Function at 0x140015e58
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140040010]
xor rax, rsp
mov qword [rbp + 0xd0], rax
xor r14d, r14d
mov rbx, rcx
mov qword [rcx], r14
mov byte [rcx + 8], r14b
mov qword [rcx + 0x38], r14
mov qword [rcx + 0x40], 0xf
mov byte [rcx + 0x28], r14b
mov dword [rcx + 0x48], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [0x1400372a8]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140015eda
mov eax, r14d
jmp 0x140015eff
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], r14d
mov rcx, rdi
call rax
test eax, eax
jne 0x140015ef4
mov eax, 2
jmp 0x140015eff
cmp dword [rsp + 0x30], r14d
mov eax, r14d
setne al
mov dword [rbx + 0x58], eax
lea rcx, [rbp - 0x4c]
mov qword [rbx + 0x70], r14
xor edx, edx
mov qword [rbx + 0x78], 0xf
mov r8d, 0x118
mov byte [rbx + 0x60], r14b
mov dword [rbp - 0x50], 0x11c
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rbp - 0x4c]
mov edi, 1
mov ecx, dword [rbp - 0x48]
mov edx, dword [rbp - 0x44]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x10], ecx
lea r8d, [rdi + 8]
mov dword [rbx + 0x14], edx
mov dword [rbx + 0x18], r14d
cmp eax, 5
jne 0x140015f68
test ecx, ecx
jle 0x140015fcc
cmp ecx, edi
mov eax, r14d
setne al
add eax, edi
jmp 0x140015fcf
cmp eax, 6
jne 0x140015f8e
test ecx, ecx
je 0x140015f87
sub ecx, edi
je 0x140015f80
cmp ecx, edi
jne 0x140015fcf
mov eax, 5
jmp 0x140015fcf
mov eax, 4
jmp 0x140015fcf
mov eax, 3
jmp 0x140015fcf
cmp eax, 0xa
jne 0x140015fc2
cmp edx, 0x295a
jge 0x140015fa2
mov eax, 7
jmp 0x140015fcf
cmp edx, 0x3839
jge 0x140015fb1
mov eax, 8
jmp 0x140015fcf
cmp edx, 0x3ad7
mov eax, r14d
setge al
add eax, r8d
jmp 0x140015fcf
cmp eax, 6
mov eax, 0xb
jg 0x140015fcf
mov eax, r14d
mov dword [rbx], eax
lea rdx, [rbp - 0x3c]
movzx eax, word [rbp + 0xc4]
lea rcx, [rsp + 0x68]
mov dword [rbx + 0x20], eax
movzx eax, word [rbp + 0xc6]
mov dword [rbx + 0x24], eax
call fcn.1400044d0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call fcn.140013d3c
mov rdx, rax
lea rcx, [rbx + 0x28]
call fcn.140011ab8
lea rcx, [rbp - 0x78]
call fcn.14000ef80
lea rcx, [rsp + 0x68]
call fcn.140004cb0
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x38]
mov edx, 9
test eax, eax
je 0x140016060
cmp eax, 6
je 0x140016057
cmp eax, edx
jne 0x140016064
mov dword [rbx + 0x48], edi
jmp 0x140016064
mov dword [rbx + 0x48], 2
jmp 0x140016064
mov dword [rbx + 0x48], r14d
mov eax, dword [rsp + 0x58]
mov ecx, dword [rbp - 0x4c]
mov dword [rbx + 0x4c], eax
mov eax, dword [rsp + 0x60]
mov qword [rbx + 0x50], rax
lea eax, [rcx - 6]
test eax, 0xfffffffb
je 0x1400160d7
cmp ecx, 5
jne 0x140016142
cmp dword [rbp - 0x48], 2
jne 0x1400160be
cmp byte [rbp + 0xca], dil
jne 0x1400160a3
cmp word [rsp + 0x38], dx
je 0x1400161a2
movzx eax, word [rbp + 0xc8]
not ax
movzx ecx, ax
shr ecx, 0xe
and ecx, 2
mov dword [rbx + 0x1c], ecx
jmp 0x140016146
cmp dword [rbp - 0x48], edi
jne 0x140016142
movzx eax, word [rbp + 0xc8]
not ax
shr eax, 9
and eax, edi
mov dword [rbx + 0x1c], eax
jmp 0x140016146
lea rcx, [0x1400372a8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProductInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [rbp - 0x48]
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov ecx, dword [rbp - 0x4c]
xor r8d, r8d
call rax
mov eax, dword [rsp + 0x34]
cmp eax, 0x1b
ja 0x14001618a
je 0x1400161c8
cmp eax, 0xf
ja 0x140016170
cmp eax, 0xc
jae 0x140016181
cmp eax, edi
je 0x1400161a2
cmp eax, 4
je 0x1400161c8
cmp eax, 6
je 0x1400161c8
jbe 0x140016142
cmp eax, 0xa
jbe 0x140016181
mov dword [rbx + 0x1c], r14d
mov rax, rbx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140005a70
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp eax, 0x10
je 0x1400161c8
jbe 0x140016142
cmp eax, 0x12
jbe 0x140016181
cmp eax, 0x19
jne 0x140016142
mov dword [rbx + 0x1c], 2
jmp 0x140016146
cmp eax, 0x54
ja 0x1400161a7
je 0x1400161c8
cmp eax, 0x30
je 0x1400161a2
cmp eax, 0x46
je 0x1400161c8
cmp eax, 0x48
je 0x1400161c8
jmp 0x140016142
mov dword [rbx + 0x1c], edi
jmp 0x140016146
cmp eax, 0x79
jb 0x140016142
cmp eax, 0x7a
jbe 0x1400161d4
cmp eax, 0x7c
jbe 0x140016142
cmp eax, 0x7e
jbe 0x1400161c8
add eax, 0xffffff7f
cmp eax, edi
ja 0x140016142
mov dword [rbx + 0x1c], 3
jmp 0x140016146
mov dword [rbx + 0x1c], 4
jmp 0x140016146