Function at 0x100398f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0x1009c00c]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push esi
push edi
push 0x98
xor esi, esi
lea eax, [esp + 0x20]
push esi
push eax
call fcn.100448d0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0x24]
add esp, 0xc
mov dword [esp + 0x18], 0x9c
push eax
call edi
test eax, eax
jne 0x10039965
push 0x98
push eax
lea eax, [esp + 0x24]
push eax
call fcn.100448d0
add esp, 0xc
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call edi
test eax, eax
je 0x10039c39
cmp dword [esp + 0x28], 2
jne 0x10039b45
cmp dword [esp + 0x1c], 6
ja 0x10039988
jne 0x10039a7d
cmp dword [esp + 0x20], 2
jb 0x10039a88
push 1
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
cmp edi, 9
ja 0x10039a7d
mov ebx, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push 0x94
lea eax, [esp + 0xc4]
push 0
push eax
call fcn.100448d0
add esp, 0xc
mov dword [esp + 0xb8], 0x9c
lea eax, [esp + 0xb8]
mov dword [esp + 0xbc], edi
push dword [esp + 0x10]
push dword [esp + 0x18]
push 2
push eax
call ebx
test eax, eax
jne 0x100399fd
inc edi
cmp edi, 9
jbe 0x100399b1
jmp 0x10039a7d
cmp dword [esp + 0x1c], edi
jae 0x10039a0b
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], esi
push 1
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
cmp edi, 9
ja 0x10039a7d
nop word [eax + eax]
push 0x9c
lea eax, [esp + 0xbc]
push 0
push eax
call fcn.100448d0
add esp, 0xc
mov dword [esp + 0xb8], 0x9c
lea eax, [esp + 0xb8]
mov dword [esp + 0xc0], edi
push dword [esp + 0x14]
push dword [esp + 0x14]
push 1
push eax
call ebx
test eax, eax
jne 0x10039a79
inc edi
cmp edi, 9
jbe 0x10039a30
jmp 0x10039a7d
mov dword [esp + 0x20], edi
cmp dword [esp + 0x1c], 0xf
ja 0x10039b45
mov eax, dword [esp + 0x20]
cmp eax, 0xf
ja 0x10039b45
mov edx, dword [esp + 0x1c]
mov ecx, 1
cmp cl, byte [esp + 0xb2]
sbb ecx, ecx
shl edx, 4
or edx, eax
inc ecx
mov dword [0x1009dd10], edx
lea eax, [edx - 0x50]
cmp eax, 0x14
ja case.0x10039ac2.83
movzx eax, byte [eax + 0x10039c74]
jmp dword [eax*4 + 0x10039c50]
mov esi, str.2000
jmp 0x10039b45
mov esi, 0x100878f8
jmp 0x10039b45
mov esi, str.2003
jmp 0x10039b45
test ecx, ecx
mov esi, str.Vista
mov eax, str.2008
cmove esi, eax
jmp 0x10039b45
test ecx, ecx
mov esi, 0x10087914
mov eax, str.2008_R2
cmove esi, eax
jmp 0x10039b45
test ecx, ecx
mov esi, 0x10087920
mov eax, str.2012
cmove esi, eax
jmp 0x10039b45
test ecx, ecx
mov esi, 0x1008792c
mov eax, str.2012_R2
cmove esi, eax
jmp 0x10039b45
test ecx, ecx
mov esi, 0x10087938
mov eax, str.2015
cmove esi, eax
jmp 0x10039b45
cmp edx, 0x50
jge 0x10039b40
mov dword [0x1009dd10], esi
jmp 0x10039b45
mov esi, str.11_or_later
xor ecx, ecx
mov dword [esp + 0x10], ecx
cmp dword [0x100aa6dc], ecx
je 0x10039b69
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x100aa6dc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
mov eax, str.64_bit
mov edx, str.32_bit
cmove eax, edx
push eax
test esi, esi
jne 0x10039b9f
push dword [esp + 0x24]
cmp dword [esp + 0x30], 2
mov eax, 0x10087960
push dword [esp + 0x24]
mov ecx, 0x10087964
cmovne eax, ecx
push eax
push str.Windows__s__u._u__s
jmp 0x10039bbf
mov cx, word [esp + 0xb2]
test cx, cx
je 0x10039be5
movzx eax, cx
push eax
movzx eax, word [esp + 0xb4]
push eax
push esi
push str.Windows__s_SP_u._u__s
push str.get_windows_version
push 4
push 0
call fcn.10036f50
add esp, 0x20
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.100417b6
mov esp, ebp
pop ebp
ret
mov cx, word [esp + 0xb0]
test cx, cx
je 0x10039c22
movzx eax, cx
push eax
push esi
push str.Windows__s_SP_u__s
push str.get_windows_version
push 4
push 0
call fcn.10036f50
add esp, 0x1c
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.100417b6
mov esp, ebp
pop ebp
ret
push esi
push str.Windows__s__s
push str.get_windows_version
push 4
push 0
call fcn.10036f50
add esp, 0x18
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100417b6
mov esp, ebp
pop ebp
ret