Function at 0x140030f70
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140081338]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov qword [rcx + 0x38], 0
mov byte [rcx + 8], 0
mov qword [rcx], 0
mov qword [rcx + 0x40], 0xf
mov byte [rcx + 0x28], 0
mov dword [rcx + 0x48], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebp, ebp
mov ecx, 0
test rax, rax
je 0x14003100e
mov dword [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
mov rcx, rdi
call rax
xor edx, edx
cmp dword [rsp + 0x70], 0
setne dl
test eax, eax
mov ecx, 2
cmovne ecx, edx
mov dword [rsi + 0x58], ecx
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsi + 0x70], xmm0
mov byte [rsi + 0x60], 0
lea rcx, [rsp + 0x74]
xor edx, edx
mov r8d, 0x118
call fcn.1400445c0
mov dword [rsp + 0x70], 0x11c
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rsp + 0x74]
mov dword [rsi + 0xc], eax
mov eax, dword [rsp + 0x78]
mov dword [rsi + 0x10], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsi + 0x14], eax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140032a70
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rdx, 0xffffffff80000002
mov r9d, 1
mov rcx, rdi
call fcn.140032a90
test eax, eax
jne 0x1400310b2
mov dword [rsp + 0x3c], 0
lea rdx, [0x140067eaa]
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x3c]
call fcn.140032b70
mov ebp, dword [rsp + 0x3c]
lea rbx, [rsi + 0x28]
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140032b20
mov dword [rsi + 0x18], ebp
mov ecx, dword [rsi + 0x14]
mov edx, dword [rsi + 0xc]
mov eax, dword [rsi + 0x10]
test eax, eax
jle 0x1400310e9
cmp edx, 5
jne 0x1400310e9
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, 2
sub eax, ecx
jmp 0x140031158
cmp edx, 0xa
je 0x140031103
cmp edx, 6
jne 0x14003114b
lea ecx, [rax + 3]
cmp eax, 3
mov eax, 6
cmovb eax, ecx
jmp 0x140031158
mov eax, 7
cmp ecx, 0x295a
jl 0x140031158
mov eax, 8
cmp ecx, 0x3839
jl 0x140031158
mov eax, 9
cmp ecx, 0x3ad7
jl 0x140031158
mov eax, 0xa
cmp ecx, 0x3fab
jl 0x140031158
xor edx, edx
cmp ecx, 0x42ee
setl dl
mov eax, 0xc
sub eax, edx
jmp 0x140031158
xor ecx, ecx
cmp edx, 6
mov eax, 0xd
cmovle eax, ecx
mov dword [rsi], eax
movzx eax, word [rsp + 0x184]
mov dword [rsi + 0x20], eax
movzx eax, word [rsp + 0x186]
mov dword [rsi + 0x24], eax
lea rcx, [rsp + 0x84]
mov qword [rsp + 0x28], rcx
call fcn.1400478b0
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14000bd30
cmp rdi, rbx
je 0x14003120e
mov rax, qword [rsi + 0x40]
cmp rax, 0x10
jb 0x1400311e1
mov rcx, qword [rbx]
add rax, 1
cmp rax, 0x1000
jb 0x1400311dc
test cl, 0x1f
jne 0x1400313a7
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400313a7
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
mov rcx, rax
jae 0x1400313a7
call fcn.140041240
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
jmp 0x140031259
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x140031259
mov rcx, qword [rsp + 0x40]
add rax, 1
cmp rax, 0x1000
jb 0x140031254
test cl, 0x1f
jne 0x1400313a7
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400313a7
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
mov rcx, rax
jae 0x1400313a7
call fcn.140041240
mov qword [rsp + 0x58], 0xf
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x40]
test ax, ax
je 0x1400312a8
movzx ecx, ax
cmp ecx, 6
je 0x1400312a1
cmp ecx, 9
jne 0x1400312ad
mov ecx, 1
jmp 0x1400312aa
mov ecx, 2
jmp 0x1400312aa
xor ecx, ecx
mov dword [rsi + 0x48], ecx
mov ecx, dword [rsp + 0x60]
mov dword [rsi + 0x4c], ecx
mov ecx, dword [rsp + 0x68]
mov qword [rsi + 0x50], rcx
mov ecx, dword [rsp + 0x74]
cmp ecx, 5
je 0x140031331
cmp ecx, 0xa
je 0x1400312d3
cmp ecx, 6
jne case.0x140031326.1
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [rsp + 0x74]
mov edx, dword [rsp + 0x78]
lea rbp, [rsp + 0x3c]
mov qword [rsp + 0x20], rbp
xor r8d, r8d
xor r9d, r9d
call rax
mov eax, dword [rsp + 0x3c]
add eax, 0xffffffff
cmp eax, 0x81
ja case.0x140031326.1
lea rcx, [0x1400313b0]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov dword [rsi + 0x1c], 3
jmp 0x14003137f
mov ecx, dword [rsp + 0x78]
cmp ecx, 1
je 0x140031365
cmp ecx, 2
jne case.0x140031326.1
movzx eax, ax
cmp eax, 9
jne 0x140031351
cmp byte [rsp + 0x18a], 1
je case.0x140031326.0
cmp word [rsp + 0x188], 0
js case.0x140031326.1
mov dword [rsi + 0x1c], 2
jmp 0x14003137f
test byte [rsp + 0x189], 2
jne case.0x140031326.1
mov dword [rsi + 0x1c], 1
jmp 0x14003137f
mov dword [rsi + 0x1c], 0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140041210
mov rax, rsi
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov dword [rsi + 0x1c], 4
jmp 0x14003137f
call fcn.1400476b0
ud2