Function at 0x1400b48a0
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address
Get system information on windows

Disassembly:
push rdi
push r15
sub rsp, 0x68
mov rax, qword [0x140108500]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.1400b4fd0
mov r15d, eax
test eax, eax
jns 0x1400b4901
cmp eax, 0xc0000510
jne 0x1400b4f39
mov rax, qword [0x140108820]
cmp word [rax], 2
jne 0x1400b48f7
movzx edx, word [rax + 2]
test dx, dx
jns 0x1400b48f7
mov ecx, 0x8001
cmp dx, cx
jne 0x1400b48f7
xor edi, edi
mov eax, edi
jmp 0x1400b4f39
mov eax, 0xc00000bb
jmp 0x1400b4f39
mov rax, qword [0x140108820]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], rsi
mov esi, 2
mov word [rax], si
mov rax, qword [0x140108820]
mov word [rax + 2], 0x8001
mov rax, qword [0x140108820]
mov qword [rax + 0x70], rax
mov rcx, qword [0x140108820]
add rcx, 0x18
call qword [sym.imp.kernel32.dll_GetSystemInfo]
lea r8, [rsp + 0x4c]
mov bl, 0xa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
mov eax, dword [rsp + 0x4c]
test eax, 0xf0000000
je 0x1400b4972
movzx eax, ax
mov dword [rsp + 0x4c], eax
mov ecx, dword [rsp + 0x20]
sub ecx, 5
je 0x1400b4a85
sub ecx, 1
je 0x1400b4a09
cmp ecx, 4
jne 0x1400b4abe
cmp dword [rsp + 0x48], 0
jne 0x1400b4abe
cmp eax, 0x2800
jb 0x1400b4abe
cmp eax, 0x3839
jb 0x1400b49f4
cmp eax, 0x3ad7
jb 0x1400b49df
cmp eax, 0x55f0
mov rax, qword [0x140108820]
jb 0x1400b49d1
mov edx, 0x138
mov byte [rax + 0x14], 9
jmp 0x1400b4ad1
mov edx, 0x120
mov byte [rax + 0x14], 8
jmp 0x1400b4ad1
mov rax, qword [0x140108820]
mov edx, 0x120
mov byte [rax + 0x14], 7
jmp 0x1400b4ad1
mov rax, qword [0x140108820]
mov edx, 0x118
mov byte [rax + 0x14], 6
jmp 0x1400b4ad1
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x1400b4a69
sub ecx, 1
je 0x1400b4a54
sub ecx, 1
je 0x1400b4a44
cmp ecx, 1
jne 0x1400b4abe
cmp eax, 0x2580
jne 0x1400b4abe
mov rax, qword [0x140108820]
mov edx, 0x118
mov byte [rax + 0x14], 5
jmp 0x1400b4ad1
cmp eax, 0x23f0
jne 0x1400b4abe
mov bl, 4
mov edx, 0x110
jmp 0x1400b4ac2
sub eax, 0x1db0
je 0x1400b4a60
cmp eax, 1
jne 0x1400b4abe
mov bl, 3
mov edx, 0xe0
jmp 0x1400b4ac2
sub eax, 0x1770
je 0x1400b4a7a
sub eax, 1
je 0x1400b4a7a
cmp eax, 1
jne 0x1400b4abe
movzx ebx, sil
mov edx, 0xc8
jmp 0x1400b4ac2
mov ecx, dword [rsp + 0x48]
cmp ecx, 1
jne 0x1400b4aa1
cmp eax, 0xa28
je 0x1400b4aac
mov rax, qword [0x140108820]
mov byte [rax + 0x14], bl
jmp 0x1400b4b06
cmp ecx, esi
jne 0x1400b4abe
cmp eax, 0xece
jne 0x1400b4abe
mov rax, qword [0x140108820]
mov edx, 0x98
mov byte [rax + 0x14], 1
jmp 0x1400b4ad1
mov edx, dword [rsp + 0x20]
mov rax, qword [0x140108820]
mov byte [rax + 0x14], bl
cmp bl, 0xa
je 0x1400b4b06
mov rax, qword [0x140108820]
mov ecx, dword [rsp + 0x20]
mov dword [rax + 8], ecx
mov rax, qword [0x140108820]
mov ecx, dword [rsp + 0x48]
mov dword [rax + 0xc], ecx
mov rax, qword [0x140108820]
mov ecx, dword [rsp + 0x4c]
mov dword [rax + 0x10], ecx
mov rax, qword [0x140108820]
mov word [rax + 0x16], dx
mov rax, qword [0x140108820]
cmp byte [rax + 0x14], 0xa
jne 0x1400b4b2d
mov rdx, rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, 0xc00000bb
jmp 0x1400b4f29
lea rcx, [rax + 0x88]
mov qword [rsp + 0x88], rbp
mov qword [rax + 0x48], rcx
add rcx, 0x20
mov rax, qword [0x140108820]
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x60], r14
mov qword [rax + 0x50], rcx
add rcx, 8
mov rax, qword [0x140108820]
mov qword [rax + 0x58], rcx
add rcx, 8
mov rax, qword [0x140108820]
mov qword [rax + 0x60], rcx
add rcx, 0x90
mov rax, qword [0x140108820]
mov qword [rax + 0x68], rcx
add rcx, 0xa8
mov rax, qword [0x140108820]
mov qword [rax + 0x78], rcx
add rcx, 0x28
mov rax, qword [0x140108820]
mov qword [rax + 0x80], rcx
lea rcx, [0x1400d4b68]
call fcn.1400b2540
mov rcx, qword [0x140108820]
xor edi, edi
mov r13, rax
mov r14d, edi
mov r8, qword [rcx + 0x48]
mov qword [r8 + 8], rax
mov rcx, qword [0x140108820]
mov r8, qword [rcx + 0x48]
mov rbp, qword [r8 + 8]
test rbp, rbp
je 0x1400b4caa
xor r8d, r8d
mov edx, esi
mov ecx, 6
call fcn.1400b4190
test eax, eax
je 0x1400b4caa
lea rcx, [rbp + 0xc8]
mov qword [rsp + 0x20], rcx
mov rax, qword [rcx + 0x10]
and rax, 0xfffffffffffffff8
je 0x1400b4c32
nop dword [rax + rax]
mov rcx, rax
mov qword [rsp + 0x20], rax
mov rax, qword [rax + 0x10]
and rax, 0xfffffffffffffff8
jne 0x1400b4c20
test byte [rcx + 0x10], 1
jne 0x1400b4caa
mov rcx, qword [rbp + 0x30]
lea rax, [rsp + 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
mov qword [rsp + 0x30], 8
lea rdx, [0x1400d4b60]
xor bl, bl
movdqu xmmword [rsp + 0x38], xmm0
call fcn.1400b3e10
test eax, eax
js 0x1400b4caa
nop
movzx eax, bl
inc bl
test al, al
jne 0x1400b4caa
mov rcx, qword [rbp + 0x30]
lea r8, [rsp + 0x28]
mov rsi, qword [rsp + 0x38]
lea rdx, [0x1400d4b60]
call fcn.1400b3e10
test eax, eax
jns 0x1400b4c70
test rsi, rsi
je 0x1400b4caa
cmp qword [rsi], rdi
je 0x1400b4caa
cmp qword [rsi + 8], rdi
je 0x1400b4caa
mov r14, rsi
mov rax, qword [0x140108820]
lea rdx, str.RtlRbInsertNodeEx
mov rcx, qword [rax + 0x48]
mov qword [rcx], r14
mov rcx, qword [r13 + 0x30]
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x140108820]
mov rdx, qword [rcx + 0x48]
mov qword [rdx + 0x10], rax
lea rdx, str.RtlRbRemoveNode
mov rcx, qword [r13 + 0x30]
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x140108820]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x88]
mov rdx, qword [rcx + 0x48]
mov qword [rdx + 0x18], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x30]
add rdx, 0x30
cmp rdx, rcx
je 0x1400b4d77
nop dword [rax + rax]
mov rax, qword [rcx + 0x50]
lea rbx, [rcx + 0x50]
cmp rax, rbx
je 0x1400b4d42
cmp qword [rax], rbx
je 0x1400b4d4c
mov rcx, qword [rcx]
cmp rdx, rcx
jne 0x1400b4d30
jmp 0x1400b4d77
add rcx, 0x38
mov edx, 1
call fcn.1400b23e0
mov rbx, qword [rbx]
neg eax
movsxd rcx, eax
shl rcx, 4
add rbx, rcx
mov rcx, rbx
call fcn.1400b4f50
test eax, eax
cmovne rdi, rbx
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x58]
mov qword [rcx], rdi
call fcn.1400b4690
mov rcx, qword [0x140108820]
mov rdx, qword [rcx + 0x50]
mov qword [rdx], rax
mov rax, qword [0x140108820]
mov dword [rax + 4], 0x65
mov rcx, qword [0x140108820]
mov rax, qword [rcx + 0x48]
cmp qword [rax], 0
je 0x1400b4dc2
or dword [rcx + 4], 2
mov rcx, qword [0x140108820]
mov rax, qword [rcx + 0x58]
cmp qword [rax], 0
je 0x1400b4dd7
or dword [rcx + 4], 8
mov rcx, qword [0x140108820]
mov rax, qword [rcx + 0x50]
cmp qword [rax], 0
je 0x1400b4dec
or dword [rcx + 4], 0x10
mov rcx, qword [0x140108820]
mov rax, qword [rcx + 0x78]
lea rcx, [fcn.1400b0e90]
mov qword [rax], rcx
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x78]
lea rax, [fcn.1400b1420]
mov qword [rcx + 8], rax
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x78]
lea rax, [0x1400b15a0]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x78]
lea rax, [0x1400b6730]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x78]
lea rax, [0x1400b6750]
mov qword [rcx + 0x20], rax
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x80]
add rcx, 0x10
call qword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x80]
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x80]
add rcx, 0x38
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x80]
mov rax, qword [sym.imp.kernel32.dll_LoadLibraryA]
mov qword [rcx + 0x48], rax
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x80]
mov rax, qword [sym.imp.kernel32.dll_FreeLibrary]
mov qword [rcx + 0x50], rax
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x80]
mov dword [rcx + 0x58], 1
mov rax, qword [0x140108820]
mov rdx, qword [rax + 0x80]
mov rax, qword [rdx + 8]
lea rcx, [rdx + 0x38]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov qword [rdx + 8], rcx
call fcn.1400b6770
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x68]
mov byte [rcx + 0x40], 0
mov rax, qword [0x140108820]
mov rcx, qword [rax + 0x68]
mov eax, r15d
mov byte [rcx + 0x41], 0
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b7570
add rsp, 0x68
pop r15
pop rdi
ret