Function at 0x14005cbe0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov rax, qword [0x1400c7070]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor r15d, r15d
mov r12, r9
mov rsi, r8
mov r13, rdx
mov rbx, rcx
mov edi, r15d
test rcx, rcx
je 0x14005d5bc
test rdx, rdx
je 0x14005d5bc
test r8, r8
je 0x14005d5bc
test r9, r9
je 0x14005d5bc
xorps xmm0, xmm0
mov dword [r8], r15d
lea rcx, str.ntdll.dll
mov dword [r9], r15d
movups xmmword [rbp + 0x60], xmm0
mov dword [rsp + 0x30], r15d
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005d5b5
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14005d5b5
xor edx, edx
lea rcx, [rbp + 0x94]
mov r8d, 0x118
call fcn.1400659a0
lea rcx, [rbp + 0x90]
mov dword [rbp + 0x90], 0x11c
mov rax, r14
call qword [0x1400926f0]
test eax, eax
jne 0x14005d5b5
lea rcx, [rsp + 0x40]
lea rdx, [rbp + 0x90]
lea eax, [r15 + 2]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x14005cce0
mov rax, qword [rdx + 0x10]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov eax, dword [rdx + 0x18]
mov edx, dword [rbp + 0x98]
mov dword [rcx + 0x18], eax
lea rcx, str.int_OSMinorVersion
call sym.Installer.exe_Put
mov edx, dword [rsp + 0x44]
lea rcx, str.int_OSMajorVersion
call sym.Installer.exe_Put
imul edx, dword [rsp + 0x44], 0x64
lea rcx, str.int_VersionNT
add edx, dword [rsp + 0x48]
call sym.Installer.exe_Put
mov r8d, dword [rsp + 0x48]
lea rcx, str.GetOSVersion_dwMajorVersion___i_dwMinorVersion___i._n
mov edx, dword [rsp + 0x44]
call fcn.14005cb30
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400b1158]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x60]
test rax, rax
je 0x14005cdc1
call qword [0x1400926f0]
jmp 0x14005cdc7
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x50], 2
jne 0x14005d5bc
cmp dword [rsp + 0x44], 4
jbe 0x14005d5bc
lea r8, str.Microsoft
mov edx, 0x100
mov rcx, rbx
call fcn.14006e2a0
cmp dword [rsp + 0x44], 0xa
jne 0x14005ce4b
cmp dword [rsp + 0x48], edi
jne 0x14005d47f
cmp byte [rbp + 0x5a], 1
mov edx, 0x100
mov rcx, rbx
jne 0x14005ce34
lea r8, str.Windows_10
call fcn.14006e308
mov edx, 1
lea rcx, str.int_IsWindows10
call sym.Installer.exe_Put
mov edi, 0x1b
jmp 0x14005ce4b
lea r8, str.Windows_Server_10
mov dword [rsi], 1
call fcn.14006e308
mov edi, 0x1c
cmp dword [rsp + 0x44], 6
lea r14, str.Embedded
mov eax, 0x8000
jne case.0x14005d050.5
cmp dword [rsp + 0x48], r15d
jne 0x14005ceb7
cmp byte [rbp + 0x5a], 1
mov edx, 0x100
mov rcx, rbx
jne 0x14005ce9b
lea r8, str.Windows_Vista
call fcn.14006e308
mov edx, 1
lea rcx, str.int_IsWindowsVista
call sym.Installer.exe_Put
mov edi, 0xb
jmp 0x14005ceb2
lea r8, str.Windows_Server_2008
mov dword [rsi], 1
call fcn.14006e308
mov edi, 0x11
mov eax, 0x8000
cmp dword [rsp + 0x48], 1
jne 0x14005cf1b
cmp byte [rbp + 0x5a], 1
mov edx, 0x100
mov rcx, rbx
jne 0x14005cef0
lea r8, str.Windows_7
call fcn.14006e308
mov edx, 1
lea rcx, str.int_IsWindows7
call sym.Installer.exe_Put
mov edi, 0xc
jmp 0x14005cf1b
mov dword [rsi], 1
test word [rbp + 0x58], ax
je 0x14005cf0a
mov edi, 0x18
lea r8, str.Windows_Home_Server_2011
jmp 0x14005cf16
mov edi, 0x12
lea r8, str.Windows_Server_2008_R2
call fcn.14006e308
cmp dword [rsp + 0x48], 2
jne 0x14005cf6b
cmp byte [rbp + 0x5a], 1
mov edx, 0x100
mov rcx, rbx
jne 0x14005cf54
lea r8, str.Windows_8
call fcn.14006e308
mov edx, 1
lea rcx, str.int_IsWindows8
call sym.Installer.exe_Put
mov edi, 0xd
jmp 0x14005cf6b
lea r8, str.Windows_Server_2012
call fcn.14006e308
mov dword [rsi], 1
mov edi, 0x16
cmp dword [rsp + 0x48], 3
jne 0x14005cfdd
cmp byte [rbp + 0x5a], 1
mov edx, 0x100
mov rcx, rbx
jne 0x14005cfc6
lea r8, str.Windows_8.1
call fcn.14006e308
mov edx, 1
lea rcx, str.int_IsWindows8
call sym.Installer.exe_Put
mov edx, 1
lea rcx, str.int_IsWindows8.1
call sym.Installer.exe_Put
mov edx, 1
lea rcx, str.int_IsWindows8_1
call sym.Installer.exe_Put
mov edi, 0x19
jmp 0x14005cfdd
lea r8, str.Windows_Server_2012_R2
call fcn.14006e308
mov dword [rsi], 1
mov edi, 0x1a
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProductInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov ecx, dword [rsp + 0x44]
xor r8d, r8d
call qword [0x1400926f0]
mov edx, dword [rsp + 0x30]
lea rcx, str.GetOSVersion_dwType___i._n
call fcn.14005cb30
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 0x40
ja case.0x14005d050.5
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x5d634]
mov ecx, dword [rdx + rax*4 + 0x5d5e4]
add rcx, rdx
jmp rcx
mov r8, r14
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
jmp case.0x14005d050.5
lea r8, str.Ultimate_Edition
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
jmp case.0x14005d050.5
lea r8, str.Professional
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
jmp case.0x14005d050.5
lea r8, str.Home_Premium_Edition
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
jmp case.0x14005d050.5
lea r8, str.Home_Basic_Edition
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
jmp case.0x14005d050.5
lea r8, str.Enterprise_Edition
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
jmp case.0x14005d050.5
lea r8, str.Business_Edition
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
jmp case.0x14005d050.5
lea r8, str.Starter_Edition
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
jmp case.0x14005d050.5
lea r8, str.Cluster_Server_Edition
jmp 0x14005d1bf
lea r8, str.Datacenter_Edition
jmp 0x14005d1bf
lea r8, str.Datacenter_Edition__core_installation_
jmp 0x14005d1bf
lea r8, str.Enterprise_Edition
jmp 0x14005d1bf
lea r8, str.Enterprise_Edition__core_installation_
jmp 0x14005d1bf
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x14005d1bf
lea r8, str.Small_Business_Server
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
cmp byte [rbp + 0x5a], 1
mov dword [rsi], 1
je case.0x14005d050.5
cmp dword [rsp + 0x44], 6
jne case.0x14005d050.5
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x14005d18c
lea edi, [rax + 0x15]
jmp 0x14005d47f
cmp eax, 1
jne 0x14005d47f
lea edi, [rax + 0x13]
jmp 0x14005d47f
lea r8, str.Small_Business_Server_Premium_Edition
jmp 0x14005d1bf
lea r8, str.Standard_Edition
jmp 0x14005d1bf
lea r8, str.Standard_Edition__core_installation_
jmp 0x14005d1bf
lea r8, str.Web_Server_Edition
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
mov dword [rsi], 1
cmp dword [rsp + 0x44], 5
jne 0x14005d47f
mov eax, dword [rsp + 0x48]
cmp eax, 2
jne 0x14005d37d
lea ecx, [rax + 0x57]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14005d215
lea r8, str.Windows_Server_2003_R2_
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
mov edi, 0x10
jmp 0x14005d2c3
movzx eax, word [rbp + 0x58]
bt ax, 0xd
jae 0x14005d239
lea r8, str.Windows_Storage_Server_2003
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
jmp 0x14005d2c3
bt ax, 0xf
jae 0x14005d25b
lea r8, str.Windows_Home_Server
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
mov edi, 0xe
jmp 0x14005d2c3
cmp byte [rbp + 0x5a], 1
jne 0x14005d2aa
cmp word [rbp + 0x60], 9
jne 0x14005d2aa
lea r8, str.Windows_XP_Professional_x64_Edition
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
mov edx, 1
lea rcx, str.int_IsWindowsXp
call sym.Installer.exe_Put
movzx eax, word [rbp + 0x58]
mov edi, 4
test al, 0x40
mov dword [r12], 1
mov ecx, 2
cmove edi, ecx
jmp 0x14005d2c7
lea r8, str.Windows_Server_2003_
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
mov edi, 0xf
movzx eax, word [rbp + 0x58]
cmp byte [rbp + 0x5a], 1
je 0x14005d36e
cmp word [rbp + 0x60], 6
mov dword [rsi], 1
jne 0x14005d2f8
test al, al
jns 0x14005d2eb
lea r8, str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x14005d361
test al, 2
je 0x14005d36e
lea r8, str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x14005d361
cmp word [rbp + 0x60], 9
jne 0x14005d322
test al, al
jns 0x14005d30c
lea r8, str.Datacenter_x64_Edition
jmp 0x14005d361
test al, 2
lea r8, str.Enterprise_x64_Edition
lea rax, str.Standard_x64_Edition
cmove r8, rax
jmp 0x14005d361
bt ax, 0xe
jae 0x14005d332
lea r8, str.Compute_Cluster_Edition
jmp 0x14005d361
test al, al
jns 0x14005d33f
lea r8, str.Datacenter_Edition
jmp 0x14005d361
test al, 2
je 0x14005d34c
lea r8, str.Enterprise_Edition
jmp 0x14005d361
bt ax, 0xa
lea r8, str.Web_Edition
jb 0x14005d361
lea r8, str.Standard_Edition
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
cmp dword [rsp + 0x44], 5
jne 0x14005d47f
mov eax, dword [rsp + 0x48]
cmp eax, 1
jne 0x14005d423
cmp word [rbp + 0x54], 2
jne 0x14005d39b
mov edx, eax
lea rcx, str.int_IsWindowsXpSp2
call sym.Installer.exe_Put
mov edx, 1
lea rcx, str.int_IsWindowsXp
call sym.Installer.exe_Put
lea r8, str.Windows_XP
mov edx, 0x100
mov rcx, rbx
mov edi, 2
call fcn.14006e308
movzx eax, word [rbp + 0x58]
bt ax, 9
jae 0x14005d3d9
lea r14, str.Home_Edition
jmp 0x14005d408
test al, 0x40
je 0x14005d3e4
mov edi, 4
jmp 0x14005d408
mov ecx, 0x56
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14005d401
mov edi, 3
lea r14, str.Tablet_PC_Edition
jmp 0x14005d408
lea r14, str.Professional
mov r8, r14
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
cmp dword [rsp + 0x44], 5
jne 0x14005d47f
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x14005d47f
lea r8, str.Windows_2000
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
mov edi, 1
cmp byte [rbp + 0x5a], dil
jne 0x14005d44f
lea r8, str.Professional
jmp 0x14005d472
movzx eax, word [rbp + 0x58]
test al, al
jns 0x14005d460
lea r8, str.Datacenter_Server
jmp 0x14005d472
lea r8, str.Advanced_Server
test al, 2
jne 0x14005d472
lea r8, str.Server
mov edx, 0x100
mov rcx, rbx
call fcn.14006e308
lea rdx, [rsp + 0x54]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x14005d490
test rax, rax
je 0x14005d4b1
lea r8, [rsp + 0x54]
mov edx, 0x100
mov rcx, r13
call fcn.14002b970
cmp dword [rsp + 0x44], 6
jb 0x14005d4d9
movzx eax, word [rbp + 0x60]
cmp eax, 9
je 0x14005d4d1
cmp eax, 0xc
jne 0x14005d4d9
mov eax, 2
mov dword [r12], eax
jmp 0x14005d4d9
mov dword [r12], 1
mov rdx, rbx
lea rcx, str.GetOSVersion_osName___s._n
call fcn.14005cb30
movsxd rdx, edi
lea rcx, str.int_OSType
call sym.Installer.exe_Put
movzx edx, word [rbp + 0x54]
lea rcx, str.int_SPMajorVers
call sym.Installer.exe_Put
movzx edx, word [rbp + 0x56]
lea rcx, str.int_SPMinorVers
call sym.Installer.exe_Put
cmp dword [r12], 1
lea rcx, str.int_isX64
mov rdx, r15
sete dl
call sym.Installer.exe_Put
cmp dword [r12], 2
lea rcx, str.int_isARM64
mov rdx, r15
sete dl
call sym.Installer.exe_Put
mov rdx, r15
lea rcx, str.int_isServer
cmp dword [rsi], edx
setne dl
call sym.Installer.exe_Put
mov edx, dword [rsp + 0x30]
lea rcx, str.int_OSProductType
call sym.Installer.exe_Put
lea rcx, str.int_IsWindowsXp
call sym.Installer.exe_Get
mov rdx, r15
lea rcx, str.int_XP_EMB
cmp edi, 4
mov rbx, rax
sete dl
call sym.Installer.exe_Put
lea ecx, [rdi - 0xf]
cmp ecx, 1
jbe 0x14005d5a6
cmp dword [r12], 1
jne 0x14005d5a0
test ebx, ebx
jne 0x14005d5a6
mov r15d, 1
mov rdx, r15
lea rcx, str.int_ValidSystemForAvc
call sym.Installer.exe_Put
mov eax, 1
jmp 0x14005d5be
xor eax, eax
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400625f0
add rsp, 0x2c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret