Function at 0x140047a9c
Capabilities:
Check os version
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
lea rbp, [rax - 0x578]
sub rsp, 0x660
mov rax, qword [0x14011d6b0]
xor rax, rsp
mov qword [rbp + 0x550], rax
mov rsi, rcx
call fcn.140071a10
mov rcx, rax
test rax, rax
je 0x140048a99
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
call fcn.140071a10
mov rcx, rax
test rax, rax
je 0x140048aa4
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.140071a10
mov rcx, rax
test rax, rax
je 0x140048aaf
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x80], rax
call fcn.140071a10
mov rcx, rax
test rax, rax
je 0x140048aba
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.140071a10
mov rcx, rax
test rax, rax
je 0x140048ac5
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.140071a10
mov rcx, rax
test rax, rax
je 0x140048ad0
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x78], rax
call fcn.140071a10
mov rcx, rax
test rax, rax
je 0x140048adb
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.140071a10
mov rcx, rax
test rax, rax
je 0x140048a8e
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov edi, 0x11c
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.1400abab0
mov dword [rbp + 0x20], edi
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rbp + 0x30]
or r12d, 0xffffffff
sub eax, 1
je 0x14004885a
cmp eax, 1
jne 0x140048959
lea eax, [r12 + 7]
lea edi, [rax - 1]
lea r13d, [r12 + 2]
mov r8d, dword [rbp + 0x24]
cmp r8d, 3
jne 0x140047c3b
mov r8d, dword [rbp + 0x28]
lea rdx, str.Windows_NT3._d
lea rcx, [rsp + 0x48]
call fcn.1400042cc
jmp 0x140047e08
mov r9d, dword [rbp + 0x28]
cmp r8d, 4
jne 0x140047c63
test r9d, r9d
jne 0x140047df7
lea rcx, str.Windows_NT4
call fcn.1400af134
lea rdx, str.Windows_NT4
jmp 0x140047c84
cmp r8d, edi
jne 0x140047d0e
test r9d, r9d
jne 0x140047c96
lea rcx, str.Windows_2000
call fcn.1400af134
lea rdx, str.Windows_2000
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002b78
jmp 0x140047e08
cmp r9d, r13d
jne 0x140047ca7
lea rdi, str.Windows_XP
jmp 0x140047dd8
cmp r9d, 2
jne 0x140047df7
lea ecx, [r9 + 0x57]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140047ccb
lea rdi, str.Windows_Server_2003_R2
jmp 0x140047dd8
mov eax, 0x2000
cmp word [rbp + 0x138], ax
jne 0x140047ce5
lea rdi, str.Windows_Storage_Server_2003
jmp 0x140047dd8
cmp byte [rbp + 0x13a], r13b
jne 0x140047d02
call fcn.140047264
test eax, eax
lea rdi, str.Windows_XP
jne 0x140047dd8
lea rdi, str.Windows_Server_2003
jmp 0x140047dd8
cmp r8d, eax
jne 0x140047da2
test r9d, r9d
jne 0x140047d3c
cmp byte [rbp + 0x13a], r13b
lea rdi, str.Windows_Server_2008
jne 0x140047dd8
lea rdi, str.Windows_Vista
jmp 0x140047dd8
cmp r9d, r13d
jne 0x140047d5e
cmp byte [rbp + 0x13a], r13b
lea rdi, str.Windows_Server_2008_R2
jne 0x140047dd8
lea rdi, str.Windows_7
jmp 0x140047dd8
cmp r9d, 2
jne 0x140047d7d
cmp byte [rbp + 0x13a], r13b
lea rdi, str.Windows_Server_2012
jne 0x140047dd8
lea rdi, str.Windows_8
jmp 0x140047dd8
cmp r9d, 3
jne 0x140047d9c
cmp byte [rbp + 0x13a], r13b
lea rdi, str.Windows_Server_2012_R2
jne 0x140047dd8
lea rdi, str.Windows_8.1
jmp 0x140047dd8
cmp r9d, 4
je 0x140047dad
cmp r8d, 0xa
jne 0x140047df7
test r9d, r9d
jne 0x140047df7
cmp byte [rbp + 0x13a], r13b
je 0x140047dd1
cmp dword [rbp + 0x2c], 0x4563
jb 0x140047dc8
lea rdi, str.Windows_Server_2019
jmp 0x140047dd8
lea rdi, str.Windows_Server_2016
jmp 0x140047dd8
lea rdi, str.Windows_10
mov rcx, rdi
call fcn.1400af134
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140002b78
mov edi, 5
jmp 0x140047e08
lea rdx, str.Windows_NT__d._d
lea rcx, [rsp + 0x48]
call fcn.1400042cc
mov eax, 6
cmp dword [rbp + 0x24], eax
jb 0x1400482e8
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProductInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400485aa
and dword [rsp + 0x68], 0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x24]
call rax
mov eax, dword [rsp + 0x68]
cmp eax, 0x3e
ja 0x140048245
cmp eax, 0x3c
jae 0x14004822d
cmp eax, 0x10
ja 0x14004806b
je 0x140048053
cmp eax, 8
ja 0x140047f7c
je 0x140047f64
sub eax, r13d
je 0x140047f4c
sub eax, r13d
je 0x140047f34
sub eax, r13d
je 0x140047f1c
sub eax, r13d
je 0x140047f04
sub eax, r13d
je 0x140047eec
sub eax, r13d
je 0x140047ed4
cmp eax, r13d
jne 0x1400485aa
lea rcx, str.Server_Standard__full_installation_
call fcn.1400af134
lea rdx, str.Server_Standard__full_installation_
jmp 0x14004859d
lea rcx, str.Business
call fcn.1400af134
lea rdx, str.Business
jmp 0x14004859d
lea rcx, str.Home_Basic_N
call fcn.1400af134
lea rdx, str.Home_Basic_N
jmp 0x14004859d
lea rcx, str.Enterprise
call fcn.1400af134
lea rdx, str.Enterprise
jmp 0x14004859d
lea rcx, str.Home_Premium
call fcn.1400af134
lea rdx, str.Home_Premium
jmp 0x14004859d
lea rcx, str.Home_Basic
call fcn.1400af134
lea rdx, str.Home_Basic
jmp 0x14004859d
lea rcx, str.Ultimate
call fcn.1400af134
lea rdx, str.Ultimate
jmp 0x14004859d
lea rcx, str.Datacenter__Full_installation_
call fcn.1400af134
lea rdx, str.Datacenter__Full_installation_
jmp 0x14004859d
sub eax, 9
je 0x14004803b
sub eax, r13d
je 0x140048023
sub eax, r13d
je 0x14004800b
sub eax, r13d
je 0x140047ff3
sub eax, r13d
je 0x140047fdb
sub eax, r13d
je 0x140047fc3
cmp eax, r13d
jne 0x1400485aa
lea rcx, str.Datacenter_Enterprise_for_Itanium_based_Systems
call fcn.1400af134
lea rdx, str.Datacenter_Enterprise_for_Itanium_based_Systems
jmp 0x14004859d
lea rcx, str.Enterprise__Server_Core_installation_
call fcn.1400af134
lea rdx, str.Enterprise__Server_Core_installation_
jmp 0x14004859d
lea rcx, str.Server_Standard__core_installation_
call fcn.1400af134
lea rdx, str.Server_Standard__core_installation_
jmp 0x14004859d
lea rcx, str.Datacenter__Server_Core_installation_
call fcn.1400af134
lea rdx, str.Datacenter__Server_Core_installation_
jmp 0x14004859d
lea rcx, str.Starter
call fcn.1400af134
lea rdx, str.Starter
jmp 0x14004859d
lea rcx, str.Enterprise__Full_installation_
call fcn.1400af134
lea rdx, str.Enterprise__Full_installation_
jmp 0x14004859d
lea rcx, str.Small_Business_Server
call fcn.1400af134
lea rdx, str.Small_Business_Server
jmp 0x14004859d
lea rcx, str.Business_N
call fcn.1400af134
lea rdx, str.Business_N
jmp 0x14004859d
cmp eax, 0x18
ja 0x140048169
je 0x140048151
sub eax, 0x11
je 0x140048139
sub eax, r13d
je 0x140048121
sub eax, r13d
je 0x140048109
sub eax, r13d
je 0x1400480f1
sub eax, r13d
je 0x1400480d9
sub eax, r13d
je 0x1400480c1
cmp eax, r13d
jne 0x1400485aa
lea rcx, str.Storage_Server_Enterprise
call fcn.1400af134
lea rdx, str.Storage_Server_Enterprise
jmp 0x14004859d
lea rcx, str.Storage_Server_Workgroup
call fcn.1400af134
lea rdx, str.Storage_Server_Workgroup
jmp 0x14004859d
lea rcx, str.Storage_Server_Standard
call fcn.1400af134
lea rdx, str.Storage_Server_Standard
jmp 0x14004859d
lea rcx, str.Storage_Server_Express
call fcn.1400af134
lea rdx, str.Storage_Server_Express
jmp 0x14004859d
lea rcx, str.Home_Server
call fcn.1400af134
lea rdx, str.Home_Server
jmp 0x14004859d
lea rcx, str.Cluster_Server
call fcn.1400af134
lea rdx, str.Cluster_Server
jmp 0x14004859d
lea rcx, str.Web_Server
call fcn.1400af134
lea rdx, str.Web_Server
jmp 0x14004859d
lea rcx, str.Server_for_Small_Business
call fcn.1400af134
lea rdx, str.Server_for_Small_Business
jmp 0x14004859d
sub eax, 0x19
je 0x140048215
sub eax, r13d
je 0x1400481fd
sub eax, r13d
je 0x1400481e5
sub eax, r13d
je 0x1400481cd
sub eax, 0x14
je 0x1400481b7
cmp eax, r13d
jne 0x1400485aa
cmp dword [rbp + 0x28], 2
lea rdi, str.Pro_N
jae 0x1400481a7
lea rdi, str.Professional_N
mov rcx, rdi
call fcn.1400af134
mov rdx, rdi
jmp 0x14004859d
cmp dword [rbp + 0x28], 2
lea rdi, [0x1400f9c10]
jae 0x1400481a7
lea rdi, str.Professional
jmp 0x1400481a7
lea rcx, str.Ultimate_N
call fcn.1400af134
lea rdx, str.Ultimate_N
jmp 0x14004859d
lea rcx, str.Enterprise_N
call fcn.1400af134
lea rdx, str.Enterprise_N
jmp 0x14004859d
lea rcx, str.Home_Premium_N
call fcn.1400af134
lea rdx, str.Home_Premium_N
jmp 0x14004859d
lea rcx, str.Small_Business_Server_Premium
call fcn.1400af134
lea rdx, str.Small_Business_Server_Premium
jmp 0x14004859d
lea rcx, str.Essentials_Server
call fcn.1400af134
lea rdx, str.Essentials_Server
jmp 0x14004859d
cmp eax, 0xa1
je 0x1400482d0
cmp eax, 0xa2
je 0x1400482b8
cmp eax, 0xa4
je 0x1400482a0
cmp eax, 0xa5
je 0x140048288
cmp eax, 0xabcdabcd
jne 0x1400485aa
lea rcx, str.Unlicensed
call fcn.1400af134
lea rdx, str.Unlicensed
jmp 0x14004859d
lea rcx, str.Pro_for_Education_N
call fcn.1400af134
lea rdx, str.Pro_for_Education_N
jmp 0x14004859d
lea rcx, str.Pro_for_Education
call fcn.1400af134
lea rdx, str.Pro_for_Education
jmp 0x14004859d
lea rcx, str.Pro_for_Workstation_N
call fcn.1400af134
lea rdx, str.Pro_for_Workstation_N
jmp 0x14004859d
lea rcx, str.Pro_for_Workstation
call fcn.1400af134
lea rdx, str.Pro_for_Workstation
jmp 0x14004859d
cmp dword [rbp + 0x24], edi
jne 0x1400485aa
mov eax, dword [rbp + 0x28]
test eax, eax
jne 0x140048365
mov al, byte [rbp + 0x13a]
cmp al, r13b
je 0x1400481c4
cmp al, 3
jne 0x1400485aa
mov al, byte [rbp + 0x138]
test al, al
jns 0x140048331
lea rcx, str.DataCenter_Server
call fcn.1400af134
lea rdx, str.DataCenter_Server
jmp 0x14004859d
test al, 2
je 0x14004834d
lea rcx, str.Advanced_Server
call fcn.1400af134
lea rdx, str.Advanced_Server
jmp 0x14004859d
lea rcx, str.Server
call fcn.1400af134
lea rdx, str.Server
jmp 0x14004859d
cmp eax, r13d
jb 0x1400485aa
mov eax, 0x200
test word [rbp + 0x138], ax
je 0x140048391
lea rcx, str.Home_Edition
call fcn.1400af134
lea rdx, str.Home_Edition
jmp 0x140048407
mov al, byte [rbp + 0x138]
test al, al
jns 0x1400483b0
lea rcx, str.Datacenter_Edition
call fcn.1400af134
lea rdx, str.Datacenter_Edition
jmp 0x140048407
test al, 2
je 0x1400483c9
lea rcx, str.Enterprise_Edition
call fcn.1400af134
lea rdx, str.Enterprise_Edition
