Function at 0x14009ef90
Capabilities:
Check os version

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x320], rbx
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r14, r8
mov rdi, rdx
xor esi, esi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x30], si
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], rsi
mov word [rbp + 0x38], si
lea rdx, [rbp + 0x38]
lea ecx, [rsi + 0x1a]
call fcn.140065820
test al, al
jne 0x14009f01c
xor r12b, r12b
jmp 0x14009f696
xor edx, edx
mov r8d, 0x11c
lea rcx, [rbp + 0xb0]
call fcn.1400c2130
mov dword [rbp + 0xb0], 0x11c
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14009f08f
mov ecx, dword [rbp + 0xb4]
cmp ecx, 6
ja 0x14009f061
jne 0x14009f095
cmp dword [rbp + 0xb8], 2
jb 0x14009f095
mov dword [rsp + 0x20], esi
mov dword [rbp + 0x30], esi
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140068550
test al, al
je 0x14009f08f
mov ecx, dword [rsp + 0x20]
mov dword [rbp + 0xb4], ecx
mov eax, dword [rbp + 0x30]
mov dword [rbp + 0xb8], eax
jmp 0x14009f095
mov ecx, dword [rbp + 0xb4]
mov r13b, 1
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x50], si
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 7
cmp ecx, 6
lea rcx, [rbp - 0x50]
jb 0x14009f1ab
xor r13b, r13b
mov r8d, 0x3e
lea rdx, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
call fcn.140006900
nop
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.1400624d0
mov rbx, rax
lea rax, [rbp - 0x30]
cmp rax, rbx
je 0x14009f11d
cmp qword [rbp - 0x18], 8
jb 0x14009f100
mov rcx, qword [rbp - 0x30]
call fcn.1400bd20c
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x30], si
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.14000b0c0
nop
cmp qword [rbp + 8], 8
jb 0x14009f12d
mov rcx, qword [rbp - 0x10]
call fcn.1400bd20c
mov qword [rbp + 8], 7
mov qword [rbp], rsi
mov word [rbp - 0x10], si
cmp qword [rbp - 0x38], 8
jb 0x14009f14d
mov rcx, qword [rbp - 0x50]
call fcn.1400bd20c
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x50], si
mov r8, rdi
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.1400624d0
mov rbx, rax
lea rax, [rbp - 0x30]
cmp rax, rbx
je 0x14009f1a6
cmp qword [rbp - 0x18], 8
jb 0x14009f189
mov rcx, qword [rbp - 0x30]
call fcn.1400bd20c
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x30], si
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.14000b0c0
nop
jmp 0x14009f291
mov r8d, 0x2a
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch_
call fcn.140006900
nop
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.1400624d0
mov rbx, rax
lea rax, [rbp - 0x30]
cmp rax, rbx
je 0x14009f208
cmp qword [rbp - 0x18], 8
jb 0x14009f1eb
mov rcx, qword [rbp - 0x30]
call fcn.1400bd20c
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x30], si
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.14000b0c0
nop
cmp qword [rbp + 8], 8
jb 0x14009f218
mov rcx, qword [rbp - 0x10]
call fcn.1400bd20c
mov qword [rbp + 8], 7
mov qword [rbp], rsi
mov word [rbp - 0x10], si
cmp qword [rbp - 0x38], 8
jb 0x14009f238
mov rcx, qword [rbp - 0x50]
call fcn.1400bd20c
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x50], si
mov r8, rdi
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.1400624d0
mov rbx, rax
lea rax, [rbp - 0x30]
cmp rax, rbx
je 0x14009f291
cmp qword [rbp - 0x18], 8
jb 0x14009f274
mov rcx, qword [rbp - 0x30]
call fcn.1400bd20c
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x30], si
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.14000b0c0
nop
cmp qword [rbp - 0x38], 8
jb 0x14009f2a1
mov rcx, qword [rbp - 0x50]
call fcn.1400bd20c
mov word [rbp - 0x50], si
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 7
mov ecx, 8
call fcn.1400bd270
mov r15, rax
mov qword [rbp + 0x30], rax
test rax, rax
je 0x14009f2d0
mov qword [rax], 0xffffffffffffffff
jmp 0x14009f2d3
mov r15, rsi
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0x98], rsi
mov word [rbp + 0x88], si
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x30]
mov rcx, r15
call fcn.14006cfa0
xor r12b, r12b
test al, al
je 0x14009f63c
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], rsi
mov word [rbp + 0x10], si
lea rdx, [rbp + 0x38]
test r13b, r13b
je 0x14009f3fd
lea r8, str.MicrosoftInternet_ExplorerQuick_Launch_
lea rcx, [rbp - 0x78]
call fcn.14000b440
nop
lea r8, [rbp + 0x88]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000d0f0
mov rbx, rax
