Function at 0x18001ded4
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
lea rbx, [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_GetVersion]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov dword [rbx + 8], eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rcx, qword [rbx]
mov qword [rbx + 0x10], rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
test eax, eax
jne 0x18001df2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18001e20e
lea rcx, [rbx + 0x6ec]
call qword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov edx, eax
test eax, eax
je 0x18001df1f
mov rcx, qword [rsi + 0x38]
mov eax, dword [rbx + 0x30]
mov dword [rcx + 0x154], eax
mov rcx, rbx
mov rax, qword [rsi + 0x38]
mov dword [rax + 0x150], edx
mov rax, qword [rsi + 0x38]
mov dword [rax + 0x164], 1
call fcn.18001d99c
mov edi, eax
test eax, eax
jne 0x18001e212
mov rcx, rsi
call fcn.18001de00
mov edi, eax
test eax, eax
jne 0x18001e212
mov rcx, rbx
call fcn.18001e5cc
mov edi, eax
test eax, eax
jne 0x18001e212
mov rcx, qword [rsi + 0x38]
xor ebp, ebp
mov eax, dword [rbx + 0x28]
mov dword [rcx + 0x16c], eax
mov rax, qword [rsi + 0x38]
mov r14, qword [rax + 0x130]
test r14, r14
jne 0x18001dfd5
lea ecx, [r14 + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0xc8
jl 0x18001dfa9
or edi, 0xffffffff
jmp 0x18001e212
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor esi, esi
mov qword [rbx + 0x58], r14
mov qword [rbx + 0x50], rax
cmp qword [rbx + 0x60], rsi
jne 0x18001e01c
cmp esi, 0xa
jge 0x18001e01c
xor r8d, r8d
lea rdx, str.Shell_TrayWnd
xor ecx, ecx
call fcn.18001b940
mov qword [rbx + 0x60], rax
test rax, rax
jne 0x18001e013
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp qword [rbx + 0x60], 0
je 0x18001dfeb
mov rcx, qword [rbx + 0x60]
lea rdx, str.ReBarWindow32
xor r8d, r8d
call fcn.18001b940
xor r8d, r8d
mov qword [rbx + 0x70], rax
lea rdx, str.MSTaskSwWClass
mov rcx, rax
call fcn.18001b940
lea rsi, str.ToolbarWindow32
mov qword [rbx + 0x68], rax
mov rdx, rsi
xor r8d, r8d
mov rcx, rax
call fcn.18001b940
mov rcx, qword [rbx + 0x68]
lea rdx, str.MSTaskListWClass
xor r8d, r8d
mov qword [rbx + 0x78], rax
call fcn.18001b940
mov rcx, qword [rbx + 0x60]
lea rdx, str.TrayNotifyWnd
xor r8d, r8d
mov qword [rbx + 0x80], rax
call fcn.18001b940
xor r8d, r8d
mov qword [rbx + 0x98], rax
mov rdx, rsi
mov rcx, rax
call fcn.18001b940
mov rcx, qword [rbx + 0x98]
lea rdx, str.SysPager
xor r8d, r8d
mov qword [rbx + 0xc0], rax
call fcn.18001b940
xor r8d, r8d
mov qword [rbx + 0xa0], rax
mov rdx, rsi
mov rcx, rax
call fcn.18001b940
xor r8d, r8d
mov qword [rbx + 0xb0], rax
lea rdx, str.NotifyIconOverflowWindow
xor ecx, ecx
call fcn.18001b940
xor r8d, r8d
mov qword [rbx + 0xa8], rax
mov rdx, rsi
mov rcx, rax
call fcn.18001b940
mov qword [rbx + 0xb8], rax
call fcn.18000add8
mov edx, 5
cmp eax, edx
ja 0x18001e124
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.USER32.dll_GetWindow]
jmp 0x18001e18b
call fcn.18000add8
cmp eax, 6
jne 0x18001e137
call fcn.18000ade0
test eax, eax
je 0x18001e14b
call fcn.18000add8
cmp eax, 6
jne 0x18001e156
call fcn.18000ade0
cmp eax, 1
jne 0x18001e156
lea rdx, str.Button
xor ecx, ecx
jmp 0x18001e17f
call fcn.18000add8
cmp eax, 6
ja 0x18001e174
call fcn.18000add8
cmp eax, 6
jne 0x18001e18f
call fcn.18000ade0
cmp eax, 1
jbe 0x18001e18f
mov rcx, qword [rbx + 0x60]
lea rdx, str.Start
lea r8, str.Start
call fcn.18001b940
mov qword [rbx + 0x40], rax
lea r8, str.Start_menu
xor ecx, ecx
lea rdx, str.DV2ControlHost
call fcn.18001b940
lea r8, str.Program_Manager
mov qword [rbx + 0x48], rax
lea rdx, str.Progman
xor ecx, ecx
call fcn.18001b940
xor r8d, r8d
mov qword [rbx + 0x38], rax
lea rdx, str.SHELLDLL_DefView
mov rcx, rax
call fcn.18001b940
lea r8, str.FolderView
mov qword [rbx + 0x90], rax
lea rdx, str.SysListView32
mov rcx, rax
call fcn.18001b940
xor r8d, r8d
mov qword [rbx + 0x88], rax
lea r9, str.VisualEffects
mov rcx, r14
lea edx, [r8 + 0x1a]
call qword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
je 0x18001e21a
mov rcx, rbx
call fcn.18001e3d4
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret