Function at 0x14006b130
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x14017b750]
xor rax, rsp
mov qword [rsp + 0x198], rax
mov qword [rcx + 0x38], 0
mov byte [rcx + 8], 0
mov qword [rcx], 0
mov qword [rcx + 0x40], 0xf
mov byte [rcx + 0x28], 0
mov dword [rcx + 0x48], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
lea rcx, [0x140148686]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140151dcc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov ecx, 0
test rax, rax
je 0x14006b1cd
mov dword [rsp + 0x78], 0
lea rdx, [rsp + 0x78]
mov rcx, rdi
call rax
xor edx, edx
cmp dword [rsp + 0x78], 0
setne dl
test eax, eax
mov ecx, 2
cmovne ecx, edx
mov dword [rsi + 0x58], ecx
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsi + 0x70], xmm0
mov byte [rsi + 0x60], 0
lea rcx, [rsp + 0x7c]
xor edx, edx
mov r8d, 0x118
call fcn.14011eed0
mov dword [rsp + 0x78], 0x11c
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rsp + 0x7c]
mov dword [rsi + 0xc], eax
mov eax, dword [rsp + 0x80]
mov dword [rsi + 0x10], eax
mov eax, dword [rsp + 0x84]
mov dword [rsi + 0x14], eax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.1400494d0
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rdx, 0xffffffff80000002
mov r9d, 1
mov rcx, rdi
call fcn.1400496a0
test eax, eax
jne 0x14006b277
mov dword [rsp + 0x3c], 0
lea rdx, [0x140151e3a]
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x3c]
call fcn.14004a200
mov ebx, dword [rsp + 0x3c]
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140049730
mov dword [rsi + 0x18], ebx
mov ecx, dword [rsi + 0x14]
mov edx, dword [rsi + 0xc]
mov eax, dword [rsi + 0x10]
test eax, eax
jle 0x14006b2aa
cmp edx, 5
jne 0x14006b2aa
xor ecx, ecx
cmp eax, 1
sete cl
mov eax, 2
sub eax, ecx
jmp 0x14006b319
cmp edx, 0xa
je 0x14006b2c4
cmp edx, 6
jne 0x14006b30c
lea ecx, [rax + 3]
cmp eax, 3
mov eax, 6
cmovb eax, ecx
jmp 0x14006b319
mov eax, 7
cmp ecx, 0x295a
jl 0x14006b319
mov eax, 8
cmp ecx, 0x3839
jl 0x14006b319
mov eax, 9
cmp ecx, 0x3ad7
jl 0x14006b319
mov eax, 0xa
cmp ecx, 0x3fab
jl 0x14006b319
xor edx, edx
cmp ecx, 0x42ee
setl dl
mov eax, ntohl
sub eax, edx
jmp 0x14006b319
xor ecx, ecx
cmp edx, 6
mov eax, ntohl
cmovle eax, ecx
lea rbx, [rsi + 0x28]
mov dword [rsi], eax
movzx eax, word [rsp + 0x18c]
mov dword [rsi + 0x20], eax
movzx eax, word [rsp + 0x18e]
mov dword [rsi + 0x24], eax
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x28], rax
cmp word [rsp + 0x8c], 0
je 0x14006b361
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x8e], 0
lea rax, [rax + 1]
jne 0x14006b350
jmp 0x14006b363
xor eax, eax
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140047a70
cmp rdi, rbx
je 0x14006b3e5
mov rax, qword [rsi + 0x40]
cmp rax, 0x10
jb 0x14006b3b8
mov rcx, qword [rbx]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14006b3b3
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x14006b579
add rax, 0x28
mov rdx, rax
mov rcx, rdi
call fcn.14011a568
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
jmp 0x14006b426
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x14006b426
mov rcx, qword [rsp + 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14006b421
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14006b579
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.14011a568
mov qword [rsp + 0x58], 0xf
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x40]
test ax, ax
je 0x14006b475
movzx ecx, ax
cmp ecx, 6
je 0x14006b46e
cmp ecx, 9
jne 0x14006b47a
mov ecx, 1
jmp 0x14006b477
mov ecx, 2
jmp 0x14006b477
xor ecx, ecx
mov dword [rsi + 0x48], ecx
mov ecx, dword [rsp + 0x60]
mov dword [rsi + 0x4c], ecx
mov ecx, dword [rsp + 0x68]
mov qword [rsi + 0x50], rcx
mov ecx, dword [rsp + 0x7c]
cmp ecx, 5
je 0x14006b501
cmp ecx, 0xa
je 0x14006b4a0
cmp ecx, 6
jne case.0x14006b4f6.1
lea rcx, [0x140148686]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [rsp + 0x7c]
mov edx, dword [rsp + 0x80]
lea rbx, [rsp + 0x3c]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor r9d, r9d
call rax
mov eax, dword [rsp + 0x3c]
add eax, 0xffffffff
cmp eax, 0x81
ja case.0x14006b4f6.1
lea rcx, [0x14006b580]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov dword [rsi + 0x1c], 3
jmp 0x14006b552
mov ecx, dword [rsp + 0x80]
cmp ecx, 1
je 0x14006b538
cmp ecx, 2
jne case.0x14006b4f6.1
movzx eax, ax
cmp eax, 9
jne 0x14006b524
cmp byte [rsp + 0x192], 1
je case.0x14006b4f6.0
cmp word [rsp + 0x190], 0
js case.0x14006b4f6.1
mov dword [rsi + 0x1c], 2
jmp 0x14006b552
test byte [rsp + 0x191], 2
jne case.0x14006b4f6.1
mov dword [rsi + 0x1c], 1
jmp 0x14006b552
mov dword [rsi + 0x1c], 0
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14011a890
mov rax, rsi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov dword [rsi + 0x1c], 4
jmp 0x14006b552
call fcn.140128920
ud2