Function at 0x1000797f
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x10058684]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 9
pop ecx
mov dword [ebp - 0x124], eax
xor eax, eax
mov esi, 0x9c
push esi
lea edi, [ebp - 0x14c]
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x120]
push eax
call fcn.10024270
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10007d95
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
push str.GetNativeSystemInfo
mov ebx, str.kernel32.dll
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x10007a07
lea ecx, [ebp - 0x14c]
push ecx
call eax
jmp 0x10007a14
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x110], 2
jne 0x10007d82
cmp dword [ebp - 0x11c], 4
jbe 0x10007d82
cmp dword [ebp - 0x11c], 6
jne 0x10007b65
cmp dword [ebp - 0x118], 0
jne 0x10007a64
cmp byte [ebp - 0x86], 1
mov ecx, dword [ebp - 0x124]
jne 0x10007a5a
push 0x1004b728
jmp 0x10007a5f
push 0x1004b738
call fcn.100076f8
cmp dword [ebp - 0x118], 1
jne 0x10007a8d
cmp byte [ebp - 0x86], 1
mov ecx, dword [ebp - 0x124]
jne 0x10007a83
push 0x1004b750
jmp 0x10007a88
push 0x1004b75c
call fcn.100076f8
push str.GetProductInfo
push ebx
call esi
push eax
call edi
lea ecx, [ebp - 0x128]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
call eax
mov eax, dword [ebp - 0x128]
cmp eax, 0xa
ja 0x10007aec
je case.0x10007abb.4
dec eax
cmp eax, 8
ja case.0x10007abb.5
jmp dword [eax*4 + 0x10007da7]
push str.Ultimate
jmp 0x10007b2f
push str.Home_Premium
jmp 0x10007b2f
push str.Home_Basic
jmp 0x10007b2f
push str.Business
jmp 0x10007b2f
push str.Datacenter
jmp 0x10007b2f
push 0x1004b800
jmp 0x10007b2f
cmp eax, 0xf
ja 0x10007b0f
je case.0x10007abb.4
sub eax, 0xb
je 0x10007b08
dec eax
je case.0x10007abb.8
dec eax
je case.0x10007abb.7
dec eax
jne case.0x10007abb.5
push str.Enterprise
jmp 0x10007b2f
push str.Starter
jmp 0x10007b2f
sub eax, 0x11
je 0x10007b2a
dec eax
je 0x10007b23
sub eax, 7
jne case.0x10007abb.5
push 0x1004b7e8
jmp 0x10007b2f
push str.Cluster_Server
jmp 0x10007b2f
push 0x1004b814
mov ecx, dword [ebp - 0x124]
call fcn.100076f8
cmp word [ebp - 0x14c], 9
jne 0x10007b4b
push 0x1004b828
jmp 0x10007b5a
cmp word [ebp - 0x14c], 0
jne 0x10007b65
push 0x1004b834
mov ecx, dword [ebp - 0x124]
call fcn.100076f8
cmp dword [ebp - 0x11c], 5
mov ebx, 0x80
jne 0x10007d17
cmp dword [ebp - 0x118], 2
jne 0x10007c85
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10007b97
push 0x1004b840
jmp 0x10007bcb
mov eax, 0x2000
cmp word [ebp - 0x88], ax
jne 0x10007bac
push 0x1004b85c
jmp 0x10007bcb
cmp byte [ebp - 0x86], 1
jne 0x10007bc6
cmp word [ebp - 0x14c], 9
jne 0x10007bc6
push str.Windows_XP_Pro_x64
jmp 0x10007bcb
push 0x1004b88c
mov edi, dword [ebp - 0x124]
mov ecx, edi
call fcn.100076f8
cmp byte [ebp - 0x86], 1
je 0x10007c76
cmp word [ebp - 0x14c], 6
jne 0x10007c0e
test byte [ebp - 0x88], bl
je 0x10007bfe
push str.Datacenter
jmp 0x10007c6f
test byte [ebp - 0x88], 2
je 0x10007c76
push str.Enterprise
jmp 0x10007c6f
cmp word [ebp - 0x14c], 9
jne 0x10007c40
test byte [ebp - 0x88], bl
je 0x10007c27
push str.Datacenter_x64
jmp 0x10007c6f
test byte [ebp - 0x88], 2
mov ecx, edi
je 0x10007c39
push str.Enterprise_x64
jmp 0x10007c71
push str.Standard_x64
jmp 0x10007c71
mov eax, dword [ebp - 0x88]
test eax, 0x4000
je 0x10007c54
push str.Compute_Cluster
jmp 0x10007c6f
test bl, al
jne 0x10007bf7
test al, 2
jne 0x10007c07
test eax, 0x400
je 0x10007c6a
push 0x1004b8e4
jmp 0x10007c6f
push str.Standard
mov ecx, edi
call fcn.100076f8
cmp dword [ebp - 0x11c], 5
jne 0x10007d1d
jmp 0x10007c8b
mov edi, dword [ebp - 0x124]
cmp dword [ebp - 0x118], 1
mov esi, 0x1004b910
jne 0x10007cc9
push 0x1004b8fc
mov ecx, edi
call fcn.100076f8
test dword [ebp - 0x88], 0x200
mov ecx, edi
je 0x10007cba
push str.Home
jmp 0x10007cbb
push esi
call fcn.100076f8
cmp dword [ebp - 0x11c], 5
jne 0x10007d1d
cmp dword [ebp - 0x118], 0
jne 0x10007d1d
push 0x1004b920
mov ecx, edi
call fcn.100076f8
cmp byte [ebp - 0x86], 1
mov ecx, edi
jne 0x10007cec
push esi
jmp 0x10007d09
test byte [ebp - 0x88], bl
je 0x10007cfb
push 0x1004b930
jmp 0x10007d09
test byte [ebp - 0x88], 2
je 0x10007d10
push 0x1004b944
call fcn.100076f8
jmp 0x10007d1d
push 0x1004b954
jmp 0x10007d09
mov edi, dword [ebp - 0x124]
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10007d26
sub eax, edx
je 0x10007d72
push 0x7f
lea eax, [ebp - 0x83]
push 0
push eax
mov byte [ebp - 0x84], cl
call fcn.10024270
movzx eax, word [ebp - 0x8c]
push eax
push str._SP_d
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.1001f421
add esp, 0x1c
lea eax, [ebp - 0x84]
push eax
mov ecx, edi
call fcn.100076f8
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10007d77
sub eax, edx
jmp 0x10007d94
mov ecx, dword [ebp - 0x124]
push str.Unknown_Version
call fcn.100076f8
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001d73b
leave
ret 4