Function at 0x14016d870
Capabilities:
Check os version
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1d8
movups xmmword [rsp + 0x1c0], xmm6
mov ebp, 0x16
cmp qword [rcx], 0xffffffffffffffff
mov dword [rsp + 0x58], 0xffffffff
mov rsi, rcx
mov rdi, rdx
jne 0x14016dc40
test r8d, 0xfc00bffe
jne 0x14016dc40
mov ebx, dword [rcx + 0x18]
lea r12, [rsp + 0x60]
mov rcx, rdi
mov dword [rsp + 0x64], 0
mov rdx, r12
or ebx, r8d
mov eax, ebx
not eax
test eax, 0x404000
setne al
movzx eax, al
lea r8d, [rax + rax*8]
call fcn.14016c740
mov ebp, eax
test eax, eax
jne 0x14016dc40
test ebx, 0x20000
je 0x14016dc60
and ebx, 0xfff7ffff
or ebx, 0x20000000
mov dword [rsi + 0x18], ebx
mov rcx, rdi
call sym.strdup
mov r15d, dword [rsi + 0x30]
mov edx, 0x30
mov qword [rsi + 0x38], rax
mov r14, rax
mov rcx, r15
call sym.calloc
mov edx, 2
mov rcx, r15
mov qword [rsi + 0x90], rax
mov rdi, rax
call sym.calloc
mov edx, 4
mov rcx, r15
mov qword [rsi + 0x98], rax
mov r13, rax
call sym.calloc
test rdi, rdi
sete dl
test r14, r14
mov qword [rsi + 0xa0], rax
sete cl
or edx, ecx
test r13, r13
sete cl
or dl, cl
jne 0x14016dca3
test rax, rax
je 0x14016dca3
lea rax, [sym.mdb_cmp_long]
mov qword [rdi + 0x10], rax
mov edi, ebx
and edi, 0x420000
jne 0x14016dcb8
lea r8, [rsp + 0x58]
mov rdx, r12
mov rcx, rsi
call fcn.14016c8f0
mov r13d, dword [rsp + 0x58]
test eax, eax
jne 0x14016dc20
mov eax, ebx
and eax, 0x2000000
mov dword [rsp + 0x34], eax
je 0x14016d9d1
test r13d, r13d
je 0x14016e207
mov r9, rsi
mov r8d, 1
mov rdx, r12
mov rcx, rsi
call fcn.14016c800
test eax, eax
jne 0x14016dc20
mov byte [rsp + 0x4b], 1
mov eax, dword [rsi + 0x18]
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, al
cmp eax, 6
sbb eax, eax
and eax, 0xfffff400
add eax, 0x1000
cmp qword [0x14026a138], 0
mov dword [rsi + 0xec], eax
je 0x14016e098
test byte [rsi + 0x1b], 0x40
jne 0x14016dd48
lea rax, [rsp + 0x5c]
xor r15d, r15d
mov edi, 2
mov qword [rsp + 0x40], rax
lea r14, [rsp + 0x70]
pxor xmm6, xmm6
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], rax
movups xmmword [r14], xmm6
mov rcx, qword [rsi]
mov r9, qword [rsp + 0x40]
mov r8d, 0x98
movups xmmword [r14 + 0x10], xmm6
mov rdx, qword [rsp + 0x38]
mov dword [rsp + 0x80], r15d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14016dd18
mov eax, dword [rsp + 0x5c]
cmp eax, 0xffffffff
je 0x14016dd18
cmp eax, 0x98
jne 0x14016dd29
test byte [rsp + 0x12a], 8
je 0x14016e232
cmp dword [rsp + 0x130], 0xbeefc0de
jne 0x14016dd3a
cmp dword [rsp + 0x134], 1
jne 0x14016e228
test r15d, r15d
je 0x14016db00
mov r8d, dword [rsp + 0x34]
test r8d, r8d
je 0x14016e110
mov rdx, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x110]
cmp rdx, rax
jae 0x14016db98
nop
movdqu xmm1, xmmword [rsp + 0x130]
movdqu xmm2, xmmword [rsp + 0x140]
mov rax, qword [rsp + 0x1b0]
movdqu xmm3, xmmword [rsp + 0x150]
movdqu xmm4, xmmword [rsp + 0x160]
movups xmmword [rsp + 0x90], xmm1
movdqu xmm5, xmmword [rsp + 0x170]
movdqu xmm0, xmmword [rsp + 0x180]
movups xmmword [rsp + 0xa0], xmm2
movdqu xmm1, xmmword [rsp + 0x190]
movdqu xmm2, xmmword [rsp + 0x1a0]
mov qword [rsp + 0x110], rax
movups xmmword [rsp + 0xb0], xmm3
movups xmmword [rsp + 0xc0], xmm4
movups xmmword [rsp + 0xd0], xmm5
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm1
movups xmmword [rsp + 0x100], xmm2
mov eax, dword [rsp + 0xa8]
add r15d, eax
cmp edi, 1
je 0x14016de35
mov edi, 1
jmp 0x14016da57
mov rcx, qword [rsi]
mov byte [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea r9, [rsp + 0x120]
mov qword [rsp + 0x20], 0
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14016e211
mov rdx, qword [rsp + 0x98]
mov rcx, rsi
call fcn.14016cd50
test eax, eax
jne 0x14016dc20
mov rax, qword [rsi + 0x40]
lea rdx, [rsp + 0x90]
mov rcx, rsi
mov qword [rsp + 0x98], rax
call fcn.14016c000
test eax, eax
je 0x14016debc
nop
mov ebp, eax
mov edx, r13d
mov rcx, rsi
call fcn.14016c330
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x14016dc40
mov rcx, qword [rsp + 0x68]
call sym.free
nop
movups xmm6, xmmword [rsp + 0x1c0]
mov eax, ebp
add rsp, 0x1d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x1ffff
or ebx, 0x20000000
call sym.mdb_midl_alloc
mov qword [rsi + 0xd0], rax
test rax, rax
je 0x14016dca0
mov edx, 0x10
mov ecx, 0x20000
call sym.calloc
mov qword [rsi + 0xd8], rax
test rax, rax
jne 0x14016d908
nop dword [rax + rax]
mov dword [rsi + 0x18], ebx
mov r13d, 0xffffffff
mov ebp, 0xc
jmp 0x14016dc22
mov r8d, ebx
mov r9, rsi
mov rdx, r12
mov rcx, rsi
shr r8d, 0x11
xor r8d, 1
mov eax, r8d
and r8d, 1
and eax, 1
mov byte [rsp + 0x4b], al
call fcn.14016c800
test eax, eax
jne 0x14016dd08
cmp edi, 0x20000
je 0x14016dfa0
mov eax, ebx
mov r13d, 0xffffffff
and eax, 0x2000000
mov dword [rsp + 0x34], eax
jmp 0x14016d9f2
mov ebp, eax
mov r13d, 0xffffffff
jmp 0x14016dc22
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
setne al
movzx eax, al
neg eax
or r15d, eax
je 0x14016e00c
test eax, eax
js 0x14016dff5
mov eax, 0xffff87b7
jmp 0x14016dc20
mov rax, qword [rsi + 0x78]
xor edx, edx
mov rcx, rsi
add rax, 0x1fffff
and rax, 0xffffffffffe00000
mov qword [rsi + 0x78], rax
mov eax, dword [rsi + 0x20]
mov dword [rsi + 0x1c], eax
call fcn.14016cd50
test eax, eax
jne 0x14016e003
mov rcx, qword [rsi + 0x40]
xor edx, edx
test byte [rcx + 0xa], 8
je 0x14016e00c
mov rax, qword [rsi + rdx*8 + 0x50]
cmp dword [rax], 0xbeefc0de
jne 0x14016dd3a
cmp dword [rax + 4], 1
jne 0x14016e228
test rdx, rdx
je 0x14016e12e
mov rdx, qword [rax + 0x80]
mov rcx, qword [rsp + 0x110]
cmp rcx, rdx
jae 0x14016de2e
movdqu xmm4, xmmword [rax]
movdqu xmm5, xmmword [rax + 0x10]
movdqu xmm0, xmmword [rax + 0x20]
movdqu xmm3, xmmword [rax + 0x60]
movups xmmword [rsp + 0x90], xmm4
movdqu xmm4, xmmword [rax + 0x30]
movups xmmword [rsp + 0xa0], xmm5
movdqu xmm5, xmmword [rax + 0x40]
movups xmmword [rsp + 0xb0], xmm0
movdqu xmm0, xmmword [rax + 0x50]
movups xmmword [rsp + 0xc0], xmm4
movdqu xmm4, xmmword [rax + 0x70]
mov rax, qword [rax + 0x80]
movups xmmword [rsp + 0xd0], xmm5
mov qword [rsp + 0x110], rax
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm3
movups xmmword [rsp + 0x100], xmm4
mov eax, dword [rsp + 0xa8]
mov dword [rsi + 0x1c], eax
mov r8d, eax
mov rax, qword [rsp + 0x108]
xor r9d, r9d
lea rcx, [rax + 1]
mov rdx, qword [rsi + 0x78]
test rdx, rdx
jne 0x14016de5f
mov rdx, qword [rsp + 0xa0]
mov qword [rsi + 0x78], rdx
mov eax, r8d
imul rax, rcx
cmp rdx, rax
jae 0x14016de72
mov qword [rsi + 0x78], rax
mov rdx, rax
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0xa0], rdx
and eax, 1
test r9d, r9d
je 0x14016dfd0
test eax, eax
jne 0x14016dbb5
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.14016c000
test eax, eax
jne 0x14016dc20
xor edx, edx
mov rcx, rsi
call fcn.14016cd50
test eax, eax
jne 0x14016dc20
mov ecx, dword [rsi + 0x1c]
lea eax, [rcx - 0x10]
mov edx, eax
shr eax, 1
and eax, 0xfffffffe
shr edx, 3
sub eax, 2
sub edx, 1
mov dword [rsi + 0xe4], eax
mov rax, qword [rsi + 0x78]
mov dword [rsi + 0xe0], edx
xor edx, edx
div rcx
mov qword [rsi + 0x88], rax
and ebx, 0xa0000
je 0x14016e1b4
test r13d, r13d
jle 0x14016df0b
mov edx, dword [rsp + 0x34]
test edx, edx
je 0x14016e1e6
cmp byte [rsp + 0x4b], 0
je 0x14016dc2d
mov ebx, dword [rsi + 0x30]
mov edx, dword [rsi + 0x1c]
mov ecx, 1
call sym.calloc
imul edi, ebx, 0x3d
mov qword [rsi + 0x60], rax
add edi, 0x88
test rax, rax
je 0x14016e246
movsxd rdx, edi
mov ecx, 1
call sym.calloc
test rax, rax
je 0x14016e246
mov edx, ebx
lea rcx, [rax + 0x88]
mov qword [rax + 0x20], rsi
lea r8, [rdx + rdx*2]
mov qword [rax + 0x58], rcx
shl r8, 4
mov dword [rax + 0x7c], 1
add rcx, r8
mov qword [rsi + 0x70], rax
mov qword [rax + 0x68], rcx
lea rcx, [rcx + rdx*8]
lea rdx, [rcx + rdx*4]
mov qword [rax + 0x60], rcx
mov qword [rax + 0x70], rdx
mov rdx, qword [rsi + 0x90]
mov qword [rax + 0x50], rdx
jmp 0x14016dc2d
lea r8, [rsp + 0x58]
mov rdx, r12
mov rcx, rsi
call fcn.14016c8f0
test eax, eax
jne 0x14016e1fb
mov eax, ebx
mov r13d, dword [rsp + 0x58]
and eax, 0x2000000
mov dword [rsp + 0x34], eax
