Function at 0x100318f0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, 0x27
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10031d14
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
test eax, eax
je 0x10031955
lea ecx, [esp + 0x18]
push ecx
call eax
jmp 0x10031960
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x4c], 2
jne 0x10031d14
cmp dword [esp + 0x40], 4
jbe 0x10031d14
mov esi, dword [esp + 0x12c]
push str.Microsoft
push 0x100
push esi
call fcn.10031e00
mov eax, dword [esp + 0x40]
mov ebx, 1
cmp eax, 6
jne 0x10031ab6
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x10031ca8
cmp byte [esp + 0xd6], bl
jne 0x100319bb
push str.Windows_Vista
jmp 0x100319c0
push str.Windows_Server_2008
push 0x100
push esi
call fcn.10031e50
push str.GetProductInfo
push str.kernel32.dll
call edi
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
push 6
call eax
mov edx, dword [esp + 0x10]
lea eax, [edx - 1]
cmp eax, 0x18
ja case.0x100319f9.5
jmp dword [eax*4 + 0x10031d24]
push str.Ultimate_Edition
jmp 0x10031a6e
push str.Home_Premium_Edition
jmp 0x10031a6e
push str.Home_Basic_Edition
jmp 0x10031a6e
push str.Business_Edition
jmp 0x10031a6e
push str.Starter_Edition
jmp 0x10031a6e
push str.Cluster_Server_Edition
jmp 0x10031a6e
push str.Datacenter_Edition
jmp 0x10031a6e
push str.Datacenter_Edition__core_installation_
jmp 0x10031a6e
push str.Enterprise_Edition
jmp 0x10031a6e
push str.Enterprise_Edition__core_installation_
jmp 0x10031a6e
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x10031a6e
push str.Small_Business_Server
jmp 0x10031a6e
push str.Small_Business_Server_Premium_Edition
jmp 0x10031a6e
push str.Standard_Edition
jmp 0x10031a6e
push str.Standard_Edition__core_installation_
jmp 0x10031a6e
push str.Web_Server_Edition
push 0x100
push esi
call fcn.10031e50
mov ax, word [esp + 0x18]
cmp ax, 9
jne 0x10031aa1
push str.__64_bit
push 0x100
push esi
call fcn.10031e50
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x118
ret
test ax, ax
jne 0x10031ab6
push str.__32_bit
push 0x100
push esi
call fcn.10031e50
mov eax, dword [esp + 0x40]
mov edi, 5
cmp eax, edi
jne 0x10031ca8
cmp dword [esp + 0x44], 2
jne 0x10031bce
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10031ae5
push str.Windows_Server_2003_R2_
jmp 0x10031b15
cmp word [esp + 0xd4], 0x2000
jne 0x10031af8
push str.Windows_Storage_Server_2003
jmp 0x10031b15
cmp byte [esp + 0xd6], bl
jne 0x10031b10
cmp word [esp + 0x18], 9
jne 0x10031b10
push str.Windows_XP_Professional_x64_Edition
jmp 0x10031b15
push str.Windows_Server_2003_
push 0x100
push esi
call fcn.10031e50
cmp byte [esp + 0xd6], bl
je 0x10031bc4
mov ax, word [esp + 0x18]
cmp ax, 6
jne 0x10031b55
mov al, byte [esp + 0xd4]
test al, 0x80
je 0x10031b4a
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x10031bb9
test al, 2
je 0x10031bc4
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x10031bb9
cmp ax, 9
jne 0x10031b7f
mov al, byte [esp + 0xd4]
test al, 0x80
je 0x10031b6d
push str.Datacenter_x64_Edition
jmp 0x10031bb9
test al, 2
je 0x10031b78
push str.Enterprise_x64_Edition
jmp 0x10031bb9
push str.Standard_x64_Edition
jmp 0x10031bb9
mov eax, dword [esp + 0xd4]
test ah, 0x40
je 0x10031b92
push str.Compute_Cluster_Edition
jmp 0x10031bb9
test al, 0x80
je 0x10031b9d
push str.Datacenter_Edition
jmp 0x10031bb9
test al, 2
je 0x10031ba8
push str.Enterprise_Edition
jmp 0x10031bb9
test ah, 4
je 0x10031bb4
push str.Web_Edition
jmp 0x10031bb9
push str.Standard_Edition
push 0x100
push esi
call fcn.10031e50
cmp dword [esp + 0x40], edi
jne 0x10031ca8
cmp dword [esp + 0x44], ebx
jne 0x10031c11
push str.Windows_XP
push 0x100
push esi
call fcn.10031e50
mov eax, dword [esp + 0xd4]
test ah, 2
je 0x10031bf7
push str.Home_Edition
jmp 0x10031bfc
push str.Professional
push 0x100
push esi
call fcn.10031e50
cmp dword [esp + 0x40], edi
jne 0x10031ca8
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x10031ca8
push str.Windows_2000
push 0x100
push esi
call fcn.10031e50
cmp byte [esp + 0xd6], bl
jne 0x10031c48
push str.Professional
push 0x100
push esi
call fcn.10031e50
jmp 0x10031ca8
mov al, byte [esp + 0xd4]
test al, 0x80
je 0x10031c65
push str.Datacenter_Server
push 0x100
push esi
call fcn.10031e50
jmp 0x10031ca8
test al, 2
je 0x10031c7b
push str.Advanced_Server
push 0x100
push esi
call fcn.10031e50
jmp 0x10031ca8
lea eax, [esp + 0x14]
push eax
push 0x100
push esi
call fcn.10031ee0
test eax, eax
jl 0x10031ca8
mov eax, dword [esp + 0x14]
mov ecx, 0x100
sub ecx, eax
push str.Server
add eax, esi
push ecx
push eax
call fcn.10031e00
lea edi, [esp + 0x50]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10031cd8
push 0x100530a4
push 0x100
push esi
call fcn.10031e50
lea edx, [esp + 0x50]
push edx
push 0x100
push esi
call fcn.10031e50
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0xd8]
push eax
push str.__build__d_
push 0x50
push ecx
call fcn.10031d90
add esp, 0x10
lea edx, [esp + 0xd8]
push edx
push 0x100
push esi
call fcn.10031e50
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x118
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x118
ret