Function at 0x14002a7b0
Capabilities:
Check os version

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140062018]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [r8], 0xffffffffffffffff
mov ecx, dword [rcx + 0x18]
test cl, 3
je 0x14002a82c
lea rbx, [rsp + 0x24]
mov r8d, 0x110
mov rcx, rbx
xor edx, edx
call sub.ntdll.dll_memset
mov dword [rbx - 4], 0x114
lea rcx, [rsp + 0x20]
call sub.ntdll.dll_RtlGetVersion
test eax, eax
js 0x14002a927
mov ecx, dword [rsi + 0x18]
test cl, 2
jne 0x14002a92e
test cl, 1
jne 0x14002a949
test cl, 8
je 0x14002a840
xor ebx, ebx
test byte [0x140062a88], 1
je 0x14002a979
test cl, 0x40
je 0x14002a854
xor ebx, ebx
test byte [0x140062a88], 4
je 0x14002a979
test cl, 0x80
je 0x14002a868
xor ebx, ebx
test byte [0x140062a88], 8
je 0x14002a979
bt ecx, 8
jae 0x14002a87d
xor ebx, ebx
test byte [0x140062a88], 0x10
je 0x14002a979
test cl, 0x10
je 0x14002a891
xor ebx, ebx
test byte [0x140062a88], 1
jne 0x14002a979
mov rdx, qword [rsi + 0x10]
cmp rdx, 0xffffffffffffffff
je 0x14002a964
mov rax, qword [rdi + 0x10]
mov ebx, 2
test rax, rax
je 0x14002a979
mov rbp, qword [rdi + 8]
test cl, 4
jne 0x14002a96b
mov ecx, dword [rbp + 0x84]
cmp ecx, 0x10
mov edx, 0x10
cmovb edx, ecx
cmp edx, 3
jb 0x14002a979
mov r15, qword [rdi]
test r15, r15
je 0x14002a979
mov r10d, dword [rbp + 0x98]
lea r9, [r15 + r10]
cmp r9, rax
ja 0x14002a979
movzx ebp, word [r9 + 0xe]
test rbp, rbp
je 0x14002a979
movzx ecx, word [r9 + 0xc]
lea rdi, [r10 + rcx*8]
lea rdx, [r15 + rdi]
add rdx, 0x14
xor ecx, ecx
cmp word [rdx + rcx*8 - 4], 0x10
je 0x14002a99b
inc rcx
cmp rbp, rcx
jne 0x14002a915
jmp 0x14002a979
mov ebx, 2
jmp 0x14002a979
xor ebx, ebx
cmp dword [rsp + 0x24], 6
ja 0x14002a979
jne 0x14002a823
cmp dword [rsp + 0x28], 2
ja 0x14002a979
jmp 0x14002a823
xor ebx, ebx
cmp dword [rsp + 0x24], 6
ja 0x14002a979
jne 0x14002a82c
cmp dword [rsp + 0x28], 2
jae 0x14002a979
jmp 0x14002a82c
mov ebx, 3
jmp 0x14002a979
mov eax, dword [rbp + 8]
xor ecx, ecx
cmp rdx, rax
setae cl
lea ebx, [rcx + rcx*2]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14002fae0
mov eax, ebx
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
add rdi, r15
mov ebp, dword [rdi + rcx*8 + 0x14]
test ebp, ebp
jns 0x14002a979
and ebp, 0x7fffffff
lea rcx, [r9 + rbp]
cmp rcx, r15
jb 0x14002a979
cmp rcx, rax
ja 0x14002a979
movzx r8d, word [rcx + 0xe]
test r8, r8
je 0x14002a979
movzx ecx, word [rcx + 0xc]
lea rdx, [r10 + rcx*8]
add rdx, rbp
lea rbp, [r15 + rdx]
add rbp, 0x14
xor ecx, ecx
cmp word [rbp + rcx*8 - 4], 1
je 0x14002a9eb
inc rcx
cmp r8, rcx
jne 0x14002a9d9
jmp 0x14002a979
add rdx, r15
mov ecx, dword [rdx + rcx*8 + 0x14]
test ecx, ecx
jns 0x14002a979
and ecx, 0x7fffffff
add rcx, r9
xor ebp, ebp
cmp rcx, rax
mov rdx, rcx
cmova rdx, rbp
cmp rcx, r15
cmovb rdx, rbp
movzx ecx, word [rdx + 0xc]
add cx, word [rdx + 0xe]
je 0x14002a979
mov ecx, dword [rdx + 0x14]
test ecx, ecx
js 0x14002a979
add r9, rcx
cmp r9, r15
jb 0x14002a979
cmp r9, rax
ja 0x14002a979
mov ecx, dword [r9]
add r15, rcx
cmp r15, rax
ja 0x14002a979
movzx ebp, word [r15]
cmp bp, 0x26
jb 0x14002a979
movaps xmm0, xmmword [0x1400558a0]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x10], xmm0
movaps xmm0, xmmword [0x140055890]
movaps xmmword [rdx], xmm0
lea rcx, [r15 + 6]
mov r8d, 0x10
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, 0x10
jne 0x14002a979
cmp word [r15 + 2], 0x34
jne 0x14002a979
mov eax, 2
sub eax, r15d
and eax, 3
add rax, 0x26
cmp ax, bp
jae 0x14002a979
cmp dword [rax + r15], 0xfeef04bd
jne 0x14002a979
mov ecx, dword [r15 + rax + 8]
mov eax, dword [r15 + rax + 0xc]
shl rcx, 0x20
or rax, rcx
mov qword [r14], rax
xor ecx, ecx
cmp qword [rsi + 0x10], rax
jmp 0x14002a973