Function at 0x4b1680
Capabilities:
Check os version
Query environment variable

Disassembly:
push r15
mov eax, 0x2048
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0056fc10
sub rsp, rax
mov rbx, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbx]
mov qword [rsp + 0x2038], rax
xor eax, eax
mov eax, dword [0x005765dc]
mov qword [rsp + 0x20], rcx
mov rbp, rcx
mov r12, rdx
test eax, eax
jne 0x4b17e0
xor r13d, r13d
test rbp, rbp
je 0x4b16ec
mov ecx, 0xa
lea rdi, [0x00590cd1]
mov rsi, rbp
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x4b18f0
mov edx, 1
mov rcx, rbp
call fcn.004aed50
test eax, eax
je 0x4b1910
lea r14, [rsp + 0x30]
mov rdx, rbp
mov r9d, 0xffffffff
mov r8d, 0x1000
mov rcx, r14
mov edi, dword [0x00605de8]
call fcn.004ad7d0
mov edx, eax
test eax, eax
js 0x4b1948
mov r9d, edi
mov r8d, 0x104
mov rcx, r14
call fcn.004af110
test eax, eax
js 0x4b18df
lea r15, [rsp + 0x28]
mov r9d, 0xffffffff
mov r8d, 4
mov rdx, r12
mov rcx, r15
call fcn.004ad7d0
test eax, eax
js 0x4b18df
test r13d, r13d
je 0x4b18b0
xor edx, edx
mov rcx, rbp
call fcn.004af370
test eax, eax
je 0x4b19a8
mov rdx, r15
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wfopen]
mov r12, rax
test rax, rax
je 0x4b18d0
mov edx, 1
mov rcx, r14
call fcn.004ac300
test eax, eax
jne 0x4b1990
nop word [rax + rax]
mov rax, qword [rsp + 0x2038]
xor rax, qword [rbx]
jne 0x4b1a01
mov rax, r12
add rsp, 0x2048
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x20]
call fcn.004b55a0
mov rax, qword [rsp + 0x20]
movzx edx, byte [rax]
test dl, dl
je 0x4b16c6
mov rdi, rax
jmp 0x4b1819
mov rdx, rax
cmp ecx, 0x5c
je 0x4b1828
add rax, 1
mov qword [rsp + 0x20], rax
movzx edx, byte [rdx + 1]
test dl, dl
je 0x4b1850
movsx ecx, dl
cmp dl, 0x2f
jne 0x4b1800
nop dword [rax]
add rax, 1
mov qword [rsp + 0x20], rax
movsx ecx, byte [rax]
cmp cl, 0x2f
je 0x4b1828
cmp ecx, 0x5c
je 0x4b1828
test cl, cl
je 0x4b1850
mov rdi, rax
mov rdx, rax
jmp 0x4b1808
mov eax, dword [0x005765dc]
cmp eax, 1
je 0x4b19d8
cmp eax, 2
jne 0x4b1970
mov r8d, 4
mov rdx, rdi
lea rcx, str..git
call qword [sym.imp.msvcrt.dll__strnicmp_2]
test eax, eax
jne 0x4b16c6
movzx eax, byte [rdi + 4]
mov r13d, 1
test al, al
je 0x4b16c9
cmp al, 0x2f
sete r13b
cmp al, 0x5c
sete al
or r13d, eax
movzx r13d, r13b
jmp 0x4b16c9
mov rdx, r15
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wfopen]
mov r12, rax
test rax, rax
jne 0x4b17b8
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
je 0x4b19f0
xor r12d, r12d
jmp 0x4b17b8
lea r14, [rsp + 0x30]
lea rdx, [0x00590cdc]
mov rcx, r14
call sub.msvcrt.dll_wcscpy
jmp 0x4b1746
mov edi, 2
test r12, r12
je 0x4b1933
mov edx, 0x77
mov rcx, r12
call sub.msvcrt.dll_strchr
cmp rax, 1
sbb edi, edi
and edi, 0xffffffec
add edi, 0x16
call qword [sym.imp.msvcrt.dll__errno]
xor r12d, r12d
mov dword [rax], edi
jmp 0x4b17b8
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
cmp dword [rax], 0x22
jne 0x4b18df
call rsi
xor r12d, r12d
mov dword [rax], 0x26
jmp 0x4b17b8
mov r8d, 0x25d
lea rdx, str.compat_mingw.c
lea rcx, str.hide_dotfiles__HIDE_DOTFILES_DOTGITONLY
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x4b1868
mov rdx, rbp
lea rcx, str.could_not_mark__s_as_hidden.
call fcn.00494a30
jmp 0x4b17b8
xor edx, edx
mov rcx, r14
call fcn.004ac300
test eax, eax
je 0x4b1785
mov rdx, rbp
lea rcx, str.could_not_unhide__s
xor r12d, r12d
call fcn.00494950
jmp 0x4b17b8
xor r13d, r13d
cmp byte [rdi], 0x2e
sete r13b
jmp 0x4b16c9
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 2
jmp 0x4b18df
call sub.libssp_0.dll___stack_chk_fail
nop
nop word [rax + rax]