Function at 0x10015200
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100d9f50]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push 0x9c
push eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0xf0]
push eax
mov esi, ecx
call fcn.1004c8a0
add esp, 0xc
lea ecx, [ebp - 0xf0]
push ecx
mov dword [ebp - 0xf0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10015292
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047d85
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x100c9fa8
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100152bb
lea edx, [ebp - 0x118]
push edx
call eax
jmp 0x100152c8
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0xe0], 2
jne 0x10015640
cmp dword [ebp - 0xec], 4
jbe 0x10015640
push edi
mov edi, str.Microsoft
mov edx, 0x100
mov eax, esi
sub edi, esi
lea ecx, [edx + 0x7ffffefe]
test ecx, ecx
je 0x1001530a
mov cl, byte [edi + eax]
test cl, cl
je 0x1001530a
mov byte [eax], cl
inc eax
dec edx
jne 0x100152f1
jmp 0x1001530e
test edx, edx
jne 0x1001530f
dec eax
mov edi, 6
mov byte [eax], 0
cmp dword [ebp - 0xec], edi
jne 0x10015416
cmp dword [ebp - 0xe8], 0
jne 0x10015599
cmp byte [ebp - 0x56], 1
jne 0x1001533d
push str.Windows_Vista
jmp 0x10015342
push str.Windows_Server_2008
call fcn.10014460
push str.GetProductInfo
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [ebp - 0xf4]
push edx
push 0
push 0
push 0
push edi
call eax
mov eax, dword [ebp - 0xf4]
dec eax
cmp eax, 0x18
ja case.0x1001537a.5
jmp dword [eax*4 + 0x10015660]
push str.Ultimate_Edition
jmp 0x100153ef
push str.Home_Premium_Edition
jmp 0x100153ef
push str.Home_Basic_Edition
jmp 0x100153ef
push str.Enterprise_Edition
jmp 0x100153ef
push str.Business_Edition
jmp 0x100153ef
push str.Starter_Edition
jmp 0x100153ef
push str.Cluster_Server_Edition
jmp 0x100153ef
push str.Datacenter_Edition
jmp 0x100153ef
push str.Datacenter_Edition__core_installation_
jmp 0x100153ef
push str.Enterprise_Edition__core_installation_
jmp 0x100153ef
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x100153ef
push str.Small_Business_Server
jmp 0x100153ef
push str.Small_Business_Server_Premium_Edition
jmp 0x100153ef
push str.Standard_Edition
jmp 0x100153ef
push str.Standard_Edition__core_installation_
jmp 0x100153ef
push str.Web_Server_Edition
call fcn.10014460
mov eax, dword [ebp - 0x118]
cmp ax, 9
jne 0x10015407
push str.__64_bit
jmp 0x10015411
test ax, ax
jne 0x10015416
push str.__32_bit
call fcn.10014460
mov ebx, 5
cmp dword [ebp - 0xec], ebx
jne 0x10015591
cmp dword [ebp - 0xe8], 2
jne 0x10015515
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10015447
push str.Windows_Server_2003_R2_
jmp 0x10015475
mov eax, 0x2000
cmp word [ebp - 0x58], ax
jne 0x10015459
push str.Windows_Storage_Server_2003
jmp 0x10015475
cmp byte [ebp - 0x56], 1
jne 0x10015470
cmp word [ebp - 0x118], 9
jne 0x10015470
push str.Windows_XP_Professional_x64_Edition
jmp 0x10015475
push str.Windows_Server_2003_
call fcn.10014460
cmp byte [ebp - 0x56], 1
je 0x1001550d
mov eax, dword [ebp - 0x118]
cmp ax, di
jne 0x100154a8
mov al, byte [ebp - 0x58]
test al, al
jns 0x1001549d
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x10015508
test al, 2
je 0x1001550d
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x10015508
cmp ax, 9
jne 0x100154ce
mov al, byte [ebp - 0x58]
test al, al
jns 0x100154bc
push str.Datacenter_x64_Edition
jmp 0x10015508
test al, 2
je 0x100154c7
push str.Enterprise_x64_Edition
jmp 0x10015508
push str.Standard_x64_Edition
jmp 0x10015508
mov eax, dword [ebp - 0x58]
test eax, 0x4000
je 0x100154df
push str.Compute_Cluster_Edition
jmp 0x10015508
test al, al
jns 0x100154ea
push str.Datacenter_Edition
jmp 0x10015508
test al, 2
je 0x100154f5
push str.Enterprise_Edition
jmp 0x10015508
test eax, 0x400
je 0x10015503
push str.Web_Edition
jmp 0x10015508
push str.Standard_Edition
call fcn.10014460
cmp dword [ebp - 0xec], ebx
jne 0x10015591
cmp dword [ebp - 0xe8], 1
jne 0x1001554a
push str.Windows_XP
call fcn.10014460
test dword [ebp - 0x58], 0x200
je 0x10015538
push str.Home_Edition
jmp 0x1001553d
push str.Professional
call fcn.10014460
cmp dword [ebp - 0xec], ebx
jne 0x10015591
cmp dword [ebp - 0xe8], 0
jne 0x100155dc
push str.Windows_2000
call fcn.10014460
cmp byte [ebp - 0x56], 1
jne 0x1001556e
push str.Professional
jmp 0x1001558c
mov al, byte [ebp - 0x58]
test al, al
jns 0x1001557c
push str.Datacenter_Server
jmp 0x1001558c
test al, 2
je 0x10015587
push str.Advanced_Server
jmp 0x1001558c
push str.Server
call fcn.10014460
cmp dword [ebp - 0xec], edi
jne 0x100155dc
cmp dword [ebp - 0xe8], 1
jne 0x100155dc
push str.Windows_7
call fcn.10014460
cmp byte [ebp - 0x56], 1
jne 0x100155b9
push str.Professional
jmp 0x100155d7
mov al, byte [ebp - 0x58]
test al, al
jns 0x100155c7
push str.Datacenter_Server
jmp 0x100155d7
test al, 2
je 0x100155d2
push str.Advanced_Server
jmp 0x100155d7
push str.Server
call fcn.10014460
lea eax, [ebp - 0xdc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100155e5
sub eax, edx
je 0x10015606
push 0x100c9f84
call fcn.10014460
lea ecx, [ebp - 0xdc]
push ecx
call fcn.10014460
mov edx, dword [ebp - 0xe4]
push edx
push str.__build__d_
mov ecx, 0x50
lea edi, [ebp - 0x54]
call fcn.100144b0
add esp, 8
mov eax, edi
push eax
call fcn.10014460
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10047d85
mov esp, ebp
pop ebp
ret
push str.This_sample_does_not_support_this_version_of_Windows._n
call fcn.100498a5
mov ecx, dword [ebp - 4]
add esp, 4
pop ebx
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10047d85
mov esp, ebp
pop ebp
ret