Function at 0x140020207
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140053e70
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xc6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [0x1400a6e78]
xor rax, rbp
mov qword [rbp + 0x488], rax
lea rcx, [0x1400b33a0]
call fcn.140020883
mov edx, 0x30
lea rcx, [rbp + 0x148]
call fcn.1400200a9
mov edx, 0x11c
lea rcx, [rbp + 0x10]
call fcn.1400200a9
mov dword [rbp + 0x10], 0x11c
mov ecx, 0x1a
call fcn.14002009a
movzx eax, al
test eax, eax
jne 0x140053ef7
xor eax, eax
jmp 0x1400547fb
mov ecx, 0x1a
call fcn.140020081
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0x10]
call qword [rbp + 0x1d8]
mov dword [rbp + 0x194], eax
mov ecx, 4
call fcn.14002009a
movzx eax, al
test eax, eax
je 0x140053f49
mov ecx, 4
call fcn.140020081
mov qword [rbp + 0x1f8], rax
lea rcx, [rbp + 0x148]
call qword [rbp + 0x1f8]
jmp 0x140053f56
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x20], 2
jne 0x1400547f9
cmp dword [rbp + 0x14], 4
jbe 0x1400547f9
lea r8, str.Microsoft
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400203b5
cmp dword [rbp + 0x14], 0xa
jne 0x14005401f
cmp dword [rbp + 0x18], 0
jne 0x14005401a
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x140053fbc
lea r8, str.Windows_10
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x14005401a
cmp dword [rbp + 0x1c], 0x4563
jbe 0x140053fdf
lea r8, str.Windows_Server_20XX
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x14005401a
cmp dword [rbp + 0x1c], 0x3839
jbe 0x140054002
lea r8, str.Windows_Server_2019
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x14005401a
lea r8, str.Windows_Server_2016
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054721
cmp dword [rbp + 0x14], 6
jne 0x14005436a
cmp dword [rbp + 0x18], 0
jne 0x14005406d
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x140054055
lea r8, str.Windows_Vista
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x14005406d
lea r8, str.Windows_Server_2008
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
cmp dword [rbp + 0x18], 1
jne 0x1400540b1
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x140054099
lea r8, str.Windows_7
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x1400540b1
lea r8, str.Windows_Server_2008_R2
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
cmp dword [rbp + 0x18], 2
jne 0x1400540f5
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x1400540dd
lea r8, str.Windows_8
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x1400540f5
lea r8, str.Windows_Server_2012
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
mov ecx, 5
call fcn.140020081
mov qword [rbp + 0x218], rax
lea rax, [rbp + 0x1b4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x14]
call qword [rbp + 0x218]
mov eax, dword [rbp + 0x1b4]
mov dword [rbp + 0x484], eax
mov eax, dword [rbp + 0x484]
dec eax
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0x2f
ja case.0x14005416a.18
mov eax, dword [rbp + 0x484]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x54878]
mov eax, dword [rcx + rax*4 + 0x5482c]
add rax, rcx
jmp rax
lea r8, str.Ultimate_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Professional
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Home_Premium_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Home_Basic_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Enterprise_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Business_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Starter_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Cluster_Server_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Datacenter_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Datacenter_Edition__core_installation_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Enterprise_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Enterprise_Edition__core_installation_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Small_Business_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Small_Business_Server_Premium_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Standard_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Standard_Edition__core_installation_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp case.0x14005416a.18
lea r8, str.Web_Server_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054721
cmp dword [rbp + 0x14], 5
jne 0x1400545fa
cmp dword [rbp + 0x18], 2
jne 0x1400545fa
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1400543aa
lea r8, str.Windows_Server_2003_R2_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054448
movzx eax, word [rbp + 0x128]
and eax, 0x2000
test eax, eax
je 0x1400543d4
lea r8, str.Windows_Storage_Server_2003
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054448
movzx eax, word [rbp + 0x128]
and eax, 0x8000
test eax, eax
je 0x1400543fe
lea r8, str.Windows_Home_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054448
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x140054430
movzx eax, word [rbp + 0x148]
cmp eax, 9
jne 0x140054430
lea r8, str.Windows_XP_Professional_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054448
lea r8, str.Windows_Server_2003_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
je 0x1400545f5
movzx eax, word [rbp + 0x148]
cmp eax, 6
jne 0x1400544b9
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x14005448e
lea r8, str.Datacenter_Edition_for_Itanium_based_Systems
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x1400544b4
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x1400544b4
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x1400545f5
movzx eax, word [rbp + 0x148]
cmp eax, 9
jne 0x140054534
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x1400544ef
lea r8, str.Datacenter_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x14005452f
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x140054517
lea r8, str.Enterprise_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x14005452f
lea r8, str.Standard_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x1400545f5
movzx eax, word [rbp + 0x128]
and eax, 0x4000
test eax, eax
je 0x140054561
lea r8, str.Compute_Cluster_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x1400545f5
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x14005458b
lea r8, str.Datacenter_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x1400545f5
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x1400545b3
lea r8, str.Enterprise_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x1400545f5
movzx eax, word [rbp + 0x128]
and eax, 0x400
test eax, eax
je 0x1400545dd
lea r8, str.Web_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x1400545f5
lea r8, str.Standard_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054721
cmp dword [rbp + 0x14], 5
jne 0x140054665
cmp dword [rbp + 0x18], 1
jne 0x140054665
lea r8, str.Windows_XP
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
movzx eax, word [rbp + 0x128]
and eax, 0x200
test eax, eax
je 0x140054648
lea r8, str.Home_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054660
lea r8, str.Professional
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054721
cmp dword [rbp + 0x14], 5
jne 0x140054721
cmp dword [rbp + 0x18], 0
jne 0x140054721
lea r8, str.Windows_2000
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x1400546b7
lea r8, str.Professional
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054721
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x1400546e1
lea r8, str.Datacenter_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054721
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x140054709
lea r8, str.Advanced_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x140054721
lea r8, str.Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
lea r8, [rbp + 0x238]
mov edx, 0x104
lea rcx, [rbp + 0x24]
call fcn.14001f465
cmp qword [rbp + 0x238], 0
jbe 0x14005476d
lea r8, [0x14007af88]
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
lea r8, [rbp + 0x24]
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
mov r9d, dword [rbp + 0x1c]
lea r8, str.__build__u_
mov edx, 0x50
lea rcx, [rbp + 0x260]
call fcn.14001ffaa
lea r8, [rbp + 0x260]
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
cmp dword [rbp + 0x14], 6
jb 0x1400547f0
movzx eax, word [rbp + 0x148]
cmp eax, 9
jne 0x1400547cd
lea r8, str._64_bit
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
jmp 0x1400547f0
movzx eax, word [rbp + 0x148]
test eax, eax
jne 0x1400547f0
lea r8, str._32_bit
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14001f4b0
mov eax, 1
jmp 0x1400547fb
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14007ba78]
call fcn.1400203ce
mov rax, rdi
mov rcx, qword [rbp + 0x488]
xor rcx, rbp
call fcn.14001fb4f
lea rsp, [rbp + 0x498]
pop rdi
pop rbp
ret