Function at 0x1401d92a0
Capabilities:
Check os version
Get system information on windows

Disassembly:
endbr64
push r14
mov eax, 0x2880
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14027ea60
sub rsp, rax
mov rbp, qword [0x140485900]
xor edx, edx
mov r8d, 0x2710
mov rax, qword [rbp]
mov qword [rsp + 0x2878], rax
xor eax, eax
mov rbx, rcx
lea rdi, [rsp + 0x78]
lea r12, [rsp + 0x40]
lea rsi, [rsp + 0x160]
mov rcx, rsi
call sym.memset
pxor xmm0, xmm0
xor eax, eax
mov ecx, 0x12
mov qword [rsp + 0x74], 0
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x104], 0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
rep stosq qword [rdi], rax
mov dword [rsp + 0x70], 0x9c
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1401d9393
lea r14, [0x1403c00e7]
mov r13, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, r14
call r13
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call rdi
mov rcx, r12
test rax, rax
je 0x1401d93c8
call rax
cmp dword [rsp + 0x80], 2
jne 0x1401d9387
mov r10d, dword [rsp + 0x74]
cmp r10d, 4
ja 0x1401d93d0
lea rcx, str.This_sample_does_not_support_this_version_of_Windows._n
call sym.printf_char_const__::_
mov rdx, rsi
mov rcx, rbx
call fcn.1401d8080
mov rax, qword [rsp + 0x2878]
sub rax, qword [rbp]
jne 0x1401d9ba0
mov rax, rbx
add rsp, 0x2880
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x1401d9372
lea rax, str.Microsoft
mov r8, rsi
lea r9, [rax + 0x2710]
jmp 0x1401d93fb
add rax, 1
mov byte [r8], dl
lea rcx, [r8 + 1]
cmp rax, r9
je 0x1401d9402
mov r8, rcx
movzx edx, byte [rax]
test dl, dl
jne 0x1401d93e8
mov byte [r8], 0
cmp r10d, 0xa
je 0x1401d97b0
cmp r10d, 6
je 0x1401d9518
cmp r10d, 5
je 0x1401d94a0
cmp byte [rsp + 0x84], 0
jne 0x1401d97f0
mov r9d, dword [rsp + 0x7c]
lea rdi, [rsp + 0x110]
mov edx, 0x50
lea r8, str.__build__d_
mov rcx, rdi
call sym.StringCchPrintfA
mov r8, rdi
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
cmp dword [rsp + 0x74], 5
jbe 0x1401d9393
movzx eax, word [rsp + 0x40]
cmp ax, 9
je 0x1401d989b
test ax, ax
jne 0x1401d9393
lea r8, str.__32_bit
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9393
mov eax, dword [rsp + 0x78]
cmp eax, 2
je 0x1401d98fe
cmp eax, 1
je 0x1401d98b4
test eax, eax
jne 0x1401d9424
lea r8, str.Windows_2000
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
cmp byte [rsp + 0x10a], 1
je 0x1401d9aa3
movzx eax, word [rsp + 0x108]
test al, 0x80
jne 0x1401d9a71
test al, 2
je 0x1401d9a8a
lea r8, str.Advanced_Server
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9424
mov eax, dword [rsp + 0x78]
test eax, eax
jne 0x1401d9546
cmp byte [rsp + 0x10a], 1
je 0x1401d99ca
lea r8, str.Windows_Server_2008
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov eax, dword [rsp + 0x78]
cmp eax, 1
je 0x1401d9870
cmp eax, 2
je 0x1401d9845
cmp eax, 3
je 0x1401d981e
mov rcx, r14
call r13
lea rdx, str.GetProductInfo
mov rcx, rax
call rdi
lea rdx, [rsp + 0x3c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov ecx, dword [rsp + 0x74]
mov edx, dword [rsp + 0x78]
call rax
cmp dword [rsp + 0x3c], 0x30
ja case.0x1401d95a6.60
mov eax, dword [rsp + 0x3c]
lea rdx, [0x1403c0540]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
notrack jmp rax
lea r8, str.Web_Server_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
nop dword [rax]
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Enterprise_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Home_Premium_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Professional
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Home_Basic_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Ultimate_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Small_Business_Server
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Datacenter_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Standard_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Business_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Small_Business_Server_Premium_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Cluster_Server_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Enterprise_Edition__core_installation_
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Standard_Edition__core_installation_
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Datacenter_Edition__core_installation_
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
lea r8, str.Starter_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d941a
mov eax, dword [rsp + 0x78]
test eax, eax
jne 0x1401d9424
cmp byte [rsp + 0x10a], 1
je 0x1401d99e7
lea r8, str.Windows_Server_2016
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d9410
mov rcx, rsi
lea r8, [0x1403bf8bf]
mov edx, 0x2710
call sym.StringCatWorkerA.isra.0
lea r8, [rsp + 0x84]
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9432
cmp byte [rsp + 0x10a], 1
je 0x1401d9a3f
lea r8, str.Windows_Server_2012_R2
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9561
cmp byte [rsp + 0x10a], 1
je 0x1401d9a05
lea r8, str.Windows_Server_2012
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov eax, dword [rsp + 0x78]
jmp 0x1401d9558
cmp byte [rsp + 0x10a], 1
je 0x1401d9a22
lea r8, str.Windows_Server_2008_R2
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov eax, dword [rsp + 0x78]
jmp 0x1401d954f
lea r8, str.__64_bit
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9393
lea r8, str.Windows_XP
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
test byte [rsp + 0x109], 2
je 0x1401d9a58
lea r8, str.Home_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
cmp dword [rsp + 0x74], 5
jne 0x1401d9424
mov eax, dword [rsp + 0x78]
jmp 0x1401d94b6
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x1401d9abc
movzx eax, word [rsp + 0x108]
test ah, 0x20
jne 0x1401d9ad5
test ax, ax
js 0x1401d9b3c
cmp byte [rsp + 0x10a], 1
jne 0x1401d9941
cmp word [rsp + 0x40], 9
je 0x1401d9bf0
lea r8, str.Windows_Server_2003_
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
cmp byte [rsp + 0x10a], 1
je 0x1401d99b6
movzx edx, word [rsp + 0x40]
movzx eax, word [rsp + 0x108]
cmp dx, 6
je 0x1401d9aee
cmp dx, 9
je 0x1401d9b13
test ah, 0x40
jne 0x1401d9b55
test al, 0x80
jne 0x1401d9b87
test al, 2
jne 0x1401d9c09
test ah, 4
je 0x1401d9bd7
lea r8, str.Web_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
cmp dword [rsp + 0x74], 5
jne 0x1401d9424
mov eax, dword [rsp + 0x78]
jmp 0x1401d94ad
lea r8, str.Windows_Vista
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov eax, dword [rsp + 0x78]
jmp 0x1401d9546
lea r8, str.Windows_10
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov r10d, dword [rsp + 0x74]
jmp 0x1401d9410
lea r8, str.Windows_8
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov eax, dword [rsp + 0x78]
jmp 0x1401d9558
lea r8, str.Windows_7
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
mov eax, dword [rsp + 0x78]
jmp 0x1401d954f
lea r8, str.Windows_8.1
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9561
lea r8, str.Professional
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d98ea
lea r8, str.Datacenter_Server
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9424
lea r8, str.Server
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9424
lea r8, str.Professional
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9424
lea r8, str.Windows_Server_2003_R2_
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9955
lea r8, str.Windows_Storage_Server_2003
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9955
test al, 0x80
jne 0x1401d9b6e
test al, 2
je 0x1401d99b6
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d99b6
test al, 0x80
jne 0x1401d9bbe
test al, 2
je 0x1401d9ba5
lea r8, str.Enterprise_x64_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d99b6
lea r8, str.Windows_Home_Server
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9955
lea r8, str.Compute_Cluster_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d99b6
lea r8, str.Datacenter_Edition_for_Itanium_based_Systems
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d99b6
lea r8, str.Datacenter_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d99b6
call dbg.__stack_chk_fail
lea r8, str.Standard_x64_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d99b6
lea r8, str.Datacenter_x64_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d99b6
lea r8, str.Standard_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d99b6
lea r8, str.Windows_XP_Professional_x64_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d9955
lea r8, str.Enterprise_Edition
mov edx, 0x2710
mov rcx, rsi
call sym.StringCatWorkerA.isra.0
jmp 0x1401d99b6