Function at 0x1401ad630
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x4a8
mov rax, qword [0x14025e510]
xor rax, rsp
mov qword [rsp + 0x498], rax
mov ecx, 0x200
call fcn.140008c1c
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x30], rax
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14002fb80
mov r8d, 0x11c
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.14002fb80
mov dword [rsp + 0x90], 0x11c
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jne 0x1401ad6de
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x1b8], rax
mov rcx, qword [rsp + 0x1b8]
call fcn.140008c14
xor eax, eax
jmp 0x1401adfb4
lea rcx, [0x14021be78]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1401ad713
lea rcx, [rsp + 0x50]
call qword [rsp + 0x48]
jmp 0x1401ad71e
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0xa0], 2
jne 0x1401adf98
cmp dword [rsp + 0x94], 4
jbe 0x1401adf98
mov r9d, 0x7fffffff
xor r8d, r8d
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.1401b9cb0
mov dword [rsp + 0x1d0], eax
cmp dword [rsp + 0x1d0], 0
jl 0x1401ad78c
mov qword [rsp + 0x20], 0x7ffffffe
lea r9, str.Microsoft
xor r8d, r8d
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.1401b9140
mov dword [rsp + 0x1d0], eax
cmp dword [rsp + 0x94], 6
jne case.0x1401ad8f5.5
cmp dword [rsp + 0x98], 0
jne 0x1401ad7df
movzx eax, byte [rsp + 0x1aa]
cmp eax, 1
jne 0x1401ad7c9
lea r8, str.Windows_Vista
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401ad7df
lea r8, str.Windows_Server_2008
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
cmp dword [rsp + 0x98], 1
jne 0x1401ad824
movzx eax, byte [rsp + 0x1aa]
cmp eax, 1
jne 0x1401ad80e
lea r8, str.Windows_7
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401ad824
lea r8, str.Windows_Server_2008_R2
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
cmp dword [rsp + 0x98], 2
jne 0x1401ad851
movzx eax, byte [rsp + 0x1aa]
cmp eax, 1
jne 0x1401ad851
lea r8, str.Windows_8
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
lea r8, [0x14021bf60]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x94]
call qword [rsp + 0x40]
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x494], eax
mov eax, dword [rsp + 0x494]
sub eax, 1
mov dword [rsp + 0x494], eax
cmp dword [rsp + 0x494], 0x2f
ja case.0x1401ad8f5.5
mov eax, dword [rsp + 0x494]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x1ae018]
mov eax, dword [rcx + rax*4 + 0x1adfcc]
add rax, rcx
jmp rax
lea r8, str.Ultimate_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, [0x14021bfc0]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, str.Home_Premium_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, str.Home_Basic_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, [0x14021c038]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, str.Business_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, str.Starter_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, str.Cluster_Server_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, [0x14021c0d8]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, str.Datacenter_Edition__core_installation_
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, [0x14021c150]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, str.Enterprise_Edition__core_installation_
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, [0x14021c1d0]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, str.Small_Business_Server
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, [0x14021c260]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, [0x14021c2b0]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, str.Standard_Edition__core_installation_
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp case.0x1401ad8f5.5
lea r8, str.Web_Server_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
cmp dword [rsp + 0x94], 5
jne 0x1401add69
cmp dword [rsp + 0x98], 2
jne 0x1401add69
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1401adb0f
lea r8, str.Windows_Server_2003_R2_
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401adbb5
movzx eax, word [rsp + 0x1a8]
and eax, 0x2000
test eax, eax
je 0x1401adb38
lea r8, str.Windows_Storage_Server_2003
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401adbb5
movzx eax, word [rsp + 0x1a8]
and eax, 0x8000
test eax, eax
je 0x1401adb61
lea r8, str.Windows_Home_Server
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401adbb5
movzx eax, byte [rsp + 0x1aa]
cmp eax, 1
jne 0x1401adb9f
movzx eax, word [rsp + 0x50]
cmp eax, 9
jne 0x1401adb9f
lea r8, str.Windows_XP_Professional_x64_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
mov r11, qword [rsp + 0x4b8]
mov dword [r11], 1
jmp 0x1401adbb5
lea r8, str.Windows_Server_2003_
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
lea r8, [0x14021c468]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
movzx eax, byte [rsp + 0x1aa]
cmp eax, 1
je 0x1401add69
movzx eax, word [rsp + 0x50]
cmp eax, 6
jne 0x1401adc39
movzx eax, word [rsp + 0x1a8]
and eax, 0x80
test eax, eax
je 0x1401adc0f
lea r8, [0x14021c470]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401adc34
movzx eax, word [rsp + 0x1a8]
and eax, 2
test eax, eax
je 0x1401adc34
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401add69
movzx eax, word [rsp + 0x50]
cmp eax, 9
jne 0x1401adcae
movzx eax, word [rsp + 0x1a8]
and eax, 0x80
test eax, eax
je 0x1401adc6c
lea r8, str.Datacenter_x64_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401adca9
movzx eax, word [rsp + 0x1a8]
and eax, 2
test eax, eax
je 0x1401adc93
lea r8, str.Enterprise_x64_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401adca9
lea r8, str.Standard_x64_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401add69
movzx eax, word [rsp + 0x1a8]
and eax, 0x4000
test eax, eax
je 0x1401adcda
lea r8, str.Compute_Cluster_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401add69
movzx eax, word [rsp + 0x1a8]
and eax, 0x80
test eax, eax
je 0x1401add03
lea r8, str.Datacenter_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401add69
movzx eax, word [rsp + 0x1a8]
and eax, 2
test eax, eax
je 0x1401add2a
lea r8, str.Enterprise_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401add69
movzx eax, word [rsp + 0x1a8]
and eax, 0x400
test eax, eax
je 0x1401add53
lea r8, str.Web_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401add69
lea r8, str.Standard_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
cmp dword [rsp + 0x94], 5
jne 0x1401adde8
cmp dword [rsp + 0x98], 1
jne 0x1401adde8
lea r8, str.Windows_XP
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
lea r8, [0x14021c698]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
movzx eax, word [rsp + 0x1a8]
and eax, 0x200
test eax, eax
je 0x1401addd2
lea r8, str.Home_Edition
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401adde8
lea r8, [0x14021c6c0]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
cmp dword [rsp + 0x94], 5
jne 0x1401adebb
cmp dword [rsp + 0x98], 0
jne 0x1401adebb
lea r8, str.Windows_2000
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
lea r8, [0x14021c700]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
movzx eax, byte [rsp + 0x1aa]
cmp eax, 1
jne 0x1401ade55
lea r8, str.Professional
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401adebb
movzx eax, word [rsp + 0x1a8]
and eax, 0x80
test eax, eax
je 0x1401ade7e
lea r8, str.Datacenter_Server
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401adebb
movzx eax, word [rsp + 0x1a8]
and eax, 2
test eax, eax
je 0x1401adea5
lea r8, [0x14021c750]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
jmp 0x1401adebb
lea r8, str.Server
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
lea rcx, [rsp + 0xa4]
call fcn.14002f9b0
test rax, rax
jbe 0x1401adefa
lea r8, [0x14021b79c]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
lea r8, [rsp + 0xa4]
mov edx, 0x100
mov rcx, qword [rsp + 0x30]
call fcn.140006ea0
cmp dword [rsp + 0x94], 6
jb 0x1401adf35
movzx eax, word [rsp + 0x50]
cmp eax, 9
jne 0x1401adf1e
mov rax, qword [rsp + 0x4b8]
mov dword [rax], 1
jmp 0x1401adf35
movzx eax, word [rsp + 0x50]
test eax, eax
jne 0x1401adf35
mov rax, qword [rsp + 0x4b8]
mov dword [rax], 0
cmp qword [rsp + 0x30], 0
jne 0x1401adf4a
mov dword [rsp + 0x490], 0
jmp 0x1401adf5b
mov rcx, qword [rsp + 0x30]
call fcn.14002f9b0
mov dword [rsp + 0x490], eax
mov r8d, dword [rsp + 0x490]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x4b0]
call fcn.140005080
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x1c0], rax
mov rcx, qword [rsp + 0x1c0]
call fcn.140008c14
mov eax, 1
jmp 0x1401adfb4
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x1c8], rax
mov rcx, qword [rsp + 0x1c8]
call fcn.140008c14
xor eax, eax
mov rcx, qword [rsp + 0x498]
xor rcx, rsp
call fcn.14002f990
add rsp, 0x4a8
ret