Function at 0x1400185b0
Capabilities:
Check os version

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140300b88]
xor rax, rsp
mov qword [rbp + 0x190], rax
xorps xmm0, xmm0
mov byte [rsp + 0x30], 0
xor eax, eax
mov r13, rcx
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0xd0], rax
mov ebx, 6
mov r8b, 3
mov qword [rbp + 0xd4], rax
lea edx, [rax + 2]
mov dword [rbp + 0x44], ebx
xor ecx, ecx
mov dword [rbp + 0x48], 1
mov r12, r9
xor esi, esi
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rbx - 5]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rbx + 0x1a]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rbx + 0xa]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
lea edx, [rbx + 0x2d]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
jne 0x140018691
lea eax, [rbx - 2]
jmp 0x140018d13
mov qword [rsp + 0x2a0], r15
test r13, r13
je 0x140018d7b
test r12, r12
je 0x140018d7b
mov r15, qword [rbp + 0x200]
lea rax, [r15 - 1]
cmp rax, 0xff
ja 0x140018d7b
cmp word [str.SafeStore.db], si
je 0x140018d7b
lea rdx, str.____:
lea rcx, str.SafeStore.db
call fcn.140219a64
test rax, rax
jne 0x140018d7b
lea rcx, str.C:ProgramDataSophosSafestore
call fcn.140024480
test al, al
je 0x140018d7b
lea rcx, str.C:ProgramDataSophosSafestore
call fcn.140024610
test al, al
je 0x140018d7b
mov qword [rsp + 0x2e8], rdi
mov edx, 0xd8
mov ecx, 1
mov qword [rsp + 0x2a8], r14
call fcn.1402122f4
mov rdi, rax
test rax, rax
je 0x140018d36
lea rcx, str.C:ProgramDataSophosSafestore
call fcn.1402186b0
mov qword [rdi + 8], rax
test rax, rax
je 0x140018d36
cmp word [rax + 0x3c], 0x5c
jne 0x140018762
mov word [rax + 0x3c], si
lea rcx, str.SafeStore.db
call fcn.1402186b0
mov qword [rdi + 0x10], rax
test rax, rax
je 0x140018d36
lea rdx, str.SafeStore.db
lea rcx, str.C:ProgramDataSophosSafestore
call fcn.1400246f0
mov qword [rdi + 0x18], rax
mov rsi, rax
test rax, rax
je 0x140018d36
mov edx, 0x18
lea ecx, [rdx - 0x17]
call fcn.1402122f4
mov r14, rax
test rax, rax
je 0x140018d36
mov rcx, rsi
call fcn.1402186b0
mov qword [r14 + 8], rax
test rax, rax
jne 0x1400187dc
xor ecx, ecx
call fcn.1402122e0
mov rcx, r14
call fcn.14001c820
jmp 0x140018d36
mov qword [rdi], r14
lfence
lea rsi, [rdi + 0x78]
mov r8, r15
mov r9, rsi
mov rdx, r12
mov rcx, r14
call fcn.14001e820
lea r10, str.ThreatObjectTable
mov ebx, eax
lea r11, str.BlobTable
test eax, eax
jne 0x140018a7f
lea rax, [rdi + 0x90]
test rax, rax
je 0x14001883d
cmp qword [rax], 1
jl 0x14001883d
jne 0x140018833
cmp qword [rax + 8], 6
jl 0x14001883d
jne 0x140018833
cmp qword [rax + 0x10], 5
jle 0x14001883d
mov ebx, 5
jmp 0x140018d36
test rsi, rsi
je 0x140018aa6
mov rcx, qword [rsi]
mov r9, qword [rsi + 0x10]
mov rax, qword [rsi + 8]
lea r8, [rcx - 1]
lea rdx, [r9 - 1]
test r8, r8
jne 0x14001886c
test rax, rax
jne 0x140018892
test rdx, rdx
je 0x140018aa6
jns 0x140018aa6
mov r14, qword [rdi]
xor r15d, r15d
mov ebx, r15d
test r14, r14
je 0x140018d31
test rcx, rcx
jns 0x140018899
lea ebx, [r15 + 5]
jmp 0x140018d36
js 0x140018872
jmp 0x140018aa6
movsd xmm1, qword [rsi + 0x10]
movsd qword [rsp + 0x50], xmm1
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x40], xmm0
cmp rcx, 1
jne 0x140018a27
test rax, rax
jne 0x140018a27
test r9, r9
jne 0x140018a27
mov dword [rsp + 0x68], ecx
lea rax, str.ThreatObjectTable_Index
mov qword [rbp - 0x78], rax
lea rcx, str.objectid
lea rax, str.datetime
mov qword [rbp - 0x60], rcx
mov qword [rsp + 0x60], rax
lea rdx, [rbp - 0x80]
lea rax, str.StringPropertyTable
mov qword [rbp + 0xe0], rcx
mov rcx, qword [r14]
mov qword [rbp - 0x40], rax
lea rax, str.StringPropertyTable_Index
mov qword [rbp - 0x38], rax
lea rax, str.BlobTable_Index
mov qword [rbp + 8], rax
lea rax, str.originalchecksum
mov qword [rbp - 0x20], rax
lea rax, str.BlobPropertyTable
mov qword [rbp + 0x20], rax
lea rax, str.BlobPropertyTable_Index
mov qword [rbp + 0x28], rax
lea rax, str.blobid
mov qword [rbp + 0xf0], rax
lea rax, [rsp + 0x60]
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x80], r10
mov dword [rbp - 0x70], 2
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x78], r15d
mov dword [rbp - 0x30], 2
mov dword [rbp - 0x58], 1
mov qword [rbp - 0x50], r15
mov dword [rbp - 0x48], r15d
mov qword [rbp], r11
mov dword [rbp + 0x10], 2
mov dword [rbp - 0x18], 1
mov qword [rbp - 0x10], r15
mov dword [rbp - 8], r15d
mov dword [rbp + 0x30], 2
mov dword [rbp + 0xe8], 1
mov dword [rbp + 0xf8], 1
mov qword [rbp + 0x100], r15
mov dword [rbp + 0x108], r15d
call fcn.14002ea00
test eax, eax
jne 0x140018a22
mov rcx, qword [r14]
lea rax, [rbp - 0x60]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x28], rax
call fcn.14002ea00
test eax, eax
jne 0x140018a22
mov rcx, qword [r14]
lea rax, [rbp - 0x20]
lea rdx, [rbp]
mov qword [rbp + 0x18], rax
call fcn.14002ea00
test eax, eax
jne 0x140018a22
mov rcx, qword [r14]
lea rax, [rbp + 0xe0]
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x38], rax
call fcn.14002ea00
test eax, eax
jne 0x140018a22
mov qword [rsp + 0x50], 1
jmp 0x140018a27
mov ebx, 7
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
sub rcx, qword [rsp + 0x48]
sub rdx, qword [rsp + 0x50]
mov rax, qword [rsi]
cmp rax, qword [rsp + 0x40]
jne 0x140018a4d
test rcx, rcx
jne 0x140018a4d
test rdx, rdx
je 0x140018a75
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, r14
call fcn.14001e470
movups xmm0, xmmword [rsp + 0x40]
test ebx, ebx
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rsi], xmm0
cmove ebx, eax
movsd qword [rsi + 0x10], xmm1
test ebx, ebx
jne 0x140018d36
jmp 0x140018aa9
cmp eax, 8
jne 0x140018d36
lfence
mov rcx, qword [rdi]
mov r9, rsi
mov r8, r15
mov rdx, r12
call fcn.14001c890
mov ebx, eax
test eax, eax
jne 0x140018d36
xor r15d, r15d
mov rcx, qword [rdi]
call fcn.140024340
mov ebx, eax
test eax, eax
jne 0x140018d36
mov rcx, rdi
mov byte [rsp + 0x30], 1
call fcn.140018510
mov ebx, eax
test eax, eax
jne 0x140018d36
mov rax, qword [rdi]
lea r14, [rdi + 0x28]
test rax, rax
je 0x140018d31
test r14, r14
je 0x140018d31
mov rbx, qword [rax]
test rbx, rbx
je 0x140018bc6
mov ecx, 0x20
call fcn.1402122d0
mov rsi, rax
test rax, rax
je 0x140018bc6
lfence
lea r8, str.select_sum_
mov edx, 0x20
mov rcx, rax
call fcn.1402198ac
lea r8, str.size
mov edx, 0x20
mov rcx, rsi
call fcn.140219980
lea r8, [0x1402d2000]
mov edx, 0x20
mov rcx, rsi
call fcn.140219980
lea r8, [0x1402d1fe8]
mov edx, 0x20
mov rcx, rsi
call fcn.140219980
lea r8, str.from
mov edx, 0x20
mov rcx, rsi
call fcn.140219980
lea r8, str.BlobTable
mov edx, 0x20
mov rcx, rsi
call fcn.140219980
lea rax, [rsp + 0x58]
mov rdx, rsi
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r8, [0x14002fa40]
mov rcx, rbx
call fcn.14005f740
mov rcx, rsi
mov ebx, eax
call fcn.1402122e0
test ebx, ebx
je 0x140018bd0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140018bc6
call fcn.140062150
mov ebx, 7
jmp 0x140018d36
mov eax, dword [rsp + 0x34]
lea rsi, [rdi + 0x30]
mov qword [r14], rax
mov rax, qword [rdi]
test rax, rax
je 0x140018d31
test rsi, rsi
je 0x140018d31
mov rbx, qword [rax]
test rbx, rbx
je 0x140018bc6
lea r9, str.ThreatObjectTable
mov edx, 0x80
lea r8, str.SELECT_count___FROM__s
lea rcx, [rbp + 0x110]
call fcn.140017f00
test eax, eax
js 0x140018bc6
cdqe
cmp rax, 0x80
jae 0x140018bc6
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], r15
mov r8d, 0xffffffff
lea rdx, [rbp + 0x110]
mov rcx, rbx
call fcn.140063200
test eax, eax
jne 0x140018bc6
mov rcx, qword [rsp + 0x38]
call fcn.1400648f0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.140065080
mov rcx, qword [rsp + 0x38]
movsxd rbx, eax
call fcn.1400654c0
mov qword [rsi], rbx
movabs rax, 0x3200000000
mov qword [rdi + 0x38], rax
movabs rax, 0x1900000000
mov qword [rdi + 0x40], rax
mov rax, qword [rdi]
mov qword [rdi + 0x48], 0x3e8
mov byte [rdi + 0x50], 1
mov qword [rdi + 0x58], 0x7d0
mov qword [rdi + 0x60], 0x100000
mov dword [rdi + 0x68], 0x15
mov qword [rdi + 0x6c], 1
mov qword [r13], rdi
test rax, rax
je 0x140018d31
cmp dword [rax + 0x10], 0
je 0x140018cf2
mov rcx, qword [rax]
test rcx, rcx
je 0x140018cf2
lea rdx, str.commit_transaction
call fcn.14002df90
mov rcx, qword [0x140308998]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test ebx, ebx
je 0x140018cf9
mov ebx, 3
jmp 0x140018d36
xor eax, eax
mov r14, qword [rsp + 0x2a8]
mov rdi, qword [rsp + 0x2e8]
mov r15, qword [rsp + 0x2a0]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140208e10
add rsp, 0x2b0
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
mov ebx, 1
lfence
cmp byte [rsp + 0x30], 0
je 0x140018d6f
mov rax, qword [rdi]
test rax, rax
je 0x140018d6f
cmp dword [rax + 0x10], 0
je 0x140018d6f
mov rcx, qword [rax]
test rcx, rcx
je 0x140018d6f
lea rdx, str.commit_transaction
call fcn.14002df90
mov rcx, qword [0x140308998]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call fcn.140018d90
mov eax, ebx
jmp 0x140018cfb
mov eax, 1
jmp 0x140018d0b