jmp 0x14016d9f2
test eax, eax
je 0x14016deaa
mov rdx, qword [rsp + 0x98]
mov rcx, rsi
call fcn.14016cd50
test eax, eax
je 0x14016debc
jmp 0x14016dc20
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14016de2e
cmp eax, 2
jne 0x14016dc20
mov edx, dword [rsi + 0x18]
mov eax, dword [rsi + 0x20]
mov ecx, 0x8000
lea r9, [rsp + 0x98]
movdqu xmm0, xmmword [0x14023a3b0]
mov rdi, r9
mov r9d, 1
cmp eax, ecx
cmovbe ecx, eax
xor eax, eax
or edx, 8
mov r8d, ecx
mov dword [rsi + 0x1c], ecx
mov ecx, 0x10
rep stosq qword [rdi], rax
mov rax, qword [0x14023a3a0]
mov ecx, 2
mov dword [rsp + 0xa8], r8d
mov word [rsp + 0xac], dx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xd0], 0xffffffffffffffff
mov qword [rsp + 0xa0], 0x100000
movups xmmword [rsp + 0x100], xmm0
jmp 0x14016de4a
lea rcx, str.NTDLL.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x14016e103
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
mov rcx, rax
call r15
mov qword [0x14026a128], rax
test rax, rax
je 0x14016e103
lea rdx, str.NtMapViewOfSection
mov rcx, rdi
call r15
mov qword [0x14026a130], rax
test rax, rax
je 0x14016e103
lea rdx, str.NtCreateSection
mov rcx, rdi
call r15
mov qword [0x14026a138], rax
test rax, rax
jne 0x14016da25
mov ebp, 0xffff87c5
jmp 0x14016dc22
mov rax, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x110]
cmp rdx, rax
jae 0x14016db98
jmp 0x14016db00
movdqu xmm3, xmmword [rax]
movdqu xmm4, xmmword [rax + 0x10]
mov edx, 1
movdqu xmm5, xmmword [rax + 0x20]
movdqu xmm0, xmmword [rax + 0x60]
movups xmmword [rsp + 0x90], xmm3
movdqu xmm3, xmmword [rax + 0x30]
movups xmmword [rsp + 0xa0], xmm4
movdqu xmm4, xmmword [rax + 0x40]
movups xmmword [rsp + 0xb0], xmm5
movdqu xmm5, xmmword [rax + 0x50]
movups xmmword [rsp + 0xc0], xmm3
movdqu xmm3, xmmword [rax + 0x70]
mov rax, qword [rax + 0x80]
movups xmmword [rsp + 0xd0], xmm4
mov qword [rsp + 0x110], rax
mov eax, dword [rsi + 0x1c]
movups xmmword [rsp + 0xe0], xmm5
movups xmmword [rsp + 0xf0], xmm0
add rcx, rax
movups xmmword [rsp + 0x100], xmm3
jmp 0x14016dd7a
lea r9, [rsi + 0x10]
mov r8d, 2
mov rdx, r12
mov rcx, rsi
call fcn.14016c800
test eax, eax
jne 0x14016dc20
test r13d, r13d
jle 0x14016df16
mov ecx, dword [rsp + 0x34]
test ecx, ecx
jne 0x14016df16
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.14016cf10
test eax, eax
je 0x14016df0b
mov r13d, dword [rsp + 0x58]
mov ebp, eax
jmp 0x14016dc22
mov ebp, 0xb
jmp 0x14016dc22
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14016deee
jmp 0x14016dc20
mov eax, 0xffff87b6
jmp 0x14016dc20
mov edx, dword [rsi + 0x18]
test edx, 0x40000000
jne 0x14016e00f
jmp 0x14016dd3a
mov r13d, dword [rsp + 0x58]
mov ebp, 0xc
jmp 0x14016dc22