Function at 0x10098390
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x1fc
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x1f8], eax
xor eax, eax
push esi
push edi
xor edi, edi
push 0x9c
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x38]
mov esi, ecx
push edi
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov byte [esi], 0
call fcn.1012e060
push 0x9c
lea ecx, [esp + 0x174]
push edi
push ecx
call fcn.1012e060
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0x18
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], 0x9c
call edi
test eax, eax
jne 0x10098449
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], 0x94
call edi
test eax, eax
jne 0x10098449
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.10127db1
add esp, 0x1fc
ret
mov eax, dword [esp + 0x38]
cmp eax, 6
ja 0x1009845b
jne 0x1009846d
cmp dword [esp + 0x3c], 2
jb 0x1009846d
lea edx, [esp + 0x164]
xor ecx, ecx
call fcn.1005a1e0
mov dword [esp + 0xc], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x10098497
lea ecx, [esp + 0x18]
push ecx
call eax
jmp 0x100984a2
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x4c], 2
jne 0x1009885f
cmp dword [esp + 0x40], 4
jbe 0x1009885f
mov edi, 0x1014d5e3
mov edx, 0x800
mov eax, esi
sub edi, esi
lea ecx, [edx + 0x7ffff7fe]
test ecx, ecx
je 0x100984e1
mov cl, byte [edi + eax]
test cl, cl
je 0x100984e1
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x100984c6
jmp 0x100984e5
test edx, edx
jne 0x100984e6
dec eax
cmp dword [esp + 0x40], 6
mov byte [eax], 0
jne 0x10098696
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x10098514
cmp byte [esp + 0xd6], 1
jne 0x1009850d
push str.Windows_Vista
jmp 0x1009852e
push str.Windows_2008
jmp 0x1009852e
cmp eax, 1
jne 0x10098533
cmp byte [esp + 0xd6], al
jne 0x10098529
push str.Windows_7
jmp 0x1009852e
push str.Windows_2008_R2
call fcn.10097740
cmp byte [esp + 0xd6], 1
jne 0x10098581
cmp dword [esp + 0x44], 2
jb 0x10098641
call fcn.1006ba70
test eax, eax
je 0x1009855b
push str.Windows_11
jmp 0x1009863c
call fcn.1006ba40
test eax, eax
je 0x1009856e
push str.Windows_10
jmp 0x1009863c
call fcn.1006b820
test eax, eax
je 0x100985cc
push str.Windows_8.1
jmp 0x1009863c
push 0x90
lea edx, [esp + 0xe0]
push 0
push edx
mov dword [esp + 0xe4], 0
call fcn.1012e060
add esp, 0xc
xor edx, edx
lea ecx, [esp + 0xd8]
call fcn.1005a1e0
cmp eax, 1
jne 0x10098624
mov eax, dword [esp + 0xe0]
cmp eax, 2
jne 0x100985da
cmp byte [esp + 0xd6], 1
jne 0x100985d3
push str.Windows_8
jmp 0x1009863c
push str.Windows_2012
jmp 0x1009863c
cmp eax, 3
jne 0x100985f0
cmp byte [esp + 0xd6], 1
jne 0x10098637
push str.Windows_8.1
jmp 0x1009863c
cmp dword [esp + 0xdc], 0xa
jb 0x10098641
mov eax, dword [esp + 0xe4]
cmp eax, 0x44c0
jae 0x1009860f
push str.Windows_2016
jmp 0x1009863c
cmp eax, 0x4c30
jae 0x1009861d
push str.Windows_2019
jmp 0x1009863c
push str.Windows_2022
jmp 0x1009863c
cmp dword [esp + 0x44], 2
je 0x100985c2
cmp dword [esp + 0xe0], 3
jne 0x10098641
jmp 0x100985df
push str.Windows_2012_R2
call fcn.10097740
push str.GetProductInfo
push str.kernel32.dll
call ebp
push eax
call ebx
test eax, eax
je 0x10098696
cmp dword [esp + 0x14], 0
je 0x10098676
mov edx, dword [esp + 0x174]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x174]
push 0
push 0
push edx
push ecx
jmp 0x10098689
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x44]
push 0
push 0
push ecx
push edx
call eax
mov edi, dword [esp + 0x10]
mov ecx, esi
call fcn.10097c80
mov edi, 5
mov ebx, 9
cmp dword [esp + 0x40], edi
jne 0x10098836
cmp dword [esp + 0x44], 2
jne 0x100987b8
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x100986c8
push str.Windows_Server_2003_R2
jmp 0x10098708
mov eax, dword [esp + 0xd4]
test eax, 0x2000
je 0x100986dd
push str.Windows_Storage_Server_2003
jmp 0x10098708
test eax, 0x8000
je 0x100986eb
push str.Windows_Home_Server
jmp 0x10098708
cmp byte [esp + 0xd6], 1
jne 0x10098703
cmp word [esp + 0x18], bx
jne 0x10098703
push str.Windows_XP_Professional_x64_Edition
jmp 0x10098708
push str.Windows_Server_2003
call fcn.10097740
cmp byte [esp + 0xd6], 1
je 0x100987ae
mov eax, dword [esp + 0x18]
cmp ax, 6
jne 0x10098742
mov al, byte [esp + 0xd4]
test al, al
jns 0x10098737
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x100987a9
test al, 2
je 0x100987ae
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x100987a9
cmp ax, bx
jne 0x1009876b
mov al, byte [esp + 0xd4]
test al, al
jns 0x10098759
push str.Datacenter_x64_Edition
jmp 0x100987a9
test al, 2
je 0x10098764
push str.Enterprise_x64_Edition
jmp 0x100987a9
push str.Standard_x64_Edition
jmp 0x100987a9
mov eax, dword [esp + 0xd4]
test eax, 0x4000
je 0x10098780
push str.Compute_Cluster_Edition
jmp 0x100987a9
test al, al
jns 0x1009878b
push str.Datacenter_Edition
jmp 0x100987a9
test al, 2
je 0x10098796
push str.Enterprise_Edition
jmp 0x100987a9
test eax, 0x400
je 0x100987a4
push str.Web_Edition
jmp 0x100987a9
push str.Standard_Edition
call fcn.10097740
cmp dword [esp + 0x40], edi
jne 0x10098836
cmp dword [esp + 0x44], 1
jne 0x100987ed
push str.Windows_XP
call fcn.10097740
test dword [esp + 0xd4], 0x200
je 0x100987dd
push str.Home_Edition
jmp 0x100987e2
push str.Professional
call fcn.10097740
cmp dword [esp + 0x40], edi
jne 0x10098836
cmp dword [esp + 0x44], 0
jne 0x10098836
push str.Windows_2000
call fcn.10097740
cmp byte [esp + 0xd6], 1
jne 0x1009880f
push str.Professional
jmp 0x10098831
mov al, byte [esp + 0xd4]
test al, al
jns 0x10098821
push str.Datacenter_Server
jmp 0x10098831
test al, 2
je 0x1009882c
push str.Advanced_Server
jmp 0x10098831
push str.Server
call fcn.10097740
cmp word [esp + 0x18], bx
jne 0x1009884e
push str._64_bit
call fcn.10097740
mov eax, 1
jmp 0x10098861
push str._32_bit
call fcn.10097740
mov eax, 1
jmp 0x10098861
xor eax, eax
mov ecx, dword [esp + 0x208]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.10127db1
add esp, 0x1fc
ret