Function at 0x10002490
Capabilities:
Check os version
Get common file path
Get geographical location
Get hostname
Get memory capacity
Get system information on windows
Make suspicious ntquerysysteminformation call
Query environment variable
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
mov edx, 1
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x37c
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x35c], ecx
mov ecx, 0x9c
mov esi, eax
mov dword [ebp - 0x358], eax
call sym._resize_table
test eax, eax
je 0x1000340b
mov dword [ebp - 0x334], 0x11c
lea eax, [ebp - 0x334]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
mov eax, dword [esi + 0x14]
sub esp, 4
mov dword [eax], str.DeviceHarddiskVolume1
mov esi, dword [ebp - 0x328]
mov dword [ebp - 0x348], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp], 0x16
mov dword [ebp - 0x34c], eax
call eax
mov ebx, eax
test eax, eax
je 0x10002538
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x10023134
mov dword [esp + 4], 0xb
mov dword [esp], eax
call sym._swprintf
mov esi, dword [ebp - 0x348]
mov eax, str.CurrentType
mov dword [esi + 4], ebx
call sym._get_reg_str.constprop.0
mov dword [esi + 8], eax
mov dword [esp], 0x5e
mov eax, dword [ebp - 0x34c]
call eax
test eax, eax
je 0x10002646
mov edx, dword [str.Microsoft_Windows]
mov dword [eax], edx
mov edx, dword [0x10024304]
mov dword [eax + 4], edx
mov edx, dword [0x10024308]
mov dword [eax + 8], edx
mov edx, dword [0x1002430c]
mov dword [eax + 0xc], edx
mov edx, dword [0x10024310]
mov dword [eax + 0x10], edx
mov edx, dword [0x10024314]
mov dword [eax + 0x14], edx
mov edx, dword [0x10024318]
mov dword [eax + 0x18], edx
mov edx, dword [0x1002431c]
mov dword [eax + 0x1c], edx
mov edx, dword [0x10024320]
mov dword [eax + 0x20], edx
movzx edx, word [0x10024324]
mov word [eax + 0x24], dx
mov edx, dword [ebp - 0x330]
cmp edx, 0xa
je 0x10003020
cmp edx, 6
je 0x10002f08
cmp edx, 5
jne 0x100025f5
mov edx, dword [ebp - 0x32c]
cmp edx, 2
je 0x10003202
cmp edx, 1
je 0x1000329d
mov edx, dword [str.2000_Professional]
mov dword [eax + 0x24], edx
mov edx, dword [0x10024124]
mov dword [eax + 0x28], edx
mov edx, dword [0x10024128]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002412c]
mov dword [eax + 0x30], edx
mov edx, dword [0x10024130]
mov dword [eax + 0x34], edx
mov edx, dword [0x10024134]
mov dword [eax + 0x38], edx
mov edx, dword [0x10024138]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002413c]
mov dword [eax + 0x40], edx
mov edx, dword [0x10024140]
mov dword [eax + 0x44], edx
mov ecx, dword [ebp - 0x348]
mov dword [ecx + 0xc], eax
mov dword [esp], 0x16
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x10002686
call dword [sym.imp.kernel32.dll_GetACP]
mov dword [esp + 8], 0x10023134
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xb
mov dword [esp], ebx
call sym._swprintf
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x10], ebx
mov dword [esp], 0xc
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x100026c8
mov dword [esp + 0xc], 6
mov dword [esp + 8], eax
mov dword [esp + 4], 5
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
sub esp, 0x10
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x14], ebx
xor eax, eax
cmp word [ebp - 0x320], 0
jne 0x10003070
mov esi, dword [ebp - 0x348]
mov dword [esi + 0x18], eax
mov dword [ebp - 0x218], 0x10
mov dword [esp], 0x20
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x350], eax
test ebx, ebx
je 0x10002725
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
mov eax, dword [ebp - 0x348]
mov esi, dword [sym.imp.kernel32.dll_GetTimeZoneInformation]
mov dword [eax + 0x1c], ebx
mov eax, dword [ebp - 0x350]
mov dword [esp], eax
call esi
xor edx, edx
sub esp, 4
cmp eax, 0xffffffff
je 0x10002761
mov edx, dword [ebp - 0x218]
cmp eax, 2
je 0x100031a8
add dx, word [ebp - 0x1c4]
neg edx
mov eax, dword [ebp - 0x348]
mov word [eax + 0x20], dx
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x218], 0x40
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
mov dword [ebp - 0x354], eax
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x100027ae
mov edx, dword [ebp - 0x204]
mov eax, dword [ebp - 0x208]
shrd eax, edx, 0xa
shr edx, 0xa
mov ecx, dword [ebp - 0x348]
mov dword [ecx + 0x22], eax
mov eax, dword [ebp - 0x350]
mov dword [ecx + 0x26], edx
mov dword [ebp - 0x218], 0x40
mov dword [esp], eax
mov eax, dword [ebp - 0x354]
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x100027f8
mov edx, dword [ebp - 0x1e4]
mov eax, dword [ebp - 0x1e8]
shrd eax, edx, 0xa
shr edx, 0xa
mov ebx, dword [ebp - 0x348]
mov dword [ebx + 0x2a], eax
mov dword [ebx + 0x2e], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2000000
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x10023152
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x100030a8
mov dword [ebp - 0x344], 0
lea edi, [ebp - 0x344]
mov dword [ebp - 0x340], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileTime]
sub esp, 0x10
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov dword [esp], 0x34
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x100030a8
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x20a]
sub esp, 8
imul eax, eax, 0x3e8
mov dword [esp + 0x24], eax
movzx eax, word [ebp - 0x20c]
mov dword [esp + 0x20], eax
movzx eax, word [ebp - 0x20e]
mov dword [esp + 0x1c], eax
movzx eax, word [ebp - 0x210]
mov dword [esp + 0x18], eax
movzx eax, word [ebp - 0x212]
mov dword [esp + 0x14], eax
movzx eax, word [ebp - 0x216]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x218]
mov dword [esp + 8], str._04u_02u_02u_02u_02u_02u._06u000
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1a
mov dword [esp], ebx
call sym._swprintf
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x32], ebx
mov dword [esp], 0x34
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x10002a24
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x30
mov edi, dword [ebp - 0x350]
mov dword [esp], 3
mov dword [esp + 4], edi
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea eax, [ebp - 0x344]
sub esp, 0x10
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ntdll.dll_RtlTimeToTimeFields]
movsx eax, word [ebp - 0x338]
sub esp, 8
imul eax, eax, 0x3e8
mov dword [esp + 0x24], eax
movsx eax, word [ebp - 0x33a]
mov dword [esp + 0x20], eax
movsx eax, word [ebp - 0x33c]
mov dword [esp + 0x1c], eax
movsx eax, word [ebp - 0x33e]
mov dword [esp + 0x18], eax
movsx eax, word [ebp - 0x340]
mov dword [esp + 0x14], eax
movsx eax, word [ebp - 0x342]
mov dword [esp + 0x10], eax
movsx eax, word [ebp - 0x344]
mov dword [esp + 8], str._04u_02u_02u_02u_02u_02u._06u000
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1a
mov dword [esp], ebx
call sym._swprintf
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x36], ebx
mov eax, dword [ebp - 0x350]
mov dword [esp], eax
call esi
sub esp, 4
cmp eax, 0xffffffff
je 0x100031d0
mov esi, dword [ebp - 0x218]
cmp eax, 2
je 0x10003098
add esi, dword [ebp - 0x1c4]
mov dword [esp], 0x34
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x10002af7
lea eax, [ebp - 0x344]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov eax, esi
sub esp, 4
neg eax
mov dword [esp + 0x28], eax
movzx eax, word [ebp - 0x336]
imul eax, eax, 0x3e8
mov dword [esp + 0x24], eax
movzx eax, word [ebp - 0x338]
mov dword [esp + 0x20], eax
movzx eax, word [ebp - 0x33a]
mov dword [esp + 0x1c], eax
movzx eax, word [ebp - 0x33c]
mov dword [esp + 0x18], eax
movzx eax, word [ebp - 0x33e]
mov dword [esp + 0x14], eax
movzx eax, word [ebp - 0x342]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0x344]
mov dword [esp + 8], str._04u_02u_02u_02u_02u_02u._06u_03d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1a
mov dword [esp], ebx
call sym._swprintf
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x3a], ebx
mov dword [esp], 0xa
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x10002b39
mov dword [esp + 0xc], 5
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
sub esp, 0x10
mov eax, dword [ebp - 0x348]
mov edi, dword [eax + 0xc]
mov dword [eax + 0x3e], ebx
mov dword [eax + 0x42], str.The_Proton_Project
cmp word [edi], 0
je 0x100031c0
mov ecx, edi
lea esi, [esi]
nop
add ecx, 2
cmp word [ecx], 0
jne 0x10002b60
sub ecx, edi
mov esi, ecx
lea eax, [ecx + 0x52]
mov dword [esp], eax
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x10002bba
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._memcpy
mov eax, dword [str.C:WINDOWSDeviceHarddisk0Partition1]
lea ecx, [ebx + esi]
mov esi, str.C:WINDOWSDeviceHarddisk0Partition1
lea edi, [ecx + 4]
mov dword [ecx], eax
mov eax, dword [0x1002410e]
and edi, 0xfffffffc
mov dword [ecx + 0x4e], eax
sub ecx, edi
sub esi, ecx
add ecx, 0x52
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x348]
mov esi, dword [ebp - 0x350]
mov dword [edi + 0x46], ebx
mov dword [ebp - 0x218], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 6
call dword [sym.imp.kernel32.dll_GetProductInfo]
mov eax, dword [ebp - 0x218]
sub esp, 0x14
mov dword [edi + 0x4a], eax
mov eax, str.RegisteredOrganization
call sym._get_reg_str.constprop.0
mov dword [edi + 0x4e], eax
mov dword [esp], esi
mov esi, 0x12
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov edx, str.32_bit
mov eax, str.64_bit
sub esp, 4
cmp word [ebp - 0x218], 9
cmovne eax, edx
mov dword [edi + 0x52], eax
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
mov dword [edi + 0x5a], 0x258dd4
movzx eax, ax
mov word [edi + 0x5e], si
mov dword [edi + 0x56], eax
mov eax, str.RegisteredOwner
mov dword [edi + 0x60], 0xffffffff
mov dword [edi + 0x64], 1
call sym._get_reg_str.constprop.0
mov dword [edi + 0x68], eax
mov eax, str.ProductId
call sym._get_reg_str.constprop.0
test eax, eax
je 0x10003190
mov esi, dword [ebp - 0x348]
mov dword [esi + 0x6c], eax
movzx eax, word [ebp - 0x220]
mov word [esi + 0x70], ax
movzx eax, word [ebp - 0x21e]
mov dword [esi + 0x74], 0x100232d8
mov word [esi + 0x72], ax
mov dword [esi + 0x78], 0x110
mov dword [esp], 0x208
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x10002cfc
mov eax, dword [ebp - 0x350]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64DisableWow64FsRedirection]
sub esp, 4
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov eax, dword [ebp - 0x218]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_Wow64RevertWow64FsRedirection]
sub esp, 4
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x7c], ebx
mov dword [esp], 6
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x10003008
mov dword [esp + 8], 3
mov dword [esp + 4], eax
mov dword [esp], str.SystemDrive
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
sub esp, 0xc
test eax, eax
je 0x10003008
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x80], ebx
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x218], 0x40
mov dword [esp], eax
mov eax, dword [ebp - 0x354]
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x10002d8c
mov edx, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x1f0]
shrd eax, edx, 0xa
shr edx, 0xa
mov esi, dword [ebp - 0x348]
mov dword [esi + 0x84], eax
mov eax, dword [ebp - 0x350]
mov dword [esi + 0x88], edx
mov dword [ebp - 0x218], 0x40
mov dword [esp], eax
mov eax, dword [ebp - 0x354]
call eax
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x100000
test ecx, ecx
je 0x10002ddc
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x210]
shrd eax, edx, 0xa
shr edx, 0xa
mov ecx, dword [ebp - 0x348]
mov dword [ecx + 0x8c], eax
mov dword [ecx + 0x90], edx
mov dword [esp], 0x42
mov eax, dword [ebp - 0x34c]
call eax
mov ebx, eax
test eax, eax
je 0x10002e39
mov eax, dword [ebp - 0x328]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x32c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x330]
mov dword [esp + 8], str._u._u._u
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x21
mov dword [esp], ebx
call sym._swprintf
mov eax, dword [ebp - 0x348]
mov dword [eax + 0x94], ebx
mov dword [esp + 4], 0x104
mov ebx, dword [ebp - 0x350]
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov edx, eax
sub esp, 8
xor eax, eax
test edx, edx
je 0x10002e70
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov edx, dword [ebp - 0x348]
mov ecx, dword [ebp - 0x35c]
mov dword [edx + 0x98], eax
test ecx, ecx
je 0x10003088
lea eax, [ebp - 0x344]
mov esi, 0xffffffff
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x350]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x358]
mov dword [esp], eax
call sym._eval_cond
test eax, eax
jne 0x10002fb0
mov eax, dword [ebp - 0x218]
mov esi, 1
mov ebx, 1
or eax, dword [ebp - 0x214]
je 0x10002fb0
test byte [0x1002179c], 8
jne 0x10002fd5
mov eax, dword [ebp - 0x358]
mov dword [eax + 0xc], ebx
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov edx, dword [ebp - 0x32c]
cmp edx, 3
je 0x100030c0
cmp edx, 2
je 0x100030e9
cmp edx, 1
je 0x10003109
test edx, edx
jne 0x100025f5
cmp byte [ebp - 0x21a], 1
je 0x100033bc
mov edx, dword [str.Server_2008_Standard]
mov dword [eax + 0x24], edx
mov edx, dword [0x10024204]
mov dword [eax + 0x28], edx
mov edx, dword [0x10024208]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002420c]
mov dword [eax + 0x30], edx
mov edx, dword [0x10024210]
mov dword [eax + 0x34], edx
mov edx, dword [0x10024214]
mov dword [eax + 0x38], edx
mov edx, dword [0x10024218]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002421c]
mov dword [eax + 0x40], edx
mov edx, dword [0x10024220]
mov dword [eax + 0x44], edx
mov edx, dword [0x10024224]
mov dword [eax + 0x48], edx
movzx edx, word [0x10024228]
mov word [eax + 0x4c], dx
jmp 0x10002646
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x358]
xor ebx, ebx
mov dword [esp], eax
call sym._free_row_values
test byte [0x1002179c], 8
je 0x10002eee
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.created__u_rows_n
mov dword [esp + 8], str.fill_operatingsystem
mov dword [esp + 4], 0x1002179c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10002eee
mov dword [esp], ebx
xor ebx, ebx
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x10002d42
mov ebx, dword [ebp - 0x32c]
test ebx, ebx
jne 0x100025f5
cmp dword [ebp - 0x328], 0x55ef
jbe 0x100031d7
mov edx, dword [str.11_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x100242e0]
mov dword [eax + 0x28], edx
mov edx, dword [0x100242e4]
mov dword [eax + 0x2c], edx
movzx edx, word [0x100242e8]
mov word [eax + 0x30], dx
jmp 0x10002646
lea eax, [ebp - 0x320]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
jmp 0x100026e1
xor esi, esi
mov ebx, 1
jmp 0x10002ee1
add esi, dword [ebp - 0x170]
jmp 0x10002a59
mov dword [esp], str.20230101000000.000000000
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov ebx, eax
jmp 0x10002957
mov edx, dword [str.8.1_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x100242c0]
mov dword [eax + 0x28], edx
mov edx, dword [0x100242c4]
mov dword [eax + 0x2c], edx
mov edx, dword [0x100242c8]
mov dword [eax + 0x30], edx
jmp 0x10002646
mov edx, dword [str.8_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x100242b4]
mov dword [eax + 0x28], edx
mov edx, dword [0x100242b8]
mov dword [eax + 0x2c], edx
jmp 0x10002646
cmp byte [ebp - 0x21a], 1
je 0x100032ea
mov edx, dword [str.Server_2008_R2_Standard]
mov dword [eax + 0x24], edx
mov edx, dword [0x10024264]
mov dword [eax + 0x28], edx
mov edx, dword [0x10024268]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002426c]
mov dword [eax + 0x30], edx
mov edx, dword [0x10024270]
mov dword [eax + 0x34], edx
mov edx, dword [0x10024274]
mov dword [eax + 0x38], edx
mov edx, dword [0x10024278]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002427c]
mov dword [eax + 0x40], edx
mov edx, dword [0x10024280]
mov dword [eax + 0x44], edx
mov edx, dword [0x10024284]
mov dword [eax + 0x48], edx
mov edx, dword [0x10024288]
mov dword [eax + 0x4c], edx
mov edx, dword [0x1002428c]
mov dword [eax + 0x50], edx
jmp 0x10002646
mov dword [esp], str.12345_OEM_1234567_12345
call dword [sym.imp.ucrtbase.dll__wcsdup]
jmp 0x10002c82
add dx, word [ebp - 0x170]
neg edx
jmp 0x10002761
mov eax, 0x52
xor esi, esi
jmp 0x10002b70
xor ebx, ebx
jmp 0x10002af7
mov edx, dword [str.10_Pro]
mov dword [eax + 0x24], edx
mov edx, dword [0x100242d0]
mov dword [eax + 0x28], edx
mov edx, dword [0x100242d4]
mov dword [eax + 0x2c], edx
movzx edx, word [0x100242d8]
mov word [eax + 0x30], dx
jmp 0x10002646
cmp byte [ebp - 0x21a], 1
je 0x10003339
mov edx, dword [str.Server_2003_Standard_Edition]
mov dword [eax + 0x24], edx
mov edx, dword [0x10024184]
mov dword [eax + 0x28], edx
mov edx, dword [0x10024188]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002418c]
mov dword [eax + 0x30], edx
mov edx, dword [0x10024190]
mov dword [eax + 0x34], edx
mov edx, dword [0x10024194]
mov dword [eax + 0x38], edx
mov edx, dword [0x10024198]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002419c]
mov dword [eax + