Function at 0x14001d1b0
Capabilities:
Get hostname
Inspect section memory permissions
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xb20]
sub rsp, 0xc20
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rbp + 0xb10], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x160
call fcn.140135010
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14001aef0
lea rcx, [rbp + 0x100]
test eax, eax
je 0x14001e80d
lea rdx, [0x14019528c]
call fcn.14001e970
cmp dword [rbp - 0x2c], 5
lea r8, str.OS:
mov edx, 0x800
lea rcx, [rbp + 0x100]
jne 0x14001d235
call fcn.14013b330
jmp 0x14001d23a
call fcn.14013b390
mov ecx, dword [rbp - 0x2c]
sub ecx, 1
je 0x14001df47
sub ecx, 1
je 0x14001df3e
sub ecx, 1
je 0x14001dd92
sub ecx, 1
je 0x14001d2b7
cmp ecx, 1
je 0x14001d281
lea rdx, str.Unknown_OS
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
jmp 0x14001df4e
mov eax, dword [rbp - 0x38]
cmp eax, 7
jb 0x14001d295
lea r8, str.Windows_Embedded_Compact
jmp 0x14001df4e
cmp eax, 4
jne 0x14001d2ab
cmp dword [rbp - 0x34], 0
lea r8, str.Windows_CE_.NET
ja 0x14001df4e
lea r8, str.Windows_CE
jmp 0x14001df4e
mov ecx, dword [rbp - 0x38]
cmp ecx, 4
ja 0x14001d3b6
lea r8, str.Windows_NT
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov ecx, dword [rbp - 0x2c]
mov edx, dword [rbp + 0x70]
mov eax, dword [rbp - 0x38]
cmp ecx, 4
jne 0x14001df5f
cmp eax, ecx
ja 0x14001d2ff
cmp edx, 1
jne 0x14001d2ff
lea r8, str.__Workstation_
jmp 0x14001d359
cmp ecx, 4
jne 0x14001df5f
cmp eax, ecx
ja 0x14001d31a
cmp edx, 2
jne 0x14001d31a
lea r8, str.__Server_
jmp 0x14001d359
cmp ecx, 4
jne 0x14001df5f
cmp eax, ecx
ja 0x14001d33a
cmp edx, 3
jne 0x14001d33a
test byte [rbp + 0x60], cl
je 0x14001d33a
lea r8, str.__Primary_Domain_Controller_
jmp 0x14001d359
cmp ecx, 4
jne 0x14001df5f
cmp eax, ecx
ja 0x14001d370
cmp edx, 3
jne 0x14001d370
test byte [rbp + 0x60], 8
je 0x14001d370
lea r8, str.__Backup_Domain_Controller_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp - 0x38]
mov ecx, dword [rbp - 0x2c]
cmp ecx, 4
jne 0x14001df5f
cmp eax, ecx
ja 0x14001d38f
test byte [rbp + 0x60], 0x20
je 0x14001d38f
lea r8, str.___Datacenter_
jmp 0x14001df4e
cmp ecx, 4
jne 0x14001df5f
cmp eax, ecx
ja 0x14001df5f
test byte [rbp + 0x60], 2
je 0x14001df5f
lea r8, str.___Enterprise_
jmp 0x14001df4e
mov edx, dword [rbp - 0x34]
cmp ecx, 5
jne 0x14001d65e
test edx, edx
jne 0x14001d47b
test byte [rbp + 0x64], 0x80
je 0x14001d3d9
lea r8, str.Windows_2000__Professional_
jmp 0x14001d3ff
mov eax, dword [rbp + 0x70]
cmp eax, 2
jne 0x14001d3ea
lea r8, str.Windows_2000_Server
jmp 0x14001d3ff
cmp eax, 3
lea r8, str.Windows_2000__Domain_Controller_
lea rcx, str.Windows_2000
cmovne r8, rcx
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov edx, dword [rbp - 0x2c]
mov r8d, dword [rbp + 0x60]
mov ecx, dword [rbp - 0x34]
mov eax, dword [rbp - 0x38]
cmp edx, 4
