Function at 0x100b6a50
Capabilities:
Check os version
Get disk information
Get process image filename

Disassembly:
push 0xffffffffffffffff
push 0x100eab95
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1012007c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push edi
mov eax, dword [0x1012007c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
call dword [0x100f4984]
mov dword [esp + 0x38], ebx
mov ebp, 1
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [esp + 0x40]
and eax, 0xf
cmp al, 6
sbb edx, edx
push ecx
and edx, 0xfffff400
push ebp
add edx, 0x1000
push edx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x100b6aec
push 0x1000
push 0x1000
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
cmp dword [esp + 0x44], ebx
je 0x100b6be5
mov cx, word [0x1010adbc]
mov eax, dword [0x1010adb8]
mov word [esp + 0x28], cx
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], eax
call dword [0x100f4984]
mov dword [esp + 0x38], ebp
mov ebp, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ebx, 0x41
mov edi, edi
push 0x200
push 0x200
lea ecx, [esp + 0x18]
mov word [esp + 0x2c], bx
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
lea edx, [esp + 0x2c]
push edx
call ebp
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
mov edi, eax
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
test edi, edi
je 0x100b6b83
mov eax, dword [esi]
mov edi, dword [esp + 0x10]
mov edx, dword [eax - 0xc]
mov ecx, dword [edi - 0xc]
cmp edx, ecx
jl 0x100b6b83
push ecx
push edi
push eax
call dword [sym.imp.MSVCR90.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x100b6b8c
inc ebx
cmp bx, 0x5a
jbe 0x100b6b30
jmp 0x100b6bdb
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Mid]
lea edx, [esp + 0x14]
push edx
mov ecx, eax
lea ebx, [esp + 0x28]
mov byte [esp + 0x3c], 2
call fcn.100b3e50
add esp, 4
push eax
mov ecx, esi
mov byte [esp + 0x3c], 3
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100e7da2
add esp, 0x2c
ret