Function at 0x10157c00
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1024bd20]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push str.GetNativeSystemInfo
push str.kernel32.dll
movdqu xmmword [ebp - 0x148], xmm0
mov dword [ebp - 0x128], 0
movdqu xmmword [ebp - 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10157c5a
lea ecx, [ebp - 0x148]
push ecx
call eax
jmp 0x10157c67
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.10179250
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
mov dword [ebp - 0x110], 2
push 1
push 8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 8
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x10158103
push 0
push 0
push 5
call fcn.10158d40
add esp, 0xc
test eax, eax
je 0x10158103
cmp dword [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10157ce4
push str.Microsoft
push esi
push edi
call fcn.10159470
push 6
call fcn.10157400
add esp, 4
test eax, eax
je 0x10157dfe
push 0
call fcn.10157470
add esp, 4
test eax, eax
je 0x10157dfe
push 1
call fcn.101574e0
add esp, 4
test eax, eax
je 0x10157d1d
push str.Windows_Vista
jmp 0x10157d22
push str.Windows_Server_2008
push esi
push edi
call fcn.101593d0
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x124]
push ecx
push 0
push 0
push 0
push 6
call eax
mov eax, dword [ebp - 0x124]
dec eax
cmp eax, 0x18
ja case.0x10157d5d.5
jmp dword [eax*4 + 0x10158114]
push str.Ultimate_Edition
jmp 0x10157dd2
push str.Home_Premium_Edition
jmp 0x10157dd2
push str.Home_Basic_Edition
jmp 0x10157dd2
push str.Enterprise_Edition
jmp 0x10157dd2
push str.Business_Edition
jmp 0x10157dd2
push str.Starter_Edition
jmp 0x10157dd2
push str.Cluster_Server_Edition
jmp 0x10157dd2
push str.Datacenter_Edition
jmp 0x10157dd2
push str.Datacenter_Edition__core_installation_
jmp 0x10157dd2
push str.Enterprise_Edition__core_installation_
jmp 0x10157dd2
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x10157dd2
push str.Small_Business_Server
jmp 0x10157dd2
push str.Small_Business_Server_Premium_Edition
jmp 0x10157dd2
push str.Standard_Edition
jmp 0x10157dd2
push str.Standard_Edition__core_installation_
jmp 0x10157dd2
push str.Web_Server_Edition
push esi
push edi
call fcn.101593d0
mov ax, word [ebp - 0x148]
cmp ax, 9
jne 0x10157ded
push str.__64_bit
jmp 0x10157df7
test ax, ax
jne 0x10157dfe
push str.__32_bit
push esi
push edi
call fcn.101593d0
push 6
call fcn.10157400
add esp, 4
test eax, eax
je 0x10157e3b
push 1
call fcn.10157470
add esp, 4
test eax, eax
je 0x10157e3b
push 1
call fcn.101574e0
add esp, 4
test eax, eax
je 0x10157e2f
push str.Windows_7
jmp 0x10157e34
push str.Windows_Server_2008_R2
push esi
push edi
call fcn.101593d0
push 6
call fcn.10157400
add esp, 4
test eax, eax
je 0x10157e63
push 3
call fcn.10157470
add esp, 4
test eax, eax
je 0x10157e63
push str.Windows_8
push esi
push edi
call fcn.101593d0
push 5
call fcn.10157400
add esp, 4
test eax, eax
je 0x10157fd6
push 2
call fcn.10157470
add esp, 4
test eax, eax
je 0x10157fd6
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10157e9a
push str.Windows_Server_2003_R2
jmp 0x10157ed6
push 0x2000
call fcn.10156e40
add esp, 4
test eax, eax
je 0x10157eb2
push str.Windows_Storage_Server_2003
jmp 0x10157ed6
push 1
call fcn.101574e0
add esp, 4
test eax, eax
je 0x10157ed1
cmp word [ebp - 0x148], 9
jne 0x10157ed1
push str.Windows_XP_Professional_x64_Edition
jmp 0x10157ed6
push str.Windows_Server_2003
push esi
push edi
call fcn.101593d0
push 1
call fcn.101574e0
add esp, 4
test eax, eax
jne 0x10157fd6
mov ax, word [ebp - 0x148]
cmp ax, 6
jne 0x10157f33
push 0x80
call fcn.10156e40
add esp, 4
test eax, eax
je 0x10157f17
push str._Datacenter_Edition_for_Itanium_based_Systems
jmp 0x10157fcf
push 2
call fcn.10156e40
add esp, 4
test eax, eax
je 0x10157fd6
push str._Enterprise_Edition_for_Itanium_based_Systems
jmp 0x10157fcf
cmp ax, 9
jne 0x10157f6d
push 0x80
call fcn.10156e40
add esp, 4
test eax, eax
je 0x10157f51
push str._Datacenter_x64_Edition
jmp 0x10157fcf
push 2
call fcn.10156e40
add esp, 4
test eax, eax
je 0x10157f66
push str._Enterprise_x64_Edition
jmp 0x10157fcf
push str._Standard_x64_Edition
jmp 0x10157fcf
push 0x4000
call fcn.10156e40
add esp, 4
test eax, eax
je 0x10157f85
push str._Compute_Cluster_Edition
jmp 0x10157fcf
push 0x80
call fcn.10156e40
add esp, 4
test eax, eax
je 0x10157f9d
push str._Datacenter_Edition
jmp 0x10157fcf
push 2
call fcn.10156e40
add esp, 4
test eax, eax
je 0x10157fb2
push str._Enterprise_Edition
jmp 0x10157fcf
push 0x400
call fcn.10156e40
add esp, 4
test eax, eax
je 0x10157fca
push str._Web_Edition
jmp 0x10157fcf
push str._Standard_Edition
push esi
push edi
call fcn.101593d0
push 5
call fcn.10157400
add esp, 4
test eax, eax
je 0x10158022
push 2
call fcn.10157470
add esp, 4
test eax, eax
je 0x10158022
push str.Windows_XP
push esi
push edi
call fcn.101593d0
push 0x200
call fcn.10156e40
add esp, 4
test eax, eax
je 0x10158016
push str._Home_Edition
jmp 0x1015801b
push str._Professional
push esi
push edi
call fcn.101593d0
push 5
call fcn.10157400
add esp, 4
test eax, eax
je 0x101580ee
push 0
call fcn.10157470
add esp, 4
test eax, eax
je 0x101580ee
push str.Windows_2000
push esi
push edi
call fcn.101593d0
push 1
call fcn.101574e0
add esp, 4
test eax, eax
je 0x10158081
push str._Professional
push esi
push edi
call fcn.101593d0
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017868e
mov esp, ebp
pop ebp
ret
push 0x80
call fcn.10156e40
add esp, 4
test eax, eax
je 0x101580b3
push str._Datacenter_Server
push esi
push edi
call fcn.101593d0
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017868e
mov esp, ebp
pop ebp
ret
push 2
call fcn.10156e40
add esp, 4
test eax, eax
je 0x101580e2
push str._Advanced_Server
push esi
push edi
call fcn.101593d0
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017868e
mov esp, ebp
pop ebp
ret
push str._Server
push esi
push edi
call fcn.101593d0
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017868e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.1017868e
mov esp, ebp
pop ebp
ret