jne 0x14001df5f
cmp eax, 5
jne 0x14001d441
test ecx, ecx
jne 0x14001d441
test r8b, 0x20
je 0x14001d441
lea r8, str.___Datacenter_
jmp 0x14001df4e
cmp edx, 4
jne 0x14001df5f
cmp eax, 5
jne 0x14001df5f
test ecx, ecx
jne 0x14001df5f
cmp dword [rbp + 0x70], 2
jne 0x14001df5f
test r8b, 2
je 0x14001df5f
lea r8, str.___Advanced_Server_
jmp 0x14001df4e
cmp ecx, 5
jne 0x14001d65e
test edx, edx
je 0x14001d65e
mov eax, dword [rbp + 0x60]
bt eax, 0x10
jae 0x14001d49e
lea r8, str.Windows_XP__Starter_Edition_
jmp 0x14001d512
test al, 0x40
je 0x14001d4ab
lea r8, str.Windows_XP__Personal_
jmp 0x14001d512
test byte [rbp + 0x64], 0x80
je 0x14001d4ba
lea r8, str.Windows_XP__Professional_
jmp 0x14001d512
mov ecx, dword [rbp + 0x70]
cmp ecx, 2
jne 0x14001d4d1
bt eax, 0x11
jb 0x14001d4d1
lea r8, str.Windows_Server_2003
jmp 0x14001d512
cmp ecx, 3
jne 0x14001d4e5
bt eax, 0x11
jb 0x14001d4e5
lea r8, str.Windows_Server_2003__Domain_Controller_
jmp 0x14001d512
cmp ecx, 2
jne 0x14001d4f9
bt eax, 0x11
jae 0x14001d4f9
lea r8, str.Windows_Server_2003_R2
jmp 0x14001d512
cmp ecx, 3
jne 0x14001d50b
lea r8, str.Windows_Server_2003_R2__Domain_Controller_
bt eax, 0x11
jb 0x14001d512
lea r8, str.Windows_XP
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov r8d, dword [rbp - 0x2c]
mov eax, dword [rbp + 0x60]
mov edx, dword [rbp - 0x34]
mov ecx, dword [rbp - 0x38]
cmp r8d, 4
jne 0x14001d56e
cmp ecx, 5
jne 0x14001d549
test edx, edx
je 0x14001d549
test al, 0x20
je 0x14001d549
bt eax, 0x11
jae 0x14001d562
cmp r8d, 4
jne 0x14001d56e
cmp ecx, 5
jne 0x14001d56e
test edx, edx
je 0x14001d56e
test al, 0x20
je 0x14001d56e
bt eax, 0x11
jae 0x14001d56e
lea r8, str.___Datacenter_Edition_
jmp 0x14001df4e
mov r9d, dword [rbp + 0x70]
cmp r8d, 4
jne 0x14001d600
cmp ecx, 5
jne 0x14001d596
test edx, edx
je 0x14001d596
cmp r9d, 2
jne 0x14001d596
bt eax, 0x11
jb 0x14001d596
test r9b, al
jne 0x14001d5b6
cmp r8d, 4
jne 0x14001d600
cmp ecx, 5
jne 0x14001d5c2
test edx, edx
je 0x14001d5c2
cmp r9d, 2
jne 0x14001d5c2
bt eax, 0x11
jb 0x14001d5c2
test r9b, al
je 0x14001d5c2
lea r8, str.___Enterprise_Edition_
jmp 0x14001df4e
cmp r8d, 4
jne 0x14001d600
cmp ecx, 5
jne 0x14001d5db
test edx, edx
je 0x14001d5db
test al, al
jns 0x14001d5db
bt eax, 0x11
jae 0x14001d5f4
cmp r8d, 4
jne 0x14001d600
cmp ecx, 5
jne 0x14001d600
test edx, edx
je 0x14001d600
test al, al
jns 0x14001d600
bt eax, 0x11
jae 0x14001d600
lea r8, str.___Web_Edition_
jmp 0x14001df4e
mov r9d, dword [rbp + 0x64]
cmp r8d, 4
jne 0x14001df5f
cmp ecx, 5
jne 0x14001d623
test edx, edx
je 0x14001d623
test r9b, 0x20
je 0x14001d623
bt eax, 0x11
jae 0x14001d652
cmp r8d, 4
jne 0x14001df5f
cmp ecx, 5
jne 0x14001df5f
test edx, edx
je 0x14001df5f
test r9b, 0x20
je 0x14001df5f
bt eax, 0x11
jae 0x14001df5f
lea r8, str.___Standard_Edition_
jmp 0x14001df4e
cmp ecx, 6
jne 0x14001dbaa
test edx, edx
jne 0x14001d7af
mov eax, dword [rbp + 0x60]
bt eax, 0x10
jae 0x14001d681
lea r8, str.Windows_Vista__Starter_Edition_
jmp 0x14001d6f0
bt eax, 0x18
jae 0x14001d690
lea r8, str.Windows_Vista__Home_Basic_
jmp 0x14001d6f0
bt eax, 0x19
jae 0x14001d69f
lea r8, str.Windows_Vista__Home_Premium_
jmp 0x14001d6f0
bt eax, 0x1b
jae 0x14001d6ae
lea r8, str.Windows_Vista__Business_
jmp 0x14001d6f0
test al, 2
je 0x14001d6bb
lea r8, str.Windows_Vista__Enterprise_
jmp 0x14001d6f0
bt eax, 0x16
jae 0x14001d6ca
lea r8, str.Windows_Vista__Ultimate_
jmp 0x14001d6f0
mov eax, dword [rbp + 0x70]
cmp eax, 2
jne 0x14001d6db
lea r8, str.Windows_Server_2008
jmp 0x14001d6f0
cmp eax, 3
lea r8, str.Windows_Server_2008__Domain_Controller_
lea rcx, str.Windows_Vista
cmovne r8, rcx
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov edx, dword [rbp - 0x2c]
mov r8d, dword [rbp + 0x60]
mov ecx, dword [rbp - 0x34]
mov eax, dword [rbp - 0x38]
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001d732
test ecx, ecx
jne 0x14001d732
test r8b, 0x20
je 0x14001d732
lea r8, str.___Datacenter_Edition_
jmp 0x14001df4e
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001d75c
test ecx, ecx
jne 0x14001d75c
cmp dword [rbp + 0x70], 2
jne 0x14001d75c
test r8b, 2
je 0x14001d75c
lea r8, str.___Enterprise_Edition_
jmp 0x14001df4e
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001d77f
test ecx, ecx
jne 0x14001d77f
test r8b, r8b
jns 0x14001d77f
lea r8, str.___Web_Edition_
jmp 0x14001df4e
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001df5f
test ecx, ecx
jne 0x14001df5f
test byte [rbp + 0x64], 0x20
je 0x14001df5f
lea r8, str.___Standard_Edition_
jmp 0x14001df4e
cmp ecx, 6
jne 0x14001dbaa
cmp edx, 1
jne 0x14001d8fe
mov ecx, dword [rbp + 0x64]
bt ecx, 0x11
jae 0x14001d7d3
lea r8, str.Windows_7_Thin_PC
jmp 0x14001d852
mov eax, dword [rbp + 0x60]
bt eax, 0x10
jae 0x14001d7e5
lea r8, str.Windows_7__Starter_Edition_
jmp 0x14001d852
bt eax, 0x18
jae 0x14001d7f4
lea r8, str.Windows_7__Home_Basic_
jmp 0x14001d852
bt eax, 0x19
jae 0x14001d803
lea r8, str.Windows_7__Home_Premium_
jmp 0x14001d852
test cl, cl
jns 0x14001d810
lea r8, str.Windows_7__Professional_
jmp 0x14001d852
test al, 2
je 0x14001d81d
lea r8, str.Windows_7__Enterprise_
jmp 0x14001d852
bt eax, 0x16
jae 0x14001d82c
lea r8, str.Windows_7__Ultimate_
jmp 0x14001d852
mov eax, dword [rbp + 0x70]
cmp eax, 2
jne 0x14001d83d
lea r8, str.Windows_Server_2008_R2
jmp 0x14001d852
cmp eax, 3
lea r8, str.Windows_Server_2008_R2__Domain_Controller_
lea rcx, str.Windows_7
cmovne r8, rcx
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov edx, dword [rbp - 0x2c]
mov r8d, dword [rbp + 0x60]
mov ecx, dword [rbp - 0x34]
mov eax, dword [rbp - 0x38]
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001d895
cmp ecx, 1
jne 0x14001d895
test r8b, 0x20
je 0x14001d895
lea r8, str.___Datacenter_Edition_
jmp 0x14001df4e
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001d8c0
cmp ecx, 1
jne 0x14001d8c0
cmp dword [rbp + 0x70], 2
jne 0x14001d8c0
test r8b, 2
je 0x14001d8c0
lea r8, str.___Enterprise_Edition_
jmp 0x14001df4e
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001d8e4
cmp ecx, 1
jne 0x14001d8e4
test r8b, r8b
jns 0x14001d8e4
lea r8, str.___Web_Edition_
jmp 0x14001df4e
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001df5f
cmp ecx, 1
jmp 0x14001d793
cmp ecx, 6
jne 0x14001dbaa
cmp edx, 2
jne 0x14001da33
mov edx, dword [rbp + 0x64]
bt edx, 0x11
jae 0x14001d922
lea r8, str.Windows_8_Thin_PC
jmp 0x14001d989
mov eax, dword [rbp + 0x70]
cmp eax, 1
jne 0x14001d939
cmp dword [rbp - 0x28], 9
jne 0x14001d939
lea r8, str.Windows_8_RT
jmp 0x14001d989
mov ecx, dword [rbp + 0x60]
bt ecx, 0x10
jae 0x14001d94b
lea r8, str.Windows_8__Starter_Edition_
jmp 0x14001d989
test dl, dl
jns 0x14001d958
lea r8, str.Windows_8__Pro_
jmp 0x14001d989
test cl, 2
je 0x14001d966
lea r8, str.Windows_8__Enterprise_
jmp 0x14001d989
cmp eax, 2
jne 0x14001d974
lea r8, str.Windows_Server_2012
jmp 0x14001d989
cmp eax, 3
lea r8, str.Windows_Server_2012__Domain_Controller_
lea rcx, str.Windows_8
cmovne r8, rcx
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov edx, dword [rbp - 0x2c]
mov r8d, dword [rbp + 0x60]
mov ecx, dword [rbp - 0x34]
mov eax, dword [rbp - 0x38]
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001d9cc
cmp ecx, 2
jne 0x14001d9cc
test r8b, 0x20
je 0x14001d9cc
lea r8, str.___Datacenter_Edition_
jmp 0x14001df4e
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001d9f5
cmp ecx, 2
jne 0x14001d9f5
cmp dword [rbp + 0x70], ecx
jne 0x14001d9f5
test cl, r8b
je 0x14001d9f5
lea r8, str.___Enterprise_Edition_
jmp 0x14001df4e
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001da19
cmp ecx, 2
jne 0x14001da19
test r8b, r8b
jns 0x14001da19
lea r8, str.___Web_Edition_
jmp 0x14001df4e
cmp edx, 4
jne 0x14001df5f
cmp eax, 6
jne 0x14001df5f
cmp ecx, 2
jmp 0x14001d793
cmp ecx, 6
jne 0x14001dbaa
cmp edx, 3
jne 0x14001dba7
mov ecx, dword [rbp + 0x64]
bt ecx, 0x11
jae 0x14001da57
lea r8, str.Windows_8.1_Thin_PC
jmp 0x14001daa9
mov eax, dword [rbp + 0x60]
bt eax, 0x10
jae 0x14001da69
lea r8, str.Windows_8.1__Starter_Edition_
jmp 0x14001daa9
test cl, cl
jns 0x14001da76
lea r8, str.Windows_8.1__Pro_
jmp 0x14001daa9
test al, 2
je 0x14001da83
lea r8, str.Windows_8.1__Enterprise_
jmp 0x14001daa9
mov eax, dword [rbp + 0x70]
cmp eax, 2
jne 0x14001da94
lea r8, str.Windows_Server_2012_R2
jmp 0x14001daa9
cmp eax, 3
lea r8, str.Windows_Server_2012_R2__Domain_Controller_
lea rcx, str.Windows_8.1
cmovne r8, rcx
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp + 0x64]
bt eax, 0x17
jae 0x14001dade
lea r8, str.___with_Bing___CoreConnected_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp + 0x64]
bt eax, 0x16
jae 0x14001daff
lea r8, str.___Update_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp + 0x64]
mov r8d, dword [rbp - 0x2c]
mov r9d, dword [rbp + 0x60]
mov edx, dword [rbp - 0x34]
mov ecx, dword [rbp - 0x38]
cmp r8d, 4
jne 0x14001df5f
cmp ecx, 6
jne 0x14001db33
cmp edx, 3
jne 0x14001db33
test r9b, 0x20
je 0x14001db33
lea r8, str.___Datacenter_Edition_
jmp 0x14001df4e
cmp r8d, 4
jne 0x14001df5f
cmp ecx, 6
jne 0x14001db5f
cmp edx, 3
jne 0x14001db5f
cmp dword [rbp + 0x70], 2
jne 0x14001db5f
test r9b, 2
je 0x14001db5f
lea r8, str.___Enterprise_Edition_
jmp 0x14001df4e
cmp r8d, 4
jne 0x14001df5f
cmp ecx, 6
jne 0x14001db84
cmp edx, 3
jne 0x14001db84
test r9b, r9b
jns 0x14001db84
lea r8, str.___Web_Edition_
jmp 0x14001df4e
cmp r8d, 4
jne 0x14001df5f
cmp ecx, 6
jne 0x14001df5f
cmp edx, 3
jne 0x14001df5f
test al, 0x20
jmp 0x14001d79d
cmp ecx, 6
ja 0x14001dbbb
jne 0x14001df5f
cmp edx, 4
jb 0x14001df5f
mov r9d, dword [rbp - 0x30]
mov r8d, dword [rbp + 0x70]
lea eax, [r9 - 0x44c0]
cmp eax, 0x76f
ja 0x14001dbde
lea eax, [r8 - 2]
cmp eax, 1
jbe 0x14001df5f
cmp ecx, 6
ja 0x14001dbea
jne 0x14001dc08
cmp edx, 4
jb 0x14001dc05
lea eax, [r9 - 0x4c30]
cmp eax, 0x1910
ja 0x14001dc05
lea eax, [r8 - 2]
cmp eax, 1
jbe 0x14001df5f
cmp ecx, 6
ja 0x14001dc11
jne 0x14001dc27
cmp edx, 4
jb 0x14001dc27
cmp r9d, 0x6541
jb 0x14001dc27
lea eax, [r8 - 2]
cmp eax, 1
jbe 0x14001df5f
cmp ecx, 6
ja 0x14001dc33
jne 0x14001dc46
cmp edx, 4
jb 0x14001dc46
cmp r9d, 0x534f
jb 0x14001dc46
cmp r8d, 1
je 0x14001df5f
mov eax, dword [rbp + 0x64]
bt eax, 0x11
jae 0x14001dc5b
lea r8, str.Windows_10_Thin_PC
jmp 0x14001dd06
cmp ecx, 6
jne 0x14001dc7d
cmp edx, 2
jne 0x14001dc7d
cmp r8d, 1
jne 0x14001dc7d
cmp dword [rbp - 0x28], 9
jne 0x14001dc7d
lea r8, str.Windows_10_RT
jmp 0x14001dd06
mov ecx, dword [rbp + 0x60]
bt ecx, 0x10
jae 0x14001dc8f
lea r8, str.Windows_10__Starter_Edition_
jmp 0x14001dd06
bt eax, 0x1a
jae 0x14001dc9e
lea r8, str.Windows_10__Home_
jmp 0x14001dd06
test al, al
jns 0x14001dcab
lea r8, str.Windows_10__Pro_
jmp 0x14001dd06
test cl, 2
je 0x14001dcb9
lea r8, str.Windows_10__Enterprise_
jmp 0x14001dd06
test eax, eax
jns 0x14001dcc6
lea r8, str.Windows_10_Nano_Server
jmp 0x14001dd06
test byte [rbp + 0x68], 2
je 0x14001dcd5
lea r8, str.Windows_10_ARM64_Server
jmp 0x14001dd06
lea rdx, [rsp + 0x30]
call fcn.14001d050
test eax, eax
je 0x14001dcff
cmp r8d, 2
jne 0x14001dcf2
lea r8, str.Windows_Server_2016
jmp 0x14001dd06
cmp r8d, 3
lea r8, str.Windows_Server_2016__Domain_Controller_
je 0x14001dd06
lea r8, str.Windows_10
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov r8d, dword [rbp + 0x64]
bt r8d, 0x17
jae 0x14001dd3e
lea r8, str.___with_Bing___CoreConnected_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov r8d, dword [rbp + 0x64]
lea rdx, [rsp + 0x30]
call fcn.14001d050
test eax, eax
je 0x14001df5f
mov eax, dword [rbp + 0x60]
test al, 0x20
je 0x14001dd63
lea r8, str.___Datacenter_Edition_
jmp 0x14001df4e
cmp dword [rbp + 0x70], 2
jne 0x14001dd79
test al, 2
je 0x14001dd79
lea r8, str.___Enterprise_Edition_
jmp 0x14001df4e
test al, al
jns 0x14001dd89
lea r8, str.___Web_Edition_
jmp 0x14001df4e
test r8b, 0x20
jmp 0x14001d79d
mov ecx, dword [rbp - 0x38]
mov r8d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x34]
cmp ecx, 4
jne 0x14001df22
test edx, edx
jne 0x14001ddd1
cmp r8d, 0x3b6
jne 0x14001ddd1
lea rdx, str.Windows_95
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
jmp 0x14001df4e
cmp ecx, 4
jne 0x14001df22
lea eax, [r8 - 0x3b7]
cmp eax, 0x81
ja 0x14001de07
lea rdx, str.Windows_95_SP1
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
jmp 0x14001df4e
cmp ecx, 4
jne 0x14001df22
cmp edx, 0xa
jae 0x14001de42
lea eax, [r8 - 0x439]
cmp eax, 0x84
ja 0x14001de42
lea rdx, str.Windows_95_B__aka_OSR2_
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
jmp 0x14001df4e
cmp ecx, 4
jne 0x14001df22
cmp edx, 0xa
jae 0x14001de78
cmp r8d, 0x4be
jb 0x14001de78
lea rdx, str.Windows_95_C__aka_OSR2.5_
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
jmp 0x14001df4e
cmp ecx, 4
jne 0x14001df22
cmp edx, 0xa
jne 0x14001deae
cmp r8d, 0x7ce
jne 0x14001deae
lea rdx, str.Windows_98
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
jmp 0x14001df4e
cmp ecx, 4
jne 0x14001df22
cmp edx, 0xa
jne 0x14001dee2
lea eax, [r8 - 0x7cf]
cmp eax, 0xb7
ja 0x14001dee2
lea rdx, str.Windows_98_SP1
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
jmp 0x14001df4e
cmp ecx, 4
jne 0x14001df22
cmp edx, 0xa
jne 0x14001df11
cmp r8d, 0x887
jb 0x14001df11
lea rdx, str.Windows_98_Second_Edition
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
jmp 0x14001df4e
cmp ecx, 4
jne 0x14001df22
cmp edx, 0x5a
lea rdx, str.Windows_Millenium_Edition
je 0x14001df29
lea rdx, str.Windows___
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
jmp 0x14001df4e
lea r8, str.Windows
jmp 0x14001df4e
lea r8, [0x1401c3920]
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
movsxd rax, dword [rbp - 0x28]
cmp eax, 0xa
ja case.0x14001df79.0
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1e944]
add rcx, rdx
jmp rcx
lea r8, str.___x86_32_Processor_
jmp 0x14001dfdc
lea r8, str.___MIPS_Processor_
jmp 0x14001dfdc
lea r8, str.___Alpha_Processor_
jmp 0x14001dfdc
lea r8, str.___PPC_Processor_
jmp 0x14001dfdc
lea r8, str.___IA64_Itanium_2__Processor_
jmp 0x14001dfdc
lea r8, str.___x86_64_Processor_
jmp 0x14001dfdc
lea r8, str.___Alpha64_Processor_
jmp 0x14001dfdc
lea r8, str.___MSIL_Processor_
jmp 0x14001dfdc
lea r8, str.___ARM_Processor_
jmp 0x14001dfdc
lea r8, str.___SHX_Processor_
jmp 0x14001dfdc
lea r8, str.___Unknown_Processor_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov r8d, dword [rbp - 0x38]
lea rdx, str._v_d.
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov r8d, dword [rbp - 0x34]
mov eax, 0xcccccccd
mul r8d
shr edx, 3
lea ecx, [rdx + rdx*4]
add ecx, ecx
cmp r8d, ecx
lea rcx, [rbp + 0x90]
je 0x14001e04b
cmp r8d, 9
jbe 0x14001e04e
lea rdx, str._02d
jmp 0x14001e055
mov r8d, edx
lea rdx, str._01d
call fcn.14001e9d0
lea r8, [rbp + 0x90]
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov r8d, dword [rbp - 0x30]
test r8d, r8d
je 0x14001e0a6
lea rdx, str._Build:_d
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
lea r8, [0x1401c42cc]
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
movzx eax, word [rbp + 0x5c]
test ax, ax
je 0x14001e1af
movzx ecx, word [rbp + 0x5e]
test cx, cx
je 0x14001e17f
mov r8d, dword [rbp - 0x2c]
mov r10d, dword [rbp + 0x60]
mov r9d, dword [rbp - 0x34]
mov edx, dword [rbp - 0x38]
cmp r8d, 4
jne 0x14001e164
cmp edx, r8d
ja 0x14001e114
cmp eax, 6
jne 0x14001e11a
cmp ecx, 1
jne 0x14001e11a
lea rdx, str.Service_Pack:_6a
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
jmp 0x14001e195
cmp r8d, 4
jne 0x14001e164
cmp edx, 5
jne 0x14001e12a
test r9d, r9d
je 0x14001e12a
test r10b, 0x40
jne 0x14001e146
cmp r8d, 4
jne 0x14001e164
cmp edx, 5
jne 0x14001e164
test r9d, r9d
je 0x14001e164
cmp dword [rbp + 0x70], 1
jne 0x14001e164
test r10b, 0x40
jne 0x14001e164
cmp eax, 1
jne 0x14001e164
cmp ecx, eax
jne 0x14001e164
lea rdx, str.Service_Pack:_1a
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
jmp 0x14001e195
mov r9d, ecx
lea rdx, str.Service_Pack:_d._d
lea rcx, [rbp + 0x90]
mov r8d, eax
call fcn.14001e9d0
jmp 0x14001e195
mov r8d, eax
lea rdx, str.Service_Pack:_d
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
lea r8, [rbp + 0x90]
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
jmp 0x14001e1ce
movzx eax, word [rbp + 0x5e]
test ax, ax
je 0x14001e1ce
mov r8d, eax
lea rdx, str.Service_Pack:0._d
lea rcx, [rbp + 0x90]
call fcn.14001e9d0
mov ecx, dword [rbp + 0x60]
mov eax, ecx
shr eax, 0x13
and eax, 1
je 0x14001e1e9
test cl, 2
je 0x14001e1e9
lea r8, str.___Storage_Server_Enterprise_
jmp 0x14001e237
test byte [rbp + 0x64], 8
je 0x14001e1f8
lea r8, str.___Storage_Server_Express_
jmp 0x14001e237
test eax, eax
je 0x14001e20b
test byte [rbp + 0x64], 0x20
je 0x14001e20b
lea r8, str.___Storage_Server_Standard_
jmp 0x14001e237
test byte [rbp + 0x64], 0x10
je 0x14001e21a
lea r8, str.___Storage_Server_Workgroup_
jmp 0x14001e237
test dword [rbp + 0x64], 0x1000
je 0x14001e22c
lea r8, str.___Storage_Server_Essentials_
jmp 0x14001e237
test eax, eax
je 0x14001e248
lea r8, str.___Storage_Server_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x800
je 0x14001e25a
lea r8, str.___Home_Server_Premium_Edition_
jmp 0x14001e26a
test dword [rbp + 0x60], 0x10000000
je 0x14001e27b
lea r8, str.___Home_Server_Edition_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test byte [rbp + 0x60], 0x10
je 0x14001e299
lea r8, str.___Terminal_Services_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x100
je 0x14001e2ba
lea r8, str.___Embedded_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x200
je 0x14001e2db
lea r8, str.___Terminal_Services_in_Remote_Admin_Mode_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
lea r8, str.___64_Bit_Edition_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x4000
je 0x14001e314
lea r8, str.___Media_Center_Edition_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x8000
je 0x14001e335
lea r8, str.___Tablet_PC_Edition_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x40000
je 0x14001e356
lea r8, str.___Compute_Cluster_Edition_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x100
je 0x14001e377
lea r8, str.___Foundation_Edition_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x10000
je 0x14001e389
lea r8, str.___MultiPoint_Premium_Edition_
jmp 0x14001e399
test dword [rbp + 0x64], 0x200
je 0x14001e3aa
lea r8, str.___MultiPoint_Edition_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x100000
je 0x14001e3cb
lea r8, str.___Security_Appliance_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x200000
je 0x14001e3ec
lea r8, str.___BackOffice_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x800000
je 0x14001e40d
lea r8, str.___N_Edition_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test byte [rbp + 0x64], 0x40
je 0x14001e42b
lea r8, str.___E_Edition_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x4000000
je 0x14001e44c
lea r8, str.___Hyper_V_Tools_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x400
je 0x14001e46d
lea r8, str.___Hyper_V_Server_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x20000000
je 0x14001e48e
lea r8, str.___Server_Core_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x400
je 0x14001e4af
lea r8, str.___Uniprocessor_Free_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x800
je 0x14001e4d0
lea r8, str.___Uniprocessor_Checked_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x1000
je 0x14001e4f1
lea r8, str.___Multiprocessor_Free_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x2000
je 0x14001e512
lea r8, str.___Multiprocessor_Checked_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x40000000
je 0x14001e533
lea r8, str.___Windows_Essential_Business_Server_Manangement_Server_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x60], 0x80000000
je 0x14001e554
lea r8, str.___Windows_Essential_Business_Server_Messaging_Server_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test byte [rbp + 0x64], 1
je 0x14001e572
lea r8, str.___Windows_Essential_Business_Server_Security_Server_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test byte [rbp + 0x64], 2
je 0x14001e590
lea r8, str.___Cluster_Server_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test byte [rbp + 0x60], 1
je 0x14001e5ae
lea r8, str.___Small_Business_Server_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test byte [rbp + 0x64], 4
je 0x14001e5cc
lea r8, str.___Small_Business_Server_Premium_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x2000
je 0x14001e5ed
lea r8, str.___Prerelease_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x4000
je 0x14001e60e
lea r8, str.___Evaluation_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x40000
je 0x14001e62f
lea r8, str.___Automotive_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x80000
je 0x14001e650
lea r8, str.___China_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x100000
je 0x14001e671
lea r8, str.___Single_Language_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x200000
je 0x14001e692
lea r8, str.___Win32s_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x1000000
je 0x14001e6b3
lea r8, str.___Education_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x2000000
je 0x14001e6d4
lea r8, str.___Industry_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x8000000
je 0x14001e6f5
lea r8, str.___Student_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
test dword [rbp + 0x64], 0x10000000
je 0x14001e716
lea r8, str.___Mobile_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp + 0x68]
bt eax, 0x15
jae 0x14001e73a
lea r8, str.___IoT_Core_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp + 0x68]
test al, 0x20
je 0x14001e759
lea r8, str.___Cloud_Host_Infrastructure_Server_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp + 0x68]
bt eax, 0xd
jae 0x14001e77a
lea r8, str.___S_Edition_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp + 0x68]
test al, 1
je 0x14001e799
lea r8, str.___Cloud_Storage_Server_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp + 0x68]
test al, 4
je 0x14001e7b8
lea r8, str.___PPI_Pro_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp + 0x68]
test al, 8
je 0x14001e7d7
lea r8, str.___Connected_Car_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
mov eax, dword [rbp + 0x68]
test al, 0x10
je 0x14001e7f3
lea r8, str.___Handheld_
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
lea r8, [0x1401c42cc]
mov edx, 0x800
lea rcx, [rbp + 0x100]
call fcn.14013b390
jmp 0x14001e819
lea rdx, str.Failed_in_call_to_GetOSVersion_n
call fcn.14001e970
lea r8, [0x14019528c]
mov dword [rsp + 0x24], 0x101
mov edx, 0x400
mov rcx, rdi
call fcn.14013b330
xor edx, edx
lea rcx, [rbp + 0x900]
mov r8d, 0x101
call fcn.140135010
lea rdx, [rsp + 0x24]
lea rcx, [rbp + 0x900]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x14001e887
lea r8, str._nComputerName_:
mov edx, 0x400
mov rcx, rdi
call fcn.14013b390
lea r8, [rbp + 0x900]
mov edx, 0x400
mov rcx, rdi
call fcn.14013b390
mov edx, 0xff
lea rcx, [rbp + 0xa10]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x14001e8fa
lea rcx, [rbp + 0xa10]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14001e8fa
mov rax, qword [rax + 0x18]
mov qword [rsp + 0xc38], rbx
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rbx, rax
test rax, rax
je 0x14001e8f2
lea r8, str._nIP_:
mov edx, 0x400
mov rcx, rdi
call fcn.14013b390
mov r8, rbx
mov edx, 0x400
mov rcx, rdi
call fcn.14013b390
mov rbx, qword [rsp + 0xc38]
lea r8, [0x1401c42cc]
mov edx, 0x400
mov rcx, rdi
call fcn.14013b390
lea r8, [rbp + 0x100]
mov edx, 0x400
mov rcx, rdi
call fcn.14013b390
xor eax, eax
mov rcx, qword [rbp + 0xb10]
xor rcx, rsp
call fcn.140132620
mov rdi, qword [rsp + 0xc40]
add rsp, 0xc20
pop rbp
ret