Function at 0x140036b30
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor r8d, r8d
lea rdx, [0x140079378]
mov rbx, rcx
call fcn.140003a80
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14003716c
cmp dword [rbp - 0x80], 2
jne 0x14003716c
cmp dword [rsp + 0x74], 5
jb 0x14003716c
xor eax, eax
lea rcx, str.kernel32.dll
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x38]
test rax, rax
je 0x140036be3
call rax
jmp 0x140036be9
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, 0xa
lea rdx, str.Microsoft
mov rcx, rbx
call fcn.140003a80
mov eax, dword [rsp + 0x74]
cmp eax, 6
jne 0x140036eb3
mov eax, dword [rsp + 0x78]
test eax, eax
jne 0x140036c3b
cmp byte [rbp + 0x8a], 1
mov rcx, rbx
jne 0x140036c2c
lea r8d, [rax + 0xe]
lea rdx, str.Windows_Vista
jmp 0x140036c78
mov r8d, 0x14
lea rdx, str.Windows_Server_2008
jmp 0x140036c78
cmp eax, 1
jne 0x140036c63
mov rcx, rbx
cmp byte [rbp + 0x8a], al
jne 0x140036c54
lea rdx, str.Windows_7
jmp 0x140036c72
mov r8d, 0x17
lea rdx, str.Windows_Server_2008_R2
jmp 0x140036c78
cmp eax, 2
jne 0x140036c7d
lea rdx, str.Windows_8
mov rcx, rbx
mov r8d, 0xa
call fcn.14000d6e0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProductInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.0x140036cf1.5
movzx r9d, word [rbp + 0x86]
lea rcx, [rsp + 0x30]
movzx r8d, word [rbp + 0x84]
mov edx, dword [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x74]
call rax
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 0x2f
ja case.0x140036cf1.5
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0x371d8]
mov edx, dword [r8 + rax*4 + 0x37190]
add rdx, r8
jmp rdx
mov r8d, 0x10
lea rdx, str.Ultimate_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0xc
lea rdx, str.Professional
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x14
lea rdx, str.Home_Premium_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x12
lea rdx, str.Home_Basic_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x12
lea rdx, str.Enterprise_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x10
lea rdx, str.Business_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0xf
lea rdx, str.Starter_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x16
lea rdx, str.Cluster_Server_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x12
lea rdx, str.Datacenter_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x26
lea rdx, str.Datacenter_Edition__core_installation_
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x26
lea rdx, str.Enterprise_Edition__core_installation_
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x15
lea rdx, str.Small_Business_Server
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x25
lea rdx, str.Small_Business_Server_Premium_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x10
lea rdx, str.Standard_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x24
lea rdx, str.Standard_Edition__core_installation_
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x12
lea rdx, str.Web_Server_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
cmp eax, 5
jne case.0x140036cf1.5
mov eax, dword [rsp + 0x78]
cmp eax, 2
jne 0x140037099
lea ecx, [rax + 0x57]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140036ee5
mov r8d, 0x17
lea rdx, str.Windows_Server_2003_R2
jmp 0x140036f45
movzx eax, word [rbp + 0x88]
mov ecx, 0x2000
test cx, ax
je 0x140036f05
mov r8d, 0x1c
lea rdx, str.Windows_Storage_Server_2003
jmp 0x140036f45
mov ecx, 0x8000
test cx, ax
je 0x140036f18
lea rdx, str.Windows_Home_Server
jmp 0x140036f3f
cmp byte [rbp + 0x8a], 1
jne 0x140036f38
cmp word [rsp + 0x38], 9
jne 0x140036f38
mov r8d, 0x24
lea rdx, str.Windows_XP_Professional_x64_Edition
jmp 0x140036f45
lea rdx, str.Windows_Server_2003
mov r8d, 0x14
mov rcx, rbx
call fcn.14000d6e0
cmp byte [rbp + 0x8a], 1
je case.0x140036cf1.5
mov rax, qword [rsp + 0x38]
cmp ax, 6
jne 0x140036fb0
movzx eax, byte [rbp + 0x88]
test al, al
jns 0x140036f8c
mov r8d, 0x2c
lea rdx, str.Datacenter_Edition_for_Itanium_based_Systems
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
test al, 2
je case.0x140036cf1.5
mov r8d, 0x2c
lea rdx, str.Enterprise_Edition_for_Itanium_based_Systems
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
cmp ax, 9
jne 0x140037016
movzx eax, byte [rbp + 0x88]
test al, al
jns 0x140036fdd
mov r8d, 0x16
lea rdx, str.Datacenter_x64_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov rcx, rbx
test al, 2
je 0x140036ffd
mov r8d, 0x16
lea rdx, str.Enterprise_x64_Edition
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x14
lea rdx, str.Standard_x64_Edition
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
movzx ecx, word [rbp + 0x88]
mov eax, 0x4000
test ax, cx
je 0x140037043
mov r8d, 0x17
lea rdx, str.Compute_Cluster_Edition
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
movzx eax, byte [rbp + 0x88]
test al, al
js case.0x140036cf1.8
test al, 2
jne case.0x140036cf1.4
mov eax, 0x400
test ax, cx
mov rcx, rbx
je 0x140037080
mov r8d, 0xb
lea rdx, str.Web_Edition
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 0x10
lea rdx, str.Standard_Edition
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
cmp eax, 1
jne 0x1400370ee
lea r8d, [rax + 0xa]
mov rcx, rbx
lea rdx, str.Windows_XP
call fcn.14000d6e0
mov eax, 0x200
mov r8d, 0xc
mov rcx, rbx
test word [rbp + 0x88], ax
je 0x1400370db
lea rdx, str.Home_Edition
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
lea rdx, str.Professional
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
test eax, eax
jne case.0x140036cf1.5
lea r8d, [rax + 0xd]
mov rcx, rbx
lea rdx, str.Windows_2000
call fcn.14000d6e0
cmp byte [rbp + 0x8a], 1
je case.0x140036cf1.48
movzx eax, byte [rbp + 0x88]
test al, al
jns 0x140037136
mov r8d, 0x11
lea rdx, str.Datacenter_Server
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
test al, 2
je 0x140037153
mov r8d, 0xf
lea rdx, str.Advanced_Server
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
mov r8d, 6
lea rdx, str.Server
mov rcx, rbx
call fcn.14000d6e0
mov al, 1
jmp 0x14003716e
xor al, al
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14003a3d0
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x1a0
pop rbp
ret