Function at 0x140034798
Capabilities:
Check os version

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
xor r9d, r9d
cmp qword [0x14010ed40], 0
mov dword [rsp + 0x60], r9d
mov rbp, rcx
mov word [rsp + 0x5c], 0
mov word [rsp + 0x5e], 0
jne 0x1400348db
xor ecx, ecx
xor r8d, r8d
mov r12, qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
or r9d, 0xffffffff
mov dword [rsp + 0x28], ecx
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r8
lea r8, str.Kernel32
call r12
mov ebx, eax
cmp eax, 1
jg 0x140034807
xor esi, esi
jmp 0x14003483e
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_calloc
mov rsi, rax
test rax, rax
je 0x140034803
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
lea r8, str.Kernel32
call r12
cmp ebx, eax
je 0x140034842
xor ebx, ebx
jmp 0x1400348bc
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x1400348bc
mov r12, qword [0x1400b1240]
cmp word [r12], 0x3f
jbe 0x140034870
lea rcx, [0x14009464f]
call fcn.140036717
jmp 0x14003483e
mov r8d, 0x800
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x1400348a3
movzx eax, word [r12]
lea edx, [rax + 1]
mov word [r12], dx
mov rdx, qword [0x1400b1230]
mov qword [rdx + rax*8], rbx
jmp 0x1400348bc
call fcn.140036bd7
mov rdx, rsi
lea rcx, [0x140094678]
mov r8, rax
call fcn.140036717
jmp 0x14003483e
mov rcx, rsi
call sub.msvcrt.dll_free
lea rdx, str.IsWow64Process2
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14010ed40], rax
xor eax, eax
mov ecx, 0x27
lea r12, [rbp + 0x1a]
mov rdi, rbp
rep stosd dword [rdi], eax
mov ecx, 0x26
movabs rbx, 0x2073776f646e6957
movabs rsi, 0x656e696665646e55
mov qword [rbp + 0x1a], rbx
lea rbx, [rsp + 0x6c]
mov r13, qword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov qword [rbp + 0x22], rsi
mov rdi, rbx
lea rsi, [rsp + 0x68]
rep stosd dword [rdi], eax
mov word [r12 + 0x10], 0x64
mov rcx, rsi
mov dword [rsp + 0x68], 0x9c
call r13
test eax, eax
jne 0x14003495c
mov ecx, 0x26
mov rdi, rbx
mov dword [rsp + 0x68], 0x94
rep stosd dword [rdi], eax
mov rcx, rsi
call r13
test eax, eax
je 0x140035229
cmp dword [rsp + 0x78], 2
jne 0x140034bdb
cmp dword [rsp + 0x6c], 6
ja 0x14003497f
jne 0x140034a73
cmp dword [rsp + 0x70], 1
jbe 0x140034a73
mov r15, qword [sym.imp.KERNEL32.DLL_VerSetConditionMask]
mov r8d, 1
mov edx, 2
xor ecx, ecx
call r15
mov ebx, dword [rsp + 0x6c]
lea rsi, [rsp + 0x104]
mov r14, rax
cmp ebx, 9
ja 0x140034a6e
lea rdx, [rsp + 0x10c]
xor eax, eax
mov ecx, 0x25
mov dword [rsp + 0x104], 0x9c
mov rdi, rdx
mov dword [rsp + 0x108], ebx
mov r8, r14
mov edx, 2
rep stosd dword [rdi], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_VerifyVersionInfoA]
test eax, eax
jne 0x1400349ed
inc ebx
jmp 0x1400349a5
cmp dword [rsp + 0x6c], ebx
jae 0x1400349fd
xor edx, edx
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x70], edx
mov r8d, 1
mov edx, 1
xor ecx, ecx
call r15
mov r13d, dword [rsp + 0x70]
lea r14, [rsp + 0x108]
xor r15d, r15d
mov r8, rax
cmp r13d, 9
ja 0x140034a78
mov eax, r15d
mov ecx, 0x26
mov rdi, r14
mov qword [rsp + 0x48], r8
rep stosd dword [rdi], eax
mov edx, 1
mov dword [rsp + 0x10c], r13d
mov rcx, rsi
mov dword [rsp + 0x104], 0x9c
call qword [sym.imp.KERNEL32.DLL_VerifyVersionInfoA]
mov r8, qword [rsp + 0x48]
test eax, eax
jne 0x140034a67
inc r13d
jmp 0x140034a20
mov dword [rsp + 0x70], r13d
jmp 0x140034a78
xor r13d, r13d
jmp 0x140034a78
xor r13d, r13d
xor ebx, ebx
mov eax, dword [rsp + 0x6c]
cmp eax, 0xf
ja 0x140034be0
mov ecx, dword [rsp + 0x70]
cmp ecx, 0xf
ja 0x140034be0
shl eax, 4
mov dl, byte [rsp + 0x102]
or eax, ecx
mov dword [rbp], eax
cmp eax, 0x64
ja 0x140034ad7
cmp eax, 0x50
jbe 0x140034bd4
sub eax, 0x51
cmp eax, 0x13
ja case.0x140034ac9.83
lea rcx, [0x140094788]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rsi, [0x14009408f]
jmp 0x140034beb
cmp eax, 0xa0
je 0x140034b85
cmp eax, 0xb0
je 0x140034bc1
jmp case.0x140034ac9.83
lea rsi, str.XP_64
cmp dl, 1
jbe 0x140034beb
mov ecx, 0x59
lea rsi, str.Server_2003_R2
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
lea rax, str.Server_2003
cmove rsi, rax
jmp 0x140034beb
cmp dl, 1
lea rsi, str.Server_2008
lea rax, str.Vista
jmp 0x140034baf
cmp dl, 1
lea rsi, str.Server_2008_R2
lea rax, [0x14009408d]
jmp 0x140034baf
cmp dl, 1
lea rsi, str.Server_2012
lea rax, [0x14009408b]
jmp 0x140034baf
cmp dl, 1
lea rsi, str.Server_2012_R2
lea rax, [0x140094087]
jmp 0x140034baf
cmp dl, 1
lea rsi, str.Server_10__Preview_1_
lea rax, str.10__Preview_1_
jmp 0x140034baf
mov eax, dword [rsp + 0x74]
cmp eax, 0x4e1f
ja 0x140034bb5
lea rsi, [0x140094033]
cmp dl, 1
jbe 0x140034beb
cmp eax, 0x4562
lea rsi, str.Server_2019
lea rax, str.Server_2016
cmovbe rsi, rax
jmp 0x140034beb
mov dword [rbp], 0xb0
mov ebx, 0xb
cmp dl, 1
lea rsi, str.Server_2022
lea rax, [0x14009405d]
jmp 0x140034baf
xor eax, eax
mov dword [rbp], eax
jmp 0x140034be0
xor r13d, r13d
xor ebx, ebx
xor esi, esi
jmp 0x140034beb
lea rsi, str.12_or_later
mov dword [rbp + 4], ebx
mov rbx, qword [0x14010ed40]
mov dword [rbp + 8], r13d
test rbx, rbx
je 0x140034c22
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea rdx, [rsp + 0x5c]
lea r8, [rsp + 0x5e]
mov rcx, rax
call rbx
test eax, eax
je 0x140034c22
mov ax, word [rsp + 0x5e]
mov word [rbp + 0x18], ax
jmp 0x140034c34
mov word [rbp + 0x18], 0x8664
lea rcx, str.Note:_Underlying_Windows_architecture_was_guessed_and_may_be_incorrect...
call fcn.140036717
mov eax, dword [rbp + 0x18]
lea r13, [0x140094092]
cmp ax, 0x8664
je 0x140034c7d
ja 0x140034c67
lea r13, [0x140094096]
cmp ax, 0x14c
je 0x140034c7d
cmp ax, 0x1c0
lea r13, [0x1400940a4]
lea rax, [0x1400940a0]
jmp 0x140034c79
cmp ax, 0xaa64
lea r13, [0x1400940a4]
lea rax, [0x14009409a]
cmove r13, rax
lea rax, [rsp + 0x60]
mov edx, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x6c]
lea r15, [rbp + 0x22]
movzx r9d, word [rsp + 0xfe]
mov qword [rsp + 0x20], rax
movzx r8d, word [rsp + 0xfc]
call qword [sym.imp.KERNEL32.DLL_GetProductInfo]
test rsi, rsi
mov r14, qword [sym.imp.msvcrt.dll__snprintf]
jne 0x140034cec
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x78], 2
lea r9, [0x1400940af]
mov qword [rsp + 0x30], r13
lea r8, str._s__u._u__s
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x20], eax
lea rax, [0x1400940ac]
cmove r9, rax
jmp 0x140034d18
movzx edx, word [rsp + 0xfe]
movzx eax, word [rsp + 0xfc]
test dx, dx
je 0x140034d28
mov qword [rsp + 0x30], r13
mov r9, rsi
lea r8, str._s_SP_u._u__s
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], eax
mov edx, 0x76
mov rcx, r15
call r14
jmp 0x1400351b7
test ax, ax
je 0x140034d50
mov qword [rsp + 0x28], r13
mov r9, rsi
mov edx, 0x76
mov rcx, r15
mov dword [rsp + 0x20], eax
lea r8, str._s_SP_u__s
call r14
jmp 0x1400351b7
mov r9d, dword [rsp + 0x60]
cmp r9d, 0xbd
ja case.default.0x140034d6f
lea rdx, [0x1400947d8]
mov eax, r9d
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
lea rax, [0x1400940b2]
jmp 0x14003517c
lea rax, str._Unlicensed_
cmp r9d, 0xabcdabcd
je 0x14003517c
jmp case.0x140034d6f.15
lea rax, str.Home_Basic
jmp 0x14003517c
lea rax, str.Home_Premium
jmp 0x14003517c
lea rax, str.Enterprise
jmp 0x14003517c
lea rax, str.Home_Basic_N
jmp 0x14003517c
lea rax, str.Business
jmp 0x14003517c
lea rax, str.Server_Standard
jmp 0x14003517c
lea rax, str.Server_Datacenter
jmp 0x14003517c
lea rax, str.Smallbusiness_Server
jmp 0x14003517c
lea rax, str.Server_Enterprise
jmp 0x14003517c
lea rax, str.Starter
jmp 0x14003517c
lea rax, str.Server_Datacenter__Core_
jmp 0x14003517c
lea rax, str.Server_Standard__Core_
jmp 0x14003517c
lea rax, str.Server_Enterprise__Core_
jmp 0x14003517c
lea rax, str.Business_N
jmp 0x14003517c
lea rax, str.Web_Server
jmp 0x14003517c
lea rax, str.HPC_Edition
jmp 0x14003517c
lea rax, str.Storage_Server__Essentials_
jmp 0x14003517c
lea rax, str.Home_Premium_N
jmp 0x14003517c
lea rax, str.Enterprise_N
jmp 0x14003517c
lea rax, str.Ultimate_N
jmp 0x14003517c
lea rax, str.Home_Server
jmp 0x14003517c
lea rax, str.Server_Standard_without_Hyper_V
jmp 0x14003517c
lea rax, str.Server_Datacenter_without_Hyper_V
jmp 0x14003517c
lea rax, str.Server_Enterprise_without_Hyper_V
jmp 0x14003517c
lea rax, str.Server_Datacenter_without_Hyper_V__Core_
jmp 0x14003517c
lea rax, str.Server_Standard_without_Hyper_V__Core_
jmp 0x14003517c
lea rax, str.Server_Enterprise_without_Hyper_V__Core_
jmp 0x14003517c
lea rax, str.Hyper_V_Server
jmp 0x14003517c
lea rax, str.Starter_N
jmp 0x14003517c
lea rax, [0x1400942ed]
jmp 0x14003517c
lea rax, str.Pro_N
jmp 0x14003517c
lea rax, str.Server_Solutions_Premium
jmp 0x14003517c
lea rax, str.Server_Solutions_Premium__Core_
jmp 0x14003517c
lea rax, str.Server_Hyper_Core_V
jmp 0x14003517c
lea rax, str.Starter_E
jmp 0x14003517c
lea rax, str.Home_Basic_E
jmp 0x14003517c
lea rax, str.Premium_E
jmp 0x14003517c
lea rax, str.Pro_E
jmp 0x14003517c
lea rax, str.Enterprise_E
jmp 0x14003517c
lea rax, str.Ultimate_E
jmp 0x14003517c
lea rax, str.Enterprise__Eval_
jmp 0x14003517c
lea rax, str.Server_Standard__Eval_
jmp 0x14003517c
lea rax, str.Server_Datacenter__Eval_
jmp 0x14003517c
lea rax, str.Enterprise_N__Eval_
jmp 0x14003517c
lea rax, str.Thin_PC
jmp 0x14003517c
lea rax, str.Embedded
jmp 0x14003517c
lea rax, str.Home_N
jmp 0x14003517c
lea rax, str.Home_China
jmp 0x14003517c
lea rax, str.Home_Single_Language
jmp 0x14003517c
lea rax, str.Home
jmp 0x14003517c
lea rax, str.Pro_with_Media_Center
jmp 0x14003517c
lea rax, str.Home_Connected
jmp 0x14003517c
lea rax, str.Pro_Student
jmp 0x14003517c
lea rax, str.Home_Connected_N
jmp 0x14003517c
lea rax, str.Pro_Student_N
jmp 0x14003517c
lea rax, str.Home_Connected_Single_Language
jmp 0x14003517c
lea rax, str.Home_Connected_China
jmp 0x14003517c
lea rax, str.Education
jmp 0x14003517c
lea rax, str.Education_N
jmp 0x14003517c
lea rax, str.Enterprise_LTSB
jmp 0x14003517c
lea rax, str.Enterprise_LTSB_N
jmp 0x14003517c
lea rax, str.Pro_S
jmp 0x14003517c
lea rax, str.Pro_S_N
jmp 0x14003517c
lea rax, str.Enterprise_LTSB__Eval_
jmp 0x14003517c
lea rax, str.Enterprise_LTSB_N__Eval_
jmp 0x14003517c
lea rax, str.Pro_Single_Language
jmp 0x14003517c
lea rax, str.Pro_China
jmp 0x14003517c
lea rax, str.Enterprise_Subscription
jmp 0x14003517c
lea rax, str.Enterprise_Subscription_N
jmp 0x14003517c
lea rax, str.Server_Datacenter_SA__Core_
jmp 0x14003517c
lea rax, str.Server_Standard_SA__Core_
jmp 0x14003517c
lea rax, str.Utility_VM
jmp 0x14003517c
lea rax, str.Pro_for_Workstations
jmp 0x14003517c
lea rax, str.Pro_for_Workstations_N
jmp 0x14003517c
lea rax, str.Pro_for_Education
jmp 0x14003517c
lea rax, str.Pro_for_Education_N
jmp 0x14003517c
lea rax, str.Enterprise_G
jmp 0x14003517c
lea rax, str.Enterprise_G_N
jmp 0x14003517c
lea rax, str.Home_OS
jmp 0x14003517c
lea rax, str.Cloud_E
jmp 0x14003517c
lea rax, str.Cloud_E_N
jmp 0x14003517c
lea rax, str.Lite
jmp 0x14003517c
lea rbx, [0x14010ed00]
lea r8, str._Unknown_Edition_0x_02X_
mov edx, 0x40
mov rcx, rbx
call r14
mov byte [0x14010ed3f], 0
mov rax, rbx
jmp 0x14003517c
lea rax, str.Ultimate
lea rcx, [0x140094644]
cmp dword [rsp + 0x60], 0
mov qword [rsp + 0x30], r13
mov r9, rsi
lea rdx, [0x1400940b2]
mov qword [rsp + 0x28], rax
lea r8, str._s_s_s__s
cmovne rdx, rcx
mov rcx, r15
mov qword [rsp + 0x20], rdx
mov edx, 0x76
call r14
mov eax, dword [rsp + 0x60]
mov byte [rbp + 0x97], 0
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionUBR
lea r8, [rsp + 0x64]
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x14], eax
mov eax, dword [rsp + 0x74]
mov dword [rbp + 0xc], eax
call fcn.14003435a
mov ebx, dword [rsp + 0x64]
mov rcx, r12
mov dword [rbp + 0x10], ebx
call sub.msvcrt.dll_strlen
mov edx, 0x7f
mov r9d, dword [rbp + 0xc]
sub rdx, rax
test ebx, ebx
lea rcx, [rbp + rax + 0x1a]
je 0x140035218
mov dword [rsp + 0x20], ebx
lea r8, str.__Build__lu._lu_
call r14
jmp 0x140035222
lea r8, str.__Build__lu_
call r14
mov byte [rbp + 0x98], 0
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret