Function at 0x1001b140
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x1013d900]
xor eax, esp
mov dword [esp + 0x140], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x18
mov eax, str.unknown_OperatingSystem.
mov dword [esp + 0x2c], 0x11c
call fcn.10001ab0
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1001b3ea
mov eax, dword [esp + 0x2c]
add eax, 0xfffffffc
cmp eax, 6
ja case.0x1001b199.7
jmp dword [eax*4 + 0x1001b404]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1001b200
cmp eax, 0xa
je 0x1001b1db
cmp eax, 0x5a
jne case.0x1001b199.7
mov eax, str.Microsoft_Windows_Me
push esi
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
mov eax, str.Microsoft_Windows_98
push esi
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
mov eax, dword [esp + 0x38]
cmp eax, 2
jne 0x1001b22e
mov eax, str.Microsoft_Windows_NT_4.0
push esi
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
cmp eax, 1
jne case.0x1001b199.7
mov eax, str.Microsoft_Windows_95
push esi
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
mov eax, dword [esp + 0x30]
sub eax, 0
je 0x1001b2d7
sub eax, 1
je 0x1001b2b2
sub eax, 1
jne case.0x1001b199.7
cmp byte [esp + 0x142], 1
jne case.0x1001b199.7
cmp word [esp + 4], 9
jne case.0x1001b199.7
mov eax, str.Microsoft_Windows_XP_Professional_x64_Edition
push esi
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
mov eax, str.Microsoft_Windows_XP
push esi
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
mov eax, str.Microsoft_Windows_2000
push esi
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
mov eax, dword [esp + 0x30]
sub eax, 0
je 0x1001b361
sub eax, 1
jne case.0x1001b199.7
cmp byte [esp + 0x142], 1
push esi
jne 0x1001b33d
mov eax, str.Microsoft_Windows_7
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
mov eax, str.Microsoft_Windows_Server_2008_R2
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
cmp byte [esp + 0x142], 1
push esi
jne 0x1001b390
mov eax, str.Microsoft_Windows_Vista
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
mov eax, str.Microsoft_Windows_Server_2008
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
cmp dword [esp + 0x30], 0
jne case.0x1001b199.7
cmp byte [esp + 0x142], 1
jne case.0x1001b199.7
mov eax, str.Microsoft_Windows_10
push esi
call fcn.10012f50
mov eax, dword [esp + 0x2c]
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.10056c06
add esp, 0x144
ret
mov ecx, dword [esp + 0x144]
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.10056c06
add esp, 0x144
ret