Function at 0x140030e30
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1400ab680]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov r14, rcx
mov qword [rbp - 0x58], rcx
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x1400324b3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x1400324be
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x1400324c9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x1400324d4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x1400324df
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x1400324ea
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x1400324f5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
call fcn.14003be40
mov rcx, rax
test rax, rax
je 0x140032500
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x78], rdi
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 0x54]
call fcn.140060b10
mov dword [rbp + 0x50], 0x11c
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rbp + 0x60]
mov rsi, 0xffffffffffffffff
sub eax, 1
je 0x1400321d5
cmp eax, 1
jne 0x14003236a
mov r8d, dword [rbp + 0x54]
cmp r8d, 3
jne 0x140030fcf
mov r8d, dword [rbp + 0x58]
lea rdx, str.Windows_NT3._d
lea rcx, [rsp + 0x48]
call fcn.14000c550
jmp 0x1400312d6
mov r9d, dword [rbp + 0x58]
cmp r8d, 4
jne 0x14003100c
test r9d, r9d
jne 0x1400312c5
lea rdx, str.Windows_NT4
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140030ff0
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
cmp r8d, 5
jne 0x140031142
test r9d, r9d
jne 0x140031041
lea rdx, str.Windows_2000
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031025
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
cmp r9d, 1
jne 0x14003106d
lea rdx, str.Windows_XP
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031051
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
cmp r9d, 2
jne 0x1400312c5
lea ecx, [r9 + 0x57]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1400310ac
lea rdx, str.Windows_Server_2003_R2
mov rax, rsi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031090
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
mov eax, 0x2000
cmp word [rbp + 0x168], ax
jne 0x1400310e0
lea rdx, str.Windows_Storage_Server_2003
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400310c4
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
cmp byte [rbp + 0x16a], 1
jne 0x14003111c
call fcn.140030c90
test eax, eax
je 0x14003111c
lea rdx, str.Windows_XP
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031100
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
lea rdx, str.Windows_Server_2003
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031126
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
cmp r8d, 6
jne 0x140031359
test r9d, r9d
jne 0x1400311ac
mov rax, rsi
cmp byte [rbp + 0x16a], 1
je 0x140031180
lea rdx, str.Windows_Server_2008
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031164
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
lea rdx, str.Windows_Vista
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031190
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
cmp r9d, 1
jne 0x14003120c
mov rax, rsi
cmp byte [rbp + 0x16a], r9b
je 0x1400311e1
lea rdx, str.Windows_Server_2008_R2
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400311c5
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
lea rdx, str.Windows_7
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400311f0
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
cmp r9d, 2
jne 0x140031269
mov rax, rsi
cmp byte [rbp + 0x16a], 1
je 0x140031241
lea rdx, str.Windows_Server_2012
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031225
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
lea rdx, str.Windows_8
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031250
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
cmp r9d, 3
jne 0x1400312bb
mov rax, rsi
cmp byte [rbp + 0x16a], 1
je 0x14003129b
lea rdx, str.Windows_Server_2012_R2
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031282
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
lea rdx, str.Windows_8.1
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400312a2
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
cmp r9d, 4
je 0x140031363
lea rdx, str.Windows_NT__d._d
lea rcx, [rsp + 0x48]
call fcn.14000c550
xor r15d, r15d
mov eax, dword [rbp + 0x54]
cmp eax, 6
jb 0x14003194f
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProductInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.0x1400316f3.29
mov dword [rsp + 0x70], r15d
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x58]
mov ecx, dword [rbp + 0x54]
call rax
mov eax, dword [rsp + 0x70]
cmp eax, 0x14
ja 0x1400316bf
je 0x14003169f
dec eax
cmp eax, 0x12
ja case.0x1400316f3.29
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0x32538]
add rax, rdx
jmp rax
cmp r8d, 0xa
jb 0x1400312c5
cmp byte [rbp + 0x16a], 1
je 0x1400313f0
mov eax, dword [rbp + 0x5c]
cmp eax, 0x4f78
jb 0x1400313a0
lea rdx, str.Windows_Server_2022
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031384
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
cmp eax, 0x4563
mov rax, rsi
jb 0x1400313cd
lea rdx, str.Windows_Server_2019
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400313b1
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
lea rdx, str.Windows_Server_2016
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400313d4
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
mov rax, rsi
cmp dword [rbp + 0x5c], 0x55ec
jb 0x14003141f
lea rdx, str.Windows_11
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031403
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
lea rdx, str.Windows_10
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031426
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
jmp 0x1400312d6
lea rdx, str.Business
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031450
jmp 0x140031c8d
lea rdx, str.Business_N
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031470
jmp 0x140031c8d
lea rdx, str.Cluster_Server
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031490
jmp 0x140031c8d
lea rdx, str.Datacenter__Full_installation_
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400314b0
jmp 0x140031c8d
lea rdx, str.Datacenter__Server_Core_installation_
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400314d0
jmp 0x140031c8d
lea rdx, str.Enterprise
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400314f0
jmp 0x140031c8d
lea rdx, str.Enterprise__Full_installation_
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031510
jmp 0x140031c8d
lea rdx, str.Enterprise__Server_Core_installation_
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031530
jmp 0x140031c8d
lea rdx, str.Datacenter_Enterprise_for_Itanium_based_Systems
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031550
jmp 0x140031c8d
lea rdx, str.Home_Basic
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031570
jmp 0x140031c8d
lea rdx, str.Home_Basic_N
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031590
jmp 0x140031c8d
lea rdx, str.Home_Premium
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400315b0
jmp 0x140031c8d
lea rdx, str.Home_Server
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400315d0
jmp 0x140031c8d
lea rdx, str.Small_Business_Server
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400315f0
jmp 0x140031c8d
lea rdx, str.Server_Standard__full_installation_
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031610
jmp 0x140031c8d
lea rdx, str.Server_Standard__core_installation_
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031630
jmp 0x140031c8d
lea rdx, str.Starter
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031650
jmp 0x140031c8d
lea rdx, str.Ultimate
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031670
jmp 0x140031c8d
lea rdx, str.Web_Server
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031690
jmp 0x140031c8d
lea rdx, str.Storage_Server_Express
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400316b0
jmp 0x140031c8d
cmp eax, 0x31
ja 0x14003185f
je 0x140031825
add eax, 0xffffffeb
cmp eax, 0x1b
ja case.0x1400316f3.29
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x325ac]
mov ecx, dword [rdx + rax*4 + 0x32584]
add rcx, rdx
jmp rcx
lea rdx, str.Enterprise_N
mov rax, rsi
nop
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031700
jmp 0x140031c8d
lea rdx, str.Home_Premium_N
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031720
jmp 0x140031c8d
lea rdx, str.Server_for_Small_Business
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031740
jmp 0x140031c8d
lea rdx, str.Small_Business_Server_Premium
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031760
jmp 0x140031c8d
lea rdx, str.Storage_Server_Enterprise
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031780
