Function at 0x140029ac0
Capabilities:
Check os version

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov rsi, rcx
lea rdx, [0x1400b24c4]
lea rcx, [rsp + 0x90]
mov r8d, 0xb
call fcn.14007ff70
movzx eax, byte [rsp + 0xa8]
cmp al, 2
je 0x14002be3f
mov rdi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
lea r13, [rsp + 0xa9]
test al, al
je 0x140029daf
lea rdx, str.AppDataRoamingMicrosoft
lea rcx, [rsp + 0x90]
mov r8d, 0x19
call fcn.14000f9e0
mov r14, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x130]
mov rdx, rdi
mov r8, rbx
mov r9, r14
call fcn.1400863b0
cmp qword [rsp + 0x98], 0
je 0x140029b8a
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x140029ba1
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1400b24c4]
lea rcx, [rsp + 0x90]
mov r8d, 0xb
call fcn.14007ff70
movzx eax, byte [rsp + 0xa8]
cmp al, 2
je 0x14002be46
mov rdi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
test al, al
je 0x140029e47
lea rdx, str.AppDataRoamingMicrosoftProtect
lea rcx, [rsp + 0x90]
mov r8d, 0x21
call fcn.14000f9e0
mov r14, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x108]
mov rdx, rdi
mov r8, rbx
mov r9, r14
call fcn.1400863b0
cmp qword [rsp + 0x98], 0
je 0x140029c4d
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x140029c64
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1400b24c4]
lea rcx, [rsp + 0x90]
mov r8d, 0xb
call fcn.14007ff70
movzx eax, byte [rsp + 0xa8]
cmp al, 2
je 0x14002be4d
mov rdi, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
test al, al
je 0x140029ee7
lea rdx, str.AppDataRoamingMicrosoftProtectS_0_2_33_8774236410_5547236945_4104468792_1000
lea r14, [rsp + 0x90]
mov r8d, 0x50
mov rcx, r14
call fcn.14000f9e0
mov r15, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.1400863b0
cmp qword [rsp + 0x98], 0
je 0x140029d10
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
test r12, r12
je 0x140029d27
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
movups xmm0, xmmword [rsp + 0x130]
movups xmm1, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [rsp + 0x108]
movups xmm1, xmmword [rsp + 0x118]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm1
movups xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm1
mov eax, dword [0x1400f92c4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x140029f87
add rax, 0x110
jmp 0x140029f8c
test rbx, rbx
je 0x140029b28
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x140029ddc
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop dword [rax]
mov rdx, rcx
cmp rcx, rax
je 0x140029b28
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140029dd0
cmp r8b, 0xe0
jb 0x140029dc1
cmp r8b, 0xed
jne 0x140029e1e
cmp rcx, rax
je 0x140029b28
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140029b28
cmp byte [rdx + 1], 0x9f
ja 0x14002bed1
add rdx, 3
mov rcx, rdx
jmp 0x140029dd0
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140029dd0
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140029dd0
test rbx, rbx
je 0x140029beb
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x140029e7c
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop word cs:[rax + rax]
mov rdx, rcx
cmp rcx, rax
je 0x140029beb
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140029e70
cmp r8b, 0xe0
jb 0x140029e59
cmp r8b, 0xed
jne 0x140029ebe
cmp rcx, rax
je 0x140029beb
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140029beb
cmp byte [rdx + 1], 0x9f
ja 0x14002bf24
add rdx, 3
mov rcx, rdx
jmp 0x140029e70
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140029e70
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140029e70
test rbx, rbx
je 0x140029cae
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x140029f1c
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop word cs:[rax + rax]
mov rdx, rcx
cmp rcx, rax
je 0x140029cae
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140029f10
cmp r8b, 0xe0
jb 0x140029ef9
cmp r8b, 0xed
jne 0x140029f5e
cmp rcx, rax
je 0x140029cae
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140029cae
cmp byte [rdx + 1], 0x9f
ja 0x14002bf77
add rdx, 3
mov rcx, rdx
jmp 0x140029f10
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140029f10
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140029f10
call fcn.1400685e0
mov rax, qword [rax]
mov r8, qword [rax + 0x210]
lea rax, [rsp + 0xf7]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 3
mov ecx, 3
mov r9d, 1
xor edx, edx
call fcn.1400109d0
cmp qword [rsp + 0x98], 0
je 0x140029fe5
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1400f91f8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xb8], 0
je 0x14002a007
mov r8, qword [rsp + 0xb0]
mov rcx, qword [0x1400f91f8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xd8], 0
je 0x14002a029
mov r8, qword [rsp + 0xd0]
mov rcx, qword [0x1400f91f8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1400b24c4]
lea rcx, [rsp + 0x90]
mov r8d, 0xb
call fcn.14007ff70
movzx eax, byte [rsp + 0xa8]
cmp al, 2
je 0x14002be54
mov rdi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
test al, al
je 0x14002a89a
test rbx, rbx
je 0x14002a073
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x14002a8cc
mov al, 2
jmp 0x14002bee3
mov al, 2
jmp 0x14002bf36
mov al, 2
jmp 0x14002bf89
mov al, 2
jmp 0x14002bfe2
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0x63], ecx
mov dword [rsp + 0x60], eax
xor eax, eax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r15
mov qword [rsp + 0xa0], rbx
mov byte [rsp + 0xa8], al
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x63]
mov dword [rsp + 0xa9], eax
mov dword [rsp + 0xac], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x14002c1c5
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0x63], ecx
mov dword [rsp + 0x60], eax
xor eax, eax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r15
mov qword [rsp + 0xa0], rbx
mov byte [rsp + 0xa8], al
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x63]
mov dword [rsp + 0xa9], eax
mov dword [rsp + 0xac], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x14002c1c5
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0x63], ecx
mov dword [rsp + 0x60], eax
xor eax, eax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], rbx
mov byte [rsp + 0xa8], al
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x63]
mov dword [rsp + 0xa9], eax
mov dword [rsp + 0xac], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x14002c1c5