jmp 0x140048407
mov eax, 0x400
test word [rbp + 0x138], ax
je 0x1400483ec
lea rcx, str.Web_Edition
call fcn.1400af134
lea rdx, str.Web_Edition
jmp 0x140048407
cmp byte [rbp + 0x13a], r13b
jne 0x140048414
lea rdi, str.Professional
mov rcx, rdi
call fcn.1400af134
mov rdx, rdi
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140002b78
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14004857b
mov edx, 0x104
lea rcx, [rbp + 0x340]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
lea r8, str.ehomeehshell.exe
mov edx, 0x104
lea rcx, [rbp + 0x340]
call fcn.1400b7708
test edi, edi
je 0x1400485aa
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x340]
call fcn.14004ab7c
test eax, eax
je 0x1400485aa
lea rcx, [rbp + 0x140]
call fcn.1400af134
mov r8d, eax
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x70]
call fcn.140002b78
mov rbx, qword [rsp + 0x70]
cmp dword [rbx - 0x10], 0
jl 0x1400485aa
lea rdx, [0x1400f9e40]
mov rcx, rbx
call fcn.1400ac1d8
test rax, rax
je 0x1400485aa
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x1400485aa
lea rcx, str.Media_Center
call fcn.1400af134
mov r8d, eax
lea rdx, str.Media_Center
lea rcx, [rsp + 0x40]
call fcn.140002b78
lea r8, [0x1400ea000]
lea rdx, str.5.1.
lea rcx, [rsp + 0x70]
call fcn.140011f84
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call fcn.1400bb564
movaps xmm2, xmm0
movsd xmm1, qword [0x140104e30]
comisd xmm1, xmm0
jb 0x140048536
lea rcx, str.2002
call fcn.1400af134
lea rdx, str.2002
jmp 0x14004856c
movsd xmm0, qword [0x140104e38]
comisd xmm0, xmm2
jb 0x140048559
lea rcx, str.2004
call fcn.1400af134
lea rdx, str.2004
jmp 0x14004856c
lea rcx, str.2005
call fcn.1400af134
lea rdx, str.2005
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140003fa0
jmp 0x1400485aa
mov ecx, 0x56
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1400485aa
lea rcx, str.Tablet_PC
call fcn.1400af134
lea rdx, str.Tablet_PC
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140002b78
lea rcx, [rbp + 0x34]
call fcn.1400af134
mov r8d, eax
lea rdx, [rbp + 0x34]
lea rcx, [rbp - 0x80]
call fcn.140002b78
lea r8, [0x1400f9ebc]
lea rdx, str.Service_Pack
lea rcx, [rbp - 0x80]
call fcn.140011f84
mov r9d, dword [rbp + 0x28]
mov r8d, dword [rbp + 0x24]
lea rdx, str._d._d
lea rcx, [rsp + 0x60]
call fcn.1400042cc
mov r8d, dword [rbp + 0x2c]
lea rdx, [0x1400ea7b8]
lea rcx, [rsp + 0x58]
call fcn.1400042cc
call fcn.140047264
test eax, eax
je 0x140048629
lea rcx, [0x1400e9850]
call fcn.1400af134
lea rdx, [0x1400e9850]
jmp 0x1400487c2
lea rdi, str.kernel32
mov eax, dword [0x14011f334]
cmp eax, r12d
jne 0x140048696
and dword [0x14011f334], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140048690
lea rcx, [rbp - 0x78]
call rax
mov eax, dword [0x14011f334]
mov ecx, 5
cmp word [rbp - 0x78], cx
cmove eax, r13d
mov dword [0x14011f334], eax
jmp 0x140048696
mov eax, dword [0x14011f334]
test eax, eax
je 0x1400486b2
lea rcx, str.ARM32
call fcn.1400af134
lea rdx, str.ARM32
jmp 0x1400487c2
mov eax, dword [0x14011f330]
cmp eax, r12d
jne 0x140048714
and dword [0x14011f330], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004870e
lea rcx, [rbp - 0x48]
call rax
mov eax, dword [0x14011f330]
cmp word [rbp - 0x48], 0xc
cmove eax, r13d
mov dword [0x14011f330], eax
jmp 0x140048714
mov eax, dword [0x14011f330]
test eax, eax
je 0x140048730
lea rcx, str.ARM64
call fcn.1400af134
lea rdx, str.ARM64
jmp 0x1400487c2
mov eax, dword [0x14011f338]
cmp eax, r12d
jne 0x140048796
and dword [0x14011f338], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140048790
lea rcx, [rbp - 0x18]
call rax
mov eax, dword [0x14011f338]
mov ecx, 6
cmp word [rbp - 0x18], cx
cmove eax, r13d
mov dword [0x14011f338], eax
jmp 0x140048796
mov eax, dword [0x14011f338]
test eax, eax
je 0x1400487af
lea rcx, str.IA64
call fcn.1400af134
lea rdx, str.IA64
jmp 0x1400487c2
lea rcx, [0x1400f9f18]
call fcn.1400af134
lea rdx, [0x1400f9f18]
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.140002b78
mov rax, qword [rbp - 0x80]
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
cmp dword [rax - 0x10], 0
je 0x140048819
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rdx, str._s__s__s___s_Build__s____s_
lea rcx, [rsp + 0x78]
call fcn.1400042cc
jmp 0x140048848
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, str._s__s___s_Build__s____s_
lea rcx, [rsp + 0x78]
call fcn.1400042cc
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1400028e0
jmp 0x140048959
mov eax, dword [rbp + 0x28]
test eax, eax
je 0x1400488ac
cmp eax, 0xa
je 0x14004887d
cmp eax, 0x5a
je 0x140048874
lea rdi, str.Windows_9x
jmp 0x1400488ee
lea rdi, str.Windows_Me
jmp 0x1400488ee
mov eax, 0x8ae
cmp word [rbp + 0x2c], ax
jb 0x140048891
lea rdi, str.Windows_98_SE
jmp 0x1400488ee
mov eax, 0x7d0
cmp word [rbp + 0x2c], ax
lea rdi, str.Windows_98_SP1
jae 0x1400488ee
lea rdi, str.Windows_98
jmp 0x1400488ee
mov ecx, 0x4be
movzx eax, word [rbp + 0x2c]
cmp ax, cx
jb 0x1400488c3
lea rdi, str.Windows_95_OSR2.5
jmp 0x1400488ee
mov ecx, 0x4bc
cmp ax, cx
jb 0x1400488d6
lea rdi, str.Windows_95_OSR2.1
jmp 0x1400488ee
mov ecx, 0x457
cmp ax, cx
lea rdi, str.Windows_95_OSR2
je 0x1400488ee
lea rdi, str.Windows_95
mov rcx, rdi
call fcn.1400af134
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140002b78
mov r9d, dword [rbp + 0x28]
mov r8d, dword [rbp + 0x24]
lea rdx, str._d._d
lea rcx, [rsp + 0x60]
call fcn.1400042cc
movzx r8d, word [rbp + 0x2c]
lea rdx, [0x1400ea7b8]
lea rcx, [rsp + 0x58]
call fcn.1400042cc
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x48]
lea rdx, str._s___s_Build__s_
mov rcx, rsi
call fcn.1400042cc
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140048976
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140048998
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x1400489ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x1400489dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x1400489fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140048a1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140048a41
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140048a62
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.1400a9d90
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002f7c
nop
mov ecx, 0x80004005
call fcn.140002f7c
nop
mov ecx, 0x80004005
call fcn.140002f7c
nop
mov ecx, 0x80004005
call fcn.140002f7c
nop
mov ecx, 0x80004005
call fcn.140002f7c
nop
mov ecx, 0x80004005
call fcn.140002f7c
nop
mov ecx, 0x80004005
call fcn.140002f7c
nop
mov ecx, 0x80004005
call fcn.140002f7c
int3