Function at 0x1400208ca
Capabilities:
Check os version
Get system information on windows

Disassembly:
jmp 0x140046520
push rbp
push rbx
push rdi
sub rsp, 0x4f0
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xd0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400976fa]
call fcn.140021040
mov dword [rbp + 4], 0
lea rcx, str.___Debug_Mode_Run__several_features__like_a_shellcode_proper_generation__will_be_unavailable_r_n
call fcn.140020f41
mov r8d, 0x20
xor edx, edx
lea rcx, [rbp + 0x168]
call fcn.140020c53
mov r8d, 0x10
xor edx, edx
lea rcx, [rbp + 0x1a8]
call fcn.140020c53
xor eax, eax
xor ecx, ecx
cpuid
lea r8, [rbp + 0x1a8]
mov dword [r8], eax
mov dword [r8 + 4], ebx
mov dword [r8 + 8], ecx
mov dword [r8 + 0xc], edx
mov eax, 4
imul rax, rax, 1
mov eax, dword [rbp + rax + 0x1a8]
mov dword [rbp + 0x168], eax
mov eax, 4
imul rax, rax, 3
mov eax, dword [rbp + rax + 0x1a8]
mov dword [rbp + 0x16c], eax
mov eax, 4
imul rax, rax, 2
mov eax, dword [rbp + rax + 0x1a8]
mov dword [rbp + 0x170], eax
lea rdx, [rbp + 0x168]
lea rcx, str.___CPU_vendor_string:__s_r_n
call fcn.140020f41
mov edx, 0x114
lea rcx, [rbp + 0x30]
call fcn.140020b7c
mov dword [rbp + 0x30], 0x114
lea rcx, [rbp + 0x30]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
cmp dword [rbp + 0x34], 6
jb 0x140046633
cmp dword [rbp + 0x34], 6
jne 0x14004662a
cmp dword [rbp + 0x38], 0
je 0x140046633
cmp dword [rbp + 0x3c], 0x1db0
jne 0x140046650
lea rdx, str.____Unsupported_WinNT_version_r_n
mov ecx, 1
call fcn.1400204b0
mov dword [rbp + 4], 0x519
jmp 0x140046865
call fcn.140020f64
movzx eax, al
test eax, eax
jne 0x140046679
lea rdx, str.____Administrator_privileges_are_required_to_continue._r_n____Verify_that_you_have_sufficient_privileges_and_you_are_not_running_program_under_any_compatibility_layer._r_n
mov ecx, 1
call fcn.1400204b0
mov dword [rbp + 4], 0x522
jmp 0x140046865
mov eax, dword [rbp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x38]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x34]
lea r8, str.___Windows_version:__u._u_build__u
mov edx, 0x64
lea rcx, [rbp + 0x1e0]
call fcn.140020523
lea rdx, [rbp + 0x1e0]
lea rcx, str._s_r_n
call fcn.140020f41
lea rcx, [rbp + 0x264]
call fcn.140020460
movzx eax, al
test eax, eax
je 0x140046705
movzx eax, byte [rbp + 0x264]
test eax, eax
je 0x1400466e4
lea rax, [0x1400771dc]
mov qword [rbp + 0x4b8], rax
jmp 0x1400466f2
lea rax, str.disa
mov qword [rbp + 0x4b8], rax
mov rdx, qword [rbp + 0x4b8]
lea rcx, str.___SecureBoot_is__sbled_on_this_machine_r_n
call fcn.140020f41
lea r8, [rbp + 0x2c4]
lea rdx, [rbp + 0x2a4]
lea rcx, [rbp + 0x284]
call fcn.140020aeb
movzx eax, al
test eax, eax
je 0x14004673d
movzx eax, byte [rbp + 0x284]
test eax, eax
je 0x14004673d
lea rcx, str.___Windows_HVCI_mode_detected_r_n
call fcn.140020f41
mov dword [rbp + 0x304], 0
mov dword [rbp + 0x2e8], 8
mov dword [rbp + 0x2ec], 0
lea r9, [rbp + 0x304]
mov r8d, 8
lea rdx, [rbp + 0x2e8]
mov ecx, 0x67
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x1400467e8
mov eax, dword [rbp + 0x2ec]
and eax, 2
test eax, eax
je 0x140046797
lea rcx, str.___Test_Mode_ENABLED_r_n
call fcn.140020f41
mov eax, dword [rbp + 0x2ec]
and eax, 0x80
test eax, eax
je 0x1400467b2
lea rcx, str.___Debug_Mode_ENABLED_r_n
call fcn.140020f41
mov eax, dword [rbp + 0x2ec]
and eax, 0x400
test eax, eax
je 0x1400467cd
lea rcx, str.___HVCI_KMCI_ENABLED_r_n
call fcn.140020f41
mov eax, dword [rbp + 0x2ec]
and eax, 0x4000
test eax, eax
je 0x1400467e8
lea rcx, str.___WHQL_enforcement_ENABLED_r_n
call fcn.140020f41
cmp dword [rbp + 0x3c], 0x4563
jb 0x140046847
mov dword [rbp + 0x324], 0
xor edx, edx
lea rcx, [rbp + 0x324]
call fcn.140020e47
test eax, eax
je 0x140046847
cmp dword [rbp + 0x324], 0
je 0x140046826
lea rax, [0x1400771dc]
mov qword [rbp + 0x4b8], rax
jmp 0x140046834
lea rax, str.disa
mov qword [rbp + 0x4b8], rax
mov rdx, qword [rbp + 0x4b8]
lea rcx, str.___MSFT_Driver_block_list_is__sbled_r_n
call fcn.140020f41
movzx eax, byte [rbp + 0x284]
mov edx, dword [rbp + 0x3c]
mov ecx, eax
call fcn.140020884
mov dword [rbp + 4], eax
xor eax, eax
test eax, eax
jne 0x140046560
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140076340]
call fcn.140020d66
mov eax, edi
lea rsp, [rbp + 0x4c0]
pop rdi
pop rbx
pop rbp
ret