Function at 0x18000b6f0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
lea rbp, [rax - 0x118]
sub rsp, 0x200
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x180050b58]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov dword [rbp - 0x30], 0x114
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18000b9ac
mov eax, dword [rbp - 0x2c]
cmp eax, 6
jne 0x18000b75a
cmp dword [rbp - 0x28], 2
jb 0x18000b760
mov al, 1
jmp 0x18000b9ae
ja 0x18000b9ac
lea rcx, [rsp + 0x40]
call fcn.18000aa10
nop
mov rdx, qword [rax]
mov qword [rbp - 0x70], 7
xor r12d, r12d
mov qword [rbp - 0x78], r12
mov word [rsp + 0x78], r12w
xor eax, eax
or r13, 0xffffffffffffffff
mov rcx, r13
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x78]
call fcn.180007510
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000b7c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [rbp - 0x78], 0
jne 0x18000b7d0
jmp 0x18000b99b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x38]
mov edx, 0x20008
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000b99b
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x30], r12d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov esi, 1
mov edx, esi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, dword [rsp + 0x30]
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.180008980
lea r11, [rsp + 0x30]
mov qword [rsp + 0x20], r11
mov r9d, edi
mov rbx, qword [rsp + 0x50]
mov r8, rbx
mov edx, esi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x18000b98d
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x18000b98d
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r12
mov word [rbp - 0x60], r12w
xor eax, eax
mov rcx, r13
mov rdx, qword [rsp + 0x48]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp - 0x60]
call fcn.180007510
nop
lea rdx, [rbp - 0x60]
mov r9, qword [rbp - 0x60]
mov r8, qword [rbp - 0x48]
cmp r8, 8
cmovae rdx, r9
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
mov r10, qword [rbp - 0x50]
mov rdi, r10
mov r11, qword [rbp - 0x78]
cmp r11, r10
cmovb rdi, r11
test rdi, rdi
je 0x18000b900
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18000b8fa
add rcx, 2
add rdx, 2
dec rdi
jne 0x18000b8e3
jmp 0x18000b900
cmovb esi, r13d
jmp 0x18000b903
mov esi, r12d
movsxd rax, esi
test esi, esi
jne 0x18000b91d
cmp r11, r10
jae 0x18000b914
mov eax, r13d
jmp 0x18000b91d
mov eax, r12d
cmp r11, r10
setne al
test eax, eax
sete al
test al, al
je 0x18000b963
cmp r8, 8
jb 0x18000b934
mov rcx, r9
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r12
mov word [rbp - 0x60], r12w
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
nop
cmp qword [rbp - 0x70], 8
jb 0x18000b95f
mov rcx, qword [rsp + 0x78]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov al, 1
jmp 0x18000b9ae
cmp r8, 8
jb 0x18000b971
mov rcx, r9
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r12
mov word [rbp - 0x60], r12w
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
nop
jmp 0x18000b99b
test rbx, rbx
je 0x18000b99b
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
nop
cmp qword [rbp - 0x70], 8
jb 0x18000b9ac
mov rcx, qword [rsp + 0x78]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
xor al, al
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.18002f870
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret