Function at 0x100070d0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10017ade
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x10021568]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x11c], eax
lea esi, [ebx + 0x18]
xor edi, edi
mov eax, 0x1001bd30
mov dword [ebp - 0x120], 0
call fcn.10003390
lea ecx, [ebp - 0xe0]
push ecx
mov dword [ebp - 0xe0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xdc]
sub eax, 5
mov byte [ebx], 1
je 0x1000735a
dec eax
je 0x1000723e
mov edi, 0xc
mov eax, str.Windows_NT_v
call fcn.10003390
mov eax, dword [ebp - 0xdc]
mov edi, dword [sym.imp.MSVCR100.dll__itoa_s]
push 0xa
push 0xa
lea edx, [ebp - 0x1c]
push edx
push eax
call edi
lea eax, [ebp - 0x1c]
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10007181
sub eax, ecx
push eax
lea eax, [ebp - 0x1c]
mov ecx, esi
call fcn.10003050
push 1
mov eax, 0x1001c378
mov ecx, esi
call fcn.10003050
mov edx, dword [ebp - 0xd8]
push 0xa
push 0xa
lea ecx, [ebp - 0x1c]
push ecx
push edx
call edi
lea eax, [ebp - 0x1c]
add esp, 0x10
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100071c0
sub eax, ecx
push eax
lea eax, [ebp - 0x1c]
mov ecx, esi
call fcn.10003050
push 1
mov eax, 0x1001c378
mov ecx, esi
call fcn.10003050
mov ecx, dword [ebp - 0xd4]
push 0xa
push 0xa
lea eax, [ebp - 0x1c]
push eax
push ecx
call edi
lea eax, [ebp - 0x1c]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10007200
sub eax, edx
push eax
lea eax, [ebp - 0x1c]
mov ecx, esi
call fcn.10003050
cmp dword [ebp - 0xdc], 4
jne 0x10007651
cmp byte [ebp - 0x46], 1
jne 0x10007651
push 0xc
mov eax, str._Workstation
mov ecx, esi
call fcn.10003050
jmp 0x10007651
mov eax, dword [ebp - 0xd8]
sub eax, 0
mov byte [ebx + 1], 1
je 0x100072fc
dec eax
je 0x100072dd
dec eax
je 0x1000729d
push esi
mov eax, str.Windows_NT_v
call fcn.10002ed0
mov eax, dword [ebp - 0xdc]
push 0xa
push 0xa
lea edx, [ebp - 0x28]
push edx
push eax
call dword [sym.imp.MSVCR100.dll__itoa_s]
lea eax, [ebp - 0x28]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10007284
sub eax, edx
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
call fcn.10003050
jmp 0x1000731c
mov eax, dword [ebp - 0xd4]
mov byte [ebx + 5], 1
cmp eax, 0x1ebb
jne 0x100072b5
mov eax, str.Windows_8_Milestone1
jmp 0x10007316
lea ecx, [eax - 0x1ee6]
cmp ecx, 0x25
ja 0x100072c7
mov eax, str.Windows_8_Milestone2
jmp 0x10007316
push esi
cmp eax, 0x1f13
jne 0x100072d6
mov eax, str.Windows_8_Milestone3
jmp 0x10007317
mov eax, str.Windows_8
jmp 0x10007317
cmp dword [ebp - 0xd4], 0x1a91
mov byte [ebx + 4], 1
push esi
jne 0x100072f5
mov eax, str.Windows_7_preBeta_build_M3_PDC_2008
jmp 0x10007317
mov eax, str.Windows_7
jmp 0x10007317
cmp byte [ebp - 0x46], 1
jne 0x1000730d
mov byte [ebx + 2], 1
mov eax, str.Windows_Vista
jmp 0x10007316
mov byte [ebx + 3], 1
mov eax, str.Windows_Server_2008
push esi
call fcn.10002ed0
lea edx, [ebp - 0xfc]
push edx
push ebx
call fcn.10006fa0
push 0
push eax
or eax, 0xffffffff
mov dword [ebp - 4], 0
call fcn.100032a0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xe8], 0x10
jb 0x10007651
mov eax, dword [ebp - 0xfc]
jmp 0x10007647
mov eax, dword [ebp - 0xd8]
sub eax, 0
mov edi, dword [sym.imp.MSVCR100.dll__itoa_s]
mov byte [ebx + 6], 1
je 0x10007568
dec eax
je 0x10007538
dec eax
je 0x100073d2
push esi
mov eax, str.Windows_NT_v
call fcn.10002ed0
mov edx, dword [ebp - 0xdc]
push 0xa
push 0xa
lea ecx, [ebp - 0x28]
push ecx
push edx
call edi
add esp, 0x10
push esi
lea eax, [ebp - 0x28]
call fcn.10007b60
push esi
mov eax, 0x1001c378
call fcn.10007b60
mov ecx, dword [ebp - 0xd8]
push 0xa
push 0xa
lea eax, [ebp - 0x28]
push eax
push ecx
call edi
add esp, 0x10
push esi
lea eax, [ebp - 0x28]
call fcn.10007b60
jmp 0x100075c7
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x100073fd
movzx edx, byte [ebp - 0x46]
mov byte [ebx + 0xa], 1
push esi
cmp edx, 0x2000
jne 0x100073f6
mov eax, str.Windows_Storage_Server_2003_R2
jmp 0x10007442
mov eax, str.Windows_Server_2003_R2
jmp 0x10007442
mov cl, byte [ebp - 0x46]
movzx eax, cl
cmp eax, 0x8000
jne 0x10007415
mov byte [ebx + 0xb], 1
mov eax, str.Windows_Home_Server
jmp 0x10007441
cmp eax, 0x2000
jne 0x10007423
mov eax, str.Windows_Storage_Server_2003
jmp 0x1000743d
cmp cl, 1
jne 0x10007438
cmp byte [ebx + 0xc], 0
je 0x10007438
mov byte [ebx + 9], cl
mov eax, str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x10007441
mov eax, str.Windows_Server_2003
mov byte [ebx + 0xa], 1
push esi
call fcn.10002ed0
cmp byte [ebp - 0x46], 1
je 0x100075c7
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x144]
cmp ax, 6
jne 0x100074a0
mov ax, word [ebp - 0x48]
test ax, ax
je 0x100075c7
mov ecx, 0x80
cmp ax, cx
jne 0x1000748c
mov eax, str._Datacenter_Edition_pour_Itanium
jmp 0x100075c1
cmp ax, 2
jne 0x100075c7
mov eax, str._Enterprise_Edition_pour_Itanium
jmp 0x100075c1
cmp ax, 9
mov ax, word [ebp - 0x48]
jne 0x100074dd
test ax, ax
je 0x100074d3
mov edx, 0x80
cmp ax, dx
jne 0x100074c3
mov eax, str._Datacenter_x64_Edition
jmp 0x100075c1
cmp ax, 2
jne 0x100074d3
mov eax, str._Enterprise_x64_Edition
jmp 0x100075c1
mov eax, str._Standard_x64_Edition
jmp 0x100075c1
test ax, ax
je 0x1000752e
mov ecx, 0x80
cmp ax, cx
jne 0x100074f6
mov eax, str._Datacenter_Edition
jmp 0x100075c1
cmp ax, 2
jne 0x10007506
mov eax, str._Enterprise_Edition
jmp 0x100075c1
mov edx, 0x4000
cmp ax, dx
jne 0x1000751a
mov eax, str._Compute_Cluster_Edition
jmp 0x100075c1
mov ecx, 0x400
cmp ax, cx
jne 0x1000752e
mov eax, str._Web_Edition
jmp 0x100075c1
mov eax, str._Standard_Edition
jmp 0x100075c1
push esi
mov eax, str.Windows_XP
mov byte [ebx + 9], 1
call fcn.10002ed0
mov ax, word [ebp - 0x48]
test ax, ax
je 0x10007561
mov edx, 0x200
cmp ax, dx
jne 0x10007561
mov eax, str._Home_Edition
jmp 0x100075c1
mov eax, str._Professionel
jmp 0x100075c1
push esi
mov eax, str.Windows_2000
mov byte [ebx + 7], 1
call fcn.10002ed0
cmp byte [ebp - 0x46], 1
mov ax, word [ebp - 0x48]
jne 0x10007597
test ax, ax
je 0x10007561
mov ecx, 0x200
cmp ax, cx
jne 0x10007561
mov eax, str._Home_Edition
jmp 0x100075c1
mov byte [ebx + 8], 1
test ax, ax
je 0x100075bc
mov edx, 0x80
cmp ax, dx
jne 0x100075b1
mov eax, str._DataCenter_Server
jmp 0x100075c1
cmp ax, 2
mov eax, str._Advanced_Server
je 0x100075c1
mov eax, str._Server
push esi
call fcn.10007b60
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.10006fa0
push 0
push eax
or eax, 0xffffffff
mov dword [ebp - 4], 1
call fcn.100032a0
mov edi, 0x10
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x30], edi
jb 0x10007601
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.mfc100.dll_Ordinal_1296]
add esp, 4
lea edx, [ebp - 0x118]
push edx
push ebx
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
call fcn.10007040
push 0
push eax
or eax, 0xffffffff
mov dword [ebp - 4], 2
call fcn.100032a0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x104], edi
jb 0x10007651
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_1296]
add esp, 4
cmp word [ebp - 0x4c], 0
jbe 0x100076cc
push 0xe
mov eax, str._Service_Pack
mov ecx, esi
call fcn.10003050
movzx edx, word [ebp - 0x4c]
mov edi, dword [sym.imp.MSVCR100.dll__itoa_s]
push 0xa
push 0xa
lea ecx, [ebp - 0x1c]
push ecx
push edx
call edi
lea eax, [ebp - 0x1c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10007684
sub eax, edx
push eax
lea eax, [ebp - 0x1c]
mov ecx, esi
call fcn.10003050
mov ax, word [ebp - 0x4a]
test ax, ax
je 0x100076cc
push 0xa
push 0xa
lea ecx, [ebp - 0x1c]
movzx edx, ax
push ecx
push edx
call edi
lea eax, [ebp - 0x1c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100076b8
sub eax, edx
push eax
lea eax, [ebp - 0x1c]
mov ecx, esi
call fcn.10003050
mov eax, dword [ebp - 0x11c]
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
push esi
mov esi, dword [ebp - 0x11c]
mov byte [eax], 0
or eax, 0xffffffff
xor ebx, ebx
mov ecx, esi
call fcn.10001300
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10015f75
mov esp, ebp
pop ebp
ret 4