Function at 0x100b63b0
Capabilities:
Check os version
Get disk information
Get process image filename

Disassembly:
push 0xffffffffffffffff
push 0x100ea6a5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1011f07c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push edi
mov eax, dword [0x1011f07c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
call dword [0x100f3984]
mov dword [esp + 0x38], ebx
mov ebp, 1
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [esp + 0x40]
and eax, 0xf
cmp al, 6
sbb edx, edx
push ecx
and edx, 0xfffff400
push ebp
add edx, 0x1000
push edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x100b644c
push 0x1000
push 0x1000
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
cmp dword [esp + 0x44], ebx
je 0x100b6545
mov cx, word [0x10109dbc]
mov eax, dword [0x10109db8]
mov word [esp + 0x28], cx
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], eax
call dword [0x100f3984]
mov dword [esp + 0x38], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebx, 0x41
mov edi, edi
push 0x200
push 0x200
lea ecx, [esp + 0x18]
mov word [esp + 0x2c], bx
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
lea edx, [esp + 0x2c]
push edx
call ebp
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
mov edi, eax
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
test edi, edi
je 0x100b64e3
mov eax, dword [esi]
mov edi, dword [esp + 0x10]
mov edx, dword [eax - 0xc]
mov ecx, dword [edi - 0xc]
cmp edx, ecx
jl 0x100b64e3
push ecx
push edi
push eax
call dword [sym.imp.MSVCR90.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x100b64ec
inc ebx
cmp bx, 0x5a
jbe 0x100b6490
jmp 0x100b653b
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Mid]
lea edx, [esp + 0x14]
push edx
mov ecx, eax
lea ebx, [esp + 0x28]
mov byte [esp + 0x3c], 2
call fcn.100b37a0
add esp, 4
push eax
mov ecx, esi
mov byte [esp + 0x3c], 3
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100e78b2
add esp, 0x2c
ret