Function at 0x1000c200
Capabilities:
Check os version
Get common file path
Get geographical location
Get hostname
Get memory capacity
Get system information on windows
Make suspicious ntquerysysteminformation call
Query environment variable
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
mov edx, 1
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x37c
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x35c], ecx
mov ecx, 0x9c
mov edi, eax
mov dword [ebp - 0x358], eax
call sym._resize_table
test eax, eax
je 0x1000d15b
mov dword [ebp - 0x334], 0x11c
lea eax, [ebp - 0x334]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
mov eax, dword [edi + 0x14]
sub esp, 4
mov dword [eax], str.DeviceHarddiskVolume1
mov dword [ebp - 0x348], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp], 0x16
mov dword [ebp - 0x34c], eax
call eax
mov ebx, eax
test eax, eax
je 0x1000c2a8
mov eax, dword [ebp - 0x328]
mov dword [esp + 8], 0x1002316c
mov dword [esp + 4], 0xb
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym._swprintf
mov edi, dword [ebp - 0x348]
mov eax, str.CurrentType
mov dword [edi + 4], ebx
call sym._get_reg_str.constprop.0
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x34c]
mov dword [esp], 0x5e
call eax
test eax, eax
je 0x1000c3b6
mov edx, dword [str.Microsoft_Windows]
mov dword [eax], edx
mov edx, dword [0x1002ee44]
mov dword [eax + 4], edx
mov edx, dword [0x1002ee48]
mov dword [eax + 8], edx
mov edx, dword [0x1002ee4c]
mov dword [eax + 0xc], edx
mov edx, dword [0x1002ee50]
mov dword [eax + 0x10], edx
mov edx, dword [0x1002ee54]
mov dword [eax + 0x14], edx
mov edx, dword [0x1002ee58]
mov dword [eax + 0x18], edx
mov edx, dword [0x1002ee5c]
mov dword [eax + 0x1c], edx
mov edx, dword [0x1002ee60]
mov dword [eax + 0x20], edx
movzx edx, word [0x1002ee64]
mov word [eax + 0x24], dx
mov edx, dword [ebp - 0x330]
cmp edx, 0xa
je 0x1000cd70
cmp edx, 6
je 0x1000cc60
cmp edx, 5
jne 0x1000c365
mov edx, dword [ebp - 0x32c]
cmp edx, 2
je 0x1000cf52
cmp edx, 1
je 0x1000cfed
mov edx, dword [str.2000_Professional]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002ed04]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002ed08]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002ed0c]
mov dword [eax + 0x30], edx
mov edx, dword [0x1002ed10]
mov dword [eax + 0x34], edx
mov edx, dword [0x1002ed14]
mov dword [eax + 0x38], edx
mov edx, dword [0x1002ed18]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002ed1c]
mov dword [eax + 0x40], edx
mov edx, dword [0x1002ed20]
mov dword [eax + 0x44], edx
mov ecx, dword [ebp - 0x348]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x34c]
mov dword [esp], 0x16
call eax
mov ebx, eax
test eax, eax
je 0x1000c3f6
call dword [sym.imp.kernel32.dll_GetACP]
mov dword [esp + 8], 0x1002316c
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xb
mov dword [esp], ebx
call sym._swprintf
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x10], ebx
mov eax, dword [ebp - 0x34c]
mov dword [esp], 0xc
call eax
mov ebx, eax
test eax, eax
je 0x1000c438
mov dword [esp + 0xc], 6
mov dword [esp + 8], eax
mov dword [esp + 4], 5
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
sub esp, 0x10
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x14], ebx
xor eax, eax
cmp word [ebp - 0x320], 0
jne 0x1000cdc0
mov ecx, dword [ebp - 0x348]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x218], 0x10
mov dword [esp], 0x20
call eax
mov ebx, eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x350], eax
test ebx, ebx
je 0x1000c495
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
mov eax, dword [ebp - 0x348]
mov esi, dword [sym.imp.kernel32.dll_GetTimeZoneInformation]
mov dword [eax + 0x1c], ebx
mov eax, dword [ebp - 0x350]
mov dword [esp], eax
call esi
mov edx, eax
sub esp, 4
xor eax, eax
cmp edx, 0xffffffff
je 0x1000c4d3
mov eax, dword [ebp - 0x218]
cmp edx, 2
je 0x1000cef8
add ax, word [ebp - 0x1c4]
neg eax
mov ecx, dword [ebp - 0x348]
mov word [ecx + 0x20], ax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x218], 0x40
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
mov dword [ebp - 0x354], eax
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x1000c520
mov edx, dword [ebp - 0x204]
mov eax, dword [ebp - 0x208]
shrd eax, edx, 0xa
shr edx, 0xa
mov ecx, dword [ebp - 0x348]
mov dword [ecx + 0x22], eax
mov eax, dword [ebp - 0x350]
mov dword [ecx + 0x26], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x218], 0x40
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x1000c56a
mov edx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x1e8]
shrd eax, edx, 0xa
shr edx, 0xa
mov ecx, dword [ebp - 0x348]
mov dword [ecx + 0x2a], eax
mov dword [ecx + 0x2e], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x1002318a
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x1000cdf8
lea edi, [ebp - 0x344]
mov dword [esp + 0xc], 0
mov dword [ebp - 0x344], 0
mov dword [ebp - 0x340], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileTime]
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x34c]
sub esp, 4
mov dword [esp], 0x34
call eax
mov ebx, eax
test eax, eax
je 0x1000cdf8
mov eax, dword [ebp - 0x350]
mov dword [esp], edi
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x20a]
sub esp, 8
imul eax, eax, 0x3e8
mov dword [esp + 8], str._04u_02u_02u_02u_02u_02u._06u000
mov dword [esp + 4], 0x1a
mov dword [esp], ebx
mov dword [esp + 0x24], eax
movzx eax, word [ebp - 0x20c]
mov dword [esp + 0x20], eax
movzx eax, word [ebp - 0x20e]
mov dword [esp + 0x1c], eax
movzx eax, word [ebp - 0x210]
mov dword [esp + 0x18], eax
movzx eax, word [ebp - 0x212]
mov dword [esp + 0x14], eax
movzx eax, word [ebp - 0x216]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x218]
mov dword [esp + 0xc], eax
call sym._swprintf
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x32], ebx
mov eax, dword [ebp - 0x34c]
mov dword [esp], 0x34
call eax
mov ebx, eax
test eax, eax
je 0x1000c796
mov edi, dword [ebp - 0x350]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x30
mov dword [esp + 4], edi
mov dword [esp], 3
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea eax, [ebp - 0x344]
sub esp, 0x10
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movsx eax, word [ebp - 0x338]
sub esp, 8
imul eax, eax, 0x3e8
mov dword [esp + 8], str._04u_02u_02u_02u_02u_02u._06u000
mov dword [esp + 4], 0x1a
mov dword [esp], ebx
mov dword [esp + 0x24], eax
movsx eax, word [ebp - 0x33a]
mov dword [esp + 0x20], eax
movsx eax, word [ebp - 0x33c]
mov dword [esp + 0x1c], eax
movsx eax, word [ebp - 0x33e]
mov dword [esp + 0x18], eax
movsx eax, word [ebp - 0x340]
mov dword [esp + 0x14], eax
movsx eax, word [ebp - 0x342]
mov dword [esp + 0x10], eax
movsx eax, word [ebp - 0x344]
mov dword [esp + 0xc], eax
call sym._swprintf
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x36], ebx
mov eax, dword [ebp - 0x350]
mov dword [esp], eax
call esi
sub esp, 4
cmp eax, 0xffffffff
je 0x1000cf20
mov esi, dword [ebp - 0x218]
cmp eax, 2
je 0x1000cde8
add esi, dword [ebp - 0x1c4]
mov dword [esp], 0x34
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x1000c869
lea eax, [ebp - 0x344]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov eax, esi
sub esp, 4
neg eax
mov dword [esp + 0x28], eax
movzx eax, word [ebp - 0x336]
mov dword [esp + 8], str._04u_02u_02u_02u_02u_02u._06u_03d
imul eax, eax, 0x3e8
mov dword [esp + 4], 0x1a
mov dword [esp], ebx
mov dword [esp + 0x24], eax
movzx eax, word [ebp - 0x338]
mov dword [esp + 0x20], eax
movzx eax, word [ebp - 0x33a]
mov dword [esp + 0x1c], eax
movzx eax, word [ebp - 0x33c]
mov dword [esp + 0x18], eax
movzx eax, word [ebp - 0x33e]
mov dword [esp + 0x14], eax
movzx eax, word [ebp - 0x342]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x344]
mov dword [esp + 0xc], eax
call sym._swprintf
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x3a], ebx
mov eax, dword [ebp - 0x34c]
mov dword [esp], 0xa
call eax
mov ebx, eax
test eax, eax
je 0x1000c8ab
mov dword [esp + 0xc], 5
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
sub esp, 0x10
mov eax, dword [ebp - 0x348]
mov esi, dword [eax + 0xc]
mov dword [eax + 0x3e], ebx
mov dword [eax + 0x42], str.The_Wine_Project
cmp word [esi], 0
je 0x1000cf10
mov edi, esi
lea esi, [esi]
add edi, 2
cmp word [edi], 0
jne 0x1000c8d0
sub edi, esi
lea eax, [edi + 0x52]
mov dword [esp], eax
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x1000c913
mov dword [esp + 8], edi
add edi, ebx
mov dword [esp + 4], esi
mov esi, str.C:WINDOWSDeviceHarddisk0Partition1
mov dword [esp], eax
call sym._memcpy
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
movzx eax, word [esi]
mov word [edi], ax
mov esi, dword [ebp - 0x348]
mov edi, dword [ebp - 0x350]
mov dword [esi + 0x46], ebx
mov dword [esp + 0x10], edi
mov dword [ebp - 0x218], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 6
call dword [sym.imp.kernel32.dll_GetProductInfo]
mov eax, dword [ebp - 0x218]
sub esp, 0x14
mov dword [esi + 0x4a], eax
mov eax, str.RegisteredOrganization
call sym._get_reg_str.constprop.0
mov dword [esi + 0x4e], eax
mov dword [esp], edi
mov edi, 0x12
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov edx, str.64_bit
mov eax, str.32_bit
sub esp, 4
cmp word [ebp - 0x218], 9
cmove eax, edx
mov dword [esi + 0x52], eax
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
mov dword [esi + 0x5a], 0x258dd4
movzx eax, ax
mov word [esi + 0x5e], di
mov dword [esi + 0x56], eax
mov eax, str.RegisteredOwner
mov dword [esi + 0x60], 0xffffffff
mov dword [esi + 0x64], 1
call sym._get_reg_str.constprop.0
mov dword [esi + 0x68], eax
mov eax, str.ProductId
call sym._get_reg_str.constprop.0
test eax, eax
je 0x1000cee0
mov ecx, dword [ebp - 0x348]
mov dword [ecx + 0x6c], eax
movzx eax, word [ebp - 0x220]
mov word [ecx + 0x70], ax
movzx eax, word [ebp - 0x21e]
mov dword [ecx + 0x74], 0x1002330c
mov word [ecx + 0x72], ax
mov eax, dword [ebp - 0x34c]
mov dword [ecx + 0x78], 0x110
mov dword [esp], 0x208
call eax
mov ebx, eax
test eax, eax
je 0x1000ca55
mov eax, dword [ebp - 0x350]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64DisableWow64FsRedirection]
sub esp, 4
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov eax, dword [ebp - 0x218]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64RevertWow64FsRedirection]
sub esp, 4
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x7c], ebx
mov eax, dword [ebp - 0x34c]
mov dword [esp], 6
call eax
mov ebx, eax
test eax, eax
je 0x1000cd58
mov dword [esp + 8], 3
mov dword [esp + 4], eax
mov dword [esp], str.SystemDrive
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
je 0x1000cd58
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x80], ebx
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x218], 0x40
mov dword [esp], eax
mov eax, dword [ebp - 0x354]
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x1000cae5
mov edx, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x1f0]
shrd eax, edx, 0xa
shr edx, 0xa
mov edi, dword [ebp - 0x348]
mov dword [edi + 0x84], eax
mov eax, dword [ebp - 0x350]
mov dword [edi + 0x88], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x218], 0x40
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x1000cb35
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x210]
shrd eax, edx, 0xa
shr edx, 0xa
mov ecx, dword [ebp - 0x348]
mov dword [ecx + 0x8c], eax
mov eax, dword [ebp - 0x34c]
mov dword [ecx + 0x90], edx
mov dword [esp], 0x42
call eax
mov ebx, eax
test eax, eax
je 0x1000cb92
mov eax, dword [ebp - 0x328]
mov dword [esp + 8], str._u._u._u
mov dword [esp + 4], 0x21
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x32c]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x330]
mov dword [esp + 0xc], eax
call sym._swprintf
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x94], ebx
mov ebx, dword [ebp - 0x350]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov edx, eax
sub esp, 8
xor eax, eax
test edx, edx
je 0x1000cbc9
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov edx, dword [ebp - 0x348]
mov ecx, dword [ebp - 0x35c]
mov dword [edx + 0x98], eax
test ecx, ecx
je 0x1000cdd8
lea eax, [ebp - 0x344]
mov dword [esp + 8], ecx
mov esi, 0xffffffff
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x350]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x358]
mov dword [esp], eax
call sym._eval_cond
test eax, eax
jne 0x1000cd00
mov eax, dword [ebp - 0x214]
mov esi, 1
mov ebx, 1
or eax, dword [ebp - 0x218]
je 0x1000cd00
test byte [0x10021048], 8
jne 0x1000cd25
mov eax, dword [ebp - 0x358]
mov dword [eax + 0xc], ebx
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov edx, dword [ebp - 0x32c]
cmp edx, 3
je 0x1000ce10
cmp edx, 2
je 0x1000ce39
cmp edx, 1
je 0x1000ce59
test edx, edx
jne 0x1000c365
cmp byte [ebp - 0x21a], 1
je 0x1000d10c
mov edx, dword [str.Server_2008_Standard]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002ed84]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002ed88]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002ed8c]
mov dword [eax + 0x30], edx
mov edx, dword [0x1002ed90]
mov dword [eax + 0x34], edx
mov edx, dword [0x1002ed94]
mov dword [eax + 0x38], edx
mov edx, dword [0x1002ed98]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002ed9c]
mov dword [eax + 0x40], edx
mov edx, dword [0x1002eda0]
mov dword [eax + 0x44], edx
mov edx, dword [0x1002eda4]
mov dword [eax + 0x48], edx
movzx edx, word [0x1002eda8]
mov word [eax + 0x4c], dx
jmp 0x1000c3b6
mov eax, dword [ebp - 0x358]
mov dword [esp + 4], 0
xor ebx, ebx
mov dword [esp], eax
call sym._free_row_values
test byte [0x10021048], 8
je 0x1000cc47
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.created__u_rows_n
mov dword [esp + 8], str.fill_operatingsystem
mov dword [esp + 4], 0x10021048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x1000cc47
mov dword [esp], ebx
xor ebx, ebx
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x1000ca9b
mov esi, dword [ebp - 0x32c]
test esi, esi
jne 0x1000c365
cmp dword [ebp - 0x328], 0x55ef
jbe 0x1000cf27
mov edx, dword [str.11_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002ece8]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002ecec]
mov dword [eax + 0x2c], edx
movzx edx, word [0x1002ecf0]
mov word [eax + 0x30], dx
jmp 0x1000c3b6
lea eax, [ebp - 0x320]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
jmp 0x1000c451
xor esi, esi
mov ebx, 1
jmp 0x1000cc3a
add esi, dword [ebp - 0x170]
jmp 0x1000c7cb
mov dword [esp], str.20230101000000.000000000
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov ebx, eax
jmp 0x1000c6c9
mov edx, dword [str.8.1_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002ee24]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002ee28]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002ee2c]
mov dword [eax + 0x30], edx
jmp 0x1000c3b6
mov edx, dword [str.8_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002ee34]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002ee38]
mov dword [eax + 0x2c], edx
jmp 0x1000c3b6
cmp byte [ebp - 0x21a], 1
je 0x1000d03a
mov edx, dword [str.Server_2008_R2_Standard]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002edc4]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002edc8]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002edcc]
mov dword [eax + 0x30], edx
mov edx, dword [0x1002edd0]
mov dword [eax + 0x34], edx
mov edx, dword [0x1002edd4]
mov dword [eax + 0x38], edx
mov edx, dword [0x1002edd8]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002eddc]
mov dword [eax + 0x40], edx
mov edx, dword [0x1002ede0]
mov dword [eax + 0x44], edx
mov edx, dword [0x1002ede4]
mov dword [eax + 0x48], edx
mov edx, dword [0x1002ede8]
mov dword [eax + 0x4c], edx
mov edx, dword [0x1002edec]
mov dword [eax + 0x50], edx
jmp 0x1000c3b6
mov dword [esp], str.12345_OEM_1234567_12345
call dword [sym.imp.ucrtbase.dll__wcsdup]
jmp 0x1000c9db
add ax, word [ebp - 0x170]
neg eax
jmp 0x1000c4d3
mov eax, 0x52
xor edi, edi
jmp 0x1000c8de
xor ebx, ebx
jmp 0x1000c869
mov edx, dword [str.10_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002ecd8]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002ecdc]
mov dword [eax + 0x2c], edx
movzx edx, word [0x1002ece0]
mov word [eax + 0x30], dx
jmp 0x1000c3b6
cmp byte [ebp - 0x21a], 1
je 0x1000d089
mov edx, dword [str.Server_2003_Standard_Edition]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002ed44]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002ed48]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002ed4c]
mov dword [eax + 0x30], edx
mov edx, dword [0x1002ed50]
mov dword [eax + 0x34], edx
mov edx, dword [0x1002ed54]
mov dword [eax + 0x38], edx
mov edx, dword [0x1002ed58]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002ed5c]
mov dword [eax + 0x40], edx
mov edx, dword [0x1002ed60]
mov dword [eax + 0x44], edx
mov edx, dword [0x1002ed64]
mov dword [eax + 0x48], edx
mov edx, dword [0x1002ed68]
mov dword [eax + 0x4c], edx
mov edx, dword [0x1002ed6c]
mov dword [eax + 0x50], edx
mov edx, dword [0x1002ed70]
mov dword [eax + 0x54], edx
mov edx, dword [0x1002ed74]
mov dword [eax + 0x58], edx
movzx edx, word [0x1002ed78]
mov word [eax + 0x5c], dx
jmp 0x1000c3b6
mov edx, dword [str.XP_Professional]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002eec4]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002eec8]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002eecc]
mov dword [eax + 0x30], edx
mov edx, dword [0x1002eed0]
mov dword [eax + 0x34], edx
mov edx, dword [0x1002eed4]
mov dword [eax + 0x38], edx
mov edx, dword [0x1002eed8]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002eedc]
mov dword [eax + 0x40], edx
jmp 0x1000c3b6
mov edx, dword [str.7_Professional]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002ee04]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002ee08]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002ee0c]
mov dword [eax + 0x30], edx
mov edx, dword [0x1002ee10]
mov dword [eax + 0x34], edx
mov edx, dword [0x1002ee14]
mov dword [eax + 0x38], edx
mov edx, dword [0x1002ee18]
mov dword [eax + 0x3c], edx
movzx edx, word [0x1002ee1c]
mov word [eax + 0x40], dx
jmp 0x1000c3b6
mov edx, dword [str.XP_Professional_x64_Edition]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002ee84]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002ee88]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002ee8c]
mov dword [eax + 0x30], edx
mov edx, dword [0x1002ee90]
mov dword [eax + 0x34], edx
mov edx, dword [0x1002ee94]
mov dword [eax + 0x38], edx
mov edx, dword [0x1002ee98]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002ee9c]
mov dword [eax + 0x40], edx
mov edx, dword [0x1002eea0]
mov dword [eax + 0x44], edx
mov edx, dword [0x1002eea4]
mov dword [eax + 0x48], edx
mov edx, dword [0x1002eea8]
mov dword [eax + 0x4c], edx
mov edx, dword [0x1002eeac]
mov dword [eax + 0x50], edx
mov edx, dword [0x1002eeb0]
mov dword [eax + 0x54], edx
mov edx, dword [0x1002eeb4]
mov dword [eax + 0x58], edx
jmp 0x1000c3b6
mov edx, dword [str.Vista_Ultimate]
mov dword [eax + 0x24], edx
mov edx, dword [0x1002ebc4]
mov dword [eax + 0x28], edx
mov edx, dword [0x1002ebc8]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002ebcc]
mov dword [eax + 0x30], edx
mov edx, dword [0x1002ebd0]
mov dword [eax + 0x34], edx
mov edx, dword [0x1002ebd4]
mov dword [eax + 0x38], edx
mov edx, dword [0x1002ebd8]
mov dword [eax + 0x3c], edx
movzx edx, word [0x1002ebdc]
mov word [eax + 0x40], dx
jmp 0x1000c3b6
mov esi, 0xffffffff
jmp 0x1000cc50