Function at 0x14001d85c
Capabilities:
Check os version
Get system information on windows

Disassembly:
jmp 0x14003d1b0
push rbp
push rbx
push rdi
sub rsp, 0x4f0
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xd0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x140084faf]
call fcn.14001df69
mov dword [rbp + 4], 0
lea rcx, str.___Debug_Mode_Run__several_features__like_a_shellcode_proper_generation__will_be_unavailable_r_n
call fcn.14001de79
mov r8d, 0x20
xor edx, edx
lea rcx, [rbp + 0x168]
call fcn.14001dba9
mov r8d, 0x10
xor edx, edx
lea rcx, [rbp + 0x1a8]
call fcn.14001dba9
xor eax, eax
xor ecx, ecx
cpuid
lea r8, [rbp + 0x1a8]
mov dword [r8], eax
mov dword [r8 + 4], ebx
mov dword [r8 + 8], ecx
mov dword [r8 + 0xc], edx
mov eax, 4
imul rax, rax, 1
mov eax, dword [rbp + rax + 0x1a8]
mov dword [rbp + 0x168], eax
mov eax, 4
imul rax, rax, 3
mov eax, dword [rbp + rax + 0x1a8]
mov dword [rbp + 0x16c], eax
mov eax, 4
imul rax, rax, 2
mov eax, dword [rbp + rax + 0x1a8]
mov dword [rbp + 0x170], eax
lea rdx, [rbp + 0x168]
lea rcx, str.___CPU_vendor_string:__s_r_n
call fcn.14001de79
mov edx, 0x114
lea rcx, [rbp + 0x30]
call fcn.14001dad2
mov dword [rbp + 0x30], 0x114
lea rcx, [rbp + 0x30]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
cmp dword [rbp + 0x34], 6
jb 0x14003d2c3
cmp dword [rbp + 0x34], 6
jne 0x14003d2ba
cmp dword [rbp + 0x38], 0
je 0x14003d2c3
cmp dword [rbp + 0x3c], 0x1db0
jne 0x14003d2e0
lea rdx, str.____Unsupported_WinNT_version_r_n
mov ecx, 1
call fcn.14001d46f
mov dword [rbp + 4], 0x519
jmp 0x14003d4f0
call fcn.14001de97
movzx eax, al
test eax, eax
jne 0x14003d304
lea rcx, str.____Administrator_privileges_are_required_to_continue._r_nVerify_that_you_have_sufficient_privileges_and_you_are_not_running_program_under_compatibility_layer._r_n
call fcn.14001de79
mov dword [rbp + 4], 0x522
jmp 0x14003d4f0
mov eax, dword [rbp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x38]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x34]
lea r8, str.___Windows_version:__u._u_build__u
mov edx, 0x64
lea rcx, [rbp + 0x1e0]
call fcn.14001d4e2
lea rdx, [rbp + 0x1e0]
lea rcx, str._s_r_n
call fcn.14001de79
lea rcx, [rbp + 0x264]
call fcn.14001d41f
movzx eax, al
test eax, eax
je 0x14003d390
movzx eax, byte [rbp + 0x264]
test eax, eax
je 0x14003d36f
lea rax, [0x14006706c]
mov qword [rbp + 0x4b8], rax
jmp 0x14003d37d
lea rax, str.disa
mov qword [rbp + 0x4b8], rax
mov rdx, qword [rbp + 0x4b8]
lea rcx, str.___SecureBoot_is__sbled_on_this_machine_r_n
call fcn.14001de79
lea r8, [rbp + 0x2c4]
lea rdx, [rbp + 0x2a4]
lea rcx, [rbp + 0x284]
call fcn.14001da55
movzx eax, al
test eax, eax
je 0x14003d3c8
movzx eax, byte [rbp + 0x284]
test eax, eax
je 0x14003d3c8
lea rcx, str.___Windows_HVCI_mode_detected_r_n
call fcn.14001de79
mov dword [rbp + 0x304], 0
mov dword [rbp + 0x2e8], 8
mov dword [rbp + 0x2ec], 0
lea r9, [rbp + 0x304]
mov r8d, 8
lea rdx, [rbp + 0x2e8]
mov ecx, 0x67
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x14003d473
mov eax, dword [rbp + 0x2ec]
and eax, 2
test eax, eax
je 0x14003d422
lea rcx, str.___Test_Mode_ENABLED_r_n
call fcn.14001de79
mov eax, dword [rbp + 0x2ec]
and eax, 0x80
test eax, eax
je 0x14003d43d
lea rcx, str.___Debug_Mode_ENABLED_r_n
call fcn.14001de79
mov eax, dword [rbp + 0x2ec]
and eax, 0x400
test eax, eax
je 0x14003d458
lea rcx, str.___HVCI_KMCI_ENABLED_r_n
call fcn.14001de79
mov eax, dword [rbp + 0x2ec]
and eax, 0x4000
test eax, eax
je 0x14003d473
lea rcx, str.___WHQL_enforcement_ENABLED_r_n
call fcn.14001de79
cmp dword [rbp + 0x3c], 0x4563
jb 0x14003d4d2
mov dword [rbp + 0x324], 0
xor edx, edx
lea rcx, [rbp + 0x324]
call fcn.14001dd93
test eax, eax
je 0x14003d4d2
cmp dword [rbp + 0x324], 0
je 0x14003d4b1
lea rax, [0x14006706c]
mov qword [rbp + 0x4b8], rax
jmp 0x14003d4bf
lea rax, str.disa
mov qword [rbp + 0x4b8], rax
mov rdx, qword [rbp + 0x4b8]
lea rcx, str.___MSFT_Driver_block_list_is__sbled_r_n
call fcn.14001de79
movzx eax, byte [rbp + 0x284]
mov edx, dword [rbp + 0x3c]
mov ecx, eax
call fcn.14001d816
mov dword [rbp + 4], eax
xor eax, eax
test eax, eax
jne 0x14003d1f0
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140066240]
call fcn.14001dcb2
mov eax, edi
lea rsp, [rbp + 0x4c0]
pop rdi
pop rbx
pop rbp
ret