Function at 0x140002e80
Capabilities:
Check os version
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, rcx
mov eax, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
lea edx, [rax + 1]
imul edx, eax
and edx, 1
cmp ecx, 0xa
jl 0x140002ec2
test edx, edx
je 0x140002ec2
nop word cs:[rax + rax]
jmp 0x140002ec0
mov r8, qword gs:[0x30]
mov rax, qword [r8 + 0x60]
mov ebx, 1
test rax, rax
je 0x140003552
test r8, r8
je 0x140003552
cmp dword [rax + 0x118], 0xa
jne 0x140003552
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov r15, qword [rax]
mov rax, qword [r15 + 0x20]
mov qword [rsp + 0x28], rax
movzx eax, word [rax]
xor ebx, ebx
cmp eax, 0x5a4d
jne 0x140003542
mov rax, qword [rsp + 0x28]
movsxd r11, dword [rax + 0x3c]
xor ebx, ebx
cmp dword [rax + r11], 0x4550
jne 0x140003532
add r15, 0x20
movabs r12, 0xc7904b4225dbe27a
movabs r13, 0xb6748231d15e5782
movabs rbp, 0x7b0fb828551617ae
movabs rbx, 0x7851bda23b96393e
movabs r10, 0x4991ecfb670d4362
movabs r14, 0x3ca0e7f9690a2ae2
movabs rsi, 0x26d9b54d3ee090f6
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], r11
nop word cs:[rax + rax]
mov rcx, r13
mov r8, rbx
mov r9, r15
mov rbx, rsi
mov rsi, qword [rsp + 0x28]
mov r15d, dword [rsi + r11 + 0x88]
add r15, qword [r9]
mov r13, r8
mov qword [rdi + 0x10], r8
mov qword [rdi + 0x28], r10
mov qword [rdi + 0x40], rbx
mov qword [rdi + 0x70], r12
mov qword [rdi + 0x88], r14
mov qword [rdi + 0x58], rcx
mov qword [rdi + 0xa0], rbp
mov rcx, qword [r9]
mov rdx, r15
mov r8, rdi
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
cmp ecx, 0xa
jl 0x140003171
test edx, edx
je 0x140003171
mov rsi, r14
mov r14, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + r14 + 0x88]
mov r15, qword [rsp + 0x20]
add rdx, qword [r15]
mov qword [rdi + 0x10], r13
movabs r12, 0x4991ecfb670d4362
mov qword [rdi + 0x28], r12
mov qword [rdi + 0x40], rbx
movabs rax, 0xc7904b4225dbe27a
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x88], rsi
movabs rax, 0xb6748231d15e5782
mov qword [rdi + 0x58], rax
mov qword [rdi + 0xa0], rbp
mov rcx, qword [r15]
mov r8, rdi
call fcn.140002080
mov r11, r14
mov r14, rsi
mov rsi, rbx
mov r10, r12
movabs r12, 0xc7904b4225dbe27a
mov rbx, r13
movabs r13, 0xb6748231d15e5782
cmp dword [0x1400062cc], 0xa
jl 0x1400030b0
mov eax, dword [0x1400062d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140003120
nop dword [rax]
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + r11 + 0x88]
add rdx, qword [r15]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x28], r10
mov qword [rdi + 0x40], rsi
mov qword [rdi + 0x70], r12
mov qword [rdi + 0x88], r14
mov qword [rdi + 0x58], r13
mov qword [rdi + 0xa0], rbp
mov rcx, qword [r15]
mov r8, rdi
call fcn.140002080
mov r11, qword [rsp + 0x30]
movabs r10, 0x4991ecfb670d4362
mov ecx, dword [0x1400062d0]
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
cmp dword [0x1400062cc], 0xa
jl 0x140002f90
test eax, eax
je 0x140002f90
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + r11 + 0x88]
add rdx, qword [r15]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x28], r10
mov qword [rdi + 0x40], rsi
mov qword [rdi + 0x70], r12
mov qword [rdi + 0x88], r14
mov qword [rdi + 0x58], r13
mov qword [rdi + 0xa0], rbp
mov rcx, qword [r15]
mov r8, rdi
call fcn.140002080
mov r11, qword [rsp + 0x30]
movabs r10, 0x4991ecfb670d4362
jmp 0x1400030b0
xor ebx, ebx
test eax, eax
je 0x140003517
lea r8, [rdi + 0x18]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
mov rdx, r15
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
cmp ecx, 0xa
jl 0x1400031b2
test edx, edx
je 0x1400031b2
jmp 0x1400031b0
test eax, eax
je 0x140003517
lea r14, [rdi + 0x30]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
mov rdx, r15
mov r8, r14
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
cmp ecx, 0xa
jl 0x140003230
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
je 0x140003230
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsi]
mov rdx, r15
mov r8, r14
call fcn.140002080
mov rcx, qword [rsi]
mov rdx, r15
mov r8, r14
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
cmp ecx, 0xa
jl 0x140003230
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
jne 0x1400031f5
test eax, eax
je 0x140003353
lea r14, [rdi + 0x60]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
mov rdx, r15
mov r8, r14
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
cmp ecx, 0xa
jl 0x1400032ae
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
je 0x1400032ae
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsi]
mov rdx, r15
mov r8, r14
call fcn.140002080
mov rcx, qword [rsi]
mov rdx, r15
mov r8, r14
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
cmp ecx, 0xa
jl 0x1400032ae
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
jne 0x140003273
test eax, eax
je 0x140003372
lea r14, [rdi + 0x78]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
mov rdx, r15
mov r8, r14
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
cmp ecx, 0xa
jl 0x14000332c
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
je 0x14000332c
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsi]
mov rdx, r15
mov r8, r14
call fcn.140002080
mov rcx, qword [rsi]
mov rdx, r15
mov r8, r14
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
cmp ecx, 0xa
jl 0x14000332c
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
jne 0x1400032f1
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
sete r9b
cmp ecx, 0xa
setl r8b
or r8b, r9b
test eax, eax
je 0x140003392
test r8b, r8b
jne 0x1400033a2
jmp 0x1400033d7
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
cmp ecx, 0xa
jl 0x140003517
test edx, edx
je 0x140003517
nop
jmp 0x140003370
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
cmp ecx, 0xa
jl 0x140003517
test edx, edx
je 0x140003517
nop
jmp 0x140003390
test r8b, r8b
jne 0x140003517
nop dword [rax + rax]
jmp 0x1400033a0
lea r8, [rdi + 0x48]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
mov rdx, r15
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
cmp ecx, 0xa
jl 0x1400033ed
test edx, edx
je 0x1400033ed
lea r8, [rdi + 0x48]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
mov rdx, r15
call fcn.140002080
jmp 0x1400033a2
test eax, eax
je 0x140003517
add rdi, 0x90
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
mov rdx, r15
mov r8, rdi
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
cmp ecx, 0xa
jl 0x1400034e5
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
je 0x1400034e5
mov rsi, qword [rsp + 0x20]
lea eax, [r8 + 1]
imul eax, r8d
test al, 1
je 0x1400034ad
jmp 0x1400034d5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
mov rdx, r15
mov r8, rdi
call fcn.140002080
mov r8d, dword [0x1400062d0]
mov ecx, dword [0x1400062cc]
cmp ecx, 0xa
jl 0x1400034e5
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
jne 0x14000343b
jmp 0x1400034e5
mov rcx, qword [rsi]
mov rdx, r15
mov r8, rdi
call fcn.140002080
cmp dword [0x1400062cc], 0xa
jl 0x14000344c
mov r8d, dword [0x1400062d0]
lea eax, [r8 + 1]
imul eax, r8d
and eax, 1
jne 0x14000343b
jmp 0x14000344c
mov rcx, qword [rsi]
mov rdx, r15
mov r8, rdi
call fcn.140002080
cmp dword [0x1400062cc], 0xa
jl 0x140003480
mov eax, dword [0x1400062d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140003480
mov rcx, qword [rsi]
mov rdx, r15
mov r8, rdi
call fcn.140002080
jmp 0x1400034ad
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
sete r9b
cmp ecx, 0xa
setl r8b
or r8b, r9b
test eax, eax
je 0x140003512
mov ebx, 1
test r8b, r8b
jne 0x140003517
nop dword [rax]
jmp 0x140003510
test r8b, r8b
je 0x140003530
cmp ecx, 0xa
jl 0x140003532
test edx, edx
je 0x140003532
jmp 0x140003520
jmp 0x140003530
cmp ecx, 0xa
jl 0x140003542
test edx, edx
je 0x140003542
nop dword [rax + rax]
jmp 0x140003540
cmp ecx, 0xa
jl 0x140003552
test edx, edx
je 0x140003552
nop dword [rax + rax]
jmp 0x140003550
cmp ecx, 0xa
jl 0x140003562
test edx, edx
je 0x140003562
nop dword [rax + rax]
jmp 0x140003560
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret