Function at 0x140001984
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x118]
sub rsp, 0x1e0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14003ba58]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r14, rdx
mov esi, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
nop dword [rax + rax]
mov r12d, 1
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
nop dword [rax + rax]
mov edx, r12d
lea rcx, [0x140001920]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
nop dword [rax + rax]
xor r15d, r15d
cmp qword [0x14003a010], r15
jne 0x140001b96
mov edi, r15d
cmp byte [0x14003c0c4], r15b
jne 0x140001b19
mov dword [rbp - 0x80], 0x114
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x140001a59
cmp dword [rbp - 0x7c], 6
setb cl
mov byte [0x14003c080], cl
ja 0x140001a4e
jne 0x140001a51
cmp dword [rbp - 0x78], r12d
jbe 0x140001a51
mov edi, r12d
test cl, cl
jne 0x140001b12
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140001a97
test edi, edi
je 0x140001b0b
lea rcx, str.api_ms_win_eventing_provider_l1_1_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140001b0b
lea rdx, str.EventWrite
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x14003c090], rax
test rax, rax
je 0x140001b0b
lea rdx, [0x1400267a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [section..data], rax
test rax, rax
je 0x140001afd
lea rdx, [0x1400267b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x14003c078], rax
test rax, rax
jne 0x140001b12
lea rax, [0x140001670]
mov qword [section..data], rax
mov byte [0x14003c080], r12b
mov byte [0x14003c0c4], r12b
lea rdx, [0x14003a010]
cmp byte [0x14003c080], r15b
jne 0x140001b4c
mov r9, rdx
mov r8, rdx
lea rdx, [0x140001530]
lea rcx, [0x140026920]
mov rax, qword [section..data]
call qword [0x140025fc8]
jmp 0x140001b96
mov qword [0x14003a010], rdx
lea rax, [0x140026920]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, r12d
mov r8, rax
lea rcx, [0x1400013a0]
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
nop dword [rax + rax]
mov rax, qword [0x14003a068]
movups xmm0, xmmword [rax - 0x10]
movdqu xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x14003a088], xmm1
lea r9, [0x14003a080]
lea r8, [0x14003a060]
lea rdx, [0x140001010]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_EventRegister]
nop dword [rax + rax]
mov r13d, 2
test eax, eax
jne 0x140001c74
mov rbx, qword [0x14003a068]
movzx edi, word [rbx]
lea r8, [rsp + 0x40]
lea rdx, str.api_ms_win_eventing_provider_l1_1_0.dll
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
nop dword [rax + rax]
test eax, eax
jne 0x140001c30
lea r8, [rsp + 0x40]
lea rdx, str.advapi32.dll
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
nop dword [rax + rax]
test eax, eax
je 0x140001c74
lea rdx, str.EventSetInformation
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x140001c63
mov r9d, edi
mov r8, rbx
mov edx, r13d
mov rcx, qword [0x14003a080]
call qword [0x140025fc8]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov dword [rsp + 0x58], r15d
mov al, r15b
mov byte [rsp + 0x5c], al
mov edi, 4
mov ecx, dword [0x14003a060]
cmp ecx, 5
jbe 0x140001cd1
lea rdx, [rsp + 0x60]
lea ecx, [rdi - 1]
call qword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
nop dword [rax + rax]
movups xmm0, xmmword [rsp + 0x60]
movdqu xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
mov ecx, edi
call qword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
nop dword [rax + rax]
mov al, r12b
mov byte [rsp + 0x5c], al
mov ecx, dword [0x14003a060]
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], r12d
cmp ecx, 5
jbe 0x140001d36
test al, al
je 0x140001d0a
cmp dword [rsp + 0x70], r15d
jne 0x140001d03
cmp dword [rsp + 0x74], r15d
jne 0x140001d03
cmp dword [rsp + 0x78], r15d
jne 0x140001d03
cmp dword [rsp + 0x7c], r15d
je 0x140001d0a
lea r9, [rsp + 0x70]
jmp 0x140001d0d
mov r9, r15
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
lea r8, [rsp + 0x60]
lea rdx, [0x1400301f6]
lea rcx, [0x14003a060]
call fcn.140001090
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r15
mov r8, r14
mov edx, esi
lea rcx, [rbp + 0xa0]
call fcn.140001f60
mov ebx, eax
cmp dword [0x14003a060], 5
jbe 0x140001da8
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rdi
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400301c7]
lea rcx, [0x14003a060]
call fcn.140001090
cmp byte [rsp + 0x5c], r15b
je 0x140001dc2
lea rdx, [rsp + 0x70]
mov ecx, edi
call qword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
nop dword [rax + rax]
mov dword [rsp + 0x58], r13d
cmp dword [0x14003a060], 5
jbe 0x140001dfc
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, [0x1400301ad]
lea rcx, [0x14003a060]
call fcn.140001090
mov rcx, qword [0x14003a080]
mov dword [0x14003a060], r15d
mov qword [0x14003a080], r15
call qword [sym.imp.ADVAPI32.dll_EventUnregister]
nop dword [rax + rax]
cmp byte [0x14003c0c4], r15b
je 0x140001ea2
mov rcx, qword [0x14003a010]
test rcx, rcx
je 0x140001ea2
cmp byte [0x14003c080], r15b
jne 0x140001e4a
mov rax, qword [0x14003c078]
call qword [0x140025fc8]
jmp 0x140001e9b
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
nop dword [rax + rax]
mov dword [0x14003a030], r15d
mov byte [0x14003a038], r15b
mov qword [0x14003a018], r15
movzx eax, word [0x14003a03a]
test ax, ax
je 0x140001e9b
sub eax, r12d
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
add eax, r12d
movsxd r8, eax
shl r8, 2
xor edx, edx
mov rcx, qword [0x14003a040]
call sub.msvcrt.dll_memset
mov qword [0x14003a010], r15
cmp dword [rsp + 0x58], r12d
jne 0x140001ed9
cmp byte [rsp + 0x5c], r15b
je 0x140001ec3
lea rdx, [rsp + 0x70]
mov ecx, edi
call qword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
nop dword [rax + rax]
mov dword [rsp + 0x58], r13d
lea rdx, [rsp + 0x60]
lea rcx, [0x14003a060]
call fcn.140004e00
mov eax, ebx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140021520
mov rbx, qword [rsp + 0x230]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret