Function at 0x987eb0
Capabilities:
Check os version

Disassembly:
sub esp, 0x3e8
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x3e4], eax
push ebx
push ebp
mov ebp, dword [esp + 0x3f4]
push esi
push edi
push 0x103
xor ebx, ebx
lea eax, [esp + 0x2ed]
push ebx
push eax
mov esi, ecx
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [esp + 0xdd]
push ebx
push ecx
mov byte [esp + 0xe4], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x90
lea edx, [esp + 0x48]
push ebx
push edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x4c], ebx
call fcn.00a7ffb0
add esp, 0xc
mov byte [esi], bl
mov byte [esp + 0x2e8], bl
cmp ebp, ebx
je 0x987f59
mov byte [ebp], bl
cmp dword [0xbfc9d0], ebx
jne 0x987f82
mov edi, 1
mov dword [0xbfc9d0], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x987f82
cmp al, 6
jb 0x987f82
mov dword [0xbfc9d4], edi
jmp 0x987f8a
cmp dword [0xbfc9d4], ebx
je 0x987fb3
xor edx, edx
lea ecx, [esp + 0x40]
call fcn.0094c480
test eax, eax
jne 0x987fd9
push 0x94
lea eax, [esp + 0x44]
push ebx
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 0x40]
push ecx
jmp 0x987fcb
push 0x94
lea edx, [esp + 0x44]
push ebx
push edx
call fcn.00a7ffb0
add esp, 0xc
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.00968110
lea ecx, [esp + 0x10]
push ecx
mov edi, eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x40]
push edx
lea ebx, [esp + 0x58]
lea edx, [esp + 0x40]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x5c], edi
call fcn.009691d0
add esp, 0x20
cmp dword [0xb32da4], 0xffffffff
jne 0x98804a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xb32da4
xor ebx, ebx
xor edx, edx
xor ecx, ecx
call fcn.009691d0
add esp, 0x20
test ebp, ebp
je 0x98805e
push str.OS:
push esi
call fcn.00a78f30
add esp, 8
jmp 0x988061
mov byte [esi], 0
cmp dword [esp + 0x34], 0
je 0x9880a0
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x988070
sub eax, edx
cmp eax, 0x104
jge 0x988097
mov edx, str.Windows_95
mov cl, byte [edx]
test cl, cl
je 0x988097
mov byte [eax + esi], cl
inc eax
inc edx
cmp eax, 0x104
jl 0x988085
mov byte [eax + esi], 0
jmp 0x988277
cmp dword [esp + 0x18], 0
je 0x9880b1
push str.Windows_98
jmp 0x98826a
cmp dword [esp + 0x2c], 0
je 0x9880c2
push str.Windows_2000
jmp 0x98826a
cmp dword [esp + 0x20], 0
je 0x9880d3
push str.Windows_ME
jmp 0x98826a
cmp dword [esp + 0x30], 0
je 0x9880ff
test edi, edi
mov edi, 0x104
je 0x9880ed
push str.Windows_XP_Pro_x64
jmp 0x98826f
push str.Windows_XP
call fcn.009653e0
add esp, 4
jmp 0x98828a
cmp dword [esp + 0x28], 0
je 0x98811a
call fcn.00963620
cmp eax, 2
jle 0x9880da
push str.Windows_2003
jmp 0x98826a
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
test ebx, ebx
jne 0x98814b
cmp dword [esp + 0x14], 0
jne 0x98814b
test edi, edi
jne 0x98814b
cmp dword [esp + 0x1c], edi
jne 0x98814b
cmp dword [esp + 0x24], edi
je 0x988277
push str.Windows_NT
jmp 0x98826a
call fcn.00963620
cmp eax, 2
jle 0x98822a
cmp dword [esp + 0x44], 6
jne 0x988181
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x988172
push str.Windows_2008
jmp 0x98826a
cmp eax, 1
jne 0x988181
push str.Windows_2008_R2
jmp 0x98826a
push 0x90
lea eax, [esp + 0x1e8]
push 0
push eax
mov dword [esp + 0x1ec], 0
call fcn.00a7ffb0
add esp, 0xc
xor edx, edx
lea ecx, [esp + 0x1e0]
call fcn.0094c480
cmp eax, 1
jne 0x988209
mov eax, dword [esp + 0x1e8]
cmp eax, 2
jne 0x9881cc
push str.Windows_2012
jmp 0x98826a
cmp eax, 3
jne 0x9881db
push str.Windows_2012_R2
jmp 0x98826a
cmp dword [esp + 0x1e4], 0xa
jb 0x988277
cmp dword [esp + 0x1ec], 0x44c0
mov edi, 0x104
jae 0x988202
push str.Windows_2016
jmp 0x98826f
push str.Windows_2019
jmp 0x98826f
mov eax, dword [esp + 0x48]
cmp eax, 2
jne 0x988219
push str.Windows_2012
jmp 0x98826a
mov edi, 0x104
cmp eax, 3
jne 0x9881fb
push str.Windows_2012_R2
jmp 0x98826f
test edi, edi
je 0x98825a
call fcn.00968930
test eax, eax
je 0x98823e
push str.Windows_10
jmp 0x98826a
call fcn.00968840
mov edi, 0x104
test eax, eax
je 0x988253
push str.Windows_8.1
jmp 0x98826f
push str.Windows_8
jmp 0x98826f
test ebx, ebx
je 0x988265
push str.Windows_Vista
jmp 0x98826a
push str.Windows_7
mov edi, 0x104
call fcn.009653e0
add esp, 4
cmp dword [esp + 0x3c], 0
je 0x98828a
push str._64_Bit
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test ebp, ebp
je 0x9883a9
lea ecx, [esp + 0x2e8]
push ecx
call fcn.009883d0
add esp, 4
cmp byte [esp + 0x2e8], 0
je 0x9882f7
push 0x103
lea edx, [esp + 0x1e5]
push 0
push edx
mov byte [esp + 0x1ec], 0
call fcn.00a7ffb0
add esp, 0xc
lea eax, [esp + 0x2e8]
push eax
lea ecx, [esp + 0x1e4]
push str.__OS_Install_Date:__s_
push ecx
call fcn.00a78f30
add esp, 0xc
lea edx, [esp + 0x1e0]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea esi, [esp + 0xd8]
mov byte [ebp], 0
mov byte [esp + 0xd8], 0
call fcn.00968380
mov esi, eax
lea eax, [esp + 0xd8]
push eax
call fcn.0095ad70
add esp, 4
cmp byte [esp + 0xd8], 0
je 0x9883a9
test esi, esi
jne 0x98833e
lea ecx, [esp + 0xd8]
push ecx
push str.Ver:__s
jmp 0x9883a0
cmp esi, 1
jne 0x988352
lea edx, [esp + 0xd8]
push edx
push str.Ver:_Personal__s
jmp 0x9883a0
cmp esi, 2
jne 0x988366
lea eax, [esp + 0xd8]
push eax
push str.Ver:_Professional__s
jmp 0x9883a0
cmp esi, 3
jne 0x98837a
lea ecx, [esp + 0xd8]
push ecx
push str.Ver:_Standard_Server__s
jmp 0x9883a0
cmp esi, 4
jne 0x98838e
lea edx, [esp + 0xd8]
push edx
push str.Ver:_DataCenter_Server__s
jmp 0x9883a0
cmp esi, 5
jne 0x9883a9
lea eax, [esp + 0xd8]
push eax
push str.Ver:_Enterprise_Advanced__s
push ebp
call fcn.00a78f30
add esp, 0xc
mov ecx, dword [esp + 0x3f4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x3e8
ret 4