Function at 0x14000d3e0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
mov eax, 0x1990
call fcn.14001ec30
sub rsp, rax
mov rax, qword [0x140029ab0]
xor rax, rsp
mov qword [rsp + 0x1980], rax
mov rbp, rcx
xor r12d, r12d
mov r8d, ecx
mov ecx, 0x410
xor edx, edx
mov dword [rsp + 0x30], r12d
mov word [rsp + 0x160], r12w
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, 0x3ff
mov rdi, rax
test rax, rax
je 0x14000d4af
lea r8, [rsp + 0x160]
mov r9d, ebx
xor edx, edx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov rcx, rdi
mov dword [rsp + 0x30], eax
test eax, eax
je 0x14000d5eb
mov word [rsp + 0x95e], r12w
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x960]
mov edx, 0x400
call fcn.14000b370
test eax, eax
je 0x14000d5f1
mov rcx, rbx
lea rax, [rsp + 0x960]
cmp word [rax], r12w
je 0x14000d676
add rax, 2
sub rcx, 1
jne 0x14000d496
jmp 0x14000d6cd
cmp word [rsp + 0x160], r12w
jne 0x14000d471
mov r8d, ebp
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x14000d4fb
mov rcx, qword [0x14002b6d0]
test rcx, rcx
je 0x14000d471
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
cmp rdx, rbp
jne 0x14000d471
mov rsi, qword [0x14002b6d0]
test rsi, rsi
je 0x14000d471
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x110
mov dword [rsp + 0x40], 0x114
call fcn.14000fca0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000d5f1
cmp dword [rsp + 0x44], 5
ja 0x14000d5f8
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x30], r12d
test rax, rax
je 0x14000d5e8
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x1160]
mov r9d, 0x810
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov edx, 0x1b
call rax
test eax, eax
js 0x14000d5e8
movzx eax, word [rsp + 0x1160]
mov ecx, 0x7fe
cmp ax, cx
ja 0x14000d5e8
movzx ecx, ax
mov rax, qword [rsp + 0x1168]
lea rdx, [rsp + 0x160]
shr rcx, 1
mov r8d, ebx
mov word [rax + rcx*2], r12w
mov rcx, qword [rsp + 0x1168]
call fcn.14000b490
test eax, eax
je 0x14000d5e8
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x160]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov dword [rsp + 0x30], ecx
mov rcx, rsi
jmp 0x14000d46b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000d70f
lea rcx, str.kernel32.dll
call fcn.14000e670
mov rdi, rax
test rax, rax
je 0x14000d5f1
lea rdx, str.QueryFullProcessImageNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x30], 0x400
mov qword [0x14002b6c8], rax
test rax, rax
je 0x14000d65e
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x160]
xor edx, edx
mov rcx, rsi
call rax
test eax, eax
je 0x14000d65e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
jmp 0x14000d471
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
xor eax, eax
jmp 0x14000d70f
test rcx, rcx
je 0x14000d6cd
mov rdx, rbx
sub rdx, rcx
sub rbx, rdx
lea rax, [rsp + rdx*2 + 0x960]
je 0x14000d6c5
lea rdi, [0x14002094c]
lea rcx, [rbx + rdx + 0x7ffffc00]
sub rdi, rax
test rcx, rcx
je 0x14000d6c0
movzx edx, word [rdi + rax]
test dx, dx
je 0x14000d6c0
mov word [rax], dx
add rax, 2
dec rcx
sub rbx, 1
jne 0x14000d6a0
jmp 0x14000d6c5
test rbx, rbx
jne 0x14000d6c9
sub rax, 2
mov word [rax], r12w
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x960]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x160]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x960]
call fcn.14000f610
test eax, eax
jne 0x14000d5f1
lea rcx, [rsp + 0x160]
call fcn.14000b470
mov rcx, qword [rsp + 0x1980]
xor rcx, rsp
call fcn.14000f6d0
lea r11, [rsp + 0x1990]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret