Function at 0x1400211e9
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140055130
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xc6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [0x1400a9e80]
xor rax, rbp
mov qword [rbp + 0x488], rax
lea rcx, [0x1400b63a5]
call fcn.140021856
mov edx, 0x30
lea rcx, [rbp + 0x148]
call fcn.140021095
mov edx, 0x11c
lea rcx, [rbp + 0x10]
call fcn.140021095
mov dword [rbp + 0x10], 0x11c
mov ecx, 0x1a
call fcn.140021086
movzx eax, al
test eax, eax
jne 0x1400551b7
xor eax, eax
jmp 0x140055abb
mov ecx, 0x1a
call fcn.14002106d
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0x10]
call qword [rbp + 0x1d8]
mov dword [rbp + 0x194], eax
mov ecx, 4
call fcn.140021086
movzx eax, al
test eax, eax
je 0x140055209
mov ecx, 4
call fcn.14002106d
mov qword [rbp + 0x1f8], rax
lea rcx, [rbp + 0x148]
call qword [rbp + 0x1f8]
jmp 0x140055216
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x20], 2
jne 0x140055ab9
cmp dword [rbp + 0x14], 4
jbe 0x140055ab9
lea r8, str.Microsoft
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.14002139c
cmp dword [rbp + 0x14], 0xa
jne 0x1400552df
cmp dword [rbp + 0x18], 0
jne 0x1400552da
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x14005527c
lea r8, str.Windows_10
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400552da
cmp dword [rbp + 0x1c], 0x4563
jbe 0x14005529f
lea r8, str.Windows_Server_20XX
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400552da
cmp dword [rbp + 0x1c], 0x3839
jbe 0x1400552c2
lea r8, str.Windows_Server_2019
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400552da
lea r8, str.Windows_Server_2016
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400559e1
cmp dword [rbp + 0x14], 6
jne 0x14005562a
cmp dword [rbp + 0x18], 0
jne 0x14005532d
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x140055315
lea r8, str.Windows_Vista
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x14005532d
lea r8, str.Windows_Server_2008
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
cmp dword [rbp + 0x18], 1
jne 0x140055371
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x140055359
lea r8, str.Windows_7
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x140055371
lea r8, str.Windows_Server_2008_R2
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
cmp dword [rbp + 0x18], 2
jne 0x1400553b5
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x14005539d
lea r8, str.Windows_8
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400553b5
lea r8, str.Windows_Server_2012
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
mov ecx, 5
call fcn.14002106d
mov qword [rbp + 0x218], rax
lea rax, [rbp + 0x1b4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x14]
call qword [rbp + 0x218]
mov eax, dword [rbp + 0x1b4]
mov dword [rbp + 0x484], eax
mov eax, dword [rbp + 0x484]
dec eax
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0x2f
ja case.0x14005542a.18
mov eax, dword [rbp + 0x484]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x55b38]
mov eax, dword [rcx + rax*4 + 0x55aec]
add rax, rcx
jmp rax
lea r8, str.Ultimate_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Professional
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Home_Premium_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Home_Basic_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Enterprise_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Business_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Starter_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Cluster_Server_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Datacenter_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Datacenter_Edition__core_installation_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Enterprise_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Enterprise_Edition__core_installation_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Small_Business_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Small_Business_Server_Premium_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Standard_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Standard_Edition__core_installation_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp case.0x14005542a.18
lea r8, str.Web_Server_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400559e1
cmp dword [rbp + 0x14], 5
jne 0x1400558ba
cmp dword [rbp + 0x18], 2
jne 0x1400558ba
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14005566a
lea r8, str.Windows_Server_2003_R2_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x140055708
movzx eax, word [rbp + 0x128]
and eax, 0x2000
test eax, eax
je 0x140055694
lea r8, str.Windows_Storage_Server_2003
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x140055708
movzx eax, word [rbp + 0x128]
and eax, 0x8000
test eax, eax
je 0x1400556be
lea r8, str.Windows_Home_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x140055708
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x1400556f0
movzx eax, word [rbp + 0x148]
cmp eax, 9
jne 0x1400556f0
lea r8, str.Windows_XP_Professional_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x140055708
lea r8, str.Windows_Server_2003_
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
je 0x1400558b5
movzx eax, word [rbp + 0x148]
cmp eax, 6
jne 0x140055779
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x14005574e
lea r8, str.Datacenter_Edition_for_Itanium_based_Systems
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x140055774
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x140055774
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400558b5
movzx eax, word [rbp + 0x148]
cmp eax, 9
jne 0x1400557f4
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x1400557af
lea r8, str.Datacenter_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400557ef
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x1400557d7
lea r8, str.Enterprise_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400557ef
lea r8, str.Standard_x64_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400558b5
movzx eax, word [rbp + 0x128]
and eax, 0x4000
test eax, eax
je 0x140055821
lea r8, str.Compute_Cluster_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400558b5
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x14005584b
lea r8, str.Datacenter_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400558b5
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x140055873
lea r8, str.Enterprise_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400558b5
movzx eax, word [rbp + 0x128]
and eax, 0x400
test eax, eax
je 0x14005589d
lea r8, str.Web_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400558b5
lea r8, str.Standard_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400559e1
cmp dword [rbp + 0x14], 5
jne 0x140055925
cmp dword [rbp + 0x18], 1
jne 0x140055925
lea r8, str.Windows_XP
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
movzx eax, word [rbp + 0x128]
and eax, 0x200
test eax, eax
je 0x140055908
lea r8, str.Home_Edition
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x140055920
lea r8, str.Professional
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400559e1
cmp dword [rbp + 0x14], 5
jne 0x1400559e1
cmp dword [rbp + 0x18], 0
jne 0x1400559e1
lea r8, str.Windows_2000
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
movzx eax, byte [rbp + 0x12a]
cmp eax, 1
jne 0x140055977
lea r8, str.Professional
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400559e1
movzx eax, word [rbp + 0x128]
and eax, 0x80
test eax, eax
je 0x1400559a1
lea r8, str.Datacenter_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400559e1
movzx eax, word [rbp + 0x128]
and eax, 2
test eax, eax
je 0x1400559c9
lea r8, str.Advanced_Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x1400559e1
lea r8, str.Server
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
lea r8, [rbp + 0x238]
mov edx, 0x104
lea rcx, [rbp + 0x24]
call fcn.140020451
cmp qword [rbp + 0x238], 0
jbe 0x140055a2d
lea r8, [0x14007d7c8]
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
lea r8, [rbp + 0x24]
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
mov r9d, dword [rbp + 0x1c]
lea r8, str.__build__u_
mov edx, 0x50
lea rcx, [rbp + 0x260]
call fcn.140020f9b
lea r8, [rbp + 0x260]
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
cmp dword [rbp + 0x14], 6
jb 0x140055ab0
movzx eax, word [rbp + 0x148]
cmp eax, 9
jne 0x140055a8d
lea r8, str._64_bit
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
jmp 0x140055ab0
movzx eax, word [rbp + 0x148]
test eax, eax
jne 0x140055ab0
lea r8, str._32_bit
mov edx, 0x104
mov rcx, qword [rbp + 0x4b0]
call fcn.1400204a1
mov eax, 1
jmp 0x140055abb
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14007e3d0]
call fcn.1400213b5
mov rax, rdi
mov rcx, qword [rbp + 0x488]
xor rcx, rbp
call fcn.140020b4a
lea rsp, [rbp + 0x498]
pop rdi
pop rbp
ret