Function at 0x140374870
Capabilities:
Check os version
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1d8
movups xmmword [rsp + 0x1c0], xmm6
mov ebp, 0x16
cmp qword [rcx], 0xffffffffffffffff
mov dword [rsp + 0x58], 0xffffffff
mov rsi, rcx
mov rdi, rdx
jne 0x140374c40
test r8d, 0xfc00bffe
jne 0x140374c40
mov ebx, dword [rcx + 0x18]
lea r12, [rsp + 0x60]
mov rcx, rdi
mov dword [rsp + 0x64], 0
mov rdx, r12
or ebx, r8d
mov eax, ebx
not eax
test eax, 0x404000
setne al
movzx eax, al
lea r8d, [rax + rax*8]
call fcn.140373740
mov ebp, eax
test eax, eax
jne 0x140374c40
test ebx, 0x20000
je 0x140374c60
and ebx, 0xfff7ffff
or ebx, 0x20000000
mov dword [rsi + 0x18], ebx
mov rcx, rdi
call sym.strdup
mov r15d, dword [rsi + 0x30]
mov edx, 0x30
mov qword [rsi + 0x38], rax
mov r14, rax
mov rcx, r15
call sym.calloc
mov edx, 2
mov rcx, r15
mov qword [rsi + 0x90], rax
mov rdi, rax
call sym.calloc
mov edx, 4
mov rcx, r15
mov qword [rsi + 0x98], rax
mov r13, rax
call sym.calloc
test rdi, rdi
sete dl
test r14, r14
mov qword [rsi + 0xa0], rax
sete cl
or edx, ecx
test r13, r13
sete cl
or dl, cl
jne 0x140374ca3
test rax, rax
je 0x140374ca3
lea rax, [sym.mdb_cmp_long]
mov qword [rdi + 0x10], rax
mov edi, ebx
and edi, 0x420000
jne 0x140374cb8
lea r8, [rsp + 0x58]
mov rdx, r12
mov rcx, rsi
call fcn.1403738f0
mov r13d, dword [rsp + 0x58]
test eax, eax
jne 0x140374c20
mov eax, ebx
and eax, 0x2000000
mov dword [rsp + 0x34], eax
je 0x1403749d1
test r13d, r13d
je 0x140375207
mov r9, rsi
mov r8d, 1
mov rdx, r12
mov rcx, rsi
call fcn.140373800
test eax, eax
jne 0x140374c20
mov byte [rsp + 0x4b], 1
mov eax, dword [rsi + 0x18]
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, al
cmp eax, 6
sbb eax, eax
and eax, 0xfffff400
add eax, 0x1000
cmp qword [0x1404e3938], 0
mov dword [rsi + 0xec], eax
je 0x140375098
test byte [rsi + 0x1b], 0x40
jne 0x140374d48
lea rax, [rsp + 0x5c]
xor r15d, r15d
mov edi, 2
mov qword [rsp + 0x40], rax
lea r14, [rsp + 0x70]
pxor xmm6, xmm6
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], rax
movups xmmword [r14], xmm6
mov rcx, qword [rsi]
mov r9, qword [rsp + 0x40]
mov r8d, 0x98
movups xmmword [r14 + 0x10], xmm6
mov rdx, qword [rsp + 0x38]
mov dword [rsp + 0x80], r15d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140374d18
mov eax, dword [rsp + 0x5c]
cmp eax, 0xffffffff
je 0x140374d18
cmp eax, 0x98
jne 0x140374d29
test byte [rsp + 0x12a], 8
je 0x140375232
cmp dword [rsp + 0x130], 0xbeefc0de
jne 0x140374d3a
cmp dword [rsp + 0x134], 1
jne 0x140375228
test r15d, r15d
je 0x140374b00
mov r8d, dword [rsp + 0x34]
test r8d, r8d
je 0x140375110
mov rdx, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x110]
