Function at 0x1400c9808
Capabilities:
Check os version
Set current directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3858
call fcn.1400fd8d0
sub rsp, rax
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x3840], rax
mov rdi, r9
mov qword [rsp + 0x70], r9
mov r13, r8
mov r12, rdx
mov qword [rsp + 0x58], rdx
mov rbp, rcx
mov rsi, qword [rsp + 0x38c0]
call fcn.1400d18e8
mov rcx, rax
xor r15d, r15d
mov edx, r15d
cmp rax, r15
setne dl
cmp edx, r15d
jne 0x1400c9882
mov ecx, 0x80004005
call fcn.14001cd80
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.1400d18e8
mov r11, rax
mov ecx, r15d
cmp rax, r15
setne cl
cmp ecx, r15d
jne 0x1400c98b2
mov ecx, 0x80004005
call fcn.14001cd80
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
call fcn.1400d18e8
mov r11, rax
mov ecx, r15d
cmp rax, r15
setne cl
cmp ecx, r15d
jne 0x1400c98e5
mov ecx, 0x80004005
call fcn.14001cd80
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.1400d18e8
mov r11, rax
mov ecx, r15d
cmp rax, r15
setne cl
cmp ecx, r15d
jne 0x1400c9918
mov ecx, 0x80004005
call fcn.14001cd80
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x80], rax
mov r8d, 0x104
lea rdx, [rsp + 0x3620]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x3620]
call fcn.1400e1d50
mov r8d, eax
lea rdx, [rsp + 0x3620]
lea rcx, [rsp + 0x30]
call fcn.1400a779c
mov edx, 0x5c
mov rcx, qword [rsp + 0x30]
call fcn.1400e4b88
mov rbx, rax
or r14, 0xffffffffffffffff
cmp rax, r15
je 0x1400c9a2e
sub ebx, dword [rsp + 0x30]
cmp ebx, r14d
je 0x1400c9a2e
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rcx - 0x10]
sub r8d, ebx
dec r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.1400a7668
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400a7950
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
cmp eax, r15d
jg 0x1400c99e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.1400a7708
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400a7950
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
cmp eax, r15d
jg 0x1400c9a4c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400c9a4c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400a7950
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400a7950
mov edx, 0x2e
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.1400e4b88
cmp rax, r15
je 0x1400c9abb
sub eax, ebx
cmp eax, r14d
je 0x1400c9abb
mov r8d, eax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call fcn.1400a7708
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400a7950
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
cmp eax, r15d
jg 0x1400c9ab4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x38]
jmp 0x1400c9aca
mov rbx, qword [rsp + 0x38]
jmp 0x1400c9aca
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.1400a7950
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor edx, edx
mov r8d, 0x4a0
mov rcx, rbp
call fcn.1400e1fc0
lea rcx, [rsp + 0x130]
call fcn.1400cc9ec
nop
mov r14d, r15d
xor edx, edx
mov r8d, 0x3354
lea rcx, [rsp + 0x2c0]
call fcn.1400e1fc0
lea rcx, [rsp + 0x130]
call fcn.1400cc990
mov r11, qword [0x140146510]
mov qword [rsp + 0x28], r11
lea r9, str.VEDATA
mov qword [rsp + 0x20], r9
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [rsp + 0x130]
call fcn.1400cc5f8
cmp eax, r15d
je 0x1400c9bee
lea rcx, [rsp + 0x130]
call fcn.1400cc3bc
cmp eax, 0x3354
jne 0x1400c9b89
lea rcx, [rsp + 0x138]
call fcn.1400a71b0
mov rcx, rax
mov r9d, 0x83b2aeda
mov r8d, 0x3354
lea rdx, [rsp + 0x2c0]
