Function at 0x1401f68d9
Capabilities:
Check os version

Disassembly:
test rdx, rdx
je 0x1401f6c6d
mov r11, rsp
push rsi
push rdi
sub rsp, 0x288
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [rcx + 0xc8], rdx
mov rax, qword [rdx]
mov rsi, rcx
mov qword [r11 + 0x18], rbx
mov rcx, rdx
mov rdi, rdx
mov qword [r11 - 0x18], rbp
call qword [rax + 0x30]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x78]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + 0x50]
mov rcx, rdi
mov word [rsp + 0x60], ax
mov rax, qword [rdi]
call qword [rax + 0x90]
mov rcx, rdi
mov qword [rsp + 0x68], rax
mov rax, qword [rdi]
call qword [rax + 0xf0]
test eax, eax
je 0x1401f69c6
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_336]
xor edx, edx
mov r8d, Ordinal_280
call sub.ntdll.dll_memset
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_336]
mov dword [rsp + reloc.MFC80U.DLL_Ordinal_336], Ordinal_280
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + reloc.MFC80U.DLL_Ordinal_340], 6
jb 0x1401f69c6
call fcn.140049500
lea rdx, [0x140370b28]
mov r8, qword [rax]
mov rcx, rax
call qword [r8]
lea rdx, [rsp + 0x88]
nop
nop
nop
nop
movzx ecx, word [rax]
add rdx, 2
add rax, 2
test cx, cx
mov word [rdx - 2], cx
jne 0x1401f69b0
jmp 0x1401f69e3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x48]
cmp eax, 0xb
ja 0x1401f69e3
lea rcx, [rsp + 0x88]
mov edx, eax
call fcn.1401f4420
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x58]
lea rdx, [rsp + 0xc8]
nop
nop
nop
movzx ecx, word [rax]
add rdx, 2
add rax, 2
test cx, cx
mov word [rdx - 2], cx
jne 0x1401f6a00
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x48]
cmp eax, 0xb
ja case.default.0x1401f6a35
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x1f6c70]
add rcx, rdx
jmp rcx
mov eax, 0x9b6cf2
jmp 0x1401f6a7a
mov eax, 0x9b6cf2
jmp 0x1401f6a7a
mov eax, 0xa86d00
jmp 0x1401f6a7a
mov eax, 0xbb4aaf
jmp 0x1401f6a7a
mov eax, 0x3f3f3f
jmp 0x1401f6a7a
mov eax, 0x277a81
jmp 0x1401f6a7a
mov eax, 0xa86d00
jmp 0x1401f6a7a
mov eax, 0x969696
jmp 0x1401f6a7a
mov eax, 0xa86d00
jmp 0x1401f6a7a
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x148], eax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0xb0]
xor ebp, ebp
mov rcx, rdi
mov dword [rsp + reloc.MFC80U.DLL_Ordinal_332], eax
mov rax, qword [rdi]
mov rbx, rbp
call qword [rax + 0xc0]
test eax, eax
jne 0x1401f6abe
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x70]
mov rbx, rax
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0xc0]
mov rcx, rdi
mov dword [rsi + 0xb8], eax
mov rdx, qword [rdi]
call qword [rdx + 0x70]
mov rcx, rdi
mov qword [rsi + 0xc0], rax
mov rdx, qword [rdi]
call qword [rdx + 0x88]
mov rcx, rdi
add rax, rbx
mov qword [rsp + 0x70], rax
mov rax, qword [rdi]
call qword [rax + 0x68]
mov rcx, qword [rsi + 0xc8]
add rax, rbx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x1d8], rax
mov rax, qword [rcx]
call qword [rax + 0xc0]
test eax, eax
jne 0x1401f6b39
mov rcx, qword [rsi + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x70]
sub qword [rsi + 0x1d8], rax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rbp
mov r10, qword [rax]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [r10 + 0x30]
mov ebx, dword [rsp + 0x34]
lea rcx, [rsi + 0xd8]
imul ebx, dword [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r8d, 0xf0
mov qword [rsp + 0x80], rbx
call sub.ntdll.dll_memcpy
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
call fcn.1401f4610
mov r11, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsi + 0xc8]
mov qword [rsi + 0x1c8], r11
mov qword [rsi + 0x1d0], rax
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x60]
mov rbx, qword [rsp + 0x2b0]
test eax, eax
jne 0x1401f6c16
cmp dword [rsi + reloc.MFC80U.DLL_Ordinal_452], 0x200
jne 0x1401f6c16
movabs rax, 0x100000000
cmp qword [rsi + 0x1d0], rax
jl 0x1401f6c16
mov eax, 0xffffffff
mov qword [rsi + 0x1d0], rax
mov rcx, rsi
mov dword [rsi + 0x290], 1
call fcn.1401f51f0
cmp dword [rsi + 0xb4], ebp
jne 0x1401f6c4c
mov rcx, qword [rsi + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0xd0]
test eax, eax
sete bpl
mov dword [rsi + 0x388], ebp
mov rbp, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140161080
add rsp, 0x288
pop rdi
pop rsi
ret 0