Function at 0x1401926e0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x9d0
mov qword [rsp + 0x9b0], 0xfffffffffffffffe
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rsp + 0x9c0], rax
mov rax, qword [rsp + 0x9e0]
lea rcx, vtable.Utils::Info::COSInfo.0
mov qword [rax], rcx
mov rax, qword [rsp + 0x9e0]
add rax, 8
mov qword [rsp + 0x3d0], rax
lea rdx, [0x14042f270]
mov rcx, qword [rsp + 0x3d0]
call fcn.1400021f0
nop
lea rdx, [0x14042f270]
lea rcx, [rsp + 0x40]
call fcn.1400021f0
nop
lea rdx, [0x14042f270]
lea rcx, [rsp + 0x1a0]
call fcn.1400021f0
nop
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
call fcn.140001da0
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x11c
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0x11c
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140192803
mov dword [rsp + 0x80], VarUI4FromDisp
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140192803
mov rax, qword [rsp + 0x9e0]
add rax, 8
mov qword [rsp + 0x3f0], rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x3f0]
call fcn.140002260
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x9b8], eax
cmp dword [rsp + 0x9b8], 0
je 0x14019442d
cmp dword [rsp + 0x9b8], 1
je 0x14019420a
cmp dword [rsp + 0x9b8], 2
je 0x14019283c
jmp 0x140194491
cmp dword [rsp + 0x34], 0
je 0x140193e20
cmp dword [rsp + 0x84], 6
jne case.0x140192aac.5
cmp dword [rsp + 0x88], 0
jne 0x14019293a
movzx eax, byte [rsp + 0x19a]
cmp eax, 1
jne 0x1401928d6
lea rax, str.Microsoft_Windows_Vista
mov qword [rsp + 0x3f8], rax
cmp qword [rsp + 0x3f8], 0
jne 0x140192897
mov dword [rsp + 0x400], 0
jmp 0x1401928bb
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x3f8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x400], eax
mov r8d, dword [rsp + 0x400]
lea rdx, str.Microsoft_Windows_Vista
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x14019293a
lea rax, str.Microsoft_Windows_Server_2008
mov qword [rsp + 0x408], rax
cmp qword [rsp + 0x408], 0
jne 0x1401928fd
mov dword [rsp + 0x410], 0
jmp 0x140192921
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x408]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x410], eax
mov r8d, dword [rsp + 0x410]
lea rdx, str.Microsoft_Windows_Server_2008
lea rcx, [rsp + 0x40]
call fcn.140002740
cmp dword [rsp + 0x88], 1
jne 0x140192a1f
movzx eax, byte [rsp + 0x19a]
cmp eax, 1
jne 0x1401929bb
lea rax, str.Microsoft_Windows_7
mov qword [rsp + 0x418], rax
cmp qword [rsp + 0x418], 0
jne 0x14019297c
mov dword [rsp + 0x420], 0
jmp 0x1401929a0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x418]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x420], eax
mov r8d, dword [rsp + 0x420]
lea rdx, str.Microsoft_Windows_7
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140192a1f
lea rax, str.Microsoft_Windows_Server_2008_R2
mov qword [rsp + 0x428], rax
cmp qword [rsp + 0x428], 0
jne 0x1401929e2
mov dword [rsp + 0x430], 0
jmp 0x140192a06
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x428]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x430], eax
mov r8d, dword [rsp + 0x430]
lea rdx, str.Microsoft_Windows_Server_2008_R2
lea rcx, [rsp + 0x40]
call fcn.140002740
lea rcx, [0x14033da28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x84]
call qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x9bc], eax
mov eax, dword [rsp + 0x9bc]
dec eax
mov dword [rsp + 0x9bc], eax
cmp dword [rsp + 0x9bc], 0x2f
ja case.0x140192aac.5
mov eax, dword [rsp + 0x9bc]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x1945a4]
mov eax, dword [rcx + rax*4 + 0x194558]
add rax, rcx
jmp rax
lea rax, str.Ultimate_Edition
mov qword [rsp + 0x438], rax
cmp qword [rsp + 0x438], 0
jne 0x140192ad5
mov dword [rsp + 0x440], 0
jmp 0x140192af9
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x438]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x440], eax
mov r8d, dword [rsp + 0x440]
lea rdx, str.Ultimate_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, [0x14033da48]
mov qword [rsp + 0x448], rax
cmp qword [rsp + 0x448], 0
jne 0x140192b3e
mov dword [rsp + 0x450], 0
jmp 0x140192b62
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x448]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x450], eax
mov r8d, dword [rsp + 0x450]
lea rdx, [0x14033da48]
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Home_Premium_Edition
mov qword [rsp + 0x458], rax
cmp qword [rsp + 0x458], 0
jne 0x140192ba7
mov dword [rsp + 0x460], 0
jmp 0x140192bcb
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x458]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x460], eax
mov r8d, dword [rsp + 0x460]
lea rdx, str.Home_Premium_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Home_Basic_Edition
mov qword [rsp + 0x468], rax
cmp qword [rsp + 0x468], 0
jne 0x140192c10
mov dword [rsp + 0x470], 0
jmp 0x140192c34
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x468]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x470], eax
mov r8d, dword [rsp + 0x470]
lea rdx, str.Home_Basic_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, [0x14033dac0]
mov qword [rsp + 0x478], rax
cmp qword [rsp + 0x478], 0
jne 0x140192c79
mov dword [rsp + 0x480], 0
jmp 0x140192c9d
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x478]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x480], eax
mov r8d, dword [rsp + 0x480]
lea rdx, [0x14033dac0]
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Business_Edition
mov qword [rsp + 0x488], rax
cmp qword [rsp + 0x488], 0
jne 0x140192ce2
mov dword [rsp + 0x490], 0
jmp 0x140192d06
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x488]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x490], eax
mov r8d, dword [rsp + 0x490]
lea rdx, str.Business_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Starter_Edition
mov qword [rsp + 0x498], rax
cmp qword [rsp + 0x498], 0
jne 0x140192d4b
mov dword [rsp + 0x4a0], 0
jmp 0x140192d6f
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x498]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x4a0], eax
mov r8d, dword [rsp + 0x4a0]
lea rdx, str.Starter_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Cluster_Server_Edition
mov qword [rsp + 0x4a8], rax
cmp qword [rsp + 0x4a8], 0
jne 0x140192db4
mov dword [rsp + 0x4b0], 0
jmp 0x140192dd8
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x4a8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x4b0], eax
mov r8d, dword [rsp + 0x4b0]
lea rdx, str.Cluster_Server_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, [0x14033db68]
mov qword [rsp + 0x4b8], rax
cmp qword [rsp + 0x4b8], 0
jne 0x140192e1d
mov dword [rsp + 0x4c0], 0
jmp 0x140192e41
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x4b8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x4c0], eax
mov r8d, dword [rsp + 0x4c0]
lea rdx, [0x14033db68]
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Datacenter_Edition__core_installation_
mov qword [rsp + 0x4c8], rax
cmp qword [rsp + 0x4c8], 0
jne 0x140192e86
mov dword [rsp + 0x4d0], 0
jmp 0x140192eaa
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x4c8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x4d0], eax
mov r8d, dword [rsp + 0x4d0]
lea rdx, str.Datacenter_Edition__core_installation_
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, [0x14033dbe0]
mov qword [rsp + 0x4d8], rax
cmp qword [rsp + 0x4d8], 0
jne 0x140192eef
mov dword [rsp + 0x4e0], 0
jmp 0x140192f13
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x4d8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x4e0], eax
mov r8d, dword [rsp + 0x4e0]
lea rdx, [0x14033dbe0]
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Enterprise_Edition__core_installation_
mov qword [rsp + 0x4e8], rax
cmp qword [rsp + 0x4e8], 0
jne 0x140192f58
mov dword [rsp + 0x4f0], 0
jmp 0x140192f7c
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x4e8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x4f0], eax
mov r8d, dword [rsp + 0x4f0]
lea rdx, str.Enterprise_Edition__core_installation_
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, [0x14033dc60]
mov qword [rsp + 0x4f8], rax
cmp qword [rsp + 0x4f8], 0
jne 0x140192fc1
mov dword [rsp + 0x500], 0
jmp 0x140192fe5
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x4f8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x500], eax
mov r8d, dword [rsp + 0x500]
lea rdx, [0x14033dc60]
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Small_Business_Server
mov qword [rsp + 0x508], rax
cmp qword [rsp + 0x508], 0
jne 0x14019302a
mov dword [rsp + 0x510], 0
jmp 0x14019304e
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x508]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x510], eax
mov r8d, dword [rsp + 0x510]
lea rdx, str.Small_Business_Server
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Small_Business_Server_Premium_Edition
mov qword [rsp + 0x518], rax
cmp qword [rsp + 0x518], 0
jne 0x140193093
mov dword [rsp + 0x520], 0
jmp 0x1401930b7
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x518]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x520], eax
mov r8d, dword [rsp + 0x520]
lea rdx, str.Small_Business_Server_Premium_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, [0x14033dd40]
mov qword [rsp + 0x528], rax
cmp qword [rsp + 0x528], 0
jne 0x1401930fc
mov dword [rsp + 0x530], 0
jmp 0x140193120
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x528]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x530], eax
mov r8d, dword [rsp + 0x530]
lea rdx, [0x14033dd40]
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Standard_Edition__core_installation_
mov qword [rsp + 0x538], rax
cmp qword [rsp + 0x538], 0
jne 0x140193165
mov dword [rsp + 0x540], 0
jmp 0x140193189
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x538]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x540], eax
mov r8d, dword [rsp + 0x540]
lea rdx, str.Standard_Edition__core_installation_
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp case.0x140192aac.5
lea rax, str.Web_Server_Edition
mov qword [rsp + 0x548], rax
cmp qword [rsp + 0x548], 0
jne 0x1401931cb
mov dword [rsp + 0x550], 0
jmp 0x1401931ef
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x548]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x550], eax
mov r8d, dword [rsp + 0x550]
lea rdx, str.Web_Server_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
cmp dword [rsp + 0x84], 5
jne 0x14019392c
cmp dword [rsp + 0x88], 2
jne 0x14019392c
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14019329c
lea rax, str.Windows_Server_2003_R2_
mov qword [rsp + 0x558], rax
cmp qword [rsp + 0x558], 0
jne 0x14019325a
mov dword [rsp + 0x560], 0
jmp 0x14019327e
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x558]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x560], eax
mov r8d, dword [rsp + 0x560]
lea rdx, str.Windows_Server_2003_R2_
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140193471
movzx eax, word [rsp + 0x198]
and eax, 0x2000
test eax, eax
je 0x140193316
lea rax, str.Windows_Storage_Server_2003
mov qword [rsp + 0x568], rax
cmp qword [rsp + 0x568], 0
jne 0x1401932d4
mov dword [rsp + 0x570], 0
jmp 0x1401932f8
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x568]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x570], eax
mov r8d, dword [rsp + 0x570]
lea rdx, str.Windows_Storage_Server_2003
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140193471
movzx eax, word [rsp + 0x198]
and eax, 0x8000
test eax, eax
je 0x140193390
lea rax, str.Windows_Home_Server
mov qword [rsp + 0x578], rax
cmp qword [rsp + 0x578], 0
jne 0x14019334e
mov dword [rsp + 0x580], 0
jmp 0x140193372
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x578]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x580], eax
mov r8d, dword [rsp + 0x580]
lea rdx, str.Windows_Home_Server
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140193471
movzx eax, byte [rsp + 0x19a]
cmp eax, 1
jne 0x14019340d
movzx eax, word [rsp + 0x48]
cmp eax, 9
jne 0x14019340d
lea rax, str.Windows_XP_Professional_x64_Edition
mov qword [rsp + 0x588], rax
cmp qword [rsp + 0x588], 0
jne 0x1401933ce
mov dword [rsp + 0x590], 0
jmp 0x1401933f2
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x588]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x590], eax
mov r8d, dword [rsp + 0x590]
lea rdx, str.Windows_XP_Professional_x64_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140193471
lea rax, str.Windows_Server_2003_
mov qword [rsp + 0x598], rax
cmp qword [rsp + 0x598], 0
jne 0x140193434
mov dword [rsp + 0x5a0], 0
jmp 0x140193458
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x598]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x5a0], eax
mov r8d, dword [rsp + 0x5a0]
lea rdx, str.Windows_Server_2003_
lea rcx, [rsp + 0x40]
call fcn.140002740
movzx eax, byte [rsp + 0x19a]
cmp eax, 1
je 0x14019392c
movzx eax, word [rsp + 0x48]
cmp eax, 6
jne 0x14019357f
movzx eax, word [rsp + 0x198]
and eax, 0x80
test eax, eax
je 0x140193507
lea rax, str.Datacenter_Edition_for_Itanium_based_Systems
mov qword [rsp + 0x5a8], rax
cmp qword [rsp + 0x5a8], 0
jne 0x1401934c8
mov dword [rsp + 0x5b0], 0
jmp 0x1401934ec
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5a8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x5b0], eax
mov r8d, dword [rsp + 0x5b0]
lea rdx, str.Datacenter_Edition_for_Itanium_based_Systems
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x14019357a
movzx eax, word [rsp + 0x198]
and eax, 2
test eax, eax
je 0x14019357a
lea rax, str.Enterprise_Edition_for_Itanium_based_Systems
mov qword [rsp + 0x5b8], rax
cmp qword [rsp + 0x5b8], 0
jne 0x14019353d
mov dword [rsp + 0x5c0], 0
jmp 0x140193561
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5b8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x5c0], eax
mov r8d, dword [rsp + 0x5c0]
lea rdx, str.Enterprise_Edition_for_Itanium_based_Systems
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x14019392c
movzx eax, word [rsp + 0x48]
cmp eax, 9
jne 0x1401936e5
movzx eax, word [rsp + 0x198]
and eax, 0x80
test eax, eax
je 0x140193607
lea rax, str.Datacenter_x64_Edition
mov qword [rsp + 0x5c8], rax
cmp qword [rsp + 0x5c8], 0
jne 0x1401935c5
mov dword [rsp + 0x5d0], 0
jmp 0x1401935e9
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5c8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x5d0], eax
mov r8d, dword [rsp + 0x5d0]
lea rdx, str.Datacenter_x64_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x1401936e0
movzx eax, word [rsp + 0x198]
and eax, 2
test eax, eax
je 0x14019367c
lea rax, str.Enterprise_x64_Edition
mov qword [rsp + 0x5d8], rax
cmp qword [rsp + 0x5d8], 0
jne 0x14019363d
mov dword [rsp + 0x5e0], 0
jmp 0x140193661
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5d8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x5e0], eax
mov r8d, dword [rsp + 0x5e0]
lea rdx, str.Enterprise_x64_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x1401936e0
lea rax, str.Standard_x64_Edition
mov qword [rsp + 0x5e8], rax
cmp qword [rsp + 0x5e8], 0
jne 0x1401936a3
mov dword [rsp + 0x5f0], 0
jmp 0x1401936c7
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5e8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x5f0], eax
mov r8d, dword [rsp + 0x5f0]
lea rdx, str.Standard_x64_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x14019392c
movzx eax, word [rsp + 0x198]
and eax, 0x4000
test eax, eax
je 0x14019375f
lea rax, str.Compute_Cluster_Edition
mov qword [rsp + 0x5f8], rax
cmp qword [rsp + 0x5f8], 0
jne 0x14019371d
mov dword [rsp + 0x600], 0
jmp 0x140193741
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x5f8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x600], eax
mov r8d, dword [rsp + 0x600]
lea rdx, str.Compute_Cluster_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x14019392c
movzx eax, word [rsp + 0x198]
and eax, 0x80
test eax, eax
je 0x1401937d9
lea rax, str.Datacenter_Edition
mov qword [rsp + 0x608], rax
cmp qword [rsp + 0x608], 0
jne 0x140193797
mov dword [rsp + 0x610], 0
jmp 0x1401937bb
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x608]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x610], eax
mov r8d, dword [rsp + 0x610]
lea rdx, str.Datacenter_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x14019392c
movzx eax, word [rsp + 0x198]
and eax, 2
test eax, eax
je 0x140193851
lea rax, str.Enterprise_Edition
mov qword [rsp + 0x618], rax
cmp qword [rsp + 0x618], 0
jne 0x14019380f
mov dword [rsp + 0x620], 0
jmp 0x140193833
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x618]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x620], eax
mov r8d, dword [rsp + 0x620]
lea rdx, str.Enterprise_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x14019392c
movzx eax, word [rsp + 0x198]
and eax, 0x400
test eax, eax
je 0x1401938c8
lea rax, str.Web_Edition
mov qword [rsp + 0x628], rax
cmp qword [rsp + 0x628], 0
jne 0x140193889
mov dword [rsp + 0x630], 0
jmp 0x1401938ad
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x628]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x630], eax
mov r8d, dword [rsp + 0x630]
lea rdx, str.Web_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x14019392c
lea rax, str.Standard_Edition
mov qword [rsp + 0x638], rax
cmp qword [rsp + 0x638], 0
jne 0x1401938ef
mov dword [rsp + 0x640], 0
jmp 0x140193913
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x638]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x640], eax
mov r8d, dword [rsp + 0x640]
lea rdx, str.Standard_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
cmp dword [rsp + 0x84], 5
jne 0x140193a87
cmp dword [rsp + 0x88], 1
jne 0x140193a87
lea rax, str.Microsoft_Windows_XP
mov qword [rsp + 0x648], rax
cmp qword [rsp + 0x648], 0
jne 0x14019396f
mov dword [rsp + 0x650], 0
jmp 0x140193993
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x648]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x650], eax
mov r8d, dword [rsp + 0x650]
lea rdx, str.Microsoft_Windows_XP
lea rcx, [rsp + 0x40]
call fcn.140002740
movzx eax, word [rsp + 0x198]
and eax, 0x200
test eax, eax
je 0x140193a23
lea rax, str.Home_Edition
mov qword [rsp + 0x658], rax
cmp qword [rsp + 0x658], 0
jne 0x1401939e4
mov dword [rsp + 0x660], 0
jmp 0x140193a08
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x658]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x660], eax
mov r8d, dword [rsp + 0x660]
lea rdx, str.Home_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140193a87
lea rax, [0x14033e178]
mov qword [rsp + 0x668], rax
cmp qword [rsp + 0x668], 0
jne 0x140193a4a
mov dword [rsp + 0x670], 0
jmp 0x140193a6e
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x668]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x670], eax
mov r8d, dword [rsp + 0x670]
lea rdx, [0x14033e178]
lea rcx, [rsp + 0x40]
call fcn.140002740
cmp dword [rsp + 0x84], 5
jne 0x140193cd0
cmp dword [rsp + 0x88], 0
jne 0x140193cd0
lea rax, str.Microsoft_Windows_2000
mov qword [rsp + 0x678], rax
cmp qword [rsp + 0x678], 0
jne 0x140193aca
mov dword [rsp + 0x680], 0
jmp 0x140193aee
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x678]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x680], eax
mov r8d, dword [rsp + 0x680]
lea rdx, str.Microsoft_Windows_2000
lea rcx, [rsp + 0x40]
call fcn.140002740
movzx eax, byte [rsp + 0x19a]
cmp eax, 1
jne 0x140193b7d
lea rax, str.Professional
mov qword [rsp + 0x688], rax
cmp qword [rsp + 0x688], 0
jne 0x140193b3b
mov dword [rsp + 0x690], 0
jmp 0x140193b5f
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x688]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x690], eax
mov r8d, dword [rsp + 0x690]
lea rdx, str.Professional
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140193cd0
movzx eax, word [rsp + 0x198]
and eax, 0x80
test eax, eax
je 0x140193bf7
lea rax, str.Datacenter_Server
mov qword [rsp + 0x698], rax
cmp qword [rsp + 0x698], 0
jne 0x140193bb5
mov dword [rsp + 0x6a0], 0
jmp 0x140193bd9
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x698]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x6a0], eax
mov r8d, dword [rsp + 0x6a0]
lea rdx, str.Datacenter_Server
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140193cd0
movzx eax, word [rsp + 0x198]
and eax, 2
test eax, eax
je 0x140193c6c
lea rax, [0x14033e210]
mov qword [rsp + 0x6a8], rax
cmp qword [rsp + 0x6a8], 0
jne 0x140193c2d
mov dword [rsp + 0x6b0], 0
jmp 0x140193c51
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x6a8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x6b0], eax
mov r8d, dword [rsp + 0x6b0]
lea rdx, [0x14033e210]
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140193cd0
lea rax, [0x14033e238]
mov qword [rsp + 0x6b8], rax
cmp qword [rsp + 0x6b8], 0
jne 0x140193c93
mov dword [rsp + 0x6c0], 0
jmp 0x140193cb7
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x6b8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x6c0], eax
mov r8d, dword [rsp + 0x6c0]
lea rdx, [0x14033e238]
lea rcx, [rsp + 0x40]
call fcn.140002740
cmp dword [rsp + 0x84], 4
ja 0x140193e1b
lea rax, str.Microsoft_Windows_NT
mov qword [rsp + 0x6c8], rax
cmp qword [rsp + 0x6c8], 0
jne 0x140193d05
mov dword [rsp + 0x6d0], 0
jmp 0x140193d29
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x6c8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x6d0], eax
mov r8d, dword [rsp + 0x6d0]
lea rdx, str.Microsoft_Windows_NT
lea rcx, [rsp + 0x40]
call fcn.140002740
movzx eax, word [rsp + 0x198]
and eax, 2
test eax, eax
je 0x140193db7
lea rax, str.Server_4.0__Enterprise_Edition
mov qword [rsp + 0x6d8], rax
cmp qword [rsp + 0x6d8], 0
jne 0x140193d78
mov dword [rsp + 0x6e0], 0
jmp 0x140193d9c
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x6d8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x6e0], eax
mov r8d, dword [rsp + 0x6e0]
lea rdx, str.Server_4.0__Enterprise_Edition
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140193e1b
lea rax, str.Server_4.0
mov qword [rsp + 0x6e8], rax
cmp qword [rsp + 0x6e8], 0
jne 0x140193dde
mov dword [rsp + 0x6f0], 0
jmp 0x140193e02
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x6e8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x6f0], eax
mov r8d, dword [rsp + 0x6f0]
lea rdx, str.Server_4.0
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140194098
mov dword [rsp + 0x3b8], 0x100
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x3bc], eax
cmp dword [rsp + 0x3bc], 0
je 0x140193e6b
jmp 0x140194491
lea rax, [rsp + 0x3b8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProductType
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x3bc], eax
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x3bc], 0
jne 0x140193ecc
cmp dword [rsp + 0x3b8], 0x100
jbe 0x140193ed1
jmp 0x140194491
lea rdx, [rsp + 0x1b0]
lea rcx, str.WINNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140193f4e
lea rax, str.Workstation
mov qword [rsp + 0x6f8], rax
cmp qword [rsp + 0x6f8], 0
jne 0x140193f11
mov dword [rsp + 0x700], 0
jmp 0x140193f35
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x6f8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x700], eax
mov r8d, dword [rsp + 0x700]
lea rdx, str.Workstation
lea rcx, [rsp + 0x40]
call fcn.140002740
lea rdx, [rsp + 0x1b0]
lea rcx, str.LANMANNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140193fcb
lea rax, str.Server
mov qword [rsp + 0x708], rax
cmp qword [rsp + 0x708], 0
jne 0x140193f8e
mov dword [rsp + 0x710], 0
jmp 0x140193fb2
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x708]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x710], eax
mov r8d, dword [rsp + 0x710]
lea rdx, str.Server
lea rcx, [rsp + 0x40]
call fcn.140002740
lea rdx, [rsp + 0x1b0]
lea rcx, str.SERVERNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140194048
lea rax, str.Advanced_Server
mov qword [rsp + 0x718], rax
cmp qword [rsp + 0x718], 0
jne 0x14019400b
mov dword [rsp + 0x720], 0
jmp 0x14019402f
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x718]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x720], eax
mov r8d, dword [rsp + 0x720]
lea rdx, str.Advanced_Server
lea rcx, [rsp + 0x40]
call fcn.140002740
mov r9d, dword [rsp + 0x88]
mov r8d, dword [rsp + 0x84]
lea rdx, [0x14033e3f0]
lea rcx, [rsp + 0x1a0]
call fcn.14001bdb0
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x724], eax
mov r8d, dword [rsp + 0x724]
mov rdx, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x40]
call fcn.140002740
cmp dword [rsp + 0x84], 4
jne 0x1401941b6
lea rdx, str.Service_Pack_6
lea rcx, [rsp + 0x94]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1401941b6
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x3c8], eax
cmp dword [rsp + 0x3c8], 0
jne 0x14019414f
mov eax, dword [rsp + 0x8c]
and eax, 0xffff
mov r8d, eax
lea rdx, str.Service_Pack_6a__Build__d__r_n
lea rcx, [rsp + 0x1a0]
call fcn.14001bdb0
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x74c], eax
mov r8d, dword [rsp + 0x74c]
mov rdx, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x1401941a6
mov eax, dword [rsp + 0x8c]
and eax, 0xffff
mov r9d, eax
lea r8, [rsp + 0x94]
lea rdx, str._s__Build__d__r_n
lea rcx, [rsp + 0x1a0]
call fcn.14001bdb0
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x774], eax
mov r8d, dword [rsp + 0x774]
mov rdx, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x40]
call fcn.140002740
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140194205
mov eax, dword [rsp + 0x8c]
and eax, 0xffff
mov r8d, eax
lea rdx, str._Build__d_
lea rcx, [rsp + 0x1a0]
call fcn.14001bdb0
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x79c], eax
mov r8d, dword [rsp + 0x79c]
mov rdx, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140194491
cmp dword [rsp + 0x84], 4
jne 0x140194308
cmp dword [rsp + 0x88], 0
jne 0x140194308
lea rax, str.Microsoft_Windows_95
mov qword [rsp + 0x7c8], rax
cmp qword [rsp + 0x7c8], 0
jne 0x14019424d
mov dword [rsp + 0x7d0], 0
jmp 0x140194271
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x7c8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x7d0], eax
mov r8d, dword [rsp + 0x7d0]
lea rdx, str.Microsoft_Windows_95
lea rcx, [rsp + 0x40]
call fcn.140002740
movzx eax, word [rsp + 0x96]
cmp eax, 0x43
je 0x1401942a4
movzx eax, word [rsp + 0x96]
cmp eax, 0x42
jne 0x140194308
lea rax, str.OSR2
mov qword [rsp + 0x800], rax
cmp qword [rsp + 0x800], 0
jne 0x1401942cb
mov dword [rsp + 0x808], 0
jmp 0x1401942ef
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x800]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x808], eax
mov r8d, dword [rsp + 0x808]
lea rdx, str.OSR2
lea rcx, [rsp + 0x40]
call fcn.140002740
cmp dword [rsp + 0x84], 4
jne 0x1401943b3
cmp dword [rsp + 0x88], 0xa
jne 0x1401943b3
lea rax, str.Microsoft_Windows_98
mov qword [rsp + 0x838], rax
cmp qword [rsp + 0x838], 0
jne 0x14019434b
mov dword [rsp + 0x840], 0
jmp 0x14019436f
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x838]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x840], eax
mov r8d, dword [rsp + 0x840]
lea rdx, str.Microsoft_Windows_98
lea rcx, [rsp + 0x40]
call fcn.140002740
movzx eax, word [rsp + 0x96]
cmp eax, 0x41
je 0x1401943a2
movzx eax, word [rsp + 0x96]
cmp eax, 0x42
jne 0x1401943b3
lea rdx, [0x14033da24]
lea rcx, [rsp + 0x40]
call fcn.140194650
cmp dword [rsp + 0x84], 4
jne 0x14019442b
cmp dword [rsp + 0x88], 0x5a
jne 0x14019442b
lea rax, str.Microsoft_Windows_Millennium_Edition_r_n
mov qword [rsp + 0x8a8], rax
cmp qword [rsp + 0x8a8], 0
jne 0x1401943ee
mov dword [rsp + 0x8b0], 0
jmp 0x140194412
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x8a8]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x8b0], eax
mov r8d, dword [rsp + 0x8b0]
lea rdx, str.Microsoft_Windows_Millennium_Edition_r_n
lea rcx, [rsp + 0x40]
call fcn.140002740
jmp 0x140194491
lea rax, str.Microsoft_Win32s_r_n
mov qword [rsp + 0x8e0], rax
cmp qword [rsp + 0x8e0], 0
jne 0x140194454
mov dword [rsp + 0x8e8], 0
jmp 0x140194478
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x8e0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x8e8], eax
mov r8d, dword [rsp + 0x8e8]
lea rdx, str.Microsoft_Win32s_r_n
lea rcx, [rsp + 0x40]
call fcn.140002740
lea rax, [rsp + 0x94]
mov qword [rsp + 0x918], rax
cmp qword [rsp + 0x918], 0
jne 0x1401944b9
mov dword [rsp + 0x920], 0
jmp 0x1401944dd
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x918]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x920], eax
mov r8d, dword [rsp + 0x920]
lea rdx, [rsp + 0x94]
lea rcx, [rsp + 0x40]
call fcn.140002740
mov rax, qword [rsp + 0x9e0]
add rax, 8
mov qword [rsp + 0x998], rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x998]
call fcn.140002260
nop
lea rcx, [rsp + 0x1a0]
call fcn.140203610
nop
lea rcx, [rsp + 0x40]
call fcn.140203610
nop
mov rax, qword [rsp + 0x9e0]
mov rcx, qword [rsp + 0x9c0]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x9d0
pop rdi
ret