Function at 0x10001310
Capabilities:
Check os version
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x1000c18b
mov eax, dword fs:[0]
push eax
sub esp, 0x31c
mov eax, dword [0x1001201c]
xor eax, esp
mov dword [esp + 0x318], eax
push ebp
push edi
mov eax, dword [0x1001201c]
xor eax, esp
push eax
lea eax, [esp + 0x328]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x330], edi
mov ecx, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push 0x11c
lea eax, [esp + 0xe8]
push edi
mov dword [esp + 0x338], edi
push eax
mov dword [esp + 0x20], 1
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0xe4]
push ecx
mov dword [esp + 0xe8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edx, [esp + 0x10]
push edx
push 0x64
push edi
mov dword [esp + 0x1c], edi
call sub.NETAPI32.dll_NetWkstaGetInfo
test eax, eax
jne 0x100013d5
mov eax, dword [esp + 0x10]
mov edi, dword [eax + 0xc]
mov ebp, dword [eax + 0x10]
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov dword [esp + 0xe8], edi
mov dword [esp + 0xec], ebp
jmp 0x10001447
cmp dword [esp + 0xe8], 6
jne 0x10001447
cmp dword [esp + 0xec], 2
jne 0x10001447
push 1
push 1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 0x11c
mov edi, eax
lea eax, [esp + 0x208]
push 0
push eax
mov ebp, edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebp
push edi
push 1
lea ecx, [esp + 0x210]
push ecx
mov dword [esp + 0x214], 0x11c
mov dword [esp + 0x21c], 3
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x10001447
mov dword [esp + 0xec], 3
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10001467
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea edx, [esp + 0x38]
push edx
call eax
mov eax, dword [esp + 0xe8]
cmp eax, 0xa
jne 0x1000149a
cmp byte [esp + 0x1fe], 1
mov ecx, esi
je 0x10001490
push str.Windows_10_Server
jmp 0x1000157f
push str.Windows_10
jmp 0x1000157f
cmp eax, 6
jne 0x10001530
mov eax, dword [esp + 0xec]
cmp eax, 3
jne 0x100014cf
cmp byte [esp + 0x1fe], 1
mov ecx, esi
je 0x100014c5
push str.Windows_Server_2012_R2
jmp 0x1000157f
push str.Windows_8.1
jmp 0x1000157f
cmp eax, 2
jne 0x100014f4
cmp byte [esp + 0x1fe], 1
mov ecx, esi
je 0x100014ea
push str.Windows_Server_2012
jmp 0x1000157f
push str.Windows_8
jmp 0x1000157f
cmp eax, 1
jne 0x10001512
mov ecx, esi
cmp byte [esp + 0x1fe], al
je 0x1000150b
push str.Windows_Server_2008_R2
jmp 0x1000157f
push str.Windows_7
jmp 0x1000157f
test eax, eax
jne 0x10001578
cmp byte [esp + 0x1fe], 1
mov ecx, esi
je 0x10001529
push str.Windows_Server_2008
jmp 0x1000157f
push str.Windows_Vista
jmp 0x1000157f
cmp eax, 5
jne 0x10001578
mov eax, dword [esp + 0xec]
cmp eax, 2
jne 0x10001561
cmp byte [esp + 0x1fe], 1
jne 0x1000155a
cmp word [esp + 0x38], 9
jne 0x1000155a
push str.Windows_XP_x64
jmp 0x1000157d
push str.Windows_Server_2003
jmp 0x1000157d
cmp eax, 1
jne 0x1000156d
push str.Windows_XP
jmp 0x1000157d
test eax, eax
jne 0x10001578
push str.Windows_2000
jmp 0x1000157d
push str.Windows
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push 1
push 3
lea ecx, [esp + 0x64]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_int_]
mov dword [esp + 0x330], 1
mov eax, dword [esp + 0xf0]
mov edx, dword [esp + 0xe8]
push eax
push ecx
mov ecx, dword [esp + 0xf4]
push 0x1000d57c
push ecx
push 0x1000d57c
push edx
lea eax, [esp + 0x7c]
push 0x1000d580
push eax
call fcn.100047a0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push eax
call fcn.100047a0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
push eax
call fcn.100047a0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x60]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void_]
push eax
mov ecx, esi
mov byte [esp + 0x334], 2
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x330], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x5c]
mov byte [esp + 0x330], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::vbase_dtor_void_]
mov eax, esi
mov ecx, dword [esp + 0x328]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x318]
xor ecx, esp
call fcn.1000b132
add esp, 0x328
ret