Function at 0x1c000c008
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rdi, rdx
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x150
call fcn.1c0002080
xor edx, edx
lea rcx, [rbp + 0xb4]
mov r8d, 0x110
call fcn.1c0002080
lea rcx, [rbp + 0xb0]
mov dword [rbp + 0xb0], 0x114
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
nop dword [rax + rax]
test eax, eax
js 0x1c000c0a1
cmp dword [rbp + 0xb4], 6
ja 0x1c000c097
jne 0x1c000c0a1
cmp dword [rbp + 0xb8], 2
jb 0x1c000c0a1
mov dword [0x1c00040a0], 0x200
lea rax, [0x1c0007010]
mov ebx, 0xb004
mov qword [rsp + 0x68], rax
mov rcx, rdi
lea rax, [0x1c00074e0]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x70], rax
lea rax, [fcn.1c0007e20]
mov qword [rsp + 0x78], rax
lea rax, [0x1c0007f80]
mov qword [rbp - 0x80], rax
lea rax, [0x1c0007fa0]
mov qword [rbp - 0x78], rax
lea rax, [0x1c0007fb0]
mov qword [rbp - 0x60], rax
lea rax, [0x1c0008040]
mov qword [rbp - 0x58], rax
lea rax, [0x1c0008060]
mov qword [rbp - 0x50], rax
lea rax, [0x1c0008150]
mov qword [rbp - 0x48], rax
lea rax, [0x1c00010f0]
mov qword [rbp - 0x38], rax
lea rax, [0x1c0008710]
mov qword [rbp - 0x30], rax
lea rax, [0x1c00013a0]
mov qword [rbp + 0x70], rax
lea rax, [0x1c0001490]
mov qword [rbp + 0x78], rax
lea rax, [0x1c0001010]
mov qword [rbp + 0x68], rax
lea rax, [0x1c0008720]
mov qword [rbp - 0x18], rax
lea rax, [0x1c0008850]
mov qword [rbp], rax
lea rax, [0x1c00087b0]
mov qword [rbp - 8], rax
lea rax, [0x1c0008980]
mov qword [rbp + 0x60], rax
lea rax, [0x1c0008bc0]
mov qword [rbp + 0x18], rax
lea rax, [0x1c0008d40]
mov qword [rbp + 0x20], rax
lea rax, [0x1c0008d50]
mov qword [rbp + 0x28], rax
lea rax, [0x1c0009290]
mov qword [rbp + 0x30], rax
lea rax, [0x1c0001100]
mov qword [rbp + 0x38], rax
lea rax, [0x1c00092a0]
mov qword [rbp + 0x40], rax
lea rax, [0x1c00092c0]
mov qword [rbp + 0x48], rax
lea rax, [0x1c0009350]
mov qword [rbp + 0x58], rax
call fcn.1c0009878
and qword [rsp + 0x48], 0
xor sil, sil
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
mov qword [0x1c00042b8], r14
test r14, r14
je 0x1c000c317
test rdi, rdi
je 0x1c000c317
mov ecx, dword [rsp + 0x60]
lea eax, [rcx - 0x1052]
cmp eax, 1
jbe 0x1c000c274
cmp ecx, 0x2005
je 0x1c000c274
cmp ecx, 0x300e
je 0x1c000c274
lea eax, [rcx - 0x4002]
cmp eax, 1
jbe 0x1c000c274
cmp ecx, 0x5023
je 0x1c000c274
cmp ecx, 0x6003
je 0x1c000c274
lea eax, [rcx - 0x6010]
cmp eax, 1
jbe 0x1c000c274
cmp ecx, 0x700a
je 0x1c000c274
cmp ecx, 0x8001
je 0x1c000c274
cmp ecx, 0x9006
je 0x1c000c274
cmp ecx, 0xa00b
je 0x1c000c274
cmp ecx, ebx
jae 0x1c000c274
mov ebx, 0xc0000059
jmp 0x1c000c31c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1c0001dd0
mov ecx, 0x80000000
mov ebx, eax
add eax, ecx
mov edx, 0xc000010e
test ecx, eax
jne 0x1c000c299
cmp ebx, edx
jne 0x1c000c2bf
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
cmp ebx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
setne sil
call fcn.1c000aa00
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1c000c2d5
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
nop dword [rax + rax]
test ebx, ebx
js 0x1c000c30b
mov rax, qword [rsp + 0x70]
lea r8, [rsp + 0x60]
mov qword [0x1c0004290], rax
mov rdx, rdi
lea rax, [0x1c000ab00]
mov rcx, r14
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x50]
call qword [0x1c0006170]
mov ebx, eax
jmp 0x1c000c31c
test sil, sil
je 0x1c000c31c
call fcn.1c0001f04
jmp 0x1c000c31c
mov ebx, 0xc000000d
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1c0001f70
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret