Function at 0x180035bd0
Capabilities:
Check os version

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x1f8
mov rax, qword [0x1800881a0]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x6c], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
movsxd rdx, dword [rsp + 0x6c]
lea r8, [0x180087dc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087dc0]
mov dword [rdx + rcx], eax
cmp dword [0x18008c90c], 0
jne 0x180035c7d
movzx eax, byte [rsp + 0x200]
test eax, eax
jne 0x180035c7d
lea rax, [0x1800d3970]
jmp 0x180036659
mov r8d, VarUI4FromDisp
xor edx, edx
lea rcx, [0x1800d3970]
call fcn.18004d3a0
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x64], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
movsxd rdx, dword [rsp + 0x64]
lea r8, [0x180087dc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087dc0]
mov dword [rdx + rcx], eax
mov dword [0x1800d3970], 0x11c
cmp qword [0x1800d26e8], 0
je 0x180035d27
lea rcx, [0x1800d3970]
call qword [0x1800d26e8]
mov dword [rsp + 0x60], eax
jmp 0x180035d2f
mov dword [rsp + 0x60], 0
cmp dword [rsp + 0x60], 0
je 0x1800364ca
mov eax, 1
mov word [rsp + 0x2c], ax
movsx rax, word [rsp + 0x2c]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x180035d79
movsx rax, word [rsp + 0x2c]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x2c]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
cmp dword [0x1800d3974], 6
ja 0x180035d9c
cmp dword [0x1800d3974], 6
jne 0x1800364c5
cmp dword [0x1800d3978], 2
jb 0x1800364c5
mov eax, 8
mov word [rsp + 0x34], ax
movsx rax, word [rsp + 0x34]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x180035ddb
movsx rax, word [rsp + 0x34]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x34]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
cmp qword [0x1800d1ab8], 0
je 0x180035dff
mov r8b, 3
mov edx, 2
xor ecx, ecx
call qword [0x1800d1ab8]
mov qword [rsp + 0x90], rax
jmp 0x180035e0b
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x24], 1
mov eax, SafeArrayGetDim
mov word [rsp + 0x30], ax
movsx rax, word [rsp + 0x30]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x180035e5f
movsx rax, word [rsp + 0x30]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x30]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
xor eax, eax
mov word [rsp + 0x20], ax
mov eax, 6
mov word [rsp + 0x20], ax
jmp 0x180035e7f
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
cmp eax, 0x14
jge 0x180035fdc
mov r8d, 0x11c
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.18004d3a0
mov eax, 7
mov word [rsp + 0x44], ax
movsx rax, word [rsp + 0x44]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x180035ee1
movsx rax, word [rsp + 0x44]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x44]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
mov eax, SafeArrayGetDim
mov word [rsp + 0x38], ax
movsx rax, word [rsp + 0x38]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x180035f20
movsx rax, word [rsp + 0x38]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x38]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
mov dword [rsp + 0xc0], 0x11c
movzx eax, word [rsp + 0x20]
mov dword [rsp + 0xc4], eax
mov dword [rsp + 0xc8], 0
xor eax, eax
mov word [rsp + 0x1d4], ax
xor eax, eax
mov word [rsp + 0x1d6], ax
cmp qword [0x1800d27a8], 0
je 0x180035f7e
mov r8, qword [rsp + 0x48]
mov edx, 2
lea rcx, [rsp + 0xc0]
call qword [0x1800d27a8]
mov dword [rsp + 0x5c], eax
jmp 0x180035f86
mov dword [rsp + 0x5c], 0
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x180035f97
jmp 0x180035fdc
movzx eax, word [rsp + 0x20]
mov dword [0x1800d3974], eax
mov dword [rsp + 0x80], 1
mov eax, dword [rsp + 0x80]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x180035fd7
xor r9d, r9d
lea r8, [0x180089ffc]
lea rdx, [0x18008a004]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x180035e72
cmp dword [rsp + 0x24], 0
je 0x18003602b
mov dword [rsp + 0x70], 1
mov eax, dword [rsp + 0x70]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x180036012
xor r9d, r9d
lea r8, [0x180089ffc]
lea rdx, [0x18008a004]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movzx eax, word [rsp + 0x20]
mov r8d, eax
lea rdx, [0x18008c910]
mov ecx, 3
call fcn.180040a70
cmp qword [0x1800d1ab8], 0
je 0x18003604f
mov r8b, 1
mov edx, 2
xor ecx, ecx
call qword [0x1800d1ab8]
mov qword [rsp + 0xb8], rax
jmp 0x18003605b
mov qword [rsp + 0xb8], 0
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x48], rax
cmp qword [0x1800d1ab8], 0
je 0x18003608f
mov r8b, 3
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [0x1800d1ab8]
mov qword [rsp + 0xa8], rax
jmp 0x18003609b
mov qword [rsp + 0xa8], 0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x48], rax
xor eax, eax
mov word [rsp + 0x20], ax
jmp 0x1800360be
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
cmp eax, 0xa
jge 0x18003619f
mov r8d, 0x11c
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.18004d3a0
mov dword [rsp + 0xc0], 0x11c
mov eax, dword [0x1800d3974]
mov dword [rsp + 0xc4], eax
movzx eax, word [rsp + 0x20]
mov dword [rsp + 0xc8], eax
xor eax, eax
mov word [rsp + 0x1d4], ax
xor eax, eax
mov word [rsp + 0x1d6], ax
cmp qword [0x1800d27a8], 0
je 0x180036141
mov r8, qword [rsp + 0x48]
mov edx, 3
lea rcx, [rsp + 0xc0]
call qword [0x1800d27a8]
mov dword [rsp + 0x54], eax
jmp 0x180036149
mov dword [rsp + 0x54], 0
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x18003615a
jmp 0x18003619f
mov dword [rsp + 0x88], 1
mov eax, dword [rsp + 0x88]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18003618f
xor r9d, r9d
lea r8, [0x180089ffc]
lea rdx, [0x18008a004]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movzx eax, word [rsp + 0x20]
mov dword [0x1800d3978], eax
jmp 0x1800360b1
cmp dword [rsp + 0x24], 0
je 0x1800361fe
mov eax, 3
mov word [rsp + 0x40], ax
movsx rax, word [rsp + 0x40]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x1800361e5
movsx rax, word [rsp + 0x40]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x40]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
movzx eax, word [rsp + 0x20]
mov r8d, eax
lea rdx, [0x18008c950]
mov ecx, 3
call fcn.180040a70
cmp qword [0x1800d1ab8], 0
je 0x180036222
mov r8b, 1
mov edx, 2
xor ecx, ecx
call qword [0x1800d1ab8]
mov qword [rsp + 0x98], rax
jmp 0x18003622e
mov qword [rsp + 0x98], 0
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
cmp qword [0x1800d1ab8], 0
je 0x180036262
mov r8b, 1
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [0x1800d1ab8]
mov qword [rsp + 0xa0], rax
jmp 0x18003626e
mov qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rax
cmp qword [0x1800d1ab8], 0
je 0x1800362a2
mov r8b, 3
mov edx, 0x20
mov rcx, qword [rsp + 0x48]
call qword [0x1800d1ab8]
mov qword [rsp + 0xb0], rax
jmp 0x1800362ae
mov qword [rsp + 0xb0], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
xor eax, eax
mov word [rsp + 0x20], ax
jmp 0x1800362d1
movzx eax, word [rsp + 0x20]
inc ax
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
cmp eax, 0xa
jge 0x1800364a5
mov r8d, 0x11c
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.18004d3a0
mov eax, 0x11
mov word [rsp + 0x28], ax
movsx rax, word [rsp + 0x28]
lea rcx, [0x180087dc0]
cmp dword [rcx + rax*4], 1
jne 0x180036333
movsx rax, word [rsp + 0x28]
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x28]
lea rdx, [0x180087dc0]
mov dword [rdx + rcx*4], eax
mov dword [rsp + 0xc0], 0x11c
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x84], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
movsxd rdx, dword [rsp + 0x84]
lea r8, [0x180087dc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087dc0]
mov dword [rdx + rcx], eax
mov eax, dword [0x1800d3974]
mov dword [rsp + 0xc4], eax
mov eax, dword [0x1800d3978]
mov dword [rsp + 0xc8], eax
movzx eax, word [rsp + 0x20]
mov word [rsp + 0x1d4], ax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x7c], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
movsxd rdx, dword [rsp + 0x7c]
lea r8, [0x180087dc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087dc0]
mov dword [rdx + rcx], eax
xor eax, eax
mov word [rsp + 0x1d6], ax
cmp qword [0x1800d27a8], 0
je 0x18003647b
mov r8, qword [rsp + 0x48]
mov edx, 0x23
lea rcx, [rsp + 0xc0]
call qword [0x1800d27a8]
mov dword [rsp + 0x58], eax
jmp 0x180036483
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x180036494
jmp 0x1800364a5
movzx eax, word [rsp + 0x20]
mov word [0x1800d3a84], ax
jmp 0x1800362c4
cmp dword [rsp + 0x24], 0
je 0x1800364c5
movzx eax, word [rsp + 0x20]
mov r8d, eax
lea rdx, [0x18008c988]
mov ecx, 3
call fcn.180040a70
jmp 0x180036607
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
and rax, 0xffff
movzx eax, ax
and rax, 0xff
movzx eax, al
mov dword [0x1800d3974], eax
mov dword [rsp + 0x74], 1
mov eax, dword [rsp + 0x74]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x18003651f
xor r9d, r9d
lea r8, [0x180089ffc]
lea rdx, [0x18008a004]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [rsp + 0x50]
and rax, 0xffff
movzx eax, ax
shr rax, 8
and rax, 0xff
movzx eax, al
mov dword [0x1800d3978], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
xor edx, edx
mov ecx, SafeArrayGetElement
div rcx
mov rax, rdx
mov dword [rsp + 0x78], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
movsxd rdx, dword [rsp + 0x78]
lea r8, [0x180087dc0]
mov eax, dword [rcx + rax]
mov dword [r8 + rdx*4], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x180087dc0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0
lea rdx, [0x180087dc0]
mov dword [rdx + rcx], eax
cmp dword [rsp + 0x50], 0x80000000
jae 0x1800365fe
mov dword [rsp + 0x68], 1
mov eax, dword [rsp + 0x68]
cdq
sub eax, edx
sar eax, 1
cmp eax, 0x32
jle 0x1800365e7
xor r9d, r9d
lea r8, [0x180089ffc]
lea rdx, [0x18008a004]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [rsp + 0x50]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [0x1800d397c], eax
xor eax, eax
mov word [0x1800d3a84], ax
mov dword [0x18008c90c], 0
lea rax, [0x1800d3970]
jmp 0x180036659
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.18004d370
add rsp, 0x1f8
ret