Function at 0x7104c220
Capabilities:
Check os version
Get common file path
Get geographical location
Get hostname
Get memory capacity
Get system information on windows
Make suspicious ntquerysysteminformation call
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ecx, 0x9c
mov edx, 1
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x38c
mov eax, dword [ebp + 8]
call sym._resize_table
test eax, eax
je 0x7104cf50
mov dword [ebp - 0x33c], 0x11c
lea eax, [ebp - 0x33c]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
mov eax, dword [ebp + 8]
sub esp, 4
mov eax, dword [eax + 0x14]
mov dword [eax], str.DeviceHarddiskVolume1
mov dword [ebp - 0x35c], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp], 0x16
mov dword [ebp - 0x360], eax
call eax
mov ebx, eax
test eax, eax
je 0x7104c2b0
mov eax, dword [ebp - 0x330]
mov dword [esp + 8], 0x7106216c
mov dword [esp + 4], 0xb
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym._swprintf
mov eax, dword [ebp - 0x35c]
mov dword [eax + 4], ebx
mov dword [eax + 8], str.Wine_build
mov eax, dword [ebp - 0x360]
mov dword [esp], 0x5e
call eax
test eax, eax
je 0x7104c3b8
mov edx, dword [str.Microsoft_Windows]
mov dword [eax], edx
mov edx, dword [0x7106dc44]
mov dword [eax + 4], edx
mov edx, dword [0x7106dc48]
mov dword [eax + 8], edx
mov edx, dword [0x7106dc4c]
mov dword [eax + 0xc], edx
mov edx, dword [0x7106dc50]
mov dword [eax + 0x10], edx
mov edx, dword [0x7106dc54]
mov dword [eax + 0x14], edx
mov edx, dword [0x7106dc58]
mov dword [eax + 0x18], edx
mov edx, dword [0x7106dc5c]
mov dword [eax + 0x1c], edx
mov edx, dword [0x7106dc60]
mov dword [eax + 0x20], edx
movzx edx, word [0x7106dc64]
mov word [eax + 0x24], dx
mov edx, dword [ebp - 0x338]
cmp edx, 0xa
je 0x7104cbc0
cmp edx, 6
je 0x7104cac0
cmp edx, 5
jne 0x7104c367
mov edx, dword [ebp - 0x334]
cmp edx, 2
je 0x7104cd47
cmp edx, 1
je 0x7104cde2
mov edx, dword [str.2000_Professional]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106db04]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106db08]
mov dword [eax + 0x2c], edx
mov edx, dword [0x7106db0c]
mov dword [eax + 0x30], edx
mov edx, dword [0x7106db10]
mov dword [eax + 0x34], edx
mov edx, dword [0x7106db14]
mov dword [eax + 0x38], edx
mov edx, dword [0x7106db18]
mov dword [eax + 0x3c], edx
mov edx, dword [0x7106db1c]
mov dword [eax + 0x40], edx
mov edx, dword [0x7106db20]
mov dword [eax + 0x44], edx
mov ecx, dword [ebp - 0x35c]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x360]
mov dword [esp], 0x16
call eax
mov ebx, eax
test eax, eax
je 0x7104c3f8
call dword [sym.imp.kernel32.dll_GetACP]
mov dword [esp + 8], 0x7106216c
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xb
mov dword [esp], ebx
call sym._swprintf
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x10], ebx
mov eax, dword [ebp - 0x360]
mov dword [esp], 0xc
call eax
mov ebx, eax
test eax, eax
je 0x7104c43a
mov dword [esp + 0xc], 6
mov dword [esp + 8], eax
mov dword [esp + 4], 5
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
sub esp, 0x10
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x14], ebx
xor eax, eax
cmp word [ebp - 0x328], 0
jne 0x7104cc00
mov ecx, dword [ebp - 0x35c]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x220], 0x10
mov dword [esp], 0x20
call eax
mov ebx, eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x364], eax
test ebx, ebx
je 0x7104c497
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
mov eax, dword [ebp - 0x35c]
