, rsi
je 0x14009bdb2
mov qword [rax + 0x20], rsi
mov qword [rax + 0x28], rsi
mov qword [rax + 0x30], rsi
or rcx, 0xffffffffffffffff
mov dword [rax + 0x38], ecx
mov dword [rax + 0x3c], ecx
mov dword [rax + 0x40], ecx
mov byte [rax], sil
jmp 0x14009bdb5
mov rax, rsi
mov qword [rbx + 0x558], rax
lea r8, [0x1401de110]
mov edx, 0x20
mov rcx, rax
call fcn.140158644
and qword [rsp + 0xa8], 0
and qword [rsp + 0xb0], 0
and qword [rsp + 0xb8], 0
and qword [rsp + 0xc0], 0
xor esi, esi
cmp dword [rbx + 0x50c], esi
jle 0x14009c1e5
mov ebp, dword [rsp + 0xc4]
mov r12d, dword [rsp + 0xc0]
mov r13d, dword [rsp + 0xbc]
mov r14d, dword [rsp + 0xb8]
mov r15d, dword [rsp + 0xb4]
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x80], eax
xor edx, edx
lea r8d, [rdx + 0x4e]
lea rcx, [rsp + 0x4a0]
call fcn.140158a90
xor edx, edx
lea r8d, [rdx + 0x18]
lea rcx, [rsp + 0x50]
call fcn.140158a90
movzx r11d, sil
mov dword [rsp + 0x4a0], r11d
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 0x19
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], 0x4e
lea rcx, [rsp + 0x50]
call qword [rdi + 0x1b0]
test eax, eax
jne 0x14009c1af
movsxd rax, esi
lea rdx, [rax + rax*8]
mov rcx, qword [rbx + 0x550]
mov eax, dword [rsp + 0x4a4]
mov dword [rcx + rdx*8 + 0x40], eax
mov ecx, dword [rsp + 0x4a4]
test ecx, ecx
je 0x14009c175
sub ecx, 1
je 0x14009c126
sub ecx, 1
je 0x14009c0da
sub ecx, 1
je 0x14009c08e
sub ecx, 1
je 0x14009c045
sub ecx, 1
je 0x14009bffc
sub ecx, 1
je 0x14009bfb3
sub ecx, 1
je 0x14009bf69
cmp ecx, 1
jne 0x14009c1af
test ebp, ebp
jne 0x14009bf43
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, str.Crypto
lea edx, [rbp + 0x20]
call fcn.140158644
jmp 0x14009bf62
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
mov r9d, ebp
lea r8, str.Crypto__d
mov edx, 0x20
call fcn.140044464
inc ebp
jmp 0x14009c1af
test r12d, r12d
jne 0x14009bf8c
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, str.Overlay
lea edx, [r12 + 0x20]
call fcn.140158644
jmp 0x14009bfab
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
mov r9d, r12d
lea r8, str.Overlay__d
mov edx, 0x20
call fcn.140044464
inc r12d
jmp 0x14009c1af
test r13d, r13d
jne 0x14009bfd5
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, str.Copy
lea edx, [r13 + 0x20]
call fcn.140158644
jmp 0x14009bff4
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
mov r9d, r13d
lea r8, str.Copy__d
mov edx, 0x20
call fcn.140044464
inc r13d
jmp 0x14009c1af
test r14d, r14d
jne 0x14009c01e
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, str.Scene_Assembly
lea edx, [r14 + 0x20]
call fcn.140158644
jmp 0x14009c03d
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
mov r9d, r14d
lea r8, str.Scene_Assembly__d
mov edx, 0x20
call fcn.140044464
inc r14d
jmp 0x14009c1af
test r15d, r15d
jne 0x14009c067
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, str.Video_Processing
lea edx, [r15 + 0x20]
call fcn.140158644
jmp 0x14009c086
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
mov r9d, r15d
lea r8, str.Video_Processing__d
mov edx, 0x20
call fcn.140044464
inc r15d
jmp 0x14009c1af
mov r9d, dword [rsp + 0x40]
test r9d, r9d
jne 0x14009c0b5
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, str.Video_Encode
lea edx, [r9 + 0x20]
call fcn.140158644
jmp 0x14009c0d1
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, str.Video_Encode__d
mov edx, 0x20
call fcn.140044464
inc dword [rsp + 0x40]
jmp 0x14009c1af
mov r9d, dword [rsp + 0x6c]
test r9d, r9d
jne 0x14009c101
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, str.Video_Decode
lea edx, [r9 + 0x20]
call fcn.140158644
jmp 0x14009c11d
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, str.Video_Decode__d
mov edx, 0x20
call fcn.140044464
inc dword [rsp + 0x6c]
jmp 0x14009c1af
mov r9d, dword [rsp + 0x80]
test r9d, r9d
jne 0x14009c150
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, [0x1401e3b24]
lea edx, [r9 + 0x20]
call fcn.140158644
jmp 0x14009c16c
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
lea r8, str.3D__d
mov edx, 0x20
call fcn.140044464
inc dword [rsp + 0x80]
jmp 0x14009c1af
mov rax, qword [rbx + 0x550]
lea rcx, [rax + rdx*8]
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rcx
or r9d, 0xffffffff
lea r8, [rsp + 0x4a8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
inc esi
cmp esi, dword [rbx + 0x50c]
jl 0x14009be4d
mov rbp, qword [rsp + 0xf8]
mov r12, qword [rsp + 0x100]
mov r13, qword [rsp + 0xd8]
mov r14, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xe8]
and qword [rbx + 0x548], 0
and qword [rbx + 0x540], 0
xor esi, esi
cmp dword [rbx + 0x508], esi
jle 0x14009c2b0
xor edx, edx
mov r8d, 0x328
lea rcx, [rsp + 0x130]
call fcn.140158a90
mov dword [rsp + 0x130], 3
mov rax, qword [rsp + 0x9c]
mov qword [rsp + 0x134], rax
mov dword [rsp + 0x450], esi
lea rcx, [rsp + 0x130]
call qword [rdi + 0x1a8]
xor ecx, ecx
cmp eax, ecx
jne 0x14009c2a2
cmp dword [r13 + 0x118], ecx
je 0x14009c282
cmp dword [rsp + 0x170], ecx
jne 0x14009c271
mov rax, qword [rsp + 0x148]
add qword [rbx + 0x540], rax
jmp 0x14009c2a2
mov rax, qword [rsp + 0x148]
add qword [rbx + 0x548], rax
jmp 0x14009c2a2
mov eax, dword [rsp + 0x148]
cmp dword [rsp + 0x168], ecx
jne 0x14009c29b
add qword [rbx + 0x540], rax
jmp 0x14009c2a2
add qword [rbx + 0x548], rax
inc esi
cmp esi, dword [rbx + 0x508]
jl 0x14009c203
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r11, qword [rsp + 0x88]
mov qword [rbx + 0x570], r11
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x88]
mov qword [rbx + 0x560], r11
or rax, 0xffffffffffffffff
cmp dword [rbx + 0x51c], eax
je 0x14009c310
mov rdx, rbx
mov rcx, r12
call fcn.14005622c
mov ebx, 1
mov dword [rsp + 0x48], ebx
mov esi, dword [rsp + 0x68]
jmp 0x14009c32b
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov esi, dword [rsp + 0x68]
mov ebx, dword [rsp + 0x48]
jmp 0x14009c32b
mov ebx, dword [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r14d, r14d
jmp 0x14009c343
mov ebx, dword [rsp + 0x48]
jmp 0x14009c343
mov ebx, dword [rsp + 0x48]
inc esi
mov dword [rsp + 0x68], esi
lea rax, [rsp + 0x460]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [0x1401d4240]
xor edx, edx
mov rcx, rbp
call qword [rdi + 0x108]
cmp eax, r14d
jne 0x14009b83f
mov rcx, rbp
call qword [rdi + pe_nt_image_headers64]
mov eax, ebx
jmp 0x14009c383
xor eax, eax
mov rcx, qword [rsp + 0x990]
xor rcx, rsp
call fcn.140156fd0
lea r11, [rsp + 0x9a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret