Function at 0x1400a1940
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13d, r8d
mov rsi, rdx
mov rdi, rcx
cmp r8d, 4
jb 0x1400a1d35
xor r12d, r12d
nop word [rax + rax]
movzx eax, byte [rsi + 2]
movzx ebp, byte [rsi + 3]
shl ebp, 8
or ebp, eax
lea eax, [r13 - 4]
cmp ebp, eax
ja 0x1400a2051
movzx ecx, byte [rsi + 1]
movzx eax, byte [rsi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x4453
ja 0x1400a1c43
je 0x1400a1a68
cmp ecx, 9
je 0x1400a1c9c
cmp ecx, 0xc
je 0x1400a1a01
cmp ecx, 0x334d
jne 0x1400a1d1b
cmp ebp, 0xe
jb 0x1400a19f6
test byte [rsi + 8], 4
je 0x1400a19f6
movzx eax, byte [rsi + 6]
movzx ecx, byte [rsi + 7]
shl ecx, 8
add ecx, eax
movzx eax, byte [rsi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [rsi + 4]
shl ecx, 8
add ecx, eax
lea eax, [rbp - 0xe]
cmp ecx, eax
je 0x1400a1d1b
mov r14d, reloc.WS2_32.dll_ntohl
jmp 0x1400a1ca2
movzx eax, byte [rsi + 6]
lea r8d, [rbp - 4]
movzx ebx, byte [rsi + 7]
lea rdx, [rsi + 8]
shl ebx, 8
xor ecx, ecx
add ebx, eax
movzx eax, byte [rsi + 5]
shl ebx, 8
add ebx, eax
movzx eax, byte [rsi + 4]
shl ebx, 8
add ebx, eax
call fcn.1400a4de0
cmp ebx, eax
je 0x1400a1d1b
lea rdx, str._bad_CRC_for_extended_attributes_n
lea rcx, [rdi + 0xb08]
call fcn.140094280
mov r8d, eax
lea rdx, [rdi + 0xb08]
mov r9d, 1
mov rcx, rdi
call qword [rdi + 0x10df0]
jmp 0x1400a1d1b
cmp ebp, 5
jb 0x1400a1d8c
cmp byte [rsi + 8], r12b
ja 0x1400a1d85
movzx eax, byte [rsi + 6]
movzx ebx, byte [rsi + 7]
shl ebx, 8
add ebx, eax
movzx eax, byte [rsi + 5]
shl ebx, 8
add ebx, eax
movzx eax, byte [rsi + 4]
shl ebx, 8
add ebx, eax
je 0x1400a1aa5
cmp ebp, 0xb
jbe 0x1400a1d8c
mov ecx, ebx
call fcn.1401313c0
mov r14, rax
test rax, rax
je 0x1400a1d7e
lea ecx, [rbp - 5]
mov r8d, ebx
mov dword [rsp + 0x20], ecx
lea r9, [rsi + 9]
mov rcx, rdi
mov rdx, rax
call fcn.1400a20e0
mov ebx, eax
test eax, eax
jne 0x1400a1c2e
mov eax, dword [0x1401b7f48]
cmp eax, 0xffffffff
jne 0x1400a1b0b
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1400a1aff
mov dword [0x1401b7f48], 1
jmp 0x1400a1b13
mov dword [0x1401b7f48], r12d
jmp 0x1400a1c2b
test eax, eax
je 0x1400a1c2b
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
jne 0x1400a1b28
lea ebx, [rax + 1]
jmp 0x1400a1c2e
lea r9, [rsp + 0x98]
mov rcx, r14
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x1400a1b52
lea ebx, [rax + 1]
jmp 0x1400a1c2e
cmp dword [rsp + 0x90], r12d
je 0x1400a1b73
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
jne 0x1400a1b73
lea ebx, [rax + 1]
jmp 0x1400a1c2e
lea r9, [rsp + 0x98]
mov rcx, r14
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
jne 0x1400a1b9d
lea ebx, [rax + 1]
jmp 0x1400a1c2e
cmp dword [rsp + 0x90], r12d
je 0x1400a1bbb
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_IsValidAcl]
test eax, eax
jne 0x1400a1bbb
lea ebx, [rax + 1]
jmp 0x1400a1c2e
lea r8, [rsp + 0x98]
mov rcx, r14
lea rdx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
test eax, eax
jne 0x1400a1bda
lea ebx, [rax + 1]
jmp 0x1400a1c2e
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400a1bf3
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x1400a1bf3
lea ebx, [rax + 1]
jmp 0x1400a1c2e
lea r8, [rsp + 0x98]
mov rcx, r14
lea rdx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
test eax, eax
jne 0x1400a1c12
lea ebx, [rax + 1]
jmp 0x1400a1c2e
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400a1c2b
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
mov ebx, 1
test eax, eax
je 0x1400a1c2e
mov ebx, r12d
mov rcx, r14
call fcn.140125238
test ebx, ebx
jne 0x1400a1d91
jmp 0x1400a1d1b
cmp ecx, 0x4c41
je 0x1400a1c9c
cmp ecx, 0x6542
je 0x1400a1c5f
cmp ecx, 0x7441
jne 0x1400a1d1b
cmp ebp, 5
jb 0x1400a1c94
test byte [rsi + 8], 1
je 0x1400a1c94
movzx eax, byte [rsi + 6]
movzx ecx, byte [rsi + 7]
shl ecx, 8
add ecx, eax
movzx eax, byte [rsi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [rsi + 4]
shl ecx, 8
add ecx, eax
lea eax, [rbp - 5]
cmp ecx, eax
je 0x1400a1d1b
mov r14d, 5
jmp 0x1400a1ca2
mov r14d, 4
cmp ebp, 4
jb 0x1400a1f22
movzx eax, byte [rsi + 6]
movzx ebx, byte [rsi + 7]
shl ebx, 8
add ebx, eax
movzx eax, byte [rsi + 5]
shl ebx, 8
add ebx, eax
movzx eax, byte [rsi + 4]
shl ebx, 8
add ebx, eax
je 0x1400a1cd8
lea eax, [r14 + 6]
cmp ebp, eax
jbe 0x1400a1f22
mov ecx, ebx
call fcn.1401313c0
mov r15, rax
test rax, rax
je 0x1400a1f1b
mov edx, ebp
lea r9d, [r14 + 4]
sub edx, r14d
add r9, rsi
mov dword [rsp + 0x20], edx
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.1400a20e0
mov rcx, r15
mov ebx, eax
call fcn.140125238
test ebx, ebx
jne 0x1400a1f27
mov eax, 0xfffffffc
lea ecx, [rbp + 4]
sub eax, ebp
add rsi, rcx
add r13d, eax
cmp r13d, 4
jae 0x1400a1970
cmp dword [rdi + 0x44], 0
jne 0x1400a1d64
lea rdx, str._OK_n
lea rcx, [rdi + 0xb08]
call fcn.140094280
mov r8d, eax
lea rdx, [rdi + 0xb08]
xor r9d, r9d
mov rcx, rdi
call qword [rdi + 0x10df0]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 7
jmp 0x1400a1d91
mov ebx, 0x4001
jmp 0x1400a1d91
mov ebx, 0x4f
lea r14, [rdi + 0xb08]
cmp dword [rdi + 0x44], r12d
je 0x1400a1dd8
lea rdx, [rdi + 0x8b08]
lea rcx, [rdi + 0x10c5c]
call fcn.1400a2360
mov r8, rax
lea rdx, [0x1401a08c8]
mov rcx, r14
call fcn.140094280
mov r8d, eax
mov r9d, 1
mov rdx, r14
mov rcx, rdi
call qword [rdi + 0x10df0]
cmp ebx, 7
jg 0x1400a1e2a
cmp ebx, 6
jge 0x1400a1e16
mov ecx, ebx
sub ecx, 1
je 0x1400a1e02
cmp ecx, 1
jne 0x1400a1e3b
lea rdx, str._invalid_compressed_data_for_EAs_n
mov rcx, r14
call fcn.140094280
jmp 0x1400a1eff
lea rdx, str._EAs_fail_security_check_n
mov rcx, r14
call fcn.140094280
jmp 0x1400a1eff
lea rdx, str._out_of_memory_while_inflating_EAs_n
mov rcx, r14
call fcn.140094280
jmp 0x1400a1eff
cmp ebx, 0x4f
je 0x1400a1ee5
cmp ebx, 0x4001
je 0x1400a1eb0
mov rcx, r14
cmp bl, 2
je 0x1400a1e6b
lea rdx, str._unknown_error_on_extended_attributes_n
call fcn.140094280
mov r8d, eax
mov r9d, 1
mov rdx, r14
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebx
jmp 0x1400a1d66
mov eax, ebx
sar eax, 8
cmp ax, 8
jne 0x1400a1e9e
lea rdx, str._bad_CRC_for_extended_attributes_n
call fcn.140094280
mov r8d, eax
mov r9d, 1
mov rdx, r14
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebx
jmp 0x1400a1d66
movzx r8d, ax
lea rdx, str._unknown_compression_method_for_EAs___u__n
call fcn.140094280
jmp 0x1400a1e82
movzx r8d, byte [rsi + 8]
lea rdx, str._unsupported_NTSD_EAs_version__d_n
mov rcx, r14
call fcn.140094280
mov r8d, eax
mov r9d, 1
mov rdx, r14
mov rcx, rdi
call qword [rdi + 0x10df0]
mov ebx, 1
mov eax, ebx
jmp 0x1400a1d66
lea r8d, [rbp - 0xb]
mov rcx, r14
lea r9, reloc.WS2_32.dll_ioctlsocket
lea rdx, str._compressed_WinNT_security_data_missing___d_bytes__s
call fcn.140094280
mov r9d, 1
mov r8d, eax
mov rdx, r14
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebx
jmp 0x1400a1d66
mov ebx, 7
jmp 0x1400a1f27
mov ebx, 0x4f
lea rsi, [rdi + 0xb08]
cmp dword [rdi + 0x44], r12d
je 0x1400a1f6e
lea rdx, [rdi + 0x8b08]
lea rcx, [rdi + 0x10c5c]
call fcn.1400a2360
mov r8, rax
lea rdx, [0x1401a08c8]
mov rcx, rsi
call fcn.140094280
mov r8d, eax
mov r9d, 1
mov rdx, rsi
mov rcx, rdi
call qword [rdi + 0x10df0]
cmp ebx, 2
je 0x1400a2026
cmp ebx, 5
jle 0x1400a1fb1
cmp ebx, 7
jle 0x1400a1fa8
cmp ebx, 0x4f
jne 0x1400a1fb1
sub ebp, r14d
lea r9, reloc.WS2_32.dll_ioctlsocket
lea rdx, str._compressed_EA_data_missing___d_bytes__s
mov rcx, rsi
lea r8d, [rbp - 6]
call fcn.140094280
jmp 0x1400a2035
lea rdx, str._out_of_memory_while_inflating_EAs_n
jmp 0x1400a202d
mov rcx, rsi
cmp bl, 2
je 0x1400a1fe1
lea rdx, str._unknown_error_on_extended_attributes_n
call fcn.140094280
mov r8d, eax
mov r9d, 1
mov rdx, rsi
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebx
jmp 0x1400a1d66
mov eax, ebx
sar eax, 8
cmp ax, 8
jne 0x1400a2014
lea rdx, str._bad_CRC_for_extended_attributes_n
call fcn.140094280
mov r8d, eax
mov r9d, 1
mov rdx, rsi
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebx
jmp 0x1400a1d66
movzx r8d, ax
lea rdx, str._unknown_compression_method_for_EAs___u__n
call fcn.140094280
jmp 0x1400a1ff8
lea rdx, str._invalid_compressed_data_for_EAs_n
mov rcx, rsi
call fcn.140094280
mov r9d, 1
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, ebx
jmp 0x1400a1d66
cmp dword [rdi + 0x44], r12d
je 0x1400a2099
lea rdx, [rdi + 0x8b08]
lea rcx, [rdi + 0x10c5c]
call fcn.1400a2360
mov r8, rax
lea rdx, [0x1401a08c8]
lea rcx, [rdi + 0xb08]
call fcn.140094280
mov r8d, eax
lea rdx, [rdi + 0xb08]
mov r9d, 1
mov rcx, rdi
call qword [rdi + 0x10df0]
lea r9d, [r13 - 4]
mov r8d, ebp
lea rdx, str.bad_extra_field_entry:_n______EF_block_length___u_bytes__exceeds_remaining_EF_data___u_bytes__n
lea rcx, [rdi + 0xb08]
call fcn.140094280
mov r8d, eax
lea rdx, [rdi + 0xb08]
mov r9d, 1
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, 2
jmp 0x1400a1d66