Function at 0x14001070c
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1e0
mov rax, qword [0x140036018]
xor rax, rsp
mov qword [rbp + 0xd0], rax
xor r15d, r15d
lea rsi, [rcx + 0x28]
mov qword [rcx], r15
mov rbx, rcx
mov byte [rcx + 8], r15b
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
lea edi, [r15 + 3]
mov byte [rsi], r15b
mov dword [rcx + 0x48], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [0x14002de50]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140010796
mov eax, r15d
jmp 0x1400107bb
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], r15d
mov rcx, r14
call rax
test eax, eax
jne 0x1400107b0
mov eax, 2
jmp 0x1400107bb
cmp dword [rsp + 0x30], r15d
mov eax, r15d
setne al
mov dword [rbx + 0x58], eax
lea rcx, [rbp - 0x4c]
mov qword [rbx + 0x70], r15
xor edx, edx
mov qword [rbx + 0x78], 0xf
mov r8d, 0x118
mov byte [rbx + 0x60], r15b
mov dword [rbp - 0x50], 0x11c
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rbp - 0x4c]
mov r8d, 9
mov ecx, dword [rbp - 0x48]
mov edx, dword [rbp - 0x44]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x10], ecx
lea r14d, [r8 - 8]
mov dword [rbx + 0x14], edx
mov dword [rbx + 0x18], r15d
cmp eax, 5
jne 0x140010828
test ecx, ecx
jle 0x14001086c
cmp ecx, r14d
mov edi, r15d
setne dil
add edi, r14d
jmp 0x14001086f
cmp eax, 6
jne 0x14001084d
test ecx, ecx
je 0x14001086f
sub ecx, r14d
je 0x140010846
cmp ecx, r14d
je 0x14001083f
mov edi, eax
jmp 0x14001086f
mov edi, 5
jmp 0x14001086f
mov edi, 4
jmp 0x14001086f
cmp eax, 0xa
jne 0x140010864
cmp edx, 0x295a
mov edi, r15d
setge dil
add edi, 7
jmp 0x14001086f
mov edi, r8d
cmp eax, 6
jg 0x14001086f
mov edi, r15d
movzx eax, word [rbp + 0xc4]
lea rdx, [rbp - 0x3c]
mov dword [rbx + 0x20], eax
lea rcx, [rsp + 0x68]
movzx eax, word [rbp + 0xc6]
mov dword [rbx + 0x24], eax
mov dword [rbx], edi
call fcn.1400030a0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.14000f2c4
mov rdi, rax
cmp rsi, rax
je 0x1400108ce
mov rcx, rsi
call fcn.140004824
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r15b
lea rcx, [rbp - 0x78]
call fcn.140004824
lea rcx, [rsp + 0x68]
call fcn.140009944
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x38]
mov edx, 9
test eax, eax
je 0x140010922
cmp eax, 6
je 0x140010919
cmp eax, edx
jne 0x140010926
mov dword [rbx + 0x48], r14d
jmp 0x140010926
mov dword [rbx + 0x48], 2
jmp 0x140010926
mov dword [rbx + 0x48], r15d
mov eax, dword [rsp + 0x58]
mov ecx, dword [rbp - 0x4c]
mov dword [rbx + 0x4c], eax
mov eax, dword [rsp + 0x60]
mov qword [rbx + 0x50], rax
lea eax, [rcx - 6]
test eax, 0xfffffffb
je 0x140010998
cmp ecx, 5
jne 0x1400109f1
cmp dword [rbp - 0x48], 2
jne 0x14001097d
cmp byte [rbp + 0xca], r14b
jne 0x140010965
cmp word [rsp + 0x38], dx
je 0x140010a38
movzx eax, word [rbp + 0xc8]
not ax
movzx ecx, ax
shr ecx, 0xe
and ecx, 2
mov dword [rbx + 0x1c], ecx
jmp 0x1400109f5
cmp dword [rbp - 0x48], r14d
jne 0x1400109f1
movzx eax, word [rbp + 0xc8]
not ax
movzx ecx, ax
shr ecx, 9
and ecx, r14d
jmp 0x140010978
lea rcx, [0x14002de50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProductInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [rbp - 0x48]
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov ecx, dword [rbp - 0x4c]
xor r8d, r8d
call rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xf
ja 0x140010a24
cmp eax, 0xc
jae 0x140010a3e
cmp eax, r14d
je 0x140010a38
cmp eax, 4
je 0x140010a38
cmp eax, 6
je 0x140010a38
jbe 0x1400109f1
cmp eax, 0xa
jbe 0x140010a3e
mov dword [rbx + 0x1c], r15d
mov rax, rbx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140005c90
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
cmp eax, 0x11
jb 0x1400109f1
cmp eax, 0x12
jbe 0x140010a3e
cmp eax, 0x19
je 0x140010a3e
cmp eax, 0x30
jne 0x1400109f1
mov dword [rbx + 0x1c], r14d
jmp 0x1400109f5
mov dword [rbx + 0x1c], 2
jmp 0x1400109f5