jmp 0x140031c8d
lea rdx, str.Storage_Server_Standard
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400317a0
jmp 0x140031c8d
lea rdx, str.Storage_Server_Workgroup
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400317c0
jmp 0x140031c8d
lea rdx, str.Ultimate_N
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400317e0
jmp 0x140031c8d
mov rax, rsi
cmp dword [rbp + 0x58], 2
jb 0x14003180f
lea rdx, [0x140097250]
nop
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031800
jmp 0x140031c8d
lea rdx, str.Professional
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031816
jmp 0x140031c8d
mov rax, rsi
cmp dword [rbp + 0x58], 2
jb 0x140031844
lea rdx, str.Pro_N
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031835
jmp 0x140031c8d
lea rdx, str.Professional_N
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031850
jmp 0x140031c8d
cmp eax, 0xa2
ja 0x1400318df
je 0x1400318bf
sub eax, 0x3c
je 0x14003189f
sub eax, 1
je 0x14003189f
sub eax, 1
je 0x14003189f
cmp eax, 0x63
jne case.0x1400316f3.29
lea rdx, str.Pro_for_Workstation
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031890
jmp 0x140031c8d
lea rdx, str.Essentials_Server
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400318b0
jmp 0x140031c8d
lea rdx, str.Pro_for_Workstation_N
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400318d0
jmp 0x140031c8d
cmp eax, 0xa4
je 0x14003192f
cmp eax, 0xa5
je 0x140031911
cmp eax, 0xabcdabcd
jne case.0x1400316f3.29
lea rdx, str.Unlicensed
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031902
jmp 0x140031c8d
lea rdx, str.Pro_for_Education_N
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031920
jmp 0x140031c8d
lea rdx, str.Pro_for_Education
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031940
jmp 0x140031c8d
cmp eax, 5
jne case.0x1400316f3.29
mov eax, dword [rbp + 0x58]
test eax, eax
jne 0x1400319ff
movzx eax, byte [rbp + 0x16a]
cmp al, 1
jne 0x14003198f
lea rdx, str.Professional
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031980
jmp 0x140031c8d
cmp al, 3
jne case.0x1400316f3.29
movzx eax, byte [rbp + 0x168]
test al, al
jns 0x1400319bf
lea rdx, str.DataCenter_Server
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400319b0
jmp 0x140031c8d
test al, 2
mov rax, rsi
je 0x1400319e0
lea rdx, str.Advanced_Server
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400319d1
jmp 0x140031c8d
lea rdx, str.Server
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400319f0
jmp 0x140031c8d
cmp eax, 1
jb case.0x1400316f3.29
movzx ecx, word [rbp + 0x168]
bt cx, 9
jae 0x140031a33
lea rdx, str.Home_Edition
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031a24
jmp 0x140031aca
movzx eax, byte [rbp + 0x168]
test al, al
jns 0x140031a5c
lea rdx, str.Datacenter_Edition
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031a50
jmp 0x140031aca
test al, 2
je 0x140031a7c
lea rdx, str.Enterprise_Edition
mov rax, rsi
nop
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031a70
jmp 0x140031aca
bt cx, 0xa
jae 0x140031aa0
lea rdx, str.Web_Edition
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031a91
jmp 0x140031aca
cmp byte [rbp + 0x16a], 1
jne 0x140031ad7
lea rdx, str.Professional
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031ac0
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140002ba0
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140031c6a
mov edx, 0x104
lea rcx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, eax
lea r8, str.ehomeehshell.exe
mov edx, 0x104
lea rcx, [rbp + 0x370]
call fcn.140068848
test ebx, ebx
je case.0x1400316f3.29
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x370]
call fcn.1400346f0
test eax, eax
je case.0x1400316f3.29
lea rcx, [rbp + 0x170]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140031b43
mov r8d, eax
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x78]
call fcn.140002ba0
mov rdi, qword [rsp + 0x78]
cmp dword [rdi - 0x10], r15d
jl case.0x1400316f3.29
lea rdx, [0x140097480]
mov rcx, rdi
call fcn.14005ff88
test rax, rax
je case.0x1400316f3.29
sub rax, rdi
sar rax, 1
test eax, eax
jne case.0x1400316f3.29
lea rdx, str.Media_Center
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031ba0
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140002ba0
lea r8, [0x1400901e0]
lea rdx, str.5.1.
lea rcx, [rsp + 0x78]
call fcn.140020c70
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call fcn.14006caac
