Function at 0x21035317
Capabilities:
Check os version
Get common file path
Get geographical location
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x210711bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x94], 0
call fcn.21036241
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x13c], 1
push 0x210840f0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x148], eax
push 0x210840fc
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x140], eax
lea edx, [ebp - 0x174]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x140], 0
je 0x210353ea
lea eax, [ebp - 0x30]
push eax
call dword [ebp - 0x140]
push 0x9c
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.21053be0
add esp, 0xc
mov dword [ebp - 0x138], 0x9c
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jne 0x2103545e
push 0x9c
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.21053be0
add esp, 0xc
mov dword [ebp - 0x138], 0x94
lea ecx, [ebp - 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x2103545e
xor eax, eax
jmp 0x21036231
cmp dword [ebp - 0x150], 0
je 0x21035491
mov dl, byte [ebp - 0x9e]
mov byte [ebp - 0x2c4], dl
cmp byte [ebp - 0x2c4], 2
jb 0x21035491
cmp byte [ebp - 0x2c4], 3
jbe 0x21035487
jmp 0x21035491
mov dword [ebp - 0x94], 1
push 0x104
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea ecx, [ebp - 0x27c]
push ecx
push str.user32.dll
lea edx, [ebp - 0x27c]
push edx
call fcn.210134f1
push 0
push 0
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x178]
push ecx
push 0
push 0
lea edx, [ebp - 0x27c]
push edx
call fcn.21001046
mov eax, dword [ebp - 0x178]
and eax, 0xffff
test eax, eax
jne 0x210354fd
mov ecx, dword [ebp - 0x40]
and ecx, 0xffff
test ecx, ecx
je 0x21035542
mov edx, dword [ebp - 0x178]
and edx, 0xffff
cmp dword [ebp - 0x134], edx
jne 0x21035521
mov eax, dword [ebp - 0x40]
and eax, 0xffff
cmp dword [ebp - 0x130], eax
je 0x21035542
mov ecx, dword [ebp - 0x178]
and ecx, 0xffff
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x40]
and edx, 0xffff
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
je 0x21035656
cmp dword [ebp - 0x2c8], 1
je 0x21035576
cmp dword [ebp - 0x2c8], 2
je 0x2103566c
jmp 0x21035d91
mov ecx, dword [ebp - 0x134]
shl ecx, 8
or ecx, dword [ebp - 0x130]
mov dword [ebp - 0x2cc], ecx
cmp dword [ebp - 0x2cc], 0x400
je 0x210355b1
cmp dword [ebp - 0x2cc], 0x40a
je 0x210355e1
cmp dword [ebp - 0x2cc], 0x45a
je 0x21035611
jmp 0x21035624
push str.Windows_95
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
movsx eax, byte [ebp - 0x123]
cmp eax, 0x42
jne 0x210355df
push str._OSR2
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
jmp 0x21035651
push str.Windows_98
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
movsx eax, byte [ebp - 0x123]
cmp eax, 0x41
jne 0x2103560f
push 0x2108413c
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
jmp 0x21035651
push str.Windows_Me
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x21035651
mov eax, dword [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
push str.Windows_9x_Me_v_d._02d
mov edx, dword [ebp + 8]
push edx
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0x10
jmp 0x21035d91
push str.Win32s
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x21035d91
mov eax, dword [ebp - 0x134]
shl eax, 8
or eax, dword [ebp - 0x130]
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x502
ja 0x210356b6
cmp dword [ebp - 0x2d0], 0x502
je 0x21035711
cmp dword [ebp - 0x2d0], 0x500
je 0x210356db
cmp dword [ebp - 0x2d0], 0x501
je 0x210356fb
jmp 0x210357cc
cmp dword [ebp - 0x2d0], 0x600
je 0x2103576c
cmp dword [ebp - 0x2d0], 0x601
je 0x210357af
jmp 0x210357cc
push str.Windows_2000
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
mov dword [ebp - 0x98], 1
jmp 0x21035813
push 0x2108417c
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x21035813
cmp dword [ebp - 0x94], 0
je 0x21035756
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x21035739
push str.Windows_Server_2003_R2
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x2103574a
push str.Windows_Server_2003
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
mov dword [ebp - 0x280], 1
jmp 0x21035767
push str.Windows_XP
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x21035813
cmp dword [ebp - 0x94], 0
je 0x21035792
push str.Windows_Server_2008
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
mov dword [ebp - 0x14c], 1
jmp 0x210357ad
push str.Windows_Vista
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
mov dword [ebp - 0x9c], 1
jmp 0x21035813
push str.Windows_7
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
mov dword [ebp - 0x144], 1
jmp 0x21035813
cmp dword [ebp - 0x94], 0
je 0x210357e8
push str.Windows_Server
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x210357f9
push str.Windows_NT
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
cmp dword [ebp - 0x134], 4
jne 0x2103580c
mov dword [ebp - 0x288], 1
mov dword [ebp - 0x38], 1
cmp dword [ebp - 0x150], 0
je 0x21035b40
cmp dword [ebp - 0x94], 0
je 0x210359d1
cmp dword [ebp - 0x288], 0
je 0x21035872
mov edx, dword [ebp - 0xa0]
and edx, 0xffff
and edx, 2
test edx, edx
je 0x2103585c
push str._Server_Enterprise_Edition
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x2103586d
push 0x21084228
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
jmp 0x210359cc
cmp dword [ebp - 0x98], 0
je 0x210358e0
mov edx, dword [ebp - 0xa0]
and edx, 0xffff
and edx, 0x80
test edx, edx
je 0x210358a4
push str._Datacenter_Server
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x210358db
mov ecx, dword [ebp - 0xa0]
and ecx, 0xffff
and ecx, 2
test ecx, ecx
je 0x210358ca
push str._Advanced_Server
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x210358db
push 0x21084258
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x210359cc
cmp dword [ebp - 0x280], 0
je 0x21035976
mov ecx, dword [ebp - 0xa0]
and ecx, 0xffff
and ecx, 0x400
test ecx, ecx
je 0x21035916
push str._Web_Edition
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x21035974
mov eax, dword [ebp - 0xa0]
and eax, 0xffff
and eax, 0x80
test eax, eax
je 0x2103593d
push str._Datacenter_Edition
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
jmp 0x21035974
mov edx, dword [ebp - 0xa0]
and edx, 0xffff
and edx, 2
test edx, edx
je 0x21035963
push str._Enterprise_Edition
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x21035974
push str._Standard_Edition
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
jmp 0x210359cc
cmp dword [ebp - 0x14c], 0
je 0x210359cc
mov edx, dword [ebp - 0xa0]
and edx, 0xffff
and edx, 0x80
test edx, edx
je 0x210359a8
push str._Datacenter
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x210359cc
mov ecx, dword [ebp - 0xa0]
and ecx, 0xffff
and ecx, 2
test ecx, ecx
je 0x210359cc
push str._Enterprise
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x21035b3b
mov eax, dword [ebp - 0xa0]
and eax, 0xffff
and eax, 0x200
test eax, eax
je 0x21035a44
push str._Home
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
cmp dword [ebp - 0x9c], 0
jne 0x21035a08
cmp dword [ebp - 0x144], 0
je 0x21035a3f
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x21035a27
push str._Premium
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x21035a38
push str._Basic
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
mov dword [ebp - 0x3c], 0
jmp 0x21035b3b
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 0x2d4], ecx
cmp dword [ebp - 0x2d4], 4
je 0x21035a64
cmp dword [ebp - 0x2d4], 5
je 0x21035a7a
jmp 0x21035a90
push 0x210842e0
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x21035b3b
push 0x210842f0
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x21035b3b
cmp dword [ebp - 0x9c], 0
je 0x21035ad2
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x21035ab8
push 0x21084300
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
jmp 0x21035ac9
push str._Business
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
mov dword [ebp - 0x3c], 0
jmp 0x21035b3b
cmp dword [ebp - 0x144], 0
je 0x21035b3b
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x21035afa
push str._Starter
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x21035b2a
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x21035b19
push str._Ultimate
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
jmp 0x21035b2a
push str._Professional
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x13c], 0
jmp 0x21035c08
mov dword [ebp - 0x294], 0
mov byte [ebp - 0x27c], 0
mov dword [ebp - 0x290], 0x104
lea eax, [ebp - 0x294]
push eax
push 0x21084340
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x21035c08
lea ecx, [ebp - 0x290]
push ecx
lea edx, [ebp - 0x27c]
push edx
lea eax, [ebp - 0x28c]
push eax
push 0
push 0x21084370
mov ecx, dword [ebp - 0x294]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x21035bfb
push str.WinNt
lea edx, [ebp - 0x27c]
push edx
call fcn.21053d90
add esp, 8
test eax, eax
jne 0x21035bd2
push str._Workstation
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x21035bfb
push 0x21084394
lea ecx, [ebp - 0x27c]
push ecx
call fcn.21053d90
add esp, 8
test eax, eax
jne 0x21035bfb
push str._Server
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
mov eax, dword [ebp - 0x294]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x38], 0
je 0x21035c3b
mov ecx, dword [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
push str.__d._02d
mov eax, dword [ebp + 8]
push eax
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0x10
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x2d8], edx
cmp dword [ebp - 0x2d8], 6
je 0x21035c6b
cmp dword [ebp - 0x2d8], 9
je 0x21035c58
jmp 0x21035c7c
push str._x64
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x21035c7c
push str._Itanium
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x21035d91
cmp dword [ebp - 0x150], 0
je 0x21035d1c
mov edx, dword [ebp - 0xa4]
and edx, 0xffff
test edx, edx
jne 0x21035ca5
jmp 0x21035d1a
mov eax, dword [ebp - 0xa2]
and eax, 0xffff
test eax, eax
jne 0x21035ce2
mov ecx, dword [ebp - 0xa4]
and ecx, 0xffff
push ecx
push str._SP_d
mov edx, dword [ebp + 8]
push edx
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0xc
jmp 0x21035d1a
mov edx, dword [ebp - 0xa2]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0xa4]
and eax, 0xffff
push eax
push str._SP_d._02d
mov ecx, dword [ebp + 8]
push ecx
call fcn.21053c40
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
push edx
call fcn.2105374f
add esp, 0x10
jmp 0x21035d65
movsx eax, byte [ebp - 0x124]
test eax, eax
je 0x21035d65
push 0x210843dc
lea ecx, [ebp - 0x124]
push ecx
call fcn.21053d00
add esp, 8
test eax, eax
je 0x21035d65
lea edx, [ebp - 0x124]
push edx
push 0x210843e0
mov eax, dword [ebp + 8]
push eax
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0xc
mov edx, dword [ebp - 0x12c]
and edx, 0xffff
push edx
push str._Build__d
mov eax, dword [ebp + 8]
push eax
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0xc
push 0x50
lea edx, [ebp - 0x90]
push edx
push 9
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jle 0x21035e32
push 0
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.21051403
test eax, eax
je 0x21035e32
mov edx, dword [ebp - 0x284]
and edx, 0xffff
mov dword [ebp - 0x298], edx
mov eax, dword [ebp - 0x284]
and eax, 0xffff
and eax, 0x3ff
cmp eax, 9
je 0x21035e32
push 0x50
lea ecx, [ebp - 0x90]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x298]
push eax
call fcn.210364eb
test eax, eax
je 0x21035e32
lea ecx, [ebp - 0x90]
push ecx
push 0x210843f0
mov edx, dword [ebp + 8]
push edx
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0xc
cmp dword [ebp + 0xc], 1
jne 0x21035f4a
cmp dword [ebp - 0x140], 0
je 0x21035ea2
mov edx, dword [ebp - 0x174]
and edx, 0xffff
mov eax, dword [ebp - 0x30]
and eax, 0xffff
cmp edx, eax
je 0x21035ea2
mov ecx, dword [ebp - 0x30]
and ecx, 0xffff
mov edx, dword [ecx*4 + str.___b____b_H__b_P__b_T__b_X__b___b_d__b_l__b_t__b___b_]
push edx
mov eax, dword [ebp - 0x174]
and eax, 0xffff
mov ecx, dword [eax*4 + str.___b____b_H__b_P__b_T__b_X__b___b_d__b_l__b_t__b___b_]
push ecx
push str._nArchitecture:__s__reported____s__actual_
mov edx, dword [ebp + 8]
push edx
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0x10
jmp 0x21035ee4
mov edx, dword [ebp - 0x174]
and edx, 0xffff
test edx, edx
je 0x21035ee4
mov eax, dword [ebp - 0x174]
and eax, 0xffff
mov ecx, dword [eax*4 + str.___b____b_H__b_P__b_T__b_X__b___b_d__b_l__b_t__b___b_]
push ecx
push str._nArchitecture:__s
mov edx, dword [ebp + 8]
push edx
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0xc
cmp dword [ebp - 0x3c], 0
je 0x21035f07
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x21035f07
push str._nMedia_Center_Edition
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
cmp dword [ebp - 0x13c], 0
je 0x21035f2d
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x21035f2d
push str._nStarter_Edition
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x21035f4a
push str._nTablet_PC_Edition
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
cmp dword [ebp - 0x128], 2
jne 0x21036178
cmp dword [ebp + 0xc], 1
jne 0x21036178
call fcn.2104a43e
test eax, eax
je 0x2103603a
mov edx, dword [ebp - 0xa0]
and edx, 0xffff
and edx, 0x10
test edx, edx
je 0x21035f94
push str._nTerminal_Server
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x21035fbb
mov ecx, dword [ebp - 0xa0]
and ecx, 0xffff
and ecx, 0x100
test ecx, ecx
je 0x21035fbb
push str._nTerminal_Server__single_user_
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
call fcn.2104a6ea
test eax, eax
je 0x2103603a
push str._nremote_client
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
lea ecx, [ebp - 0x2c0]
call fcn.21049db0
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x27c]
push ecx
lea ecx, [ebp - 0x2c0]
call fcn.2104a296
test eax, eax
je 0x21036028
lea edx, [ebp - 0x27c]
push edx
push 0x210844b8
mov eax, dword [ebp + 8]
push eax
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c0]
call fcn.2104a19f
lea edx, [ebp - 0x2a0]
push edx
lea eax, [ebp - 0x29c]
push eax
call fcn.21047d11
test eax, eax
jle 0x2103609a
push str._nadministrative_user
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
cmp dword [0x2108afc4], 5
jl 0x21036098
cmp dword [ebp - 0x29c], 0
je 0x21036087
push str.__elevated_
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x21036098
push str.__not_elevated_
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x210360ab
push str._nnon_administrative_user
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
cmp dword [0x2108afc4], 5
jl 0x21036178
push str._nprocess_integrity_level:
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
cmp dword [ebp - 0x2a0], 0x1000
jae 0x210360eb
push str.untrusted
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x21036178
cmp dword [ebp - 0x2a0], 0x2000
jae 0x2103610a
push 0x21084538
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
jmp 0x21036178
cmp dword [ebp - 0x2a0], 0x3000
jae 0x21036129
push str.medium
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
jmp 0x21036178
cmp dword [ebp - 0x2a0], 0x4000
jae 0x21036148
push str.high
mov eax, dword [ebp + 8]
push eax
call fcn.210537c0
add esp, 8
jmp 0x21036178
cmp dword [ebp - 0x2a0], 0x5000
jae 0x21036167
push str.system
mov ecx, dword [ebp + 8]
push ecx
call fcn.210537c0
add esp, 8
jmp 0x21036178
push str.protected
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
cmp dword [ebp + 0xc], 1
jne 0x210361c7
movsx eax, byte [ebp - 0x124]
test eax, eax
je 0x210361c7
push 0x21084560
lea ecx, [ebp - 0x124]
push ecx
call fcn.21053d00
add esp, 8
test eax, eax
je 0x210361c7
lea edx, [ebp - 0x124]
push edx
push str._nszCSDVersion____s_
mov eax, dword [ebp + 8]
push eax
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0xc
cmp dword [ebp + 0xc], 1
jne 0x2103622b
push 0x2108457c
mov edx, dword [ebp + 8]
push edx
call fcn.210537c0
add esp, 8
mov eax, dword [ebp - 0xa0]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x9e]
and ecx, 0xff
mov edx, dword [ecx*4 + 0x21084028]
push edx
mov eax, dword [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
push str.Windows__d._02d__s_wSuiteMask_04x
mov edx, dword [ebp + 8]
push edx
call fcn.21053c40
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.2105374f
add esp, 0x18
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8