mov esi, dword [sym.imp.kernel32.dll_GetTimeZoneInformation]
mov dword [eax + 0x1c], ebx
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
call esi
mov edx, eax
sub esp, 4
xor eax, eax
cmp edx, 0xffffffff
je 0x7104c4d5
mov eax, dword [ebp - 0x220]
cmp edx, 2
je 0x7104cd18
add ax, word [ebp - 0x1cc]
neg eax
mov ecx, dword [ebp - 0x35c]
mov word [ecx + 0x20], ax
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x220], 0x40
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
mov dword [ebp - 0x368], eax
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x7104c522
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x210]
shrd eax, edx, 0xa
shr edx, 0xa
mov ecx, dword [ebp - 0x35c]
mov dword [ecx + 0x22], eax
mov eax, dword [ebp - 0x364]
mov dword [ecx + 0x26], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x220], 0x40
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x7104c56c
mov edx, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x1f0]
shrd eax, edx, 0xa
shr edx, 0xa
mov edi, dword [ebp - 0x35c]
mov dword [edi + 0x2a], eax
mov eax, dword [ebp - 0x360]
mov dword [edi + 0x2e], edx
mov dword [edi + 0x32], str.20140101000000.000000000
mov dword [esp], 0x34
call eax
mov ebx, eax
test eax, eax
je 0x7104c643
mov edi, dword [ebp - 0x364]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x30
mov dword [esp + 4], edi
mov dword [esp], 3
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea eax, [ebp - 0x34c]
sub esp, 0x10
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movsx eax, word [ebp - 0x340]
sub esp, 8
imul eax, eax, 0x3e8
mov dword [esp + 8], str._04u_02u_02u_02u_02u_02u._06u000
mov dword [esp + 4], 0x1a
mov dword [esp], ebx
mov dword [esp + 0x24], eax
movsx eax, word [ebp - 0x342]
mov dword [esp + 0x20], eax
movsx eax, word [ebp - 0x344]
mov dword [esp + 0x1c], eax
movsx eax, word [ebp - 0x346]
mov dword [esp + 0x18], eax
movsx eax, word [ebp - 0x348]
mov dword [esp + 0x14], eax
movsx eax, word [ebp - 0x34a]
mov dword [esp + 0x10], eax
movsx eax, word [ebp - 0x34c]
mov dword [esp + 0xc], eax
call sym._swprintf
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x36], ebx
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
call esi
sub esp, 4
cmp eax, 0xffffffff
je 0x7104cd40
mov esi, dword [ebp - 0x220]
cmp eax, 2
je 0x7104cc28
add esi, dword [ebp - 0x1cc]
mov dword [esp], 0x34
mov eax, dword [ebp - 0x360]
call eax
mov ebx, eax
test eax, eax
je 0x7104c716
lea eax, [ebp - 0x34c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov eax, esi
sub esp, 4
neg eax
mov dword [esp + 0x28], eax
movzx eax, word [ebp - 0x33e]
mov dword [esp + 8], str._04u_02u_02u_02u_02u_02u._06u_03d
imul eax, eax, 0x3e8
mov dword [esp + 4], 0x1a
mov dword [esp], ebx
mov dword [esp + 0x24], eax
movzx eax, word [ebp - 0x340]
mov dword [esp + 0x20], eax
movzx eax, word [ebp - 0x342]
mov dword [esp + 0x1c], eax
movzx eax, word [ebp - 0x344]
mov dword [esp + 0x18], eax
movzx eax, word [ebp - 0x346]
mov dword [esp + 0x14], eax
movzx eax, word [ebp - 0x34a]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x34c]
mov dword [esp + 0xc], eax
call sym._swprintf
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x3a], ebx
mov eax, dword [ebp - 0x360]
mov dword [esp], 0xa
call eax
mov ebx, eax
test eax, eax
je 0x7104c758
mov dword [esp + 0xc], 5
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
sub esp, 0x10
mov eax, dword [ebp - 0x35c]
mov esi, dword [eax + 0xc]
mov dword [eax + 0x3e], ebx
mov dword [eax + 0x42], str.The_Wine_Project
