Function at 0x1400e4b70
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rdi, r8
mov byte [rdx], 0
mov rbx, rdx
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x98
mov esi, r9d
call fcn.140249b10
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400e5447
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, 0xffffffffffffffff
test rax, rax
je 0x1400e4ca8
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x11c
call rax
mov eax, dword [rbp + 0x20]
lea rcx, [rbp + 0x24]
mov dword [rsp + 0x50], eax
mov eax, dword [rbp + 0x1c]
mov dword [rsp + 0x4c], eax
mov eax, dword [rbp + 0x14]
mov dword [rsp + 0x44], eax
mov eax, dword [rbp + 0x18]
mov dword [rsp + 0x48], eax
movzx eax, byte [rbp + 0x12a]
mov byte [rbp - 0x26], al
movzx eax, byte [rbp + 0x12b]
mov byte [rbp - 0x25], al
movzx eax, word [rbp + 0x124]
mov word [rbp - 0x2c], ax
movzx eax, word [rbp + 0x126]
mov word [rbp - 0x2a], ax
movzx eax, word [rbp + 0x128]
mov word [rbp - 0x28], ax
mov rax, r14
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400e4c60
lea rcx, [rbp + 0x198]
xor edx, edx
mov qword [rsp + 0x38], rcx
lea r9d, [rax + 1]
lea rcx, [0x1402860c8]
mov qword [rsp + 0x30], rcx
lea r8, [rbp + 0x24]
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
lea rcx, [0x14028b028]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x20]
test rax, rax
je 0x1400e4cec
call rax
jmp 0x1400e4cf2
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x1400e4d0a
xor eax, eax
cmp word [rbp - 0x20], 9
sete al
mov dword [rcx], eax
cmp dword [rsp + 0x50], 2
jne 0x1400e5447
mov eax, dword [rsp + 0x44]
cmp eax, 4
jbe 0x1400e5447
cmp eax, 0xa
jne 0x1400e4d60
cmp dword [rsp + 0x48], 0
jne 0x1400e4d47
test esi, esi
lea rax, str.Windows_10
lea r8, [0x1402b41d8]
cmove r8, rax
jmp 0x1400e4e41
test esi, esi
lea r8, str.WINDOWS10
lea rax, str.Windows_newer_than_10.0
cmove r8, rax
jmp 0x1400e4e41
cmp dword [rsp + 0x44], 6
jne 0x1400e4e4c
cmp dword [rsp + 0x48], 3
jbe 0x1400e4d94
lea r8, [0x1402b4210]
mov rdx, rdi
mov rcx, rbx
test esi, esi
jne 0x1400e4d8a
lea r8, str.Windows_newer_than_8.1
call fcn.140253604
cmp dword [rsp + 0x48], 3
jne 0x1400e4dc1
test esi, esi
je 0x1400e4da6
lea r8, str.WINDOWS8.1
jmp 0x1400e4e41
cmp byte [rbp - 0x26], 1
lea r8, str.Windows_8.1
lea rax, str.Windows_Server_2012_R2
cmovne r8, rax
jmp 0x1400e4e41
cmp dword [rsp + 0x48], 2
jne 0x1400e4ded
test esi, esi
je 0x1400e4dd5
lea r8, str.WINDOWS8
jmp 0x1400e4e41
cmp byte [rbp - 0x26], 1
lea r8, str.Windows_8
lea rax, str.Windows_Server_2012
cmovne r8, rax
jmp 0x1400e4e41
cmp dword [rsp + 0x48], 1
jne 0x1400e4e19
test esi, esi
je 0x1400e4e01
lea r8, str.WINDOWS7
jmp 0x1400e4e41
cmp byte [rbp - 0x26], 1
lea r8, str.Windows_7
lea rax, str.Windows_Server_2008_R2
cmovne r8, rax
jmp 0x1400e4e41
cmp dword [rsp + 0x48], 0
jne 0x1400e4e4c
test esi, esi
je 0x1400e4e2d
lea r8, str.VISTA
jmp 0x1400e4e41
cmp byte [rbp - 0x26], 1
lea r8, str.Windows_Vista
je 0x1400e4e41
lea r8, str.Windows_Server_2008
mov rdx, rdi
mov rcx, rbx
call fcn.140253604
cmp dword [rsp + 0x44], 5
jne 0x1400e4fbc
cmp dword [rsp + 0x48], 2
jne 0x1400e4f45
test esi, esi
je 0x1400e4e7d
lea r8, str.WINXP
mov rdx, rdi
mov rcx, rbx
call fcn.140253604
jmp 0x1400e4f3e
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1400e4e95
lea r8, str.Windows_Server_2003_R2
jmp 0x1400e4ed5
movzx eax, word [rbp - 0x28]
mov ecx, 0x2000
cmp ax, cx
jne 0x1400e4eac
lea r8, str.Windows_Storage_Server_2003
jmp 0x1400e4ed5
mov ecx, 0x8000
cmp ax, cx
jne 0x1400e4ebf
lea r8, str.Windows_Home_Server
jmp 0x1400e4ed5
cmp byte [rbp - 0x26], 1
lea r8, str.Windows_XP_Professional
lea rax, str.Windows_Server_2003
cmovne r8, rax
mov rdx, rdi
mov rcx, rbx
call fcn.140253604
cmp byte [rbp - 0x26], 1
je 0x1400e4f3e
movzx ecx, word [rbp - 0x28]
mov eax, 0x4000
test ax, cx
je 0x1400e4efd
lea r8, str._Compute_Cluster_Edition
jmp 0x1400e4f33
movzx eax, byte [rbp - 0x28]
test al, al
jns 0x1400e4f0e
lea r8, str._Datacenter_Edition
jmp 0x1400e4f33
test al, 2
je 0x1400e4f1b
lea r8, str._Enterprise_Edition
jmp 0x1400e4f33
mov eax, 0x400
lea r8, str._Web_Edition
test ax, cx
jne 0x1400e4f33
lea r8, str._Standard_Edition
mov rdx, rdi
mov rcx, rbx
call fcn.1402504d8
cmp dword [rsp + 0x44], 5
jne 0x1400e4fbc
cmp dword [rsp + 0x48], 1
jne 0x1400e4f9b
mov rdx, rdi
mov rcx, rbx
test esi, esi
je 0x1400e4f64
lea r8, str.WINXP
call fcn.140253604
jmp 0x1400e4f94
lea r8, str.Windows_XP
call fcn.140253604
mov eax, 0x200
lea r8, str.Home_Edition
mov rdx, rdi
mov rcx, rbx
test word [rbp - 0x28], ax
jne 0x1400e4f8f
lea r8, str.Professional
call fcn.1402504d8
cmp dword [rsp + 0x44], 5
jne 0x1400e4fbc
cmp dword [rsp + 0x48], 0
jne 0x1400e4fbc
mov rdx, rdi
mov rcx, rbx
test esi, esi
je 0x1400e504e
lea r8, str.WIN2K
call fcn.140253604
test esi, esi
jne 0x1400e5440
cmp dword [rsp + 0x44], 6
jb case.0x1400e52fc.50
lea rcx, [0x14028b028]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetProductInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.0x1400e52fc.50
mov edx, dword [rsp + 0x48]
lea rcx, [rbp + 0x198]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov ecx, dword [rsp + 0x44]
xor r8d, r8d
mov dword [rbp + 0x198], 0
call rax
mov eax, dword [rbp + 0x198]
cmp eax, 0x1c
ja 0x1400e51fa
je 0x1400e51ee
dec eax
cmp eax, 0x1a
ja case.0x1400e52fc.50
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0xe5464]
add rax, rdx
jmp rax
lea r8, str.Windows_2000
call fcn.140253604
cmp byte [rbp - 0x26], 1
mov rdx, rdi
mov rcx, rbx
jne 0x1400e5077
lea r8, str.Professional
call fcn.1402504d8
jmp 0x1400e4fc4
movzx eax, byte [rbp - 0x28]
test al, al
jns 0x1400e5090
lea r8, str.Datacenter_Server
call fcn.1402504d8
jmp 0x1400e4fc4
test al, 2
je 0x1400e50a5
lea r8, str.Advanced_Server
call fcn.1402504d8
jmp 0x1400e4fc4
lea r8, str.Server
call fcn.1402504d8
jmp 0x1400e4fc4
lea r8, str._Ultimate
jmp 0x1400e5385
lea r8, str._Home_Basic
jmp 0x1400e5385
lea r8, str._Home_Premium
jmp 0x1400e5385
lea r8, str._Home_Basic_N
jmp 0x1400e5385
lea r8, str._Business
jmp 0x1400e5385
lea r8, str._Standard
jmp 0x1400e5385
lea r8, str._Datacenter
jmp 0x1400e5385
lea r8, str._Small_Business_Server
jmp 0x1400e5385
lea r8, str._Enterprise
jmp 0x1400e5385
lea r8, str._Starter
jmp 0x1400e5385
lea r8, str._Datacenter__core_installation_
jmp 0x1400e5385
lea r8, str._Standard__core_installation_
jmp 0x1400e5385
lea r8, str._Enterprise__core_installation_
jmp 0x1400e5385
lea r8, str._Enterprise_for_Itanium_based_Systems
jmp 0x1400e5385
lea r8, str._Business_N
jmp 0x1400e5385
lea r8, str._Web_Server
jmp 0x1400e5385
lea r8, str._HPC_Edition
jmp 0x1400e5385
lea r8, str._Home_Server
jmp 0x1400e5385
lea r8, str._Storage_Express_Server
jmp 0x1400e5385
lea r8, str._Storage_Standard_Server
jmp 0x1400e5385
lea r8, str._Storage_Workgroup_Server
jmp 0x1400e5385
lea r8, str._Storage_Enterprise_Server
jmp 0x1400e5385
lea r8, str._Essential_Server
jmp 0x1400e5385
lea r8, str._Small_Business_Server_Premium
jmp 0x1400e5385
lea r8, str._Enterprise_N
jmp 0x1400e5385
lea r8, str._Home_Premium_N
jmp 0x1400e5385
lea r8, str._Ultimate_N
jmp 0x1400e5385
cmp eax, 0x2f
ja 0x1400e52d0
je 0x1400e52c4
add eax, 0xffffffe3
cmp eax, 0xd
ja case.0x1400e52fc.50
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0xe54d0]
add rax, rdx
jmp rax
lea r8, str._Datacenter_without_Hyper_V__core_installation_
jmp 0x1400e5385
lea r8, str._Datacenter_without_Hyper_V
jmp 0x1400e5385
lea r8, str._Enterprise_without_Hyper_V__core_installation_
jmp 0x1400e5385
lea r8, str._Enterprise_without_Hyper_V
jmp 0x1400e5385
lea r8, str._Hyper_V_Server
jmp 0x1400e5385
lea r8, str._Essential_Business_Server_Management_Server
jmp 0x1400e5385
lea r8, str._Essential_Business_Server_Messaging_Server
jmp 0x1400e5385
lea r8, str._Essential_Business_Server_Security_Server
jmp 0x1400e5385
lea r8, str._Essential_Server_without_Hyper_V
jmp 0x1400e5385
lea r8, str._Server_Foundation
jmp 0x1400e5385
lea r8, str._Standard_without_Hyper_V__core_installation_
jmp 0x1400e5385
lea r8, str._Standard_without_Hyper_V
jmp 0x1400e5385
lea r8, str._Web_Server__core_installation_
jmp 0x1400e5385
lea r8, str._Starter_N
jmp 0x1400e5385
cmp eax, 0x65
ja 0x1400e533d
je 0x1400e5334
add eax, 0xffffffd0
cmp eax, 0x34
ja case.0x1400e52fc.50
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0xe5524]
mov ecx, dword [rdx + rax*4 + 0xe5508]
add rcx, rdx
jmp rcx
lea r8, str._Home_China
jmp 0x1400e5385
lea r8, str._Home_Single_Language
jmp 0x1400e5385
lea r8, str._Home_N
jmp 0x1400e5385
lea r8, str._Professional
jmp 0x1400e5385
lea r8, str._Professional_N
jmp 0x1400e5385
lea r8, str._MultiPoint_Server
jmp 0x1400e5385
lea r8, str._Home
jmp 0x1400e5385
cmp eax, 0x68
je 0x1400e537e
cmp eax, 0x79
je 0x1400e5375
cmp eax, 0x7a
je 0x1400e536c
cmp eax, 0x85
je 0x1400e5363
cmp eax, 0xabcdabcd
jne case.0x1400e52fc.50
lea r8, str.__Unlicensed_Copy_
jmp 0x1400e5385
lea r8, str._Mobile_Enterprise
jmp 0x1400e5385
lea r8, str._Education_N
jmp 0x1400e5385
lea r8, str._Education
jmp 0x1400e5385
lea r8, str._Mobile
mov rdx, rdi
mov rcx, rbx
call fcn.1402504d8
cmp word [rbp - 0x20], 6
jne 0x1400e53a0
lea r8, str.__Itanium_
jmp 0x1400e53be
cmp word [rbp - 0x20], 9
jne 0x1400e53b0
lea r8, str._64_bit
jmp 0x1400e53be
cmp word [rbp - 0x20], 0
jne 0x1400e53c9
lea r8, str._32_bit
mov rdx, rdi
mov rcx, rbx
call fcn.1402504d8
lea rax, [rsp + 0x54]
nop
inc r14
cmp byte [rax + r14], 0
jne 0x1400e53d0
test r14, r14
je 0x1400e5401
lea r8, [0x1402b4930]
mov rdx, rdi
mov rcx, rbx
call fcn.1402504d8
lea r8, [rsp + 0x54]
mov rdx, rdi
mov rcx, rbx
call fcn.1402504d8
mov eax, dword [rsp + 0x4c]
lea r8, str.__Build__u._02u._04u_
mov r9d, dword [rsp + 0x44]
lea rcx, [rbp + 0x130]
mov dword [rsp + 0x28], eax
mov edx, PathResolve
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
call fcn.14000b150
lea r8, [rbp + 0x130]
mov rdx, rdi
mov rcx, rbx
call fcn.1402504d8
mov eax, 1
jmp 0x1400e5449
xor eax, eax
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret