Function at 0x140029c90
Capabilities:
Check os version

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov rsi, rcx
lea rdx, [0x1400b2583]
lea rcx, [rsp + 0x90]
mov r8d, 0xb
call fcn.140080100
movzx eax, byte [rsp + 0xa8]
cmp al, 2
je 0x14002c00f
mov rdi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
lea r13, [rsp + 0xa9]
test al, al
je 0x140029f7f
lea rdx, str.AppDataRoamingMicrosoft
lea rcx, [rsp + 0x90]
mov r8d, 0x19
call fcn.14000fa90
mov r14, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x130]
mov rdx, rdi
mov r8, rbx
mov r9, r14
call fcn.140086540
cmp qword [rsp + 0x98], 0
je 0x140029d5a
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x140029d71
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1400b2583]
lea rcx, [rsp + 0x90]
mov r8d, 0xb
call fcn.140080100
movzx eax, byte [rsp + 0xa8]
cmp al, 2
je 0x14002c016
mov rdi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
test al, al
je 0x14002a017
lea rdx, str.AppDataRoamingMicrosoftProtect
lea rcx, [rsp + 0x90]
mov r8d, 0x21
call fcn.14000fa90
mov r14, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x108]
mov rdx, rdi
mov r8, rbx
mov r9, r14
call fcn.140086540
cmp qword [rsp + 0x98], 0
je 0x140029e1d
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x140029e34
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1400b2583]
lea rcx, [rsp + 0x90]
mov r8d, 0xb
call fcn.140080100
movzx eax, byte [rsp + 0xa8]
cmp al, 2
je 0x14002c01d
mov rdi, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
test al, al
je 0x14002a0b7
lea rdx, str.AppDataRoamingMicrosoftProtectS_3_5_25_0067212291_1140412766_535520311_1000
lea r14, [rsp + 0x90]
mov r8d, 0x4f
mov rcx, r14
call fcn.14000fa90
mov r15, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.140086540
cmp qword [rsp + 0x98], 0
je 0x140029ee0
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
test r12, r12
je 0x140029ef7
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
movups xmm0, xmmword [rsp + 0x130]
movups xmm1, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [rsp + 0x108]
movups xmm1, xmmword [rsp + 0x118]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm1
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm1
mov eax, dword [0x1400f92c4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x14002a157
add rax, 0x110
jmp 0x14002a15c
test rbx, rbx
je 0x140029cf8
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x140029fac
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop dword [rax]
mov rdx, rcx
cmp rcx, rax
je 0x140029cf8
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140029fa0
cmp r8b, 0xe0
jb 0x140029f91
cmp r8b, 0xed
jne 0x140029fee
cmp rcx, rax
je 0x140029cf8
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140029cf8
cmp byte [rdx + 1], 0x9f
ja 0x14002c0a1
add rdx, 3
mov rcx, rdx
jmp 0x140029fa0
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140029fa0
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140029fa0
test rbx, rbx
je 0x140029dbb
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x14002a04c
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop word cs:[rax + rax]
mov rdx, rcx
cmp rcx, rax
je 0x140029dbb
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x14002a040
cmp r8b, 0xe0
jb 0x14002a029
cmp r8b, 0xed
jne 0x14002a08e
cmp rcx, rax
je 0x140029dbb
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140029dbb
cmp byte [rdx + 1], 0x9f
ja 0x14002c0f4
add rdx, 3
mov rcx, rdx
jmp 0x14002a040
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x14002a040
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x14002a040
test rbx, rbx
je 0x140029e7e
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x14002a0ec
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop word cs:[rax + rax]
mov rdx, rcx
cmp rcx, rax
je 0x140029e7e
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x14002a0e0
cmp r8b, 0xe0
jb 0x14002a0c9
cmp r8b, 0xed
jne 0x14002a12e
cmp rcx, rax
je 0x140029e7e
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140029e7e
cmp byte [rdx + 1], 0x9f
ja 0x14002c147
add rdx, 3
mov rcx, rdx
jmp 0x14002a0e0
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x14002a0e0
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x14002a0e0
call fcn.1400686f0
mov rax, qword [rax]
mov r8, qword [rax + 0x210]
lea rax, [rsp + 0xf7]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 3
mov ecx, 3
mov r9d, 1
xor edx, edx
call fcn.140011fa0
cmp qword [rsp + 0x98], 0
je 0x14002a1b5
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1400f91f8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xb8], 0
je 0x14002a1d7
mov r8, qword [rsp + 0xb0]
mov rcx, qword [0x1400f91f8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xd8], 0
je 0x14002a1f9
mov r8, qword [rsp + 0xd0]
mov rcx, qword [0x1400f91f8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1400b2583]
lea rcx, [rsp + 0x90]
mov r8d, 0xb
call fcn.140080100
movzx eax, byte [rsp + 0xa8]
cmp al, 2
je 0x14002c024
mov rdi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
test al, al
je 0x14002aa6a
test rbx, rbx
je 0x14002a243
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x14002aa9c
mov al, 2
jmp 0x14002c0b3
mov al, 2
jmp 0x14002c106
mov al, 2
jmp 0x14002c159
mov al, 2
jmp 0x14002c1b2
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0x63], ecx
mov dword [rsp + 0x60], eax
xor eax, eax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r15
mov qword [rsp + 0xa0], rbx
mov byte [rsp + 0xa8], al
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x63]
mov dword [rsp + 0xa9], eax
mov dword [rsp + 0xac], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x14002c395
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0x63], ecx
mov dword [rsp + 0x60], eax
xor eax, eax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r15
mov qword [rsp + 0xa0], rbx
mov byte [rsp + 0xa8], al
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x63]
mov dword [rsp + 0xa9], eax
mov dword [rsp + 0xac], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x14002c395
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0x63], ecx
mov dword [rsp + 0x60], eax
xor eax, eax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], rbx
mov byte [rsp + 0xa8], al
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x63]
mov dword [rsp + 0xa9], eax
mov dword [rsp + 0xac], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x14002c395