cmp word [esi], 0
je 0x7104cd30
mov edi, esi
lea esi, [esi]
nop
add edi, 2
cmp word [edi], 0
jne 0x7104c780
sub edi, esi
lea eax, [edi + 0x52]
mov dword [esp], eax
mov eax, dword [ebp - 0x360]
call eax
mov ebx, eax
test eax, eax
je 0x7104c7c3
mov dword [esp + 8], edi
add edi, ebx
mov dword [esp + 4], esi
mov esi, str.C:WINDOWSDeviceHarddisk0Partition1
mov dword [esp], eax
call sym._memcpy
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
movzx eax, word [esi]
mov word [edi], ax
mov esi, dword [ebp - 0x35c]
mov edi, dword [ebp - 0x364]
mov dword [esi + 0x46], ebx
mov ebx, 0x12
mov dword [ebp - 0x220], 0
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 6
call dword [sym.imp.kernel32.dll_GetProductInfo]
mov eax, dword [ebp - 0x220]
sub esp, 0x14
mov dword [esi + 0x4a], eax
mov eax, str.RegisteredOrganization
call sym._get_reg_str.constprop.0
mov dword [esi + 0x4e], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov edx, str.64_bit
mov eax, str.32_bit
sub esp, 4
cmp word [ebp - 0x220], 9
cmove eax, edx
mov dword [esi + 0x52], eax
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
mov dword [esi + 0x5a], 0x258dd4
movzx eax, ax
mov word [esi + 0x5e], bx
mov dword [esi + 0x56], eax
mov eax, str.RegisteredOwner
mov dword [esi + 0x60], 0xffffffff
mov dword [esi + 0x64], 1
call sym._get_reg_str.constprop.0
mov dword [esi + 0x68], eax
mov eax, str.ProductId
call sym._get_reg_str.constprop.0
test eax, eax
je 0x7104cd00
mov ecx, dword [ebp - 0x35c]
mov dword [ecx + 0x6c], eax
movzx eax, word [ebp - 0x228]
mov word [ecx + 0x70], ax
movzx eax, word [ebp - 0x226]
mov dword [ecx + 0x74], 0x71062300
mov word [ecx + 0x72], ax
mov eax, dword [ebp - 0x360]
mov dword [ecx + 0x78], 0x110
mov dword [esp], 0x208
call eax
mov ebx, eax
test eax, eax
je 0x7104c905
mov eax, dword [ebp - 0x364]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64DisableWow64FsRedirection]
sub esp, 4
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov eax, dword [ebp - 0x220]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64RevertWow64FsRedirection]
sub esp, 4
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x7c], ebx
mov eax, dword [ebp - 0x360]
mov dword [esp], 6
call eax
mov ebx, eax
test eax, eax
je 0x7104cbb0
mov dword [esp + 8], 3
mov dword [esp + 4], eax
mov dword [esp], str.SystemDrive
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
je 0x7104cbb0
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x80], ebx
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x220], 0x40
mov dword [esp], eax
mov eax, dword [ebp - 0x368]
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x7104c995
mov edx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x218]
shrd eax, edx, 0xa
shr edx, 0xa
mov ecx, dword [ebp - 0x35c]
mov dword [ecx + 0x84], eax
mov dword [ecx + 0x8c], eax
mov eax, dword [ebp - 0x360]
mov dword [ecx + 0x88], edx
mov dword [ecx + 0x90], edx
mov dword [esp], 0x42
call eax
mov ebx, eax
test eax, eax
je 0x7104c9fe
mov eax, dword [ebp - 0x330]
mov dword [esp + 8], str._u._u._u
mov dword [esp + 4], 0x21
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x334]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x338]
mov dword [esp + 0xc], eax
call sym._swprintf
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x94], ebx
mov ebx, dword [ebp - 0x364]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov edx, eax
sub esp, 8
xor eax, eax
test edx, edx
je 0x7104ca35
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov ecx, dword [ebp - 0x35c]
mov dword [ecx + 0x98], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7104cc18
lea eax, [ebp - 0x34c]
mov dword [esp + 4], 0
mov esi, 0xffffffff
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x364]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._eval_cond
test eax, eax
jne 0x7104cb60
mov eax, dword [ebp - 0x21c]
mov esi, 1
mov ebx, 1
or eax, dword [ebp - 0x220]
je 0x7104cb60
test byte [0x71060048], 8
jne 0x7104cb82
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], ebx
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x334]
cmp edx, 3
je 0x7104cc38
cmp edx, 2
je 0x7104cc61
cmp edx, 1
je 0x7104cc81
test edx, edx
jne 0x7104c367
cmp byte [ebp - 0x222], 1
je 0x7104cf01
mov edx, dword [str.Server_2008_Standard]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106db84]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106db88]
mov dword [eax + 0x2c], edx
mov edx, dword [0x7106db8c]
mov dword [eax + 0x30], edx
mov edx, dword [0x7106db90]
mov dword [eax + 0x34], edx
mov edx, dword [0x7106db94]
mov dword [eax + 0x38], edx
mov edx, dword [0x7106db98]
mov dword [eax + 0x3c], edx
mov edx, dword [0x7106db9c]
mov dword [eax + 0x40], edx
mov edx, dword [0x7106dba0]
mov dword [eax + 0x44], edx
mov edx, dword [0x7106dba4]
mov dword [eax + 0x48], edx
movzx edx, word [0x7106dba8]
mov word [eax + 0x4c], dx
jmp 0x7104c3b8
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0
xor ebx, ebx
mov dword [esp], eax
call sym._free_row_values
test byte [0x71060048], 8
je 0x7104cab0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.created__u_rows_n
mov dword [esp + 8], str.fill_operatingsystem
mov dword [esp + 4], 0x71060048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x7104cab0
mov dword [esp], ebx
xor ebx, ebx
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x7104c94b
mov ebx, dword [ebp - 0x334]
test ebx, ebx
jne 0x7104c367
mov edx, dword [str.10_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106dad8]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106dadc]
mov dword [eax + 0x2c], edx
movzx edx, word [0x7106dae0]
mov word [eax + 0x30], dx
jmp 0x7104c3b8
lea eax, [ebp - 0x328]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
jmp 0x7104c453
xor esi, esi
mov ebx, 1
jmp 0x7104caa3
add esi, dword [ebp - 0x178]
jmp 0x7104c678
mov edx, dword [str.8.1_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106dc24]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106dc28]
mov dword [eax + 0x2c], edx
mov edx, dword [0x7106dc2c]
mov dword [eax + 0x30], edx
jmp 0x7104c3b8
mov edx, dword [str.8_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106dc34]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106dc38]
mov dword [eax + 0x2c], edx
jmp 0x7104c3b8
cmp byte [ebp - 0x222], 1
je 0x7104ce2f
mov edx, dword [str.Server_2008_R2_Standard]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106dbc4]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106dbc8]
mov dword [eax + 0x2c], edx
mov edx, dword [0x7106dbcc]
mov dword [eax + 0x30], edx
mov edx, dword [0x7106dbd0]
mov dword [eax + 0x34], edx
mov edx, dword [0x7106dbd4]
mov dword [eax + 0x38], edx
mov edx, dword [0x7106dbd8]
mov dword [eax + 0x3c], edx
mov edx, dword [0x7106dbdc]
mov dword [eax + 0x40], edx
mov edx, dword [0x7106dbe0]
mov dword [eax + 0x44], edx
mov edx, dword [0x7106dbe4]
mov dword [eax + 0x48], edx
mov edx, dword [0x7106dbe8]
mov dword [eax + 0x4c], edx
mov edx, dword [0x7106dbec]
mov dword [eax + 0x50], edx
jmp 0x7104c3b8
mov dword [esp], str.12345_OEM_1234567_12345
call dword [sym.imp.ucrtbase.dll__wcsdup]
jmp 0x7104c88b
add ax, word [ebp - 0x178]
neg eax
jmp 0x7104c4d5
mov eax, 0x52
xor edi, edi
jmp 0x7104c78e
xor ebx, ebx
jmp 0x7104c716
cmp byte [ebp - 0x222], 1
je 0x7104ce7e
mov edx, dword [str.Server_2003_Standard_Edition]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106db44]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106db48]
mov dword [eax + 0x2c], edx
mov edx, dword [0x7106db4c]
mov dword [eax + 0x30], edx
mov edx, dword [0x7106db50]
mov dword [eax + 0x34], edx
mov edx, dword [0x7106db54]
mov dword [eax + 0x38], edx
mov edx, dword [0x7106db58]
mov dword [eax + 0x3c], edx
mov edx, dword [0x7106db5c]
mov dword [eax + 0x40], edx
mov edx, dword [0x7106db60]
mov dword [eax + 0x44], edx
mov edx, dword [0x7106db64]
mov dword [eax + 0x48], edx
mov edx, dword [0x7106db68]
mov dword [eax + 0x4c], edx
mov edx, dword [0x7106db6c]
mov dword [eax + 0x50], edx
mov edx, dword [0x7106db70]
mov dword [eax + 0x54], edx
mov edx, dword [0x7106db74]
mov dword [eax + 0x58], edx
movzx edx, word [0x7106db78]
mov word [eax + 0x5c], dx
jmp 0x7104c3b8
mov edx, dword [str.XP_Professional]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106dcc4]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106dcc8]
mov dword [eax + 0x2c], edx
mov edx, dword [0x7106dccc]
mov dword [eax + 0x30], edx
mov edx, dword [0x7106dcd0]
mov dword [eax + 0x34], edx
mov edx, dword [0x7106dcd4]
mov dword [eax + 0x38], edx
mov edx, dword [0x7106dcd8]
mov dword [eax + 0x3c], edx
mov edx, dword [0x7106dcdc]
mov dword [eax + 0x40], edx
jmp 0x7104c3b8
mov edx, dword [str.7_Professional]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106dc04]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106dc08]
mov dword [eax + 0x2c], edx
mov edx, dword [0x7106dc0c]
mov dword [eax + 0x30], edx
mov edx, dword [0x7106dc10]
mov dword [eax + 0x34], edx
mov edx, dword [0x7106dc14]
mov dword [eax + 0x38], edx
mov edx, dword [0x7106dc18]
mov dword [eax + 0x3c], edx
movzx edx, word [0x7106dc1c]
mov word [eax + 0x40], dx
jmp 0x7104c3b8
mov edx, dword [str.XP_Professional_x64_Edition]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106dc84]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106dc88]
mov dword [eax + 0x2c], edx
mov edx, dword [0x7106dc8c]
mov dword [eax + 0x30], edx
mov edx, dword [0x7106dc90]
mov dword [eax + 0x34], edx
mov edx, dword [0x7106dc94]
mov dword [eax + 0x38], edx
mov edx, dword [0x7106dc98]
mov dword [eax + 0x3c], edx
mov edx, dword [0x7106dc9c]
mov dword [eax + 0x40], edx
mov edx, dword [0x7106dca0]
mov dword [eax + 0x44], edx
mov edx, dword [0x7106dca4]
mov dword [eax + 0x48], edx
mov edx, dword [0x7106dca8]
mov dword [eax + 0x4c], edx
mov edx, dword [0x7106dcac]
mov dword [eax + 0x50], edx
mov edx, dword [0x7106dcb0]
mov dword [eax + 0x54], edx
mov edx, dword [0x7106dcb4]
mov dword [eax + 0x58], edx
jmp 0x7104c3b8
mov edx, dword [str.Vista_Ultimate]
mov dword [eax + 0x24], edx
mov edx, dword [0x7106d9c4]
mov dword [eax + 0x28], edx
mov edx, dword [0x7106d9c8]
mov dword [eax + 0x2c], edx
mov edx, dword [0x7106d9cc]
mov dword [eax + 0x30], edx
mov edx, dword [0x7106d9d0]
mov dword [eax + 0x34], edx
mov edx, dword [0x7106d9d4]
mov dword [eax + 0x38], edx
mov edx, dword [0x7106d9d8]
mov dword [eax + 0x3c], edx
movzx edx, word [0x7106d9dc]
mov word [eax + 0x40], dx
jmp 0x7104c3b8
mov esi, 0xffffffff
jmp 0x7104cab6