Function at 0x140011483
Capabilities:
Check os version

Disassembly:
jmp 0x1400123f0
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140021040]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x140027230]
call fcn.140011438
lea rcx, str.Determining_Windows_NT_version_and_architecture..._n
call fcn.1400111f9
mov byte [rbp + 4], 1
movzx eax, byte [rbp + 4]
test eax, eax
je 0x140012453
lea rcx, str.The_architecture_of_OS_:_64bit_n
call fcn.1400111f9
jmp 0x14001245f
lea rcx, str.The_architecture_of_OS_:_32bit_n
call fcn.1400111f9
mov r8d, 0x94
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.140011361
mov dword [rbp + 0x30], 0x94
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400126bb
cmp dword [rbp + 0x40], 2
jne 0x1400126bb
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 3
je 0x1400124de
cmp dword [rbp + 0x194], 4
je 0x140012557
cmp dword [rbp + 0x194], 5
je 0x14001258a
cmp dword [rbp + 0x194], 6
je 0x140012603
cmp dword [rbp + 0x194], 0xa
je 0x140012690
jmp 0x1400126bb
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 1
je 0x140012504
cmp dword [rbp + 0x194], 5
je 0x14001251e
cmp dword [rbp + 0x194], 0x33
je 0x140012538
jmp 0x140012552
lea rdx, str.Windows_NT_3.1__1993_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
lea rdx, str.Windows_NT_3.5__1994_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
lea rdx, str.Windows_NT_3.51__1995_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
jmp 0x1400126bb
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x14001256b
jmp 0x140012585
lea rdx, str.Windows_NT_4.0__1996_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
jmp 0x1400126bb
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x1400125b0
cmp dword [rbp + 0x194], 1
je 0x1400125ca
cmp dword [rbp + 0x194], 2
je 0x1400125e4
jmp 0x1400125fe
lea rdx, str.Windows_NT_5.0__Windows_2000___1997_1999_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
lea rdx, str.Windows_NT_5.1__Windows_XP___2001_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
lea rdx, str.Windows_NT_5.2__Windows_Server_2003__Windows_XP_x64___2003_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
jmp 0x1400126bb
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x140012632
cmp dword [rbp + 0x194], 1
je 0x140012649
cmp dword [rbp + 0x194], 2
je 0x140012660
cmp dword [rbp + 0x194], 3
je 0x140012677
jmp 0x14001268e
lea rdx, str.Windows_NT_6.0__Windows_Vista__Windows_Server_2008___2006_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
lea rdx, str.Windows_NT_6.1__Windows_7__Windows_Server_2008_R2___2009_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
lea rdx, str.Windows_NT_6.2__Windows_8__Windows_Server_2012___2012_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
lea rdx, str.Windows_NT_6.3__Windows_8.1__Windows_Server_2012_R2___2013_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
jmp 0x1400126bb
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x1400126a4
jmp 0x1400126bb
lea rdx, str.Windows_NT_10.0__Windows_10__Windows_Server_2016___2015_
lea rcx, [0x14001d334]
call fcn.1400111f9
mov al, 1
jmp 0x1400126bd
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001d260]
call fcn.1400113bb
mov rax, rdi
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.140011217
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret