Function at 0x1400923f4
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r15, rcx
and qword [rsp + 0x38], 0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
xor edi, edi
mov qword [rsp + 0x50], rdi
xor esi, esi
mov qword [rsp + 0x48], rsi
and dword [rsp + 0x30], ebx
test rcx, rcx
jne 0x140092461
mov r14d, 0x80070057
jmp 0x1400927dc
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x64]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
nop dword [rax + rax]
test eax, eax
je 0x1400924aa
lea rdx, [rsp + 0x30]
mov ecx, eax
call fcn.140025c40
test eax, eax
jne 0x1400924aa
mov r14d, dword [rsp + 0x30]
jmp 0x1400927dc
or r13d, 0xffffffff
cmp dword [rsp + 0x64], 6
jb 0x140092655
lea r9, [rsp + 0x40]
lea r8, str.EditionId
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
call fcn.140023a00
mov r14d, eax
test eax, eax
jns 0x1400924e9
mov ecx, eax
call fcn.140025d30
mov rbx, qword [rsp + 0x40]
jmp 0x1400927e4
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x28], r13d
lea rax, str.Business
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rbx
mov edx, 1
mov r14d, 0x409
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x140092596
lea rdx, [rsp + 0x30]
lea rcx, str.Professional
call fcn.140029fcc
mov r14d, eax
test eax, eax
js 0x140092558
lea rcx, str.Professional
mov edx, dword [rsp + 0x30]
lea r8, [rsp + 0x38]
call fcn.140028308
mov r14d, eax
test eax, eax
jns 0x14009255f
mov ecx, eax
call fcn.140025d30
mov ecx, r14d
call fcn.140025d50
test r14d, r14d
js 0x1400927dc
lea rcx, [rsp + 0x48]
call fcn.14009214c
mov r14d, eax
test eax, eax
jns 0x14009275e
mov ecx, eax
call fcn.140025d30
mov rsi, qword [rsp + 0x48]
jmp 0x1400927e4
mov dword [rsp + 0x28], r13d
lea rax, str.BusinessN
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rbx
mov edx, 1
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x1400925ee
lea rdx, [rsp + 0x30]
lea rcx, str.ProfessionalN
call fcn.140029fcc
mov r14d, eax
test eax, eax
js 0x140092558
lea rcx, str.ProfessionalN
jmp 0x140092543
mov dword [rsp + 0x28], r13d
lea rax, str.ServerComputeCluster
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rbx
mov edx, 1
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x140092646
lea rdx, [rsp + 0x30]
lea rcx, str.ServerHPC
call fcn.140029fcc
mov r14d, eax
test eax, eax
js 0x140092558
lea rcx, str.ServerHPC
jmp 0x140092543
mov rax, rbx
xor ebx, ebx
mov qword [rsp + 0x38], rax
jmp 0x140092570
cmp dword [rsp + 0x64], 5
jne 0x1400927d6
cmp dword [rsp + 0x68], 2
jne 0x14009271c
cmp byte [rbp + 0x7a], 1
je 0x140092524
mov al, byte [rbp + 0x78]
lea rdx, [rsp + 0x30]
test al, al
jns 0x1400926a4
lea rcx, str.ServerDatacenter
call fcn.140029fcc
mov r14d, eax
test eax, eax
js 0x140092558
lea rcx, str.ServerDatacenter
jmp 0x140092543
test al, 2
je 0x1400926cb
lea rcx, str.ServerEnterprise
call fcn.140029fcc
mov r14d, eax
test eax, eax
js 0x140092558
lea rcx, str.ServerEnterprise
jmp 0x140092543
mov eax, 0x400
test word [rbp + 0x78], ax
je 0x1400926f9
lea rcx, str.ServerWeb
call fcn.140029fcc
mov r14d, eax
test eax, eax
js 0x140092558
lea rcx, str.ServerWeb
jmp 0x140092543
lea rcx, str.ServerStandard
call fcn.140029fcc
mov r14d, eax
test eax, eax
js 0x140092558
lea rcx, str.ServerStandard
jmp 0x140092543
cmp dword [rsp + 0x68], 1
jne 0x1400927d6
mov eax, 0x200
lea rdx, [rsp + 0x30]
test word [rbp + 0x78], ax
je 0x140092529
lea rcx, str.HomePremium
call fcn.140029fcc
mov r14d, eax
test eax, eax
js 0x140092558
lea rcx, str.HomePremium
jmp 0x140092543
mov rsi, qword [rsp + 0x48]
mov dword [rsp + 0x28], r13d
lea rax, str.Server_Core
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rsi
mov edx, 1
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x1400927c7
mov r8, qword [rsp + 0x38]
lea rdx, str._sCore
lea rcx, [rsp + 0x50]
call fcn.140002c14
mov r14d, eax
test eax, eax
jns 0x1400927c0
mov ecx, eax
call fcn.140025d30
mov rdi, qword [rsp + 0x50]
jmp 0x1400927e4
mov rax, qword [rsp + 0x50]
jmp 0x1400927d1
mov rax, qword [rsp + 0x38]
and qword [rsp + 0x38], rdi
mov qword [r15], rax
jmp 0x1400927e4
mov r14d, 0x80070032
mov ecx, r14d
call fcn.140025d30
mov ecx, r14d
call fcn.140025d50
nop
test rsi, rsi
je 0x14009281b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rsi - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
test rdi, rdi
je 0x140092849
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rdi - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
test rbx, rbx
je 0x140092877
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rbx - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400928ad
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
mov eax, r14d
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140094220
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret