Function at 0x140006b40
Capabilities:
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x210
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x228], rbx
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], rax
mov rbx, rcx
mov qword [rsp + 0x58], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
lea rdx, [0x14008ac98]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
nop
xor edx, edx
mov r8d, ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >
lea rcx, [rsp + 0xe0]
call sub.MSVCR90.dll_memset
mov dword [rsp + 0xe0], ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140006c0e
mov dword [rsp + 0xe0], ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140006c0e
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov rax, rbx
jmp 0x140007005
cmp dword [rsp + 0xf0], 2
je 0x140006c5c
lea rdx, str.Windows_Unknown
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov rax, rbx
jmp 0x140007005
mov eax, dword [rsp + 0xe4]
sub eax, 5
je 0x140006dd1
sub eax, 1
je 0x140006cb7
cmp eax, 4
jne 0x140006f0e
lea rdx, str.Windows_10
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
cmp byte [rsp + 0x1fa], 1
je 0x140006f0e
lea rdx, str.Windows_Server_2016
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
mov eax, dword [rsp + 0xe8]
test eax, eax
je 0x140006d94
sub eax, 1
je 0x140006d57
sub eax, 1
je 0x140006d1a
cmp eax, 1
jne 0x140006f0e
lea rdx, str.Windows_8.1
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
cmp byte [rsp + 0x1fa], 1
je 0x140006f0e
lea rdx, str.Windows_Server_2012_R2
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
lea rdx, str.Windows_8
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
cmp byte [rsp + 0x1fa], 1
je 0x140006f0e
lea rdx, str.Windows_Server_2012
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
lea rdx, str.Windows_7
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
cmp byte [rsp + 0x1fa], 1
je 0x140006f0e
lea rdx, str.Windows_Server_2008_R2
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
lea rdx, str.Windows_Vista
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
cmp byte [rsp + 0x1fa], 1
je 0x140006f0e
lea rdx, str.Windows_Server_2008
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
mov eax, dword [rsp + 0xe8]
test eax, eax
je 0x140006ef9
sub eax, 1
je 0x140006ee2
sub eax, 1
je 0x140006e34
cmp eax, 1
jne 0x140006f0e
lea rdx, str.Windows_8.1
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
cmp byte [rsp + 0x1fa], 1
je 0x140006f0e
lea rdx, str.Windows_Server_2012_R2
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
mov dword [rsp + 0x60], edi
xor edx, edx
lea r8d, [rdx + 0x2c]
lea rcx, [rsp + 0x64]
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [rsp + 0x1fa], 1
jne 0x140006e7f
cmp word [rsp + 0x60], 9
jne 0x140006e7f
lea rdx, str.Windows_XP_Professional_x64_Edition
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
mov eax, 0x8000
test word [rsp + 0x1f8], ax
je 0x140006ea5
lea rdx, str.Windows_Home_Server
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x140006ecb
lea rdx, str.Windows_Server_2003
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
lea rdx, str.Windows_Server_2003_R2
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
lea rdx, str.Windows_XP
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
jmp 0x140006f0e
lea rdx, str.Windows_2000
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::end_void____ptr64]
lea rdx, [rsp + 0x30]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::begin_void____ptr64]
lea rdx, [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
cmp rax, rcx
je 0x140006f86
mov edx, 0x2d
cmp word [rax], 0x20
jne 0x140006f7d
mov word [rax], dx
add rax, 2
cmp rax, rcx
jne 0x140006f74
mov dword [rsp + 0x24], edi
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140006fbf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call rdi
cmp dword [rsp + 0x24], 0
je 0x140006fdb
lea rdx, str._x64
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const____ptr64____ptr64]
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0xb0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov rax, rbx
mov rcx, qword [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
xor rcx, rsp
call fcn.140077470
mov rbx, qword [rsp + 0x228]
add rsp, 0x210
pop rdi
ret