Function at 0x1401a3480
Capabilities:
Check os version

Disassembly:
push rbp
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 0x700], rax
mov rax, qword [0x1411dcc48]
lea rcx, [rsp + 0x50]
mov qword [0x1411dcc40], rax
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1401a3d4f
cmp dword [rsp + 0x54], 4
jbe 0x1401a3d4f
mov rax, qword [0x1411dcc40]
test rax, rax
je 0x1401a3d4f
mov qword [rsp + 0x868], r12
lea r12, [0x1403034c8]
mov qword [rsp + 0x860], r13
lea r13, [0x1403034b8]
mov qword [rsp + 0x850], r15
xor r15d, r15d
movaps xmmword [rsp + 0x840], xmm6
xorps xmm6, xmm6
movaps xmmword [rsp + 0x830], xmm7
movsd xmm7, qword [0x1402e24c8]
movaps xmmword [rsp + 0x820], xmm8
movsd xmm8, qword [0x1402e24d0]
movaps xmmword [rsp + 0x810], xmm9
movsd xmm9, qword [0x1402e24d8]
mov qword [rsp + 0x880], rbx
mov qword [rsp + 0x888], rsi
mov qword [rsp + 0x890], rdi
mov qword [rsp + 0x858], r14
nop
movzx ecx, byte [rax + 0xb]
cmp cl, 1
je 0x1401a3582
cmp cl, 0xf
jne 0x1401a3ce2
mov rax, qword [rax + 0xc]
lea rdx, [0x1403033a0]
lea rcx, [rbp + 0x4f0]
movzx ebx, byte [rax]
mov r14d, dword [rax + 0x12f]
add bl, 0x41
movzx r8d, bl
shl r14d, 9
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rbp + 0x4f0]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401a36ff
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp + 0xf0]
mov dword [rsp + 0x28], 0x400
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x560000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1401a36ff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x20
lea ecx, [rdx - 0x1f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov ecx, dword [rbp + 0xf0]
mov edx, 0x18
mov qword [0x1411edc60], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rcx, qword [0x1411edc60]
mov r9d, r15d
mov qword [rcx + 8], rax
mov rax, qword [0x1411edc60]
mov byte [rax + 0x10], bl
mov rax, qword [0x1411edc60]
mov qword [rax], r15
mov rax, qword [0x1411edc60]
mov ecx, dword [rbp + 0xf0]
mov dword [rax + 0x14], ecx
cmp dword [rbp + 0xf0], r15d
jbe 0x1401a36ff
mov r10d, r14d
mov eax, r9d
inc r9d
lea r8, [rax + rax*2]
mov rax, qword [0x1411edc60]
mov rcx, qword [rax + 8]
mov eax, dword [rbp + r8*8 + 0xf8]
mov dword [rcx + r8*8], eax
mov rax, qword [rbp + r8*8 + 0x100]
mov rcx, qword [0x1411edc60]
cqo
idiv r10
mov rdx, qword [rcx + 8]
mov qword [rdx + r8*8 + 8], rax
mov rax, qword [rbp + r8*8 + 0x108]
add rax, qword [rbp + r8*8 + 0x100]
mov rcx, qword [0x1411edc60]
cqo
idiv r10
mov rdx, qword [rcx + 8]
mov qword [rdx + r8*8 + 0x10], rax
cmp r9d, dword [rbp + 0xf0]
jb 0x1401a3693
mov rax, qword [0x1411edc60]
test rax, rax
je 0x1401a3cdb
cmp dword [rax + 0x14], 1
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
jbe 0x1401a3768
mov byte [rcx + 0x113], 1
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
mov qword [rcx + 0x115], r15
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
mov rax, qword [rcx + 0x11d]
mov qword [rcx + 0x125], rax
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
movzx eax, byte [rcx]
mov byte [rcx + 0x114], al
jmp 0x1401a37d8
mov byte [rcx + 0x113], r15b
mov rax, qword [0x1411edc60]
mov rdx, qword [rax + 8]
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
mov rax, qword [rdx + 8]
mov qword [rcx + 0x115], rax
mov rcx, qword [0x1411edc60]
mov rax, qword [rcx + 8]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x1401a37bd
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
mov qword [rcx + 0x125], rdx
mov rcx, qword [0x1411edc60]
mov rax, qword [rcx + 8]
movzx edx, byte [rax]
mov rax, qword [0x1411dcc40]
add dl, 0x80
mov rcx, qword [rax + 0xc]
mov byte [rcx + 0x114], dl
mov edx, r14d
mov ecx, 1
mov esi, r14d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8d, r14d
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x1411dcc40]
mov r9, rdi
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
mov r10, qword [rcx + 0xc]
mov r8, qword [r10 + 0x115]
movzx edx, byte [r10 + 0x114]
mov ecx, dword [r10 + 0x12f]
call fcn.1401c1720
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
mov byte [rcx + 0x1ff], r15b
cmp byte [rdi + 0x1fe], 0x55
jne 0x1401a3979
cmp byte [rdi + 0x1ff], 0xaa
jne 0x1401a388b
lea rcx, [rdi + 3]
mov r8d, 8
lea rdx, [0x1403013b8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1401a388b
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
mov byte [rcx + 0x1ff], 1
jmp 0x1401a3979
cmp byte [rdi + 0x1fe], 0x55
jne 0x1401a3979
cmp byte [rdi + 0x1ff], 0xaa
jne 0x1401a3979
lea rcx, [rdi + 3]
mov r8d, 8
lea rdx, [0x1403013c8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1401a3979
mov rdx, rsi
lea ecx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8, rsi
xor edx, edx
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x1411dcc40]
mov r9, rbx
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
mov r10, qword [rcx + 0xc]
mov r8, qword [r10 + 0x115]
movzx edx, byte [r10 + 0x114]
add r8, 6
mov ecx, dword [r10 + 0x12f]
call fcn.1401c1720
cmp byte [rbx + 0x1fe], 0x55
jne 0x1401a3970
cmp byte [rbx + 0x1ff], 0xaa
jne 0x1401a3970
lea rcx, [rbx + 3]
mov r8d, 8
lea rdx, [0x1403013c8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1401a3970
mov r8d, 0x200
mov rdx, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401a3970
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
mov byte [rcx + 0x1ff], 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
cmp qword [rcx + 0x11d], r15
jne 0x1401a3c84
mov rax, qword [rcx + 0x125]
xorps xmm0, xmm0
sub rax, qword [rcx + 0x115]
movaps xmm1, xmm6
mov qword [rcx + 0x11d], rax
movaps xmm2, xmm6
mov rax, qword [0x1411dcc40]
movaps xmm3, xmm6
mov rcx, qword [rax + 0xc]
mov rax, qword [rcx + 0x11d]
imul rax, rsi
mov qword [rcx + 0xcb], rax
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
mov r8, qword [rcx + 0x11d]
imul r8, rsi
mov rax, r8
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cvtsi2sd xmm0, r8
test eax, eax
je 0x1401a3a09
movaps xmm1, xmm0
mulsd xmm1, xmm7
jmp 0x1401a3a31
mov rax, r8
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
test eax, eax
je 0x1401a3a29
movaps xmm2, xmm0
mulsd xmm2, xmm8
jmp 0x1401a3a31
movaps xmm3, xmm0
mulsd xmm3, xmm9
ucomisd xmm1, xmm6
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
jp 0x1401a3a8e
jne 0x1401a3a8e
ucomisd xmm2, xmm6
jp 0x1401a3a82
jne 0x1401a3a82
lea rdx, [0x1403033e8]
jmp 0x1401a3a98
lea rdx, [0x1403033e8]
movaps xmm3, xmm2
jmp 0x1401a3a98
lea rdx, [0x1403033e0]
movaps xmm3, xmm1
movaps xmm2, xmm3
lea rcx, [rbp + 0x70]
movq r8, xmm3
call fcn.140018b70
mov rax, qword [0x1411dcc40]
lea r8, [rbp + 0x70]
mov dword [rsp + 0x28], 0x20
mov r9d, 0x20
xor edx, edx
mov rcx, qword [rax + 0xc]
add rcx, 0x16f
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [0x1411dcc40]
mov rcx, r15
mov rdx, qword [rax + 0xc]
nop word [rax + rax]
movzx eax, word [rdx + rcx*2 + 0xd3]
inc rcx
cmp ax, word [r12 + rcx*2 - 2]
jne 0x1401a3b0e
cmp rcx, 5
jne 0x1401a3af0
jmp 0x1401a3ca2
mov rcx, r15
lea r8, [0x1403033d0]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2 + 0xd3]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1401a3b3e
cmp rcx, 6
jne 0x1401a3b20
jmp 0x1401a3ca2
mov rcx, r15
lea r8, [0x1403034e0]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2 + 0xd3]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1401a3b6e
cmp rcx, 6
jne 0x1401a3b50
jmp 0x1401a3ca2
mov rcx, r15
lea r8, [0x1403034f0]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2 + 0xd3]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1401a3b9e
cmp rcx, 6
jne 0x1401a3b80
jmp 0x1401a3ca2
mov rcx, r15
movzx eax, word [rdx + rcx*2 + 0xd3]
inc rcx
cmp ax, word [r13 + rcx*2 - 2]
jne 0x1401a3bbf
cmp rcx, 6
jne 0x1401a3ba1
jmp 0x1401a3ca2
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8, rsi
xor edx, edx
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x1411dcc40]
mov r9, rbx
mov dword [rsp + 0x30], r15d
xor r8d, r8d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
mov r10, qword [rcx + 0xc]
movzx edx, byte [r10]
mov ecx, dword [r10 + 0x12f]
call fcn.1401c1720
cmp byte [rbx + 0x1fe], 0x55
jne 0x1401a3c79
cmp byte [rbx + 0x1ff], 0xaa
jne 0x1401a3c79
lea rcx, [rbx + 3]
mov r8d, 4
lea rdx, [0x140301394]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1401a3c79
mov rax, qword [0x1411dcc40]
mov rdx, r12
mov rcx, qword [rax + 0xc]
add rcx, 0xd3
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
mov byte [rcx + 0x12d], 7
mov rax, qword [0x1411dcc40]
mov rcx, qword [rax + 0xc]
mov byte [rcx + 0x12e], 4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1401a3ca2
cmp byte [rcx + 0x1ff], 1
jne 0x1401a3ca2
mov rax, qword [rcx + 0x125]
sub rax, qword [rcx + 0x115]
mov qword [rcx + 0x11d], rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x1411edc60]
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x1411edc60]
mov qword [rax + 8], r15
mov rcx, qword [0x1411edc60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1411edc60], r15
mov rax, qword [0x1411dcc40]
mov rax, qword [rax]
mov qword [0x1411dcc40], rax
test rax, rax
jne 0x1401a3570
movaps xmm9, xmmword [rsp + 0x810]
movaps xmm8, xmmword [rsp + 0x820]
movaps xmm7, xmmword [rsp + 0x830]
movaps xmm6, xmmword [rsp + 0x840]
mov r15, qword [rsp + 0x850]
mov r14, qword [rsp + 0x858]
mov r13, qword [rsp + 0x860]
mov r12, qword [rsp + 0x868]
mov rdi, qword [rsp + 0x890]
mov rsi, qword [rsp + 0x888]
mov rbx, qword [rsp + 0x880]
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x870
pop rbp
ret