call fcn.1400a7470
lea rax, [rsp + 0x2c0]
mov ecx, 5
cmp dword [rax], r15d
je 0x1400c9b9e
inc r14d
add rax, 0xa09
sub rcx, 1
jne 0x1400c9b96
mov al, byte [rsp + 0x350e]
mov byte [r13], al
cmp byte [rdi], r15b
jne 0x1400c9bc7
cmp byte [rsp + 0x350d], r15b
sete al
mov byte [rdi], al
mov al, byte [rsp + 0x350f]
mov byte [rbp + 0x398], al
lea rcx, [rbp + 0x399]
mov r8d, 0x104
lea rdx, [rsp + 0x3510]
call fcn.1400e0ec0
lea rcx, [rsp + 0x130]
call fcn.1400cc990
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1400ca560
lea eax, [rax + r14 + 1]
mov dword [rsp + 0x48], eax
mov ecx, eax
mov edi, 0xa09
mov rax, rdi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400cfdfc
mov r12, rax
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.1400e0ec0
lea rcx, [r12 + 0x4d]
call fcn.1400c97f8
mov edi, r15d
mov r15d, 1
lea rsi, [rsp + 0x30c]
cmp dword [rsi - 0x4c], 0
je 0x1400c9caa
cmp byte [rsi], 0
je 0x1400c9c7e
mov eax, edi
imul rax, rax, 0xa09
lea rcx, [rsp + rax + 0x30d]
call fcn.1400c97f8
mov eax, edi
imul rax, rax, 0xa09
lea rdx, [rsp + rax + 0x2c0]
mov ecx, r15d
imul rcx, rcx, 0xa09
add rcx, r12
mov r8d, 0xa09
call fcn.1400e0ec0
inc r15d
inc edi
add rsi, 0xa09
cmp edi, 5
jb 0x1400c9c5d
lea rcx, [rbp + 0x370]
mov r8d, 0x1f
lea rdx, [rsp + 0x34ed]
call fcn.1400e2260
mov edi, dword [rsp + 0x48]
mov r8d, edi
sub r8d, r14d
dec r8d
lea edx, [r14 + 1]
imul rdx, rdx, 0xa09
add rdx, r12
mov r14, qword [rsp + 0x58]
mov rcx, r14
call fcn.1400ca560
xor r15d, r15d
cmp byte [r13], r15b
je 0x1400c9d53
mov esi, 0x94
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.1400e1fc0
mov dword [rsp + 0x90], esi
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov byte [r13], r15b
cmp dword [rsp + 0x94], 5
jne 0x1400c9d53
mov eax, dword [rsp + 0x98]
cmp eax, r15d
jbe 0x1400c9d53
cmp eax, 2
ja 0x1400c9d53
mov byte [r13], 1
mov dword [rbp + 0x10], edi
mov qword [rbp + 0x18], r12
mov al, byte [r13]
mov byte [rbp + 0x2b], al
mov rdi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x70]
cmp byte [rax], r15b
jne 0x1400c9e27
mov r8, qword [str.keymmdrv]
lea rdx, [0x14010b0c0]
lea rcx, [rsp + 0x3730]
call qword [sym.imp.USER32.dll_wsprintfA]
mov byte [rbp + 0x2a], 1
lea rsi, [rbp + 0x2c]
lea rcx, [rsi + 0x40]
mov ebp, 0x3f
mov r8, rbp
mov rdx, rbx
call fcn.1400e2260
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.1400e2260
lea rcx, [rsi + 0x80]
mov r8, rbp
mov rdx, r14
call fcn.1400e2260
lea rcx, [rsi + 0x244]
mov r8, rbp
mov rdx, qword [str.keymmdrv]
call fcn.1400e2260
lea rcx, [rsi + 0x284]
mov r8, rbp
lea rdx, [rsp + 0x3730]
call fcn.1400e2260
lea rcx, [rsi + 0x2c4]
mov r8, rbp
lea rdx, str.VE2DATA
call fcn.1400e2260
lea rcx, [rsi + 0x304]
mov r8, rbp
lea rdx, str.VE2DATA
call fcn.1400e2260
jmp 0x1400c9e2f
mov rsi, qword [rsp + 0x80]
lea rcx, [rsi + 0x140]
mov r8d, 0x103
mov rdx, qword [rsp + 0x30]
call fcn.1400e2260
nop
lea rcx, [rsp + 0x130]
call fcn.1400ccbfc
nop
lea rdx, [rdi - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
cmp eax, r15d
jg 0x1400c9e75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
cmp eax, r15d
jg 0x1400c9e96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
cmp eax, r15d
jg 0x1400c9eb7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
cmp eax, r15d
jg 0x1400c9ed7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r12
mov rcx, qword [rsp + 0x3840]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x3858
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret