Function at 0x140052f40
Capabilities:
Check os version
Enumerate pe sections
Load ntoskrnl

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor esi, esi
cmp qword [0x14013b960], 0
je 0x140053479
cmp qword [0x14013b968], 0
je 0x140053479
lea rcx, [rsp + 0x64]
xor esi, esi
mov r8d, 0x118
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
cmp eax, 0xbfffffff
ja 0x140053479
xor esi, esi
cmp dword [rsp + 0x64], 0xa
jne 0x140053479
cmp dword [rsp + 0x6c], 0x6ad
jb 0x140053479
lea rcx, [0x14013b988]
call fcn.140052dd0
test al, al
je 0x14005344b
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
lea rcx, [0x14013b978]
lea rdx, [0x14013b980]
lea r8, [rsp + 0x40]
call fcn.140052cb0
mov dil, 1
test al, al
je 0x140053081
lea rcx, str.ntoskrnl.exe
xor edx, edx
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x14013b970], rax
test rax, rax
je 0x140053081
movsxd rcx, dword [rax + 0x3c]
lea r12, [rcx + rax]
movzx edx, word [rcx + rax + 0x14]
add rdx, r12
add rdx, 0x18
movzx ecx, word [rcx + rax + 6]
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x140053162
mov qword [rsp + 0x30], r12
mov rcx, qword [0x14013b978]
mov qword [rsp + 0x38], rcx
lea rsi, [0x1400de3a0]
xor edi, edi
jmp 0x14005309e
jmp 0x140053409
test r12b, 1
jne 0x1400534a3
inc rdi
cmp rdi, qword [rsp + 0x28]
je 0x140053158
lea rcx, [rdi + rdi*4]
mov r8d, dword [rdx + rcx*8 + 0x24]
mov r9d, 0x22000000
and r8d, r9d
cmp r8d, 0x20000000
jne 0x140053090
lea rcx, [rdx + rcx*8]
mov ebx, dword [rcx + 8]
cmp rbx, 0x20
je 0x140053090
add rbx, 0xffffffffffffffe0
cmp rbx, 2
mov r14d, 1
cmovae r14, rbx
mov r15d, dword [rcx + 0xc]
mov r12b, 1
mov ebp, r15d
xor r13d, r13d
jmp 0x140053107
test r11b, 1
jne 0x140053086
inc r13
cmp r13, rbx
setb r12b
inc ebp
cmp r13, r14
je 0x140053090
mov ecx, ebp
add rcx, rax
lea r9d, [r15 + r13]
mov r8d, 1
xor r11d, r11d
jmp 0x140053132
cmp r8, 0x1f
setae r11b
add r8, 2
cmp r8, 0x21
je 0x1400530f0
movzx r10d, byte [r8 + rsi - 1]
cmp r10b, 0xff
je 0x140053145
cmp r10b, byte [rcx + r8 - 1]
jne 0x1400530f0
movzx r10d, byte [r8 + rsi]
cmp r10b, 0xff
je 0x140053120
cmp r10b, byte [rcx + r8]
je 0x140053120
jmp 0x1400530f6
xor r13d, r13d
mov r12, qword [rsp + 0x30]
jmp 0x140053165
xor r13d, r13d
mov qword [0x14013b990], r13
movzx r11d, word [r12 + 6]
test r11, r11
je 0x14005322f
mov r10, qword [0x14013b978]
xor r9d, r9d
mov esi, 0x22000000
xor edi, edi
jmp 0x14005319c
inc rdi
cmp rdi, r11
je 0x140053232
lea rcx, [rdi + rdi*4]
mov r8d, dword [rdx + rcx*8 + 0x24]
and r8d, esi
cmp r8d, 0x20000000
jne 0x140053190
lea rcx, [rdx + rcx*8]
mov r14d, dword [rcx + 8]
cmp r14, 5
je 0x140053190
add r14, 0xfffffffffffffffb
mov ebx, dword [rcx + 0xc]
cmp r14, 2
mov ecx, 1
cmovae rcx, r14
mov bpl, 1
xor r15d, r15d
jmp 0x1400531ef
inc r15
cmp r15, r14
setb bpl
cmp rcx, r15
je 0x140053190
lea r8d, [rbx + r15]
cmp byte [rax + r8], 0x48
jne 0x1400531e0
cmp byte [rax + r8 + 1], 0x83
jne 0x1400531e0
cmp byte [rax + r8 + 2], 0xc4
jne 0x1400531e0
cmp byte [rax + r8 + 3], 0x68
jne 0x1400531e0
cmp byte [rax + r8 + 4], 0xc3
jne 0x1400531e0
test bpl, 1
je 0x140053190
add ebx, r15d
add r10, rbx
mov r9, r10
jmp 0x140053232
xor r9d, r9d
mov qword [0x14013b998], r9
movzx esi, word [r12 + 6]
test rsi, rsi
je 0x1400532f8
mov r11, r12
mov rcx, qword [0x14013b978]
mov qword [rsp + 0x28], rcx
xor r10d, r10d
mov edi, 0x22000000
xor ebx, ebx
jmp 0x140053278
inc rbx
cmp rbx, rsi
je 0x1400532f3
lea rcx, [rbx + rbx*4]
mov r8d, dword [rdx + rcx*8 + 0x24]
and r8d, edi
cmp r8d, 0x20000000
jne 0x140053270
lea r8, [rdx + rcx*8]
mov ecx, dword [r8 + 8]
cmp rcx, 2
je 0x140053270
add rcx, 0xfffffffffffffffe
mov r14d, dword [r8 + 0xc]
cmp rcx, 2
mov r15d, 1
cmovae r15, rcx
mov bpl, 1
xor r8d, r8d
jmp 0x1400532cf
inc r8
cmp r8, rcx
setb bpl
cmp r15, r8
je 0x140053270
lea r12d, [r14 + r8]
cmp byte [rax + r12], 0x59
jne 0x1400532c0
cmp byte [rax + r12 + 1], 0xc3
jne 0x1400532c0
test bpl, 1
je 0x140053270
add r14d, r8d
mov r10, qword [rsp + 0x28]
add r10, r14
mov r12, r11
jmp 0x1400532fb
xor r10d, r10d
mov qword [0x14013b9a0], r10
movzx esi, word [r12 + 6]
test rsi, rsi
je 0x1400533cc
mov r11, r13
mov rcx, qword [0x14013b978]
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov edi, 0x22000000
xor ebx, ebx
jmp 0x14005333c
inc rbx
cmp rbx, rsi
je 0x1400533c7
lea rcx, [rbx + rbx*4]
mov ebp, dword [rdx + rcx*8 + 0x24]
and ebp, edi
cmp ebp, 0x20000000
jne 0x140053330
lea rcx, [rdx + rcx*8]
mov r15d, dword [rcx + 8]
cmp r15, 4
je 0x140053330
add r15, 0xfffffffffffffffc
mov r14d, dword [rcx + 0xc]
cmp r15, 2
mov r12d, 1
cmovae r12, r15
mov bpl, 1
xor ecx, ecx
jmp 0x14005338f
inc rcx
cmp rcx, r15
setb bpl
cmp r12, rcx
je 0x140053330
lea r13d, [r14 + rcx]
cmp byte [rax + r13], 0x48
jne 0x140053380
cmp byte [rax + r13 + 1], 0x89
jne 0x140053380
cmp byte [rax + r13 + 2], 1
jne 0x140053380
cmp byte [rax + r13 + 3], 0xc3
jne 0x140053380
test bpl, 1
je 0x140053330
add r14d, ecx
mov r8, qword [rsp + 0x28]
add r8, r14
mov r13, r11
jmp 0x1400533cf
xor r8d, r8d
mov qword [0x14013b9a8], r8
test r13, r13
setne al
test r9, r9
setne cl
and cl, al
test r10, r10
setne al
and al, cl
test r8, r8
setne cl
add r8, 3
mov qword [0x14013b9b0], r8
setne sil
and sil, cl
and sil, al
xor edi, edi
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x140053446
mov rcx, qword [rsp + 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140053441
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400534b3
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400d1e6c
test dil, dil
je 0x140053479
mov qword [0x14013b988], 0
mov qword [0x14013b978], 0
mov qword [0x14013b970], 0
mov qword [0x14013b980], 0
xor esi, esi
and sil, 1
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400d2000
mov eax, esi
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, r9d
mov r13, qword [rsp + 0x38]
add r13, rcx
jmp 0x14005315b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3