Function at 0x1c5bf40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x134
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x134], 0xffffffff
push 0x18
call fcn.01c9515a
add esp, 4
lea esi, [ebp - 0x12c]
mov dword [esi], eax
mov dword [esi + 8], 0x8000000c
mov dword [esi + 4], 9
movzx ecx, word [0x1cea8f6]
mov word [eax + 0x10], cx
movups xmm0, xmmword [str.Software_]
movups xmmword [eax], xmm0
mov word [eax + 0x12], 0
mov eax, dword [0x1cf8bf4]
mov eax, dword [eax + 4]
push esi
push 1
push dword [eax + 8]
call fcn.01c35230
add esp, 0xc
movzx eax, byte [esi + 0xb]
mov ebx, 4
mov edi, eax
test al, al
jns 0x1c5bfdc
mov ebx, 0x7fffffff
and ebx, dword [ebp - 0x124]
dec ebx
mov edi, dword [ebp - 0x128]
mov ecx, ebx
sub ecx, edi
cmp ecx, 0x1c
jae 0x1c5c0df
lea esi, [edi + 0x1c]
mov ecx, esi
sub ecx, ebx
mov edx, 0x7ffffff6
sub edx, ebx
cmp edx, ecx
jb 0x1c5c28a
test al, al
js 0x1c5c00b
lea eax, [ebp - 0x12c]
jmp 0x1c5c011
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x138], eax
mov ecx, 0x7ffffff7
cmp ebx, 0x3ffffff2
ja 0x1c5c042
lea eax, [ebx + ebx]
cmp esi, eax
cmova eax, esi
mov ecx, 5
cmp eax, 5
jb 0x1c5c042
or eax, 3
inc eax
mov ecx, eax
js 0x1c5c297
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x13c], ecx
lea eax, [ecx + ecx]
push eax
call fcn.01c9515a
add esp, 4
mov esi, eax
test edi, edi
je 0x1c5c073
lea eax, [edi + edi]
push eax
push dword [ebp - 0x138]
push esi
call fcn.01c994a0
add esp, 0xc
movsd xmm0, qword [0x1cdf094]
movsd qword [esi + edi*2 + 0x30], xmm0
movups xmm0, xmmword [0x1cdf084]
movups xmmword [esi + edi*2 + 0x20], xmm0
movups xmm0, xmmword [0x1cdf074]
movups xmmword [esi + edi*2 + 0x10], xmm0
movups xmm0, xmmword [str.BrowserExtensionPointPolicy]
movups xmmword [esi + edi*2], xmm0
cmp ebx, 4
je 0x1c5c0b7
push dword [ebp - 0x138]
call fcn.01c95155
add esp, 4
mov dword [ebp - 0x12c], esi
mov eax, dword [ebp - 0x13c]
or eax, 0x80000000
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x128], eax
lea eax, [esi + eax*2]
jmp 0x1c5c12c
lea ecx, [edi + 0x1c]
test al, al
jns 0x1c5c0ec
mov esi, dword [ebp - 0x12c]
movsd xmm0, qword [0x1cdf094]
movsd qword [esi + edi*2 + 0x30], xmm0
movups xmm0, xmmword [0x1cdf084]
movups xmmword [esi + edi*2 + 0x20], xmm0
movups xmm0, xmmword [0x1cdf074]
movups xmmword [esi + edi*2 + 0x10], xmm0
movups xmm0, xmmword [str.BrowserExtensionPointPolicy]
movups xmmword [esi + edi*2], xmm0
js 0x1c5c142
mov eax, ecx
and al, 0x7f
mov byte [ebp - 0x121], al
lea eax, [esi + ecx*2]
mov word [eax], 0
cmp byte [ebp - 0x121], 0
jns 0x1c5c14a
mov eax, dword [ebp - 0x12c]
jmp 0x1c5c150
mov dword [ebp - 0x128], ecx
jmp 0x1c5c129
lea eax, [ebp - 0x12c]
lea ecx, [ebp - 0x130]
lea edx, [ebp - 0x134]
push ecx
push edx
push 1
push eax
push 2
call fcn.01c33be0
add esp, 0x14
mov ebx, eax
cmp byte [ebp - 0x121], 0
jns 0x1c5c184
push dword [ebp - 0x12c]
call fcn.01c95155
add esp, 4
test bl, bl
je 0x1c5c25f
mov esi, dword [ebp - 0x134]
cmp byte [0x1cf7de4], 0
je 0x1c5c28d
push esi
call sub.ntdll.dll_NtClose
lea esi, [ebp - 0x120]
push 0x110
push 0
push esi
call fcn.01c99a20
add esp, 0xc
mov dword [esi - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x1cdf0a0]
movups xmmword [esp], xmm0
mov edi, dword [sym.imp.ntdll.dll_VerSetConditionMask]
call edi
mov ebx, 3
push ebx
push 1
push edx
push eax
call edi
push ebx
push 0x20
push edx
push eax
call edi
mov dword [esi - 8], 6
mov dword [esi - 4], 2
mov word [esi + 0x108], 0
lea esi, [ebp - 0x12c]
push edx
push eax
push 0x23
push esi
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1c5c25f
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.SetProcessMitigationPolicy
push eax
call dword [sym.imp.progwrp.dll_GetProcAddress]
test eax, eax
je 0x1c5c25f
mov ecx, eax
mov dword [ebp - 0x12c], 1
call dword [0x1cef298]
push 4
push esi
push 6
call ecx
mov eax, dword [0x1cf71ac]
test eax, eax
je 0x1c5c274
cmp byte [eax + 1], 0
jne 0x1c5c29a
mov word [eax], 0x101
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
add esp, 0x134
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01c9515a
add esp, 4
mov word [eax], 0
mov dword [0x1cf71ac], eax
jmp 0x1c5c25a
int3
call fcn.01c34370
jmp 0x1c5c19f
int3
int3