Function at 0x140035de1
Capabilities:
Check os version

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
mov rbp, rcx
xor ecx, ecx
cmp qword [0x140113f80], 0
mov word [rsp + 0x5c], 0
mov dword [rsp + 0x60], ecx
mov word [rsp + 0x5e], 0
jne 0x140035e38
lea rcx, str.Kernel32
call fcn.140035296
lea rdx, str.IsWow64Process2
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x140113f80], rax
xor eax, eax
mov ecx, 0x27
lea r12, [rbp + 0x1a]
mov rdi, rbp
rep stosd dword [rdi], eax
mov ecx, 0x26
movabs rbx, 0x2073776f646e6957
movabs rsi, 0x656e696665646e55
mov qword [rbp + 0x1a], rbx
lea rbx, [rsp + 0x6c]
mov r13, qword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov qword [rbp + 0x22], rsi
mov rdi, rbx
lea rsi, [rsp + 0x68]
rep stosd dword [rdi], eax
mov word [r12 + 0x10], 0x64
mov rcx, rsi
mov dword [rsp + 0x68], 0x9c
call r13
test eax, eax
jne 0x140035eb9
mov ecx, 0x26
mov rdi, rbx
mov dword [rsp + 0x68], 0x94
rep stosd dword [rdi], eax
mov rcx, rsi
call r13
test eax, eax
je 0x1400367b8
cmp dword [rsp + 0x78], 2
jne 0x140036138
cmp dword [rsp + 0x6c], 6
ja 0x140035edc
jne 0x140035fd0
cmp dword [rsp + 0x70], 1
jbe 0x140035fd0
mov r15, qword [sym.imp.KERNEL32.DLL_VerSetConditionMask]
mov r8d, 1
mov edx, 2
xor ecx, ecx
call r15
mov ebx, dword [rsp + 0x6c]
lea rsi, [rsp + 0x104]
mov r14, rax
cmp ebx, 9
ja 0x140035fcb
lea rdx, [rsp + 0x10c]
xor eax, eax
mov ecx, 0x25
mov dword [rsp + 0x104], 0x9c
mov rdi, rdx
mov dword [rsp + 0x108], ebx
mov r8, r14
mov edx, 2
rep stosd dword [rdi], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_VerifyVersionInfoA]
test eax, eax
jne 0x140035f4a
inc ebx
jmp 0x140035f02
cmp dword [rsp + 0x6c], ebx
jae 0x140035f5a
xor edx, edx
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x70], edx
mov r8d, 1
mov edx, 1
xor ecx, ecx
call r15
mov r13d, dword [rsp + 0x70]
lea r14, [rsp + 0x108]
xor r15d, r15d
mov r8, rax
cmp r13d, 9
ja 0x140035fd5
mov eax, r15d
mov ecx, 0x26
mov rdi, r14
mov qword [rsp + 0x48], r8
rep stosd dword [rdi], eax
mov edx, 1
mov dword [rsp + 0x10c], r13d
mov rcx, rsi
mov dword [rsp + 0x104], 0x9c
call qword [sym.imp.KERNEL32.DLL_VerifyVersionInfoA]
mov r8, qword [rsp + 0x48]
test eax, eax
jne 0x140035fc4
inc r13d
jmp 0x140035f7d
mov dword [rsp + 0x70], r13d
jmp 0x140035fd5
xor r13d, r13d
jmp 0x140035fd5
xor r13d, r13d
xor ebx, ebx
mov eax, dword [rsp + 0x6c]
cmp eax, 0xf
ja 0x14003613d
mov ecx, dword [rsp + 0x70]
cmp ecx, 0xf
ja 0x14003613d
shl eax, 4
mov dl, byte [rsp + 0x102]
or eax, ecx
mov dword [rbp], eax
cmp eax, 0x64
ja 0x140036034
cmp eax, 0x50
jbe 0x140036131
sub eax, 0x51
cmp eax, 0x13
ja case.0x140036026.83
lea rcx, [0x140099cf4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rsi, [0x140099638]
jmp 0x140036148
cmp eax, 0xa0
je 0x1400360e2
cmp eax, 0xb0
je 0x14003611e
jmp case.0x140036026.83
lea rsi, str.XP_64
cmp dl, 1
jbe 0x140036148
mov ecx, 0x59
lea rsi, str.Server_2003_R2
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
lea rax, str.Server_2003
cmove rsi, rax
jmp 0x140036148
cmp dl, 1
lea rsi, str.Server_2008
lea rax, str.Vista
jmp 0x14003610c
cmp dl, 1
lea rsi, str.Server_2008_R2
lea rax, [0x140099636]
jmp 0x14003610c
cmp dl, 1
lea rsi, str.Server_2012
lea rax, [0x140099634]
jmp 0x14003610c
cmp dl, 1
lea rsi, str.Server_2012_R2
lea rax, [0x140099630]
jmp 0x14003610c
cmp dl, 1
lea rsi, str.Server_10__Preview_1_
lea rax, str.10__Preview_1_
jmp 0x14003610c
mov eax, dword [rsp + 0x74]
cmp eax, 0x4e1f
ja 0x140036112
lea rsi, [0x1400995dc]
cmp dl, 1
jbe 0x140036148
cmp eax, 0x4562
lea rsi, str.Server_2019
lea rax, str.Server_2016
cmovbe rsi, rax
jmp 0x140036148
mov dword [rbp], 0xb0
mov ebx, 0xb
cmp dl, 1
lea rsi, str.Server_2022
lea rax, [0x140099606]
jmp 0x14003610c
xor eax, eax
mov dword [rbp], eax
jmp 0x14003613d
xor r13d, r13d
xor ebx, ebx
xor esi, esi
jmp 0x140036148
lea rsi, str.12_or_later
mov dword [rbp + 4], ebx
mov rbx, qword [0x140113f80]
mov dword [rbp + 8], r13d
test rbx, rbx
je 0x14003617f
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea rdx, [rsp + 0x5c]
lea r8, [rsp + 0x5e]
mov rcx, rax
call rbx
test eax, eax
je 0x14003617f
mov ax, word [rsp + 0x5e]
mov word [rbp + 0x18], ax
jmp 0x140036191
mov word [rbp + 0x18], 0x8664
lea rcx, str.Note:_Underlying_Windows_architecture_was_guessed_and_may_be_incorrect...
call fcn.1400380b9
mov eax, dword [rbp + 0x18]
lea r13, [0x14009963b]
cmp ax, 0x8664
je 0x1400361da
ja 0x1400361c4
lea r13, [0x14009963f]
cmp ax, 0x14c
je 0x1400361da
cmp ax, 0x1c0
lea r13, [0x14009964d]
lea rax, [0x140099649]
jmp 0x1400361d6
cmp ax, 0xaa64
lea r13, [0x14009964d]
lea rax, [0x140099643]
cmove r13, rax
lea rax, [rsp + 0x60]
mov edx, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x6c]
lea r15, [rbp + 0x22]
movzx r9d, word [rsp + 0xfe]
mov qword [rsp + 0x20], rax
movzx r8d, word [rsp + 0xfc]
call qword [sym.imp.KERNEL32.DLL_GetProductInfo]
test rsi, rsi
mov r14, qword [sym.imp.msvcrt.dll__snprintf]
jne 0x140036249
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x78], 2
lea r9, [0x140099658]
mov qword [rsp + 0x30], r13
lea r8, str._s__u._u__s
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x20], eax
lea rax, [0x140099655]
cmove r9, rax
jmp 0x140036275
movzx edx, word [rsp + 0xfe]
movzx eax, word [rsp + 0xfc]
test dx, dx
je 0x140036285
mov qword [rsp + 0x30], r13
mov r9, rsi
lea r8, str._s_SP_u._u__s
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], eax
mov edx, 0x76
mov rcx, r15
call r14
jmp 0x140036714
test ax, ax
je 0x1400362ad
mov qword [rsp + 0x28], r13
mov r9, rsi
mov edx, 0x76
mov rcx, r15
mov dword [rsp + 0x20], eax
lea r8, str._s_SP_u__s
call r14
jmp 0x140036714
mov r9d, dword [rsp + 0x60]
cmp r9d, 0xbd
ja case.default.0x1400362cc
lea rdx, [0x140099d44]
mov eax, r9d
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
lea rax, [0x14009965b]
jmp 0x1400366d9
lea rax, str._Unlicensed_
cmp r9d, 0xabcdabcd
je 0x1400366d9
jmp case.0x1400362cc.15
lea rax, str.Home_Basic
jmp 0x1400366d9
lea rax, str.Home_Premium
jmp 0x1400366d9
lea rax, str.Enterprise
jmp 0x1400366d9
lea rax, str.Home_Basic_N
jmp 0x1400366d9
lea rax, str.Business
jmp 0x1400366d9
lea rax, str.Server_Standard
jmp 0x1400366d9
lea rax, str.Server_Datacenter
jmp 0x1400366d9
lea rax, str.Smallbusiness_Server
jmp 0x1400366d9
lea rax, str.Server_Enterprise
jmp 0x1400366d9
lea rax, str.Starter
jmp 0x1400366d9
lea rax, str.Server_Datacenter__Core_
jmp 0x1400366d9
lea rax, str.Server_Standard__Core_
jmp 0x1400366d9
lea rax, str.Server_Enterprise__Core_
jmp 0x1400366d9
lea rax, str.Business_N
jmp 0x1400366d9
lea rax, str.Web_Server
jmp 0x1400366d9
lea rax, str.HPC_Edition
jmp 0x1400366d9
lea rax, str.Storage_Server__Essentials_
jmp 0x1400366d9
lea rax, str.Home_Premium_N
jmp 0x1400366d9
lea rax, str.Enterprise_N
jmp 0x1400366d9
lea rax, str.Ultimate_N
jmp 0x1400366d9
lea rax, str.Home_Server
jmp 0x1400366d9
lea rax, str.Server_Standard_without_Hyper_V
jmp 0x1400366d9
lea rax, str.Server_Datacenter_without_Hyper_V
jmp 0x1400366d9
lea rax, str.Server_Enterprise_without_Hyper_V
jmp 0x1400366d9
lea rax, str.Server_Datacenter_without_Hyper_V__Core_
jmp 0x1400366d9
lea rax, str.Server_Standard_without_Hyper_V__Core_
jmp 0x1400366d9
lea rax, str.Server_Enterprise_without_Hyper_V__Core_
jmp 0x1400366d9
lea rax, str.Hyper_V_Server
jmp 0x1400366d9
lea rax, str.Starter_N
jmp 0x1400366d9
lea rax, [0x140099896]
jmp 0x1400366d9
lea rax, str.Pro_N
jmp 0x1400366d9
lea rax, str.Server_Solutions_Premium
jmp 0x1400366d9
lea rax, str.Server_Solutions_Premium__Core_
jmp 0x1400366d9
lea rax, str.Server_Hyper_Core_V
jmp 0x1400366d9
lea rax, str.Starter_E
jmp 0x1400366d9
lea rax, str.Home_Basic_E
jmp 0x1400366d9
lea rax, str.Premium_E
jmp 0x1400366d9
lea rax, str.Pro_E
jmp 0x1400366d9
lea rax, str.Enterprise_E
jmp 0x1400366d9
lea rax, str.Ultimate_E
jmp 0x1400366d9
lea rax, str.Enterprise__Eval_
jmp 0x1400366d9
lea rax, str.Server_Standard__Eval_
jmp 0x1400366d9
lea rax, str.Server_Datacenter__Eval_
jmp 0x1400366d9
lea rax, str.Enterprise_N__Eval_
jmp 0x1400366d9
lea rax, str.Thin_PC
jmp 0x1400366d9
lea rax, str.Embedded
jmp 0x1400366d9
lea rax, str.Home_N
jmp 0x1400366d9
lea rax, str.Home_China
jmp 0x1400366d9
lea rax, str.Home_Single_Language
jmp 0x1400366d9
lea rax, str.Home
jmp 0x1400366d9
lea rax, str.Pro_with_Media_Center
jmp 0x1400366d9
lea rax, str.Home_Connected
jmp 0x1400366d9
lea rax, str.Pro_Student
jmp 0x1400366d9
lea rax, str.Home_Connected_N
jmp 0x1400366d9
lea rax, str.Pro_Student_N
jmp 0x1400366d9
lea rax, str.Home_Connected_Single_Language
jmp 0x1400366d9
lea rax, str.Home_Connected_China
jmp 0x1400366d9
lea rax, str.Education
jmp 0x1400366d9
lea rax, str.Education_N
jmp 0x1400366d9
lea rax, str.Enterprise_LTSB
jmp 0x1400366d9
lea rax, str.Enterprise_LTSB_N
jmp 0x1400366d9
lea rax, str.Pro_S
jmp 0x1400366d9
lea rax, str.Pro_S_N
jmp 0x1400366d9
lea rax, str.Enterprise_LTSB__Eval_
jmp 0x1400366d9
lea rax, str.Enterprise_LTSB_N__Eval_
jmp 0x1400366d9
lea rax, str.Pro_Single_Language
jmp 0x1400366d9
lea rax, str.Pro_China
jmp 0x1400366d9
lea rax, str.Enterprise_Subscription
jmp 0x1400366d9
lea rax, str.Enterprise_Subscription_N
jmp 0x1400366d9
lea rax, str.Server_Datacenter_SA__Core_
jmp 0x1400366d9
lea rax, str.Server_Standard_SA__Core_
jmp 0x1400366d9
lea rax, str.Utility_VM
jmp 0x1400366d9
lea rax, str.Pro_for_Workstations
jmp 0x1400366d9
lea rax, str.Pro_for_Workstations_N
jmp 0x1400366d9
lea rax, str.Pro_for_Education
jmp 0x1400366d9
lea rax, str.Pro_for_Education_N
jmp 0x1400366d9
lea rax, str.Enterprise_G
jmp 0x1400366d9
lea rax, str.Enterprise_G_N
jmp 0x1400366d9
lea rax, str.Home_OS
jmp 0x1400366d9
lea rax, str.Cloud_E
jmp 0x1400366d9
lea rax, str.Cloud_E_N
jmp 0x1400366d9
lea rax, str.Lite
jmp 0x1400366d9
lea rbx, [0x140113f40]
lea r8, str._Unknown_Edition_0x_02X_
mov edx, 0x40
mov rcx, rbx
call r14
mov byte [0x140113f7f], 0
mov rax, rbx
jmp 0x1400366d9
lea rax, str.Ultimate
lea rcx, [0x140099bed]
cmp dword [rsp + 0x60], 0
mov qword [rsp + 0x30], r13
mov r9, rsi
lea rdx, [0x14009965b]
mov qword [rsp + 0x28], rax
lea r8, str._s_s_s__s
cmovne rdx, rcx
mov rcx, r15
mov qword [rsp + 0x20], rdx
mov edx, 0x76
call r14
mov eax, dword [rsp + 0x60]
mov byte [rbp + 0x97], 0
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionUBR
lea r8, [rsp + 0x64]
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x14], eax
mov eax, dword [rsp + 0x74]
mov dword [rbp + 0xc], eax
call fcn.140035908
mov ebx, dword [rsp + 0x64]
mov rcx, r12
mov dword [rbp + 0x10], ebx
call sub.msvcrt.dll_strlen
mov edx, 0x7f
mov r9d, dword [rbp + 0xc]
sub rdx, rax
test ebx, ebx
lea rcx, [rbp + rax + 0x1a]
je 0x140036775
mov dword [rsp + 0x20], ebx
lea r8, str.__Build__lu._lu_
call r14
jmp 0x14003677f
lea r8, str.__Build__lu_
call r14
mov byte [rbp + 0x98], 0
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rbx, rax
call fcn.140035d46
test eax, eax
je 0x1400367b8
mov edx, 0x7f
lea rcx, [rbp + rbx + 0x1a]
lea r8, str._in_S_Mode
sub rdx, rbx
call r14
mov byte [rbp + 0x98], 0
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret