Function at 0x1400792c0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x1a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rdx
lea r9, str.lpOsVerInfo_x
lea r8, str.MakeOsOptTbl
lea rdx, str.CScriptFileIF
mov rcx, qword [rcx + 0x40]
call fcn.140081070
lea r12, [rdi + 0x18]
mov rcx, qword [r12]
mov ebp, 1
test rcx, rcx
je 0x140079334
mov rax, qword [rcx]
mov edx, ebp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor ebx, ebx
mov qword [r12], rbx
test rsi, rsi
je 0x14007935f
mov r9d, reloc.OLEAUT32.dll_SafeArrayLock
mov r8, rsi
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.1400cd500
mov edx, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
jmp 0x1400793a1
mov dword [rsp + 0x70], 0x11c
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [rsp + 0x80]
mov dword [rsp + 0x30], edx
mov ecx, dword [rsp + 0x74]
mov dword [rsp + 0x34], ecx
mov edx, dword [rsp + 0x78]
mov dword [rsp + 0x38], edx
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x3c], eax
movzx eax, word [rsp + 0x184]
mov dword [rsp + 0x40], eax
cmp ecx, 5
jne 0x1400793b1
cmp edx, 2
jb 0x1400793bf
mov dword [rsp + 0x38], ebp
jmp 0x1400793bf
cmp ecx, 6
jne 0x1400793bf
cmp edx, ebp
cmovae edx, ebp
mov dword [rsp + 0x38], edx
mov rax, qword [rdi + 0x30]
mov edx, dword [rax]
shr rdx, 0x17
test bpl, dl
jne 0x140079478
xor eax, eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140078420
mov edx, dword [rsp + 0x5c]
cmp edx, 0xa
jae 0x1400793ff
lea edx, [rdx + rdx*4]
add edx, edx
mov eax, dword [rsp + 0x58]
imul eax, eax, 0x64
add eax, edx
cmp eax, 0x226
jge 0x140079424
cmp dword [rsp + 0x34], 5
jb 0x140079478
mov dword [rsp + 0x34], 5
mov dword [rsp + 0x38], ebx
jmp 0x140079478
cmp eax, 0x2bc
jge 0x140079440
cmp dword [rsp + 0x34], 6
jb 0x140079478
mov dword [rsp + 0x34], 5
mov dword [rsp + 0x38], ebp
jmp 0x140079478
cmp eax, 0x2f8
jge 0x14007945c
cmp dword [rsp + 0x34], 6
jb 0x140079478
mov dword [rsp + 0x34], 6
mov dword [rsp + 0x38], ebx
jmp 0x140079478
cmp dword [rsp + 0x34], 6
jb 0x140079478
mov dword [rsp + 0x34], 6
mov eax, ebx
cmp dword [rsp + 0x38], ebp
setae al
mov dword [rsp + 0x38], eax
lea rax, str.winnt
lea rsi, str.windows
cmp dword [rsp + 0x30], 2
cmove rsi, rax
call fcn.14009d5e8
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400794ae
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
or rbp, 0xffffffffffffffff
test rsi, rsi
je 0x14007950c
test rsi, 0xffffffffffff0000
jne 0x1400794f8
movzx esi, si
mov ecx, esi
call fcn.1400a1868
test rax, rax
je 0x140079523
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000a990
mov rdi, qword [rsp + 0x50]
jmp 0x140079523
xor eax, eax
mov rcx, rbp
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14007950e
mov ecx, ebx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140003940
mov rdi, qword [rsp + 0x50]
call fcn.14009d5e8
mov rcx, rax
test rax, rax
setne bl
test ebx, ebx
jne 0x140079540
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x34]
mov r8, rdi
lea rdx, str.._s_u_u
lea rcx, [rsp + 0x48]
call fcn.14000a800
mov rdx, qword [rsp + 0x48]
mov rcx, r12
call fcn.14005ce20
mov r9d, dword [rsp + 0x34]
mov r8, rdi
lea rdx, str.._s_dx
lea rcx, [rsp + 0x48]
call fcn.14000a800
mov rdx, qword [rsp + 0x48]
mov rcx, r12
call fcn.14005ce20
mov r9d, dword [rsp + 0x34]
mov r8, rdi
lea rdx, [0x140106570]
lea rcx, [rsp + 0x48]
call fcn.14000a800
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, r12
call fcn.14005ce20
lea rdx, [0x1400fb278]
mov rcx, r12
call fcn.14005ce20
nop
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400795f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140079616
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400cd6e0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbx, rcx
mov rax, qword [rcx + 0x40]
mov rdi, qword [rax + 0x178]
test rdi, rdi
je 0x14007a626
mov rax, qword [rdi]
cmp dword [rax + 0x174], 4
jl 0x14007a626
call fcn.14009d5e8
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14007a5ba
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [0x1400fb278]
mov qword [rsp + 0x20], rax
lea r9, str.MakeDiscriminationTbl
lea r8, str.CScriptFileIF
lea rdx, str.private__s::_s__s_
lea rcx, [rsp + 0x50]
call fcn.14000a800
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14002f200
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14007a626
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbx + 0x30]
mov eax, dword [rcx]
bt rax, 0xe
jae 0x14007a639
movzx eax, word [rcx + 0x40]
jmp 0x14007a63f
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx edx, ax
mov rcx, rbx
call fcn.1400796a0
mov rcx, qword [rbx + 0x30]
call fcn.14000e6f0
mov rdx, rax
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x1400792c0