lea rax, [rbp + 0x10]
cmp rax, rbx
je 0x14009f3b3
cmp qword [rbp + 0x28], 8
jb 0x14009f396
mov rcx, qword [rbp + 0x10]
call fcn.1400bd20c
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], rsi
mov word [rbp + 0x10], si
mov rdx, rbx
lea rcx, [rbp + 0x10]
call fcn.14000b0c0
nop
cmp qword [rsp + 0x40], 8
jb 0x14009f3c5
mov rcx, qword [rsp + 0x28]
call fcn.1400bd20c
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
cmp qword [rbp - 0x60], 8
jb 0x14009f3e8
mov rcx, qword [rbp - 0x78]
call fcn.1400bd20c
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rsi
mov word [rbp - 0x78], si
jmp 0x14009f4a4
lea r8, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
lea rcx, [rsp + 0x48]
call fcn.14000b440
nop
lea r8, [rbp + 0x88]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000d0f0
mov rbx, rax
lea rax, [rbp + 0x10]
cmp rax, rbx
je 0x14009f45c
cmp qword [rbp + 0x28], 8
jb 0x14009f43f
mov rcx, qword [rbp + 0x10]
call fcn.1400bd20c
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], rsi
mov word [rbp + 0x10], si
mov rdx, rbx
lea rcx, [rbp + 0x10]
call fcn.14000b0c0
nop
cmp qword [rbp - 0x80], 8
jb 0x14009f46d
mov rcx, qword [rsp + 0x68]
call fcn.1400bd20c
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], rsi
mov word [rsp + 0x68], si
cmp qword [rsp + 0x60], 8
jb 0x14009f491
mov rcx, qword [rsp + 0x48]
call fcn.1400bd20c
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
mov qword [rbp], rsi
mov qword [rbp + 8], rsi
mov qword [rbp + 8], 7
mov qword [rbp], rsi
mov word [rbp - 0x10], si
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x10]
call fcn.14009f710
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x50]
call fcn.1400642e0
nop
cmp qword [rbp], 0
je 0x14009f54b
mov rcx, qword [r14]
mov rax, qword [r14 + 8]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x14009f549
xor edi, edi
lea rbx, [rcx + rdi]
cmp qword [rbx + 0x18], 8
jb 0x14009f501
mov rbx, qword [rbx]
lea rcx, [rbp - 0x50]
call fcn.140006600
test rbx, rbx
jne 0x14009f517
test rax, rax
sete al
jmp 0x14009f527
test rax, rax
je 0x14009f52f
mov rdx, rax
mov rcx, rbx
call fcn.1400614f0
test al, al
jne 0x14009f5c5
inc rsi
add rdi, 0x20
mov rcx, qword [r14]
mov rax, qword [r14 + 8]
sub rax, rcx
sar rax, 5
cmp rsi, rax
jb 0x14009f4f3
xor esi, esi
lea rdx, [rbp + 0x60]
mov rcx, r15
call fcn.14006d0f0
nop
test al, al
je 0x14009f5dc
cmp qword [rbp - 0x38], 8
jb 0x14009f570
mov rcx, qword [rbp - 0x50]
call fcn.1400bd20c
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x50], si
cmp qword [rbp + 8], 8
jb 0x14009f590
mov rcx, qword [rbp - 0x10]
call fcn.1400bd20c
mov qword [rbp + 8], 7
mov qword [rbp], rsi
mov word [rbp - 0x10], si
cmp qword [rbp + 0x28], 8
jb 0x14009f5b0
mov rcx, qword [rbp + 0x10]
call fcn.1400bd20c
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], rsi
mov word [rbp + 0x10], si
jmp 0x14009f330
mov r12b, 1
cmp qword [rbp - 0x38], 8
jb 0x14009f5d8
mov rcx, qword [rbp - 0x50]
call fcn.1400bd20c
xor esi, esi
jmp 0x14009f5ec
cmp qword [rbp - 0x38], 8
jb 0x14009f5ec
mov rcx, qword [rbp - 0x50]
call fcn.1400bd20c
mov word [rbp - 0x50], si
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 7
cmp qword [rbp + 8], 8
jb 0x14009f60c
mov rcx, qword [rbp - 0x10]
call fcn.1400bd20c
mov word [rbp - 0x10], si
mov qword [rbp], rsi
mov qword [rbp + 8], 7
cmp qword [rbp + 0x28], 8
jb 0x14009f62c
mov rcx, qword [rbp + 0x10]
call fcn.1400bd20c
mov word [rbp + 0x10], si
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 7
cmp qword [rbp + 0xa0], 8
jb 0x14009f652
mov rcx, qword [rbp + 0x88]
call fcn.1400bd20c
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0x98], rsi
mov word [rbp + 0x88], si
test r15, r15
je 0x14009f692
mov rcx, qword [r15]
cmp rcx, 0xffffffffffffffff
je 0x14009f68a
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x14009f68a
mov qword [r15], 0xffffffffffffffff
mov rcx, r15
call fcn.1400bd20c
mov qword [rbp + 0x30], rsi
cmp qword [rbp + 0x50], 8
jb 0x14009f6a6
mov rcx, qword [rbp + 0x38]
call fcn.1400bd20c
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], rsi
mov word [rbp + 0x38], si
cmp qword [rbp - 0x18], 8
jb 0x14009f6c6
mov rcx, qword [rbp - 0x30]
call fcn.1400bd20c
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x30], si
movzx eax, r12b
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0x320]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret