Function at 0x1002a960
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10076926
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x100a04fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x9c
push eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x234]
mov esi, ecx
push eax
mov dword [ebp - 0x238], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x234]
push ecx
mov dword [ebp - 0x234], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1002aece
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push 0x10086e88
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x1002aa2c
lea edx, [ebp - 0x260]
push edx
call eax
jmp 0x1002aa39
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x224], 2
jne 0x1002aece
cmp dword [ebp - 0x230], 4
jbe 0x1002aece
lea eax, [ebp - 0x110]
mov esi, str.Microsoft
mov ecx, eax
mov edx, 0x100
sub esi, ecx
jmp 0x1002aa70
lea ecx, [edx + 0x7ffffefe]
test ecx, ecx
je 0x1002aa89
mov cl, byte [esi + eax]
test cl, cl
je 0x1002aa89
mov byte [eax], cl
inc eax
dec edx
jne 0x1002aa70
jmp 0x1002aa8d
test edx, edx
jne 0x1002aa8e
dec eax
cmp dword [ebp - 0x230], 6
mov byte [eax], 0
jne case.0x1002ab31.5
cmp dword [ebp - 0x22c], 0
jne 0x1002aac7
cmp byte [ebp - 0x19a], 1
lea esi, [ebp - 0x110]
jne 0x1002aabd
push str.Windows_Vista
jmp 0x1002aac2
push str.Windows_Server_2008
call fcn.1002a380
cmp dword [ebp - 0x22c], 1
jne 0x1002aaf0
cmp byte [ebp - 0x19a], 1
lea esi, [ebp - 0x110]
jne 0x1002aae6
push str.Windows_7
jmp 0x1002aaeb
push str.Windows_Server_2008_R2
call fcn.1002a380
push str.GetProductInfo
push 0x10086e88
call edi
push eax
call ebx
mov ecx, dword [ebp - 0x22c]
lea edx, [ebp - 0x23c]
push edx
mov edx, dword [ebp - 0x230]
push 0
push 0
push ecx
push edx
call eax
mov eax, dword [ebp - 0x23c]
dec eax
cmp eax, 0x2f
ja case.0x1002ab31.5
movzx eax, byte [eax + 0x1002af44]
jmp dword [eax*4 + 0x1002aefc]
push str.Ultimate_Edition
jmp 0x1002abad
push str.Professional
jmp 0x1002abad
push str.Home_Premium_Edition
jmp 0x1002abad
push str.Home_Basic_Edition
jmp 0x1002abad
push str.Enterprise_Edition
jmp 0x1002abad
push str.Business_Edition
jmp 0x1002abad
push str.Starter_Edition
jmp 0x1002abad
push str.Cluster_Server_Edition
jmp 0x1002abad
push str.Datacenter_Edition
jmp 0x1002abad
push str.Datacenter_Edition__core_installation_
jmp 0x1002abad
push str.Enterprise_Edition__core_installation_
jmp 0x1002abad
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x1002abad
push str.Small_Business_Server
jmp 0x1002abad
push str.Small_Business_Server_Premium_Edition
jmp 0x1002abad
push str.Standard_Edition
jmp 0x1002abad
push str.Standard_Edition__core_installation_
jmp 0x1002abad
push str.Web_Server_Edition
lea esi, [ebp - 0x110]
call fcn.1002a380
mov edi, 5
cmp dword [ebp - 0x230], edi
jne 0x1002ad91
cmp dword [ebp - 0x22c], 2
jne 0x1002acfe
call fcn.1002a190
push 0x59
test eax, eax
je 0x1002abe9
call dword [0x100a49b4]
jmp 0x1002abef
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1002abfa
push str.Windows_Server_2003_R2
jmp 0x1002ac3b
mov eax, dword [ebp - 0x19c]
test eax, 0x2000
je 0x1002ac0e
push str.Windows_Storage_Server_2003
jmp 0x1002ac3b
test eax, 0x8000
je 0x1002ac1c
push str.Windows_Home_Server
jmp 0x1002ac3b
cmp byte [ebp - 0x19a], 1
jne 0x1002ac36
cmp word [ebp - 0x260], 9
jne 0x1002ac36
push str.Windows_XP_Professional_x64_Edition
jmp 0x1002ac3b
push str.Windows_Server_2003
lea esi, [ebp - 0x110]
call fcn.1002a380
cmp byte [ebp - 0x19a], 1
je 0x1002acf2
mov eax, dword [ebp - 0x260]
cmp ax, 6
jne 0x1002ac7b
mov al, byte [ebp - 0x19c]
test al, al
jns 0x1002ac70
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x1002ace7
test al, 2
je 0x1002acf2
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x1002ace7
cmp ax, 9
jne 0x1002acaa
mov al, byte [ebp - 0x19c]
test al, al
jns 0x1002ac92
push str.Datacenter_x64_Edition
jmp 0x1002ace7
lea esi, [ebp - 0x110]
test al, 2
je 0x1002aca3
push str.Enterprise_x64_Edition
jmp 0x1002aced
push str.Standard_x64_Edition
jmp 0x1002aced
mov eax, dword [ebp - 0x19c]
test eax, 0x4000
je 0x1002acbe
push str.Compute_Cluster_Edition
jmp 0x1002ace7
test al, al
jns 0x1002acc9
push str.Datacenter_Edition
jmp 0x1002ace7
test al, 2
je 0x1002acd4
push str.Enterprise_Edition
jmp 0x1002ace7
test eax, 0x400
je 0x1002ace2
push str.Web_Edition
jmp 0x1002ace7
push str.Standard_Edition
lea esi, [ebp - 0x110]
call fcn.1002a380
cmp dword [ebp - 0x230], edi
jne 0x1002ad91
cmp dword [ebp - 0x22c], 1
jne 0x1002ad3c
push str.Windows_XP
lea esi, [ebp - 0x110]
call fcn.1002a380
test dword [ebp - 0x19c], 0x200
je 0x1002ad2a
push str.Home_Edition
jmp 0x1002ad2f
push str.Professional
call fcn.1002a380
cmp dword [ebp - 0x230], edi
jne 0x1002ad91
cmp dword [ebp - 0x22c], 0
jne 0x1002ad91
push str.Windows_2000
lea esi, [ebp - 0x110]
call fcn.1002a380
cmp byte [ebp - 0x19a], 1
jne 0x1002ad65
push str.Professional
jmp 0x1002ad86
mov al, byte [ebp - 0x19c]
test al, al
jns 0x1002ad76
push str.Datacenter_Server
jmp 0x1002ad86
test al, 2
je 0x1002ad81
push str.Advanced_Server
jmp 0x1002ad86
push str.Server
lea esi, [ebp - 0x110]
call fcn.1002a380
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1002adbe
push 0x10087270
lea esi, [ebp - 0x110]
call fcn.1002a380
lea edx, [ebp - 0x220]
push edx
call fcn.1002a380
mov eax, dword [ebp - 0x228]
push eax
push str.__build__d_
mov ecx, 0x50
lea edi, [ebp - 0x160]
call fcn.1002a3d0
add esp, 8
mov ecx, edi
push ecx
lea esi, [ebp - 0x110]
call fcn.1002a380
cmp dword [ebp - 0x230], 6
jb 0x1002ae1c
mov eax, dword [ebp - 0x260]
cmp ax, 9
jne 0x1002ae07
push str._64_bit
jmp 0x1002ae11
test ax, ax
jne 0x1002ae1c
push str._32_bit
lea esi, [ebp - 0x110]
call fcn.1002a380
xor ebx, ebx
lea eax, [ebp - 0x110]
mov dword [ebp - 0x168], 0xf
mov dword [ebp - 0x16c], ebx
mov byte [ebp - 0x17c], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002ae40
sub eax, edx
push eax
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x17c]
call fcn.100028c0
lea edx, [ebp - 0x17c]
lea ecx, [ebp - 0x198]
mov dword [ebp - 4], ebx
call fcn.1002b0e0
mov esi, dword [ebp - 0x238]
mov edi, eax
mov byte [ebp - 4], 1
call fcn.10003bf0
cmp dword [ebp - 0x184], 8
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
jb 0x1002ae9c
mov eax, dword [ebp - 0x198]
push eax
call esi
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x168], 0x10
mov dword [ebp - 0x184], 7
mov dword [ebp - 0x188], ebx
mov word [ebp - 0x198], cx
jb 0x1002aeca
mov edx, dword [ebp - 0x17c]
push edx
call esi
add esp, 4
mov al, 1
jmp 0x1002aede
push 7
push 0x10086e64
mov ecx, esi
call fcn.10002f20
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007236c
mov esp, ebp
pop ebp
ret