Function at 0x14003a070
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor r8d, r8d
lea rdx, [0x140085648]
mov rbx, rcx
call fcn.140003b30
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14003a6ac
cmp dword [rbp - 0x80], 2
jne 0x14003a6ac
cmp dword [rsp + 0x74], 5
jb 0x14003a6ac
xor eax, eax
lea rcx, str.kernel32.dll
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x38]
test rax, rax
je 0x14003a123
call rax
jmp 0x14003a129
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, 0xa
lea rdx, str.Microsoft
mov rcx, rbx
call fcn.140003b30
mov eax, dword [rsp + 0x74]
cmp eax, 6
jne 0x14003a3f3
mov eax, dword [rsp + 0x78]
test eax, eax
jne 0x14003a17b
cmp byte [rbp + 0x8a], 1
mov rcx, rbx
jne 0x14003a16c
lea r8d, [rax + 0xe]
lea rdx, str.Windows_Vista
jmp 0x14003a1b8
mov r8d, 0x14
lea rdx, str.Windows_Server_2008
jmp 0x14003a1b8
cmp eax, 1
jne 0x14003a1a3
mov rcx, rbx
cmp byte [rbp + 0x8a], al
jne 0x14003a194
lea rdx, str.Windows_7
jmp 0x14003a1b2
mov r8d, 0x17
lea rdx, str.Windows_Server_2008_R2
jmp 0x14003a1b8
cmp eax, 2
jne 0x14003a1bd
lea rdx, str.Windows_8
mov rcx, rbx
mov r8d, 0xa
call fcn.14000fda0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProductInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.0x14003a231.5
movzx r9d, word [rbp + 0x86]
lea rcx, [rsp + 0x30]
movzx r8d, word [rbp + 0x84]
mov edx, dword [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x74]
call rax
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 0x2f
ja case.0x14003a231.5
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0x3a718]
mov edx, dword [r8 + rax*4 + 0x3a6d0]
add rdx, r8
jmp rdx
mov r8d, 0x10
lea rdx, str.Ultimate_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0xc
lea rdx, str.Professional
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x14
lea rdx, str.Home_Premium_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x12
lea rdx, str.Home_Basic_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x12
lea rdx, str.Enterprise_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x10
lea rdx, str.Business_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0xf
lea rdx, str.Starter_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x16
lea rdx, str.Cluster_Server_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x12
lea rdx, str.Datacenter_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x26
lea rdx, str.Datacenter_Edition__core_installation_
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x26
lea rdx, str.Enterprise_Edition__core_installation_
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x15
lea rdx, str.Small_Business_Server
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x25
lea rdx, str.Small_Business_Server_Premium_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x10
lea rdx, str.Standard_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x24
lea rdx, str.Standard_Edition__core_installation_
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x12
lea rdx, str.Web_Server_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
cmp eax, 5
jne case.0x14003a231.5
mov eax, dword [rsp + 0x78]
cmp eax, 2
jne 0x14003a5d9
lea ecx, [rax + 0x57]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14003a425
mov r8d, 0x17
lea rdx, str.Windows_Server_2003_R2
jmp 0x14003a485
movzx eax, word [rbp + 0x88]
mov ecx, 0x2000
test cx, ax
je 0x14003a445
mov r8d, 0x1c
lea rdx, str.Windows_Storage_Server_2003
jmp 0x14003a485
mov ecx, 0x8000
test cx, ax
je 0x14003a458
lea rdx, str.Windows_Home_Server
jmp 0x14003a47f
cmp byte [rbp + 0x8a], 1
jne 0x14003a478
cmp word [rsp + 0x38], 9
jne 0x14003a478
mov r8d, 0x24
lea rdx, str.Windows_XP_Professional_x64_Edition
jmp 0x14003a485
lea rdx, str.Windows_Server_2003
mov r8d, 0x14
mov rcx, rbx
call fcn.14000fda0
cmp byte [rbp + 0x8a], 1
je case.0x14003a231.5
mov rax, qword [rsp + 0x38]
cmp ax, 6
jne 0x14003a4f0
movzx eax, byte [rbp + 0x88]
test al, al
jns 0x14003a4cc
mov r8d, 0x2c
lea rdx, str.Datacenter_Edition_for_Itanium_based_Systems
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
test al, 2
je case.0x14003a231.5
mov r8d, 0x2c
lea rdx, str.Enterprise_Edition_for_Itanium_based_Systems
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
cmp ax, 9
jne 0x14003a556
movzx eax, byte [rbp + 0x88]
test al, al
jns 0x14003a51d
mov r8d, 0x16
lea rdx, str.Datacenter_x64_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov rcx, rbx
test al, 2
je 0x14003a53d
mov r8d, 0x16
lea rdx, str.Enterprise_x64_Edition
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x14
lea rdx, str.Standard_x64_Edition
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
movzx ecx, word [rbp + 0x88]
mov eax, 0x4000
test ax, cx
je 0x14003a583
mov r8d, 0x17
lea rdx, str.Compute_Cluster_Edition
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
movzx eax, byte [rbp + 0x88]
test al, al
js case.0x14003a231.8
test al, 2
jne case.0x14003a231.4
mov eax, 0x400
test ax, cx
mov rcx, rbx
je 0x14003a5c0
mov r8d, 0xb
lea rdx, str.Web_Edition
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 0x10
lea rdx, str.Standard_Edition
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
cmp eax, 1
jne 0x14003a62e
lea r8d, [rax + 0xa]
mov rcx, rbx
lea rdx, str.Windows_XP
call fcn.14000fda0
mov eax, 0x200
mov r8d, 0xc
mov rcx, rbx
test word [rbp + 0x88], ax
je 0x14003a61b
lea rdx, str.Home_Edition
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
lea rdx, str.Professional
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
test eax, eax
jne case.0x14003a231.5
lea r8d, [rax + 0xd]
mov rcx, rbx
lea rdx, str.Windows_2000
call fcn.14000fda0
cmp byte [rbp + 0x8a], 1
je case.0x14003a231.48
movzx eax, byte [rbp + 0x88]
test al, al
jns 0x14003a676
mov r8d, 0x11
lea rdx, str.Datacenter_Server
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
test al, 2
je 0x14003a693
mov r8d, 0xf
lea rdx, str.Advanced_Server
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
mov r8d, 6
lea rdx, str.Server
mov rcx, rbx
call fcn.14000fda0
mov al, 1
jmp 0x14003a6ae
xor al, al
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14003d350
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x1a0
pop rbp
ret