Function at 0x180003ab8
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x1800830c8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebp, edx
mov r12, rcx
test rcx, rcx
je 0x18000418e
test edx, edx
je 0x18000418e
and dword [rsp + 0x48], 0
xor edx, edx
lea rdi, [0x1800677bc]
lea rcx, [r11 - 0x177]
lea r8d, [rdx + 0x3f]
xor r15b, r15b
mov rbx, rdi
mov r14, rdi
mov byte [r11 - 0x178], r15b
call fcn.180052810
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x30]
call fcn.180052810
mov esi, 0x9c
lea rcx, [rsp + 0x80]
mov r8, rsi
xor edx, edx
call fcn.180052810
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18000418e
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x50]
test rax, rax
je 0x180003b97
call rax
jmp 0x180003b9d
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
and dword [rsp + 0x44], 0
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x44]
call fcn.1800039d4
mov esi, dword [rsp + 0x44]
mov ecx, 6
test al, al
je 0x180003be5
cmp esi, ecx
ja 0x180003bd0
jne 0x180003be5
cmp dword [rsp + 0x40], 2
jbe 0x180003be5
lea rcx, [rsp + 0x120]
mov edx, 0x40
call fcn.180003a30
mov r15b, 1
cmp dword [rsp + 0x90], 2
jne 0x18000418a
mov edx, dword [rsp + 0x84]
cmp edx, 4
jbe 0x18000418a
test r15b, r15b
je 0x180003c6e
cmp esi, 0xa
jne 0x180003cac
cmp dword [rsp + 0x40], 0
jne 0x180003c6e
mov cl, byte [rsp + 0x11a]
cmp cl, 1
jne 0x180003c2d
lea rdi, str.Windows_10
jmp 0x180003c75
lea rcx, [rsp + 0x120]
call fcn.1800529c0
test rax, rax
je 0x180003c9b
lea rdx, str.17763
lea rcx, [rsp + 0x120]
call fcn.180053060
mov edx, dword [rsp + 0x84]
lea rdi, str.Windows_Server_2019
lea rcx, str.Windows_Server_2016
test eax, eax
cmovne rdi, rcx
mov cl, byte [rsp + 0x11a]
mov esi, 6
cmp edx, esi
jne 0x180003dbe
mov eax, dword [rsp + 0x88]
test eax, eax
jne 0x180003cdd
cmp cl, 1
jne 0x180003cd6
lea rdi, str.Windows_Vista
jmp 0x180003d15
mov edx, dword [rsp + 0x84]
lea rcx, str.Windows_Server_2016
mov rdi, rcx
cmp esi, 6
jne 0x180003c6e
cmp dword [rsp + 0x40], 3
jne 0x180003c6e
mov cl, byte [rsp + 0x11a]
lea rdi, str.Windows_8.1
lea rax, str.Windows_Server_2012_R2
cmp cl, 1
cmovne rdi, rax
jmp 0x180003c75
lea rdi, str.Windows_Server_2008
cmp eax, 1
jne 0x180003cf6
cmp cl, al
jne 0x180003cef
lea rdi, str.Windows_7
jmp 0x180003d15
lea rdi, str.Windows_Server_2008_R2
cmp eax, 2
jne 0x180003d15
test r15b, r15b
jne 0x180003d15
lea rdi, str.Windows_8
lea rax, str.Windows_Server_2012
cmp cl, 1
cmovne rdi, rax
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x84]
xor r9d, r9d
xor r8d, r8d
call rax
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x160], 0
call fcn.180052810
mov esi, 0x100
lea rcx, [rsp + 0x160]
mov r8, rsi
xor edx, edx
call fcn.180052810
mov ecx, dword [rsp + 0x48]
lea rdx, [rsp + 0x160]
mov r8d, esi
call fcn.18000344c
mov edx, dword [rsp + 0x84]
lea rcx, [rsp + 0x160]
test al, al
mov esi, 6
cmove rcx, rbx
mov rbx, rcx
mov cl, byte [rsp + 0x11a]
cmp edx, 5
jne 0x180003f90
mov eax, dword [rsp + 0x88]
cmp eax, 2
jne 0x180003f17
lea ecx, [rdx + 0x54]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r8b, byte [rsp + 0x118]
movzx r9d, word [rsp + 0x50]
mov cl, byte [rsp + 0x11a]
movzx r10d, word [rsp + 0x118]
test eax, eax
je 0x180003e0b
lea rdi, str.Windows_Server_2003_R2
jmp 0x180003e31
mov eax, 0x2000
cmp ax, r10w
jne 0x180003e1f
lea rdi, str.Windows_Storage_Server_2003
jmp 0x180003e31
mov eax, 0x8000
cmp ax, r10w
jne 0x180003e38
lea rdi, str.Windows_Home_Server
mov eax, 9
jmp 0x180003e5b
mov eax, 9
cmp cl, 1
jne 0x180003e54
cmp ax, r9w
jne 0x180003e54
lea rdi, str.Windows_XP_Professional_x64_Edition
jmp 0x180003efe
lea rdi, str.Windows_Server_2003
cmp cl, 1
je 0x180003efe
cmp si, r9w
jne 0x180003e8a
test r8b, r8b
jns 0x180003e7b
lea rbx, str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x180003efe
test r8b, 2
je 0x180003efe
lea rbx, str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x180003efe
cmp ax, r9w
jne 0x180003eb2
test r8b, r8b
jns 0x180003e9e
lea rbx, str.Datacenter_x64_Edition
jmp 0x180003efe
test r8b, 2
lea rbx, str.Enterprise_x64_Edition
lea rax, str.Standard_x64_Edition
jmp 0x180003efa
mov eax, 0x4000
test ax, r10w
je 0x180003ec6
lea rbx, str.Compute_Cluster_Edition
jmp 0x180003efe
test r8b, r8b
jns 0x180003ed4
lea rbx, str.Datacenter_Edition
jmp 0x180003efe
test r8b, 2
je 0x180003ee3
lea rbx, str.Enterprise_Edition
jmp 0x180003efe
mov eax, 0x400
lea rbx, str.Web_Edition
test ax, r10w
lea rax, str.Standard_Edition
cmove rbx, rax
mov edx, dword [rsp + 0x84]
cmp edx, 5
jne 0x180003f99
mov eax, dword [rsp + 0x88]
jmp 0x180003f29
mov r10w, word [rsp + 0x118]
mov r9w, word [rsp + 0x50]
mov r8b, r10b
cmp eax, 1
jne 0x180003f51
mov r11d, 0x200
lea rdi, str.Windows_XP
test r11w, r10w
je 0x180003f4a
lea rbx, str.Home_Edition
jmp 0x180003f9b
lea rbx, str.Professional
test eax, eax
jne 0x180003f9b
lea rdi, str.Windows_2000
cmp cl, 1
jne 0x180003f6a
lea rbx, str.Professional
jmp 0x180003f9b
test r8b, r8b
jns 0x180003f78
lea rbx, str.Datacenter_Server
jmp 0x180003f9b
test r8b, 2
je 0x180003f87
lea rbx, str.Advanced_Server
jmp 0x180003f9b
lea rbx, str.Server
jmp 0x180003f96
mov r9w, word [rsp + 0x50]
cmp edx, 5
jb 0x180003fc3
mov eax, 9
cmp ax, r9w
jne 0x180003faf
lea r14, str.64_Bit
jmp 0x180003fc3
xor ecx, ecx
lea rax, str.32_Bit
cmp cx, r9w
cmovne rax, r14
mov r14, rax
cmp edx, 4
lea rsi, str.Microsoft_Windows_NT
mov rcx, r14
cmova rsi, rdi
call fcn.1800529c0
lea rcx, [rsp + 0x94]
test rax, rax
jne 0x1800040ac
call fcn.1800529c0
test rax, rax
jne 0x180004055
test r15b, r15b
je 0x180004031
lea rcx, [rsp + 0x120]
call fcn.1800529c0
test rax, rax
je 0x180004031
lea rax, [rsp + 0x120]
lea r8, str._s_s_s__Build__s_
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x28], rax
jmp 0x1800040ff
mov eax, dword [rsp + 0x8c]
lea r8, str._s_s_s__Build__d_
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x28], rax
jmp 0x1800040ff
test r15b, r15b
je 0x180004082
lea rcx, [rsp + 0x120]
call fcn.1800529c0
test rax, rax
je 0x180004082
lea rax, [rsp + 0x120]
lea r8, str._s_s_Build__s_
mov qword [rsp + 0x28], rax
jmp 0x180004094
mov eax, dword [rsp + 0x8c]
lea r8, str._s_s_Build__d_
mov dword [rsp + 0x28], eax
lea edx, [rbp - 2]
mov r9, rsi
mov rcx, r12
mov qword [rsp + 0x20], rbx
call fcn.1800528fc
jmp 0x18000418a
call fcn.1800529c0
test rax, rax
jne 0x180004114
test r15b, r15b
je 0x1800040e8
lea rcx, [rsp + 0x120]
call fcn.1800529c0
test rax, rax
je 0x1800040e8
lea rax, [rsp + 0x120]
mov qword [rsp + 0x30], r14
lea r8, str._s_s_Build__s___s
mov qword [rsp + 0x28], rax
jmp 0x1800040ff
mov eax, dword [rsp + 0x8c]
mov qword [rsp + 0x30], r14
lea r8, str._s_s_Build__d___s
mov dword [rsp + 0x28], eax
lea edx, [rbp - 2]
mov r9, rsi
mov rcx, r12
mov qword [rsp + 0x20], rbx
call fcn.1800528fc
jmp 0x18000418a
test r15b, r15b
je 0x180004153
lea rcx, [rsp + 0x120]
call fcn.1800529c0
test rax, rax
je 0x180004153
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], r14
lea r8, str._s_s_s__Build__s___s
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x28], rax
jmp 0x180004177
mov ecx, dword [rsp + 0x8c]
mov qword [rsp + 0x38], r14
lea r8, str._s_s_s__Build__d___s
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x94]
mov qword [rsp + 0x28], rcx
lea edx, [rbp - 2]
mov r9, rsi
mov rcx, r12
mov qword [rsp + 0x20], rbx
call fcn.1800528fc
mov al, 1
jmp 0x180004190
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800527e0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret