Function at 0x1400211e9
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140054f00
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xc6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [0x1400a7e78]
xor rax, rbp
mov qword [rbp + 0x488], rax
lea rcx, [0x1400b43ad]
call fcn.140021842
mov edx, 0x30
lea rcx, [rbp + 0x148]
call fcn.140021090
mov edx, 0x11c
lea rcx, [rbp + 0x10]
call fcn.140021090
mov dword [rbp + 0x10], 0x11c
mov ecx, 0x1a
call fcn.140021081
movzx eax, al
test eax, eax
jne 0x140054f87
xor eax, eax
jmp 0x14005588b
mov ecx, 0x1a
call fcn.140021063
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0x10]
call qword [rbp + 0x1d8]
mov dword [rbp + 0x194], eax
mov ecx, 4
call fcn.140021081
movzx eax, al
test eax, eax
je 0x140054fd9
mov ecx, 4
call fcn.140021063
mov qword [rbp + 0x1f8], rax
lea rcx, [rbp + 0x148]
call qword [rbp + 0x1f8]
jmp 0x140054fe6
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x20], 2
jne 0x140055889
cmp dword [rbp + 0x14], 4
jbe 0x140055889
lea r8, str.Microsoft
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.140021397
cmp dword [rbp + 0x14], 0xa
jne 0x1400550af
cmp dword [rbp + 0x18], 0
jne 0x1400550aa
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x14005504c
lea r8, str.Windows_10
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400550aa
cmp dword [rbp + 0x1c], 0x4563
jbe 0x14005506f
lea r8, str.Windows_Server_20XX
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400550aa
cmp dword [rbp + 0x1c], 0x3839
jbe 0x140055092
lea r8, str.Windows_Server_2019
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400550aa
lea r8, str.Windows_Server_2016
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400557b1
cmp dword [rbp + 0x14], 6
jne 0x1400553fa
cmp dword [rbp + 0x18], 0
jne 0x1400550fd
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x1400550e5
lea r8, str.Windows_Vista
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400550fd
lea r8, str.Windows_Server_2008
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
cmp dword [rbp + 0x18], 1
jne 0x140055141
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x140055129
lea r8, str.Windows_7
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x140055141
lea r8, str.Windows_Server_2008_R2
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
cmp dword [rbp + 0x18], 2
jne 0x140055185
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x14005516d
lea r8, str.Windows_8
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x140055185
lea r8, str.Windows_Server_2012
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
mov ecx, 5
call fcn.140021063
mov qword [rbp + 0x218], rax
lea rax, [rbp + 0x1b4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x14]
call qword [rbp + 0x218]
mov eax, dword [rbp + 0x1b4]
mov dword [rbp + 0x484], eax
mov eax, dword [rbp + 0x484]
dec eax
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0x2f
ja case.0x1400551fa.18
mov eax, dword [rbp + 0x484]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x55908]
mov eax, dword [rcx + rax*4 + 0x558bc]
add rax, rcx
jmp rax
lea r8, str.Ultimate_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Professional
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Home_Premium_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Home_Basic_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Enterprise_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Business_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Starter_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Cluster_Server_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Datacenter_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Datacenter_Edition__core_installation_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Enterprise_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Enterprise_Edition__core_installation_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Small_Business_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Small_Business_Server_Premium_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Standard_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Standard_Edition__core_installation_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp case.0x1400551fa.18
lea r8, str.Web_Server_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400557b1
cmp dword [rbp + 0x14], 5
jne 0x14005568a
cmp dword [rbp + 0x18], 2
jne 0x14005568a
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14005543a
lea r8, str.Windows_Server_2003_R2_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400554d8
movzx eax, word [rbp + 0x128]
and eax, 0x2000
test eax, eax
je 0x140055464
lea r8, str.Windows_Storage_Server_2003
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400554d8
movzx eax, word [rbp + 0x128]
and eax, 0x8000
test eax, eax
je 0x14005548e
lea r8, str.Windows_Home_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400554d8
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x1400554c0
movzx eax, word [rbp + 0x148]
cmp eax, 9
jne 0x1400554c0
lea r8, str.Windows_XP_Professional_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400554d8
lea r8, str.Windows_Server_2003_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
je 0x140055685
movzx eax, word [rbp + 0x148]
cmp eax, 6
jne 0x140055549
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x14005551e
lea r8, str.Datacenter_Edition_for_Itanium_based_Systems
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x140055544
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x140055544
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x140055685
movzx eax, word [rbp + 0x148]
cmp eax, 9
jne 0x1400555c4
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x14005557f
lea r8, str.Datacenter_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400555bf
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x1400555a7
lea r8, str.Enterprise_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400555bf
lea r8, str.Standard_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x140055685
movzx eax, word [rbp + 0x128]
and eax, 0x4000
test eax, eax
je 0x1400555f1
lea r8, str.Compute_Cluster_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x140055685
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x14005561b
lea r8, str.Datacenter_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x140055685
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x140055643
lea r8, str.Enterprise_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x140055685
movzx eax, word [rbp + 0x128]
and eax, 0x400
test eax, eax
je 0x14005566d
lea r8, str.Web_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x140055685
lea r8, str.Standard_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400557b1
cmp dword [rbp + 0x14], 5
jne 0x1400556f5
cmp dword [rbp + 0x18], 1
jne 0x1400556f5
lea r8, str.Windows_XP
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
movzx eax, word [rbp + 0x128]
and eax, 0x200
test eax, eax
je 0x1400556d8
lea r8, str.Home_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400556f0
lea r8, str.Professional
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400557b1
cmp dword [rbp + 0x14], 5
jne 0x1400557b1
cmp dword [rbp + 0x18], 0
jne 0x1400557b1
lea r8, str.Windows_2000
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x140055747
lea r8, str.Professional
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400557b1
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x140055771
lea r8, str.Datacenter_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400557b1
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x140055799
lea r8, str.Advanced_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x1400557b1
lea r8, str.Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
lea r8, [rbp + 0x238]
mov edx, 0x104
lea rcx, [rbp + 0x24]
call fcn.140020451
cmp qword [rbp + 0x238], 0
jbe 0x1400557fd
lea r8, [0x14007bff8]
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
lea r8, [rbp + 0x24]
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
mov r9d, dword [rbp + 0x1c]
lea r8, str.__build__u_
mov edx, 0x50
lea rcx, [rbp + 0x260]
call fcn.140020f91
lea r8, [rbp + 0x260]
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
cmp dword [rbp + 0x14], 6
jb 0x140055880
movzx eax, word [rbp + 0x148]
cmp eax, 9
jne 0x14005585d
lea r8, str._64_bit
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
jmp 0x140055880
movzx eax, word [rbp + 0x148]
test eax, eax
jne 0x140055880
lea r8, str._32_bit
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002049c
mov eax, 1
jmp 0x14005588b
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14007ca88]
call fcn.1400213b0
mov rax, rdi
mov rcx, qword [rbp + 0x488]
xor rcx, rbp
call fcn.140020b4a
lea rsp, [rbp + 0x498]
pop rdi
pop rbp
ret