movaps xmm2, xmm0
movsd xmm1, qword [0x14009b6b0]
mov rax, rsi
comisd xmm1, xmm0
jb 0x140031c1c
lea rdx, str.2002
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031c00
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.14000c2b0
jmp case.0x1400316f3.29
movsd xmm0, qword [0x14009b6b8]
comisd xmm0, xmm2
jb 0x140031c4a
lea rdx, str.2004
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031c31
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.14000c2b0
jmp case.0x1400316f3.29
lea rdx, str.2005
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031c51
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.14000c2b0
jmp case.0x1400316f3.29
mov ecx, 0x56
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je case.0x1400316f3.29
lea rdx, str.Tablet_PC
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031c83
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140002ba0
lea rcx, [rbp + 0x64]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140031ca1
mov r8d, eax
lea rdx, [rbp + 0x64]
lea rcx, [rsp + 0x68]
call fcn.140002ba0
lea rcx, str.Service_Pack
mov r12, rsi
inc r12
cmp word [rcx + r12*2], r15w
jne 0x140031cc6
mov qword [rbp - 0x60], r12
test r12d, r12d
je 0x140031f34
lea rdx, [0x1400974fc]
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140031cf0
mov qword [rbp - 0x68], rax
mov rbx, qword [rsp + 0x68]
mov r14, rbx
movsxd rax, dword [rbx - 0x10]
lea r13, [rbx + rax*2]
cmp rbx, r13
jae 0x140031f41
jmp 0x140031d27
lea rcx, str.Service_Pack
mov rdx, rcx
mov rcx, r14
call fcn.14005ff88
test rax, rax
je 0x140031d5f
movsxd r12, r12d
nop word [rax + rax]
inc r15d
lea r14, [rax + r12*2]
lea rdx, str.Service_Pack
mov rcx, r14
call fcn.14005ff88
test rax, rax
jne 0x140031d40
mov r12, qword [rbp - 0x60]
test r14, r14
je 0x140031d80
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140031d70
jmp 0x140031d82
xor eax, eax
inc eax
movsxd rcx, eax
lea r14, [r14 + rcx*2]
cmp r14, r13
jb 0x140031d20
test r15d, r15d
jle 0x140031f3e
movsxd r13, dword [rbx - 0x10]
mov dword [rsp + 0x50], r13d
mov eax, dword [rbp - 0x68]
sub eax, r12d
imul eax, r15d
add eax, r13d
mov dword [rbp - 0x70], eax
mov edx, r13d
cmp eax, r13d
cmovg edx, eax
test edx, edx
js 0x1400324a8
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140031de7
lea rcx, [rsp + 0x68]
call fcn.140002f40
mov rbx, qword [rsp + 0x68]
mov r14, rbx
lea r13, [rbx + r13*2]
mov qword [rbp - 0x48], r13
cmp rbx, r13
jae 0x140031f0f
lea rdx, str.Service_Pack
mov rcx, r14
call fcn.14005ff88
mov r15, rax
test rax, rax
je 0x140031ed5
movsxd rax, r12d
mov qword [rbp - 0x50], rax
movsxd r13, dword [rbp - 0x68]
add r13, r13
nop dword [rax]
nop dword [rax + rax]
mov rcx, r15
sub rcx, rbx
sar rcx, 1
mov r12d, dword [rsp + 0x50]
sub r12d, ecx
sub r12d, dword [rbp - 0x60]
movsxd r8, r12d
add r8, r8
lea rdx, [r15 + rax*2]
lea r14, [r15 + r13]
je 0x140031e73
test r14, r14
je 0x14003250b
test rdx, rdx
je 0x14003250b
mov rcx, r14
call fcn.140060460
test r13, r13
je 0x140031e93
test r15, r15
je 0x140032521
mov r8, r13
lea rdx, [0x1400974fc]
mov rcx, r15
call fcn.140060460
mov rdx, qword [rbp - 0x68]
lea eax, [r12 + rdx]
movsxd rcx, eax
xor eax, eax
mov word [r15 + rcx*2], ax
mov eax, edx
mov r12, qword [rbp - 0x60]
sub eax, r12d
add dword [rsp + 0x50], eax
lea rdx, str.Service_Pack
mov rcx, r14
call fcn.14005ff88
mov r15, rax
test rax, rax
mov rax, qword [rbp - 0x50]
jne 0x140031e30
mov r13, qword [rbp - 0x48]
test r14, r14
je 0x140031efc
mov rax, rsi
nop dword [rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140031ee0
inc eax
movsxd rcx, eax
lea r14, [r14 + rcx*2]
cmp r14, r13
jmp 0x140031df5
xor eax, eax
inc eax
movsxd rcx, eax
lea r14, [r14 + rcx*2]
cmp r14, r13
jmp 0x140031df5
movsxd rax, dword [rbp - 0x70]
test eax, eax
js 0x1400324a8
cmp eax, dword [rbx - 0xc]
jg 0x1400324a8
mov dword [rbx - 0x10], eax
xor r15d, r15d
mov word [rbx + rax*2], r15w
jmp 0x140031f41
mov rbx, qword [rsp + 0x68]
jmp 0x140031f45
xor r15d, r15d
mov r14, qword [rbp - 0x58]
mov r9d, dword [rbp + 0x58]
mov r8d, dword [rbp + 0x54]
lea rdx, str._d._d
lea rcx, [rsp + 0x60]
call fcn.14000c550
mov r8d, dword [rbp + 0x5c]
lea rdx, [0x140093a70]
lea rcx, [rsp + 0x58]
call fcn.14000c550
call fcn.140030c90
test eax, eax
je 0x140031f95
lea rdx, [0x14008fdb8]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140031f86
jmp 0x140032140
mov eax, dword [0x1400ac248]
cmp eax, esi
jne 0x140031ffd
mov dword [0x1400ac248], r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140031ff7
lea rcx, [rbp - 0x40]
call rax
cmp word [rbp - 0x40], 5
jne 0x140031ff7
mov dword [0x1400ac248], 1
jmp 0x140032001
mov eax, dword [0x1400ac248]
test eax, eax
je 0x14003201f
lea rdx, str.ARM32
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140032010
jmp 0x140032140
mov eax, dword [0x1400ac244]
cmp eax, esi
jne 0x140032087
mov dword [0x1400ac244], r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140032081
lea rcx, [rbp - 0x10]
call rax
cmp word [rbp - 0x10], 0xc
jne 0x140032081
mov dword [0x1400ac244], 1
jmp 0x14003208b
mov eax, dword [0x1400ac244]
test eax, eax
je 0x1400320a4
lea rdx, str.ARM64
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140032095
jmp 0x140032140
mov eax, dword [0x1400ac24c]
cmp eax, esi
jne 0x14003210c
mov dword [0x1400ac24c], r15d
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140032106
lea rcx, [rbp + 0x20]
call rax
cmp word [rbp + 0x20], 6
jne 0x140032106
mov dword [0x1400ac24c], 1
jmp 0x140032110
mov eax, dword [0x1400ac24c]
test eax, eax
je 0x14003212c
lea rdx, str.IA64
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140032120
jmp 0x140032140
lea rdx, [0x140097558]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140032136
mov r8d, eax
lea rcx, [rbp - 0x80]
call fcn.140002ba0
mov rax, qword [rbp - 0x80]
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
lea rcx, [rbp - 0x78]
cmp dword [rbx - 0x10], 0
je 0x14003219f
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea rdx, str._s__s__s___s_Build__s____s_
call fcn.14000c550
lea rdx, [rbp - 0x78]
mov rcx, r14
call fcn.1400026b0
jmp 0x14003236a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, str._s__s___s_Build__s____s_
call fcn.14000c550
lea rdx, [rbp - 0x78]
mov rcx, r14
call fcn.1400026b0
jmp 0x14003236a
mov eax, dword [rbp + 0x58]
test eax, eax
je 0x14003228c
cmp eax, 0xa
je 0x14003221f
cmp eax, 0x5a
mov rax, rsi
je 0x140032203
lea rdx, str.Windows_9x
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400321f4
jmp 0x14003230a
lea rdx, str.Windows_Me
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140032210
jmp 0x14003230a
mov ecx, 0x8ae
movzx eax, word [rbp + 0x5c]
cmp ax, cx
jb 0x14003224f
lea rdx, str.Windows_98_SE
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140032240
jmp 0x14003230a
mov ecx, 0x7d0
cmp ax, cx
mov rax, rsi
jb 0x140032272
lea rdx, str.Windows_98_SP1
inc rax
cmp word [rdx + rax*2], 0
jne 0x140032263
jmp 0x14003230a
lea rdx, str.Windows_98
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140032280
jmp 0x14003230a
mov ecx, 0x4be
movzx eax, word [rbp + 0x5c]
cmp ax, cx
jb 0x1400322b0
lea rdx, str.Windows_95_OSR2.5
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400322a4
jmp 0x14003230a
mov ecx, 0x4bc
cmp ax, cx
jb 0x1400322d0
lea rdx, str.Windows_95_OSR2.1
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400322c4
jmp 0x14003230a
mov ecx, 0x457
cmp ax, cx
mov rax, rsi
jne 0x1400322f0
lea rdx, str.Windows_95_OSR2
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400322e4
jmp 0x14003230a
lea rdx, str.Windows_95
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140032300
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002ba0
mov r9d, dword [rbp + 0x58]
mov r8d, dword [rbp + 0x54]
lea rdx, str._d._d
lea rcx, [rsp + 0x60]
call fcn.14000c550
movzx r8d, word [rbp + 0x5c]
lea rdx, [0x140093a70]
lea rcx, [rsp + 0x58]
call fcn.14000c550
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x48]
lea rdx, str._s___s_Build__s_
mov rcx, r14
call fcn.14000c550
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140032388
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400323aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400323cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400323ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140032412
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140032435
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140032458
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140032478
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14005df90
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
mov ecx, 0x80004005
call fcn.140002fe0
nop
call fcn.140064bcc
mov dword [rax], 0x16
call fcn.140064a90
call fcn.14003b7f8
int3
call fcn.140064bcc
mov dword [rax], 0x16
call fcn.140064a90
call fcn.14003b7f8
int3