Function at 0x140003b17
Capabilities:
Check os version

Disassembly:
push rbp
push rdi
sub rsp, 0x378
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x310], rcx
mov dword [rbp + 0x2ec], 0xc0000225
mov dword [rbp + 0x2e8], 0
movabs rax, 0xf38b4c2f8945f633
mov qword [rbp + 0x2dc], rax
mov dword [rbp + 0x2e4], 0x840fff85
movabs rax, 0xc1485b0c8d48de8b
mov qword [rbp + 0x2cf], rax
movabs rax, 0x58d4805e1c1485b
mov qword [rbp + 0x2d4], rax
movabs rax, 0xf38b4c378941ff33
mov qword [rbp + 0x2c3], rax
mov dword [rbp + 0x2cb], 0x74c08545
movabs rdi, 0xf38b48378945ff33
mov qword [rbp + 0x2b7], rdi
mov dword [rbp + 0x2bf], 0x74c98545
mov qword [rbp + 0x2ab], rax
mov dword [rbp + 0x2b3], 0x74c98545
movabs rax, 0x8bff8b4c24348945
mov qword [rbp + 0x29e], rax
movabs rax, 0x74c08545f38bff8b
mov qword [rbp + 0x2a3], rax
movabs rax, 0xf38bf78b4c378945
mov qword [rbp + 0x291], rax
movabs rax, 0x840fc08545f38bf7
mov qword [rbp + 0x296], rax
lea rdx, [rbp - 0x40]
mov eax, 0
mov ecx, 0x5a
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x40], 0x1db0
mov dword [rbp - 0x38], 0xc
lea rax, [rbp + 0x2dc]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x18], 0x13
mov dword [rbp - 0x14], 0xfffffffc
mov dword [rbp + 0x10], 0x23f0
mov dword [rbp + 0x18], 0xc
lea rax, [rbp + 0x2c3]
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x38], 0x10
mov dword [rbp + 0x3c], 0xfffffffc
mov dword [rbp + 0x60], 0x2580
mov dword [rbp + 0x68], 0xd
lea rax, [rbp + 0x2cf]
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x88], 0x24
mov dword [rbp + 0x8c], 0xfffffffa
mov dword [rbp + 0xb0], 0x2800
mov dword [rbp + 0xb8], 0xc
lea rax, [rbp + 0x2c3]
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xd8], 0x10
mov dword [rbp + 0xdc], 0xfffffffc
mov dword [rbp + 0x100], 0x3ad7
mov dword [rbp + 0x108], 0xc
lea rax, [rbp + 0x2b7]
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x128], 0x17
mov dword [rbp + 0x12c], 0xfffffffc
mov dword [rbp + 0x150], 0x42ee
mov dword [rbp + 0x158], 0xc
lea rax, [rbp + 0x2ab]
mov qword [rbp + 0x160], rax
mov dword [rbp + 0x178], 0x17
mov dword [rbp + 0x17c], 0xfffffffc
mov dword [rbp + 0x1a0], 0x47ba
mov dword [rbp + 0x1a8], 0xc
lea rax, [rbp + 0x2c3]
mov qword [rbp + 0x1b0], rax
mov dword [rbp + 0x1c8], 0x17
mov dword [rbp + 0x1cc], 0xfffffffc
mov dword [rbp + 0x1f0], 0x4f7c
mov dword [rbp + 0x1f8], 0xd
lea rax, [rbp + 0x29e]
mov qword [rbp + 0x200], rax
mov dword [rbp + 0x218], 0x18
mov dword [rbp + 0x21c], 0xfffffffc
mov dword [rbp + 0x240], 0x585c
mov dword [rbp + 0x248], 0xd
lea rax, [rbp + 0x291]
mov qword [rbp + 0x250], rax
mov dword [rbp + 0x268], 0x1b
mov dword [rbp + 0x26c], 0xfffffffc
mov rax, qword [rbp + 0x310]
mov qword [rax], 0
lea r8, [0x140018128]
lea rax, [0x140018124]
mov rdx, rax
lea rax, [0x140018120]
mov rcx, rax
call sub.ntdll.dll_RtlGetNtVersionNumbers
mov eax, dword [0x140018128]
and eax, 0x7fff
mov dword [0x140018128], eax
mov eax, dword [0x140018128]
cmp eax, 0x1388
jbe 0x140003f6c
mov eax, dword [0x140018120]
cmp eax, 5
jbe 0x140003f6c
lea rax, [rbp + 0x2e8]
mov rcx, rax
call fcn.140002aa4
test eax, eax
je 0x140003f6c
mov eax, dword [rbp + 0x2e8]
mov r8d, eax
mov edx, 0
mov ecx, 0x1010
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov rdx, qword [rbp + 0x310]
mov qword [rdx], rax
mov rax, qword [rbp + 0x310]
mov rax, qword [rax]
test rax, rax
je 0x140003f6c
mov rax, qword [rbp + 0x310]
mov rax, qword [rax]
cmp rax, 0xffffffffffffffff
je 0x140003f6c
mov rax, qword [rbp + 0x310]
mov rax, qword [rax]
mov rcx, rax
call fcn.140001cb4
call fcn.140002bc7
test eax, eax
js 0x140003f6c
mov rax, qword [rbp + 0x310]
mov rax, qword [rax]
mov rcx, rax
call fcn.140002f05
test eax, eax
je 0x140003f6c
mov r8d, dword [0x140010010]
mov rdx, qword [0x140010008]
mov rax, qword [rbp + 0x310]
mov rax, qword [rax]
lea r9, [rbp - 0x40]
lea rcx, [0x140018118]
mov qword [rsp + 0x30], rcx
lea rcx, [0x140018110]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 9
mov rcx, rax
call fcn.1400033ab
test eax, eax
je 0x140003f5d
mov rax, qword [rbp + 0x310]
mov rax, qword [rax]
mov rcx, rax
call fcn.14000377e
mov dword [rbp + 0x2ec], eax
cmp dword [rbp + 0x2ec], 0
jns 0x140003f6c
mov eax, dword [rbp + 0x2ec]
mov edx, eax
lea rax, str.___Key_import__08x_n
mov rcx, rax
call fcn.1400029ae
jmp 0x140003f6c
lea rax, str.filead_n
mov rcx, rax
call fcn.1400029ae
mov eax, dword [rbp + 0x2ec]
add rsp, 0x378
pop rdi
pop rbp
ret