Function at 0x566b00
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x190
mov rbp, rsp
mov qword [rbp + 0x28], rbp
cmp dword [0x005b4dac], 0
je 0x566b29
mov eax, dword [0x005b4dac]
mov dword [rbp + 0x18c], eax
jmp 0x567022
mov dword [rbp + 0x18c], 0
nop
mov dword [rbp + 0x3c], 0x11c
lea rcx, [rbp + 0x3c]
call sub.kernel32.dll_GetVersionExW
test eax, eax
jne 0x566b60
mov dword [rbp + 0x3c], 0x114
lea rcx, [rbp + 0x3c]
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x567016
cmp dword [rbp + 0x4c], 2
jne 0x567016
lea rcx, [rbp + 0x158]
mov edx, 0x30
xor r8, r8
call fcn.0040a600
lea rcx, [0x00567060]
call sub.kernel32.dll_GetModuleHandleW_2
mov rcx, rax
lea rdx, [0x0056707a]
call fcn.00418c20
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
je 0x566bb1
lea rcx, [rbp + 0x158]
call qword [rbp + 0x30]
jmp 0x566bbd
lea rcx, [rbp + 0x158]
call sub.kernel32.dll_GetSystemInfo_1
cmp dword [rbp + 0x40], 5
jne 0x566bd2
cmp dword [rbp + 0x44], 1
jne 0x566bd2
cmp byte [rbp + 0x156], 1
je 0x566be7
cmp dword [rbp + 0x40], 5
jne 0x566c3e
cmp dword [rbp + 0x44], 2
jne 0x566c3e
cmp byte [rbp + 0x156], 1
jne 0x566c3e
movzx rax, word [rbp + 0x158]
sub ax, 1
cmp ax, 0xffff
je 0x566c11
sub ax, 5
test ax, ax
je 0x566c2f
sub ax, 3
test ax, ax
jne 0x567007
jmp 0x566c20
mov dword [rbp + 0x18c], 1
jmp 0x567007
mov dword [rbp + 0x18c], 2
jmp 0x567007
mov dword [rbp + 0x18c], 4
jmp 0x567007
cmp dword [rbp + 0x40], 6
jne 0x566caa
cmp dword [rbp + 0x44], 0
jne 0x566caa
cmp byte [rbp + 0x156], 1
jne 0x566caa
movzx rax, word [rbp + 0x158]
sub ax, 1
cmp ax, 0xffff
je 0x566c7d
sub ax, 5
test ax, ax
je 0x566c9b
sub ax, 3
test ax, ax
jne 0x567007
jmp 0x566c8c
mov dword [rbp + 0x18c], 8
jmp 0x567007
mov dword [rbp + 0x18c], 0x10
jmp 0x567007
mov dword [rbp + 0x18c], 0x20
jmp 0x567007
cmp dword [rbp + 0x40], 6
jne 0x566d16
cmp dword [rbp + 0x44], 1
jne 0x566d16
cmp byte [rbp + 0x156], 1
jne 0x566d16
movzx rax, word [rbp + 0x158]
sub ax, 1
cmp ax, 0xffff
je 0x566ce9
sub ax, 5
test ax, ax
je 0x566d07
sub ax, 3
test ax, ax
jne 0x567007
jmp 0x566cf8
mov dword [rbp + 0x18c], 0x40
jmp 0x567007
mov dword [rbp + 0x18c], 0x80
jmp 0x567007
mov dword [rbp + 0x18c], pe_nt_image_headers64
jmp 0x567007
cmp dword [rbp + 0x40], 6
jne 0x566d82
cmp dword [rbp + 0x44], 2
jne 0x566d82
cmp byte [rbp + 0x156], 1
jne 0x566d82
movzx rax, word [rbp + 0x158]
sub ax, 1
cmp ax, 0xffff
je 0x566d55
sub ax, 5
test ax, ax
je 0x566d73
sub ax, 3
test ax, ax
jne 0x567007
jmp 0x566d64
mov dword [rbp + 0x18c], 0x200
jmp 0x567007
mov dword [rbp + 0x18c], 0x400
jmp 0x567007
mov dword [rbp + 0x18c], 0x800
jmp 0x567007
cmp dword [rbp + 0x40], 6
jne 0x566dee
cmp dword [rbp + 0x44], 3
jne 0x566dee
cmp byte [rbp + 0x156], 1
jne 0x566dee
movzx rax, word [rbp + 0x158]
sub ax, 1
cmp ax, 0xffff
je 0x566dc1
sub ax, 5
test ax, ax
je 0x566ddf
sub ax, 3
test ax, ax
jne 0x567007
jmp 0x566dd0
mov dword [rbp + 0x18c], 0x200000
jmp 0x567007
mov dword [rbp + 0x18c], 0x400000
jmp 0x567007
mov dword [rbp + 0x18c], 0x800000
jmp 0x567007
cmp dword [rbp + 0x40], 6
jne 0x566e5a
cmp dword [rbp + 0x44], 4
jne 0x566e5a
cmp byte [rbp + 0x156], 1
jne 0x566e5a
movzx rax, word [rbp + 0x158]
sub ax, 1
cmp ax, 0xffff
je 0x566e2d
sub ax, 5
test ax, ax
je 0x566e4b
sub ax, 3
test ax, ax
jne 0x567007
jmp 0x566e3c
mov dword [rbp + 0x18c], 0x1000000
jmp 0x567007
mov dword [rbp + 0x18c], 0x2000000
jmp 0x567007
mov dword [rbp + 0x18c], 0x4000000
jmp 0x567007
cmp dword [rbp + 0x40], 0xa
jne 0x566ec6
cmp dword [rbp + 0x44], 0
jne 0x566ec6
cmp byte [rbp + 0x156], 1
jne 0x566ec6
movzx rax, word [rbp + 0x158]
sub ax, 1
cmp ax, 0xffff
je 0x566e99
sub ax, 5
test ax, ax
je 0x566eb7
sub ax, 3
test ax, ax
jne 0x567007
jmp 0x566ea8
mov dword [rbp + 0x18c], 0x1000000
jmp 0x567007
mov dword [rbp + 0x18c], 0x2000000
jmp 0x567007
mov dword [rbp + 0x18c], 0x4000000
jmp 0x567007
cmp dword [rbp + 0x40], 5
jne 0x566f32
cmp dword [rbp + 0x44], 2
jne 0x566f32
cmp byte [rbp + 0x156], 1
je 0x566f32
movzx rax, word [rbp + 0x158]
sub ax, 1
cmp ax, 0xffff
je 0x566f05
sub ax, 5
test ax, ax
je 0x566f23
sub ax, 3
test ax, ax
jne 0x567007
jmp 0x566f14
mov dword [rbp + 0x18c], 0x1000
jmp 0x567007
mov dword [rbp + 0x18c], 0x2000
jmp 0x567007
mov dword [rbp + 0x18c], 0x4000
jmp 0x567007
cmp dword [rbp + 0x40], 6
jne 0x566f47
cmp dword [rbp + 0x44], 0
jne 0x566f47
cmp byte [rbp + 0x156], 1
jne 0x566f5c
cmp dword [rbp + 0x40], 6
jne 0x566faa
cmp dword [rbp + 0x44], 1
jne 0x566faa
cmp byte [rbp + 0x156], 1
je 0x566faa
movzx rax, word [rbp + 0x158]
sub ax, 1
cmp ax, 0xffff
je 0x566f86
sub ax, 5
test ax, ax
je 0x566f9e
sub ax, 3
test ax, ax
jne 0x567007
jmp 0x566f92
mov dword [rbp + 0x18c], 0x8000
jmp 0x567007
mov dword [rbp + 0x18c], 0x10000
jmp 0x567007
mov dword [rbp + 0x18c], 0x20000
jmp 0x567007
cmp dword [rbp + 0x40], 6
jne 0x567007
cmp dword [rbp + 0x44], 2
jne 0x567007
cmp byte [rbp + 0x156], 1
je 0x567007
movzx rax, word [rbp + 0x158]
sub ax, 1
cmp ax, 0xffff
je 0x566fe5
sub ax, 5
test ax, ax
je 0x566ffd
sub ax, 3
test ax, ax
jne 0x567007
jmp 0x566ff1
mov dword [rbp + 0x18c], 0x40000
jmp 0x567007
mov dword [rbp + 0x18c], 0x80000
jmp 0x567007
mov dword [rbp + 0x18c], 0x100000
nop
mov eax, dword [rbp + 0x18c]
mov dword [0x005b4dac], eax
jmp 0x567022
xor rcx, rcx
mov rdx, qword [rbp + 0x28]
call fcn.00567040
mov eax, dword [rbp + 0x18c]
lea rsp, [rbp + 0x190]
pop rbp
ret