Function at 0x101a5250
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x9c
xor edi, edi
xorps xmm0, xmm0
lea eax, [esp + 0x4c]
push edi
xor esi, esi
push eax
movdqa xmmword [esp + 0x1c], xmm0
movdqa xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x3c], esi
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x4c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x101a5697
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x101a52d5
lea ecx, [esp + 0x10]
push ecx
call eax
jmp 0x101a52e0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x58], 2
jne 0x101a5697
mov eax, dword [esp + 0x4c]
cmp eax, 4
jbe 0x101a5697
cmp eax, 6
jne case.0x101a542c.5
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x101a5323
cmp byte [esp + 0xe2], 1
mov esi, str.Windows_Vista
mov eax, str.Windows_Server_2008
cmovne esi, eax
jmp 0x101a53fc
cmp eax, 1
jne 0x101a5342
cmp byte [esp + 0xe2], 1
mov esi, str.Windows_7
mov eax, str.Windows_Server_2008_R2
cmovne esi, eax
jmp 0x101a53fc
cmp eax, 2
jne 0x101a53f7
push 0x9c
lea eax, [esp + 0xec]
push 0
push eax
call sub.MSVCR110.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
push 3
push 2
push eax
push eax
mov dword [esp + 0xf8], 0x9c
mov dword [esp + 0xfc], 6
mov dword [esp + 0x100], 3
mov word [esp + 0x18c], ax
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [esp + 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x101a53e0
cmp byte [esp + 0xe2], 1
mov esi, str.Windows_8.1
mov eax, str.Windows_Server_2012_R2
mov dword [esp + 0x50], 3
cmovne esi, eax
jmp 0x101a53fc
cmp byte [esp + 0xe2], 1
mov esi, str.Windows_8
mov eax, str.Windows_Server_2012
cmovne esi, eax
jmp 0x101a53fc
mov esi, str.Unknown_Windows_version
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
push 6
call eax
mov eax, dword [esp + 8]
dec eax
cmp eax, 0x18
ja case.0x101a542c.5
jmp dword [eax*4 + 0x101a56b0]
mov edi, str.Ultimate_Edition
jmp case.0x101a542c.5
mov edi, str.Home_Premium_Edition
jmp case.0x101a542c.5
mov edi, str.Home_Basic_Edition
jmp case.0x101a542c.5
mov edi, str.Enterprise_Edition
jmp case.0x101a542c.5
mov edi, str.Business_Edition
jmp case.0x101a542c.5
mov edi, str.Starter_Edition
jmp case.0x101a542c.5
mov edi, str.Cluster_Server_Edition
jmp case.0x101a542c.5
mov edi, str.Datacenter_Edition
jmp case.0x101a542c.5
mov edi, str.Datacenter_Edition__core_installation_
jmp case.0x101a542c.5
mov edi, str.Enterprise_Edition__core_installation_
jmp case.0x101a542c.5
mov edi, str.Enterprise_Edition_for_Itanium_based_Systems
jmp case.0x101a542c.5
mov edi, str.Small_Business_Server
jmp case.0x101a542c.5
mov edi, str.Small_Business_Server_Premium_Edition
jmp case.0x101a542c.5
mov edi, str.Standard_Edition
jmp case.0x101a542c.5
mov edi, str.Standard_Edition__core_installation_
jmp case.0x101a542c.5
mov edi, str.Web_Server_Edition
cmp dword [esp + 0x4c], 5
jne 0x101a5644
mov ecx, dword [esp + 0x50]
cmp ecx, 2
jne 0x101a559f
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov cx, word [esp + 0x10]
mov dl, byte [esp + 0xe2]
test eax, eax
mov eax, dword [esp + 0xe0]
je 0x101a54df
mov esi, str.Windows_Server_2003_R2
jmp 0x101a5518
mov esi, 0x2000
cmp ax, si
jne 0x101a54f0
mov esi, str.Windows_Storage_Server_2003
jmp 0x101a5518
mov esi, 0x8000
cmp ax, si
jne 0x101a5501
mov esi, str.Windows_Home_Server
jmp 0x101a5518
cmp dl, 1
jne 0x101a5513
cmp cx, 9
jne 0x101a5513
mov esi, str.Windows_XP_Professional_x64_Edition
jmp 0x101a558e
mov esi, str.Windows_Server_2003
cmp dl, 1
je 0x101a558e
cmp cx, 6
jne 0x101a5539
test al, al
jns 0x101a552e
mov edi, str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x101a558e
test al, 2
je 0x101a558e
mov edi, str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x101a558e
cmp cx, 9
jne 0x101a5558
test al, al
jns 0x101a554a
mov edi, str.Datacenter_x64_Edition
jmp 0x101a558e
test al, 2
mov edi, str.Enterprise_x64_Edition
mov ecx, str.Standard_x64_Edition
jmp 0x101a558b
test eax, 0x4000
je 0x101a5566
mov edi, str.Compute_Cluster_Edition
jmp 0x101a558e
test al, al
jns 0x101a5571
mov edi, str.Datacenter_Edition
jmp 0x101a558e
test al, 2
je 0x101a557c
mov edi, str.Enterprise_Edition
jmp 0x101a558e
test eax, 0x400
mov edi, str.Web_Edition
mov ecx, str.Standard_Edition
cmove edi, ecx
cmp dword [esp + 0x4c], 5
jne 0x101a5644
mov ecx, dword [esp + 0x50]
jmp 0x101a55ad
mov dl, byte [esp + 0xe2]
mov eax, dword [esp + 0xe0]
cmp ecx, 1
jne 0x101a5615
mov esi, str.Windows_XP
test eax, 0x200
je 0x101a55c5
mov edi, str.Home_Edition
jmp 0x101a5644
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x57
call edi
test eax, eax
je 0x101a55da
mov edi, str.Media_Center_Edition
jmp 0x101a55fc
push 0x58
call edi
test eax, eax
je 0x101a55e9
mov edi, str.Starter_Edition
jmp 0x101a55fc
push 0x56
call edi
mov edi, str.Tablet_PC_Edition
mov ecx, str.Professional
test eax, eax
cmove edi, ecx
cmp dword [esp + 0x4c], 5
jne 0x101a5644
mov dl, byte [esp + 0xe2]
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0x50]
test ecx, ecx
jne 0x101a5644
mov esi, str.Windows_2000
cmp dl, 1
jne 0x101a562a
mov edi, str.Professional
jmp 0x101a5644
test al, al
jns 0x101a5635
mov edi, str.Datacenter_Server
jmp 0x101a5644
test al, 2
mov edi, str.Advanced_Server
mov eax, str.Server
cmove edi, eax
cmp byte [esp + 0x5c], 0
lea eax, [esp + 0x5c]
push eax
mov ecx, 0x10549470
mov edx, 0x1053ac9c
mov eax, ecx
cmove eax, edx
push eax
mov eax, edx
test edi, edi
cmovne eax, edi
push eax
cmove ecx, edx
push ecx
push esi
push str._s_s_s_s_s
lea eax, [esp + 0x24]
push 0
push eax
call sym.php5.dll_spprintf
mov eax, dword [esp + 0x2c]
add esp, 0x20
pop edi
pop esi
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.10311bec
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10311bec
mov esp, ebp
pop ebp
ret