cmp rdx, rax
jae 0x140374b98
nop
movdqu xmm1, xmmword [rsp + 0x130]
movdqu xmm2, xmmword [rsp + 0x140]
mov rax, qword [rsp + 0x1b0]
movdqu xmm3, xmmword [rsp + 0x150]
movdqu xmm4, xmmword [rsp + 0x160]
movups xmmword [rsp + 0x90], xmm1
movdqu xmm5, xmmword [rsp + 0x170]
movdqu xmm0, xmmword [rsp + 0x180]
movups xmmword [rsp + 0xa0], xmm2
movdqu xmm1, xmmword [rsp + 0x190]
movdqu xmm2, xmmword [rsp + 0x1a0]
mov qword [rsp + 0x110], rax
movups xmmword [rsp + 0xb0], xmm3
movups xmmword [rsp + 0xc0], xmm4
movups xmmword [rsp + 0xd0], xmm5
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm1
movups xmmword [rsp + 0x100], xmm2
mov eax, dword [rsp + 0xa8]
add r15d, eax
cmp edi, 1
je 0x140374e35
mov edi, 1
jmp 0x140374a57
mov rcx, qword [rsi]
mov byte [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea r9, [rsp + 0x120]
mov qword [rsp + 0x20], 0
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140375211
mov rdx, qword [rsp + 0x98]
mov rcx, rsi
call fcn.140373d50
test eax, eax
jne 0x140374c20
mov rax, qword [rsi + 0x40]
lea rdx, [rsp + 0x90]
mov rcx, rsi
mov qword [rsp + 0x98], rax
call fcn.140373000
test eax, eax
je 0x140374ebc
nop
mov ebp, eax
mov edx, r13d
mov rcx, rsi
call fcn.140373330
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x140374c40
mov rcx, qword [rsp + 0x68]
call sym.free
nop
movups xmm6, xmmword [rsp + 0x1c0]
mov eax, ebp
add rsp, 0x1d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x1ffff
or ebx, 0x20000000
call sym.mdb_midl_alloc
mov qword [rsi + 0xd0], rax
test rax, rax
je 0x140374ca0
mov edx, 0x10
mov ecx, 0x20000
call sym.calloc
mov qword [rsi + 0xd8], rax
test rax, rax
jne 0x140374908
nop dword [rax + rax]
mov dword [rsi + 0x18], ebx
mov r13d, 0xffffffff
mov ebp, 0xc
jmp 0x140374c22
mov r8d, ebx
mov r9, rsi
mov rdx, r12
mov rcx, rsi
shr r8d, 0x11
xor r8d, 1
mov eax, r8d
and r8d, 1
and eax, 1
mov byte [rsp + 0x4b], al
call fcn.140373800
test eax, eax
jne 0x140374d08
cmp edi, 0x20000
je 0x140374fa0
mov eax, ebx
mov r13d, 0xffffffff
and eax, 0x2000000
mov dword [rsp + 0x34], eax
jmp 0x1403749f2
mov ebp, eax
mov r13d, 0xffffffff
jmp 0x140374c22
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
setne al
movzx eax, al
neg eax
or r15d, eax
je 0x14037500c
test eax, eax
js 0x140374ff5
mov eax, 0xffff87b7
jmp 0x140374c20
mov rax, qword [rsi + 0x78]
xor edx, edx
mov rcx, rsi
add rax, 0x1fffff
and rax, 0xffffffffffe00000
mov qword [rsi + 0x78], rax
mov eax, dword [rsi + 0x20]
mov dword [rsi + 0x1c], eax
call fcn.140373d50
test eax, eax
jne 0x140375003
mov rcx, qword [rsi + 0x40]
xor edx, edx
test byte [rcx + 0xa], 8
je 0x14037500c
mov rax, qword [rsi + rdx*8 + 0x50]
cmp dword [rax], 0xbeefc0de
jne 0x140374d3a
cmp dword [rax + 4], 1
jne 0x140375228
test rdx, rdx
je 0x14037512e
mov rdx, qword [rax + 0x80]
mov rcx, qword [rsp + 0x110]
cmp rcx, rdx
jae 0x140374e2e
movdqu xmm4, xmmword [rax]
movdqu xmm5, xmmword [rax + 0x10]
movdqu xmm0, xmmword [rax + 0x20]
movdqu xmm3, xmmword [rax + 0x60]
movups xmmword [rsp + 0x90], xmm4
movdqu xmm4, xmmword [rax + 0x30]
movups xmmword [rsp + 0xa0], xmm5
movdqu xmm5, xmmword [rax + 0x40]
movups xmmword [rsp + 0xb0], xmm0
movdqu xmm0, xmmword [rax + 0x50]
movups xmmword [rsp + 0xc0], xmm4
movdqu xmm4, xmmword [rax + 0x70]
mov rax, qword [rax + 0x80]
movups xmmword [rsp + 0xd0], xmm5
mov qword [rsp + 0x110], rax
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm3
movups xmmword [rsp + 0x100], xmm4
mov eax, dword [rsp + 0xa8]
mov dword [rsi + 0x1c], eax
mov r8d, eax
mov rax, qword [rsp + 0x108]
xor r9d, r9d
lea rcx, [rax + 1]
mov rdx, qword [rsi + 0x78]
test rdx, rdx
jne 0x140374e5f
mov rdx, qword [rsp + 0xa0]
mov qword [rsi + 0x78], rdx
mov eax, r8d
imul rax, rcx
cmp rdx, rax
jae 0x140374e72
mov qword [rsi + 0x78], rax
mov rdx, rax
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0xa0], rdx
and eax, 1
test r9d, r9d
je 0x140374fd0
test eax, eax
jne 0x140374bb5
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.140373000
test eax, eax
jne 0x140374c20
xor edx, edx
mov rcx, rsi
call fcn.140373d50
test eax, eax
jne 0x140374c20
mov ecx, dword [rsi + 0x1c]
lea eax, [rcx - 0x10]
mov edx, eax
shr eax, 1
and eax, 0xfffffffe
shr edx, 3
sub eax, 2
sub edx, 1
mov dword [rsi + 0xe4], eax
mov rax, qword [rsi + 0x78]
mov dword [rsi + 0xe0], edx
xor edx, edx
div rcx
mov qword [rsi + 0x88], rax
and ebx, 0xa0000
je 0x1403751b4
test r13d, r13d
jle 0x140374f0b
mov edx, dword [rsp + 0x34]
test edx, edx
je 0x1403751e6
cmp byte [rsp + 0x4b], 0
je 0x140374c2d
mov ebx, dword [rsi + 0x30]
mov edx, dword [rsi + 0x1c]
mov ecx, 1
call sym.calloc
imul edi, ebx, 0x3d
mov qword [rsi + 0x60], rax
add edi, 0x88
test rax, rax
je 0x140375246
movsxd rdx, edi
mov ecx, 1
call sym.calloc
test rax, rax
je 0x140375246
mov edx, ebx
lea rcx, [rax + 0x88]
mov qword [rax + 0x20], rsi
lea r8, [rdx + rdx*2]
mov qword [rax + 0x58], rcx
shl r8, 4
mov dword [rax + 0x7c], 1
add rcx, r8
mov qword [rsi + 0x70], rax
mov qword [rax + 0x68], rcx
lea rcx, [rcx + rdx*8]
lea rdx, [rcx + rdx*4]
mov qword [rax + 0x60], rcx
mov qword [rax + 0x70], rdx
mov rdx, qword [rsi + 0x90]
mov qword [rax + 0x50], rdx
jmp 0x140374c2d
lea r8, [rsp + 0x58]
mov rdx, r12
mov rcx, rsi
call fcn.1403738f0
test eax, eax
jne 0x1403751fb
mov eax, ebx
mov r13d, dword [rsp + 0x58]
and eax, 0x2000000
mov dword [rsp + 0x34], eax
jmp 0x1403749f2
test eax, eax
je 0x140374eaa
mov rdx, qword [rsp + 0x98]
mov rcx, rsi
call fcn.140373d50
test eax, eax
je 0x140374ebc
jmp 0x140374c20
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140374e2e
cmp eax, 2
jne 0x140374c20
mov edx, dword [rsi + 0x18]
mov eax, dword [rsi + 0x20]
mov ecx, 0x8000
lea r9, [rsp + 0x98]
movdqu xmm0, xmmword [0x14039cdd0]
mov rdi, r9
mov r9d, 1
cmp eax, ecx
cmovbe ecx, eax
xor eax, eax
or edx, 8
mov r8d, ecx
mov dword [rsi + 0x1c], ecx
mov ecx, 0x10
rep stosq qword [rdi], rax
mov rax, qword [0x14039cdc0]
mov ecx, 2
mov dword [rsp + 0xa8], r8d
mov word [rsp + 0xac], dx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xd0], 0xffffffffffffffff
mov qword [rsp + 0xa0], 0x100000
movups xmmword [rsp + 0x100], xmm0
jmp 0x140374e4a
lea rcx, str.NTDLL.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x140375103
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
mov rcx, rax
call r15
mov qword [0x1404e3928], rax
test rax, rax
je 0x140375103
lea rdx, str.NtMapViewOfSection
mov rcx, rdi
call r15
mov qword [0x1404e3930], rax
test rax, rax
je 0x140375103
lea rdx, str.NtCreateSection
mov rcx, rdi
call r15
mov qword [0x1404e3938], rax
test rax, rax
jne 0x140374a25
mov ebp, 0xffff87c5
jmp 0x140374c22
mov rax, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x110]
cmp rdx, rax
jae 0x140374b98
jmp 0x140374b00
movdqu xmm3, xmmword [rax]
movdqu xmm4, xmmword [rax + 0x10]
mov edx, 1
movdqu xmm5, xmmword [rax + 0x20]
movdqu xmm0, xmmword [rax + 0x60]
movups xmmword [rsp + 0x90], xmm3
movdqu xmm3, xmmword [rax + 0x30]
movups xmmword [rsp + 0xa0], xmm4
movdqu xmm4, xmmword [rax + 0x40]
movups xmmword [rsp + 0xb0], xmm5
movdqu xmm5, xmmword [rax + 0x50]
movups xmmword [rsp + 0xc0], xmm3
movdqu xmm3, xmmword [rax + 0x70]
mov rax, qword [rax + 0x80]
movups xmmword [rsp + 0xd0], xmm4
mov qword [rsp + 0x110], rax
mov eax, dword [rsi + 0x1c]
movups xmmword [rsp + 0xe0], xmm5
movups xmmword [rsp + 0xf0], xmm0
add rcx, rax
movups xmmword [rsp + 0x100], xmm3
jmp 0x140374d7a
lea r9, [rsi + 0x10]
mov r8d, 2
mov rdx, r12
mov rcx, rsi
call fcn.140373800
test eax, eax
jne 0x140374c20
test r13d, r13d
jle 0x140374f16
mov ecx, dword [rsp + 0x34]
test ecx, ecx
jne 0x140374f16
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.140373f10
test eax, eax
je 0x140374f0b
mov r13d, dword [rsp + 0x58]
mov ebp, eax
jmp 0x140374c22
mov ebp, 0xb
jmp 0x140374c22
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140374eee
jmp 0x140374c20
mov eax, 0xffff87b6
jmp 0x140374c20
mov edx, dword [rsi + 0x18]
test edx, 0x40000000
jne 0x14037500f
jmp 0x140374d3a
mov r13d, dword [rsp + 0x58]
mov ebp, 0xc
jmp 0x140374c22