Function at 0x1400420dc
Capabilities:
Check os version
Create thread
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
lea rbp, [rax - 0x588]
sub rsp, 0x670
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov r12d, ecx
mov ebx, VarUI4FromDisp
lea rcx, [rsp + 0x40]
mov r8d, ebx
xor edx, edx
call fcn.14005bab0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor r13d, r13d
cmp dword [rsp + 0x44], 5
jne 0x14004214a
lea eax, [r13 + 1]
cmp dword [rsp + 0x48], r13d
je 0x14004214d
mov eax, r13d
mov dword [0x1400dc080], eax
mov edi, 0x409
lea rcx, [0x1400dcae0]
test eax, eax
je 0x14004216c
lea rdx, str.Digital_Signature_Not_Found
jmp 0x14004219b
lea rdx, str.Hardware_Installation
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.Software_Installation
lea rcx, [0x1400dc8d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.Security_Alert___Driver_Installation
lea rcx, [0x1400dc2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, str.KERNEL32.DLL
mov word [0x1400dc6c0], r13w
mov word [0x1400dc4b0], r13w
mov word [0x1400dc090], r13w
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetUserDefaultUILanguage
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400421e0
call rax
movzx edi, ax
mov ecx, r13d
mov esi, 0xf
mov dword [rsp + 0x30], ecx
test ecx, ecx
jne 0x1400421f9
lea rcx, str.setupapi.dll
jmp 0x14004222c
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, [rsp + 0x40]
lea rdx, str._wsmui_fallback_04x_setupapi.dll.mui
lea rcx, [rbp + 0x150]
movzx r9d, di
call fcn.140042960
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140042332
cmp dword [0x1400dc080], r13d
mov dword [rsp + 0x20], ntohl
movzx r9d, di
mov r8d, 0x90a
mov rdx, rax
lea rcx, [0x1400dcae0]
je 0x14004227a
call fcn.1400414fc
mov r8d, 0x90a
lea rcx, [0x1400dc6c0]
jmp 0x140042308
call fcn.1400414fc
lea rcx, [0x1400dc6c0]
movzx r9d, di
mov r8d, 0x90a
mov rdx, rbx
mov dword [rsp + 0x20], esi
call fcn.1400414fc
lea rcx, [0x1400dc8d0]
movzx r9d, di
mov r8d, 0x90c
mov rdx, rbx
mov dword [rsp + 0x20], ntohl
call fcn.1400414fc
lea rcx, [0x1400dc4b0]
movzx r9d, di
mov r8d, 0x90c
mov rdx, rbx
mov dword [rsp + 0x20], esi
call fcn.1400414fc
lea rcx, [0x1400dc2a0]
movzx r9d, di
mov r8d, 0x90e
mov rdx, rbx
mov dword [rsp + 0x20], ntohl
call fcn.1400414fc
mov r8d, 0x90e
lea rcx, [0x1400dc090]
movzx r9d, di
mov rdx, rbx
mov dword [rsp + 0x20], esi
call fcn.1400414fc
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, 0x717
jne 0x140042359
mov esi, 0xf
jmp 0x140042346
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LoadLibrary_failed_0x_X._n
mov edx, eax
call fcn.1400300fc
mov ecx, dword [rsp + 0x30]
inc ecx
mov dword [rsp + 0x30], ecx
cmp ecx, 2
jb 0x1400421ec
lea r9, str.6E8C6998_8228_4f7a_B8F6_C9AF8685A043
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, str.7E8C6998_8228_4f7a_B8F6_C9AF8685A043
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [0x1400dcce8], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r8, [0x140041d6c]
mov r9, r12
mov qword [0x1400dccf8], rax
lea rax, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x1400dccf8]
mov edx, 0x7d0
mov qword [0x1400dccf0], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400dccf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400dccf0]
mov edx, 0xfffffff1
mov qword [0x1400dccf8], r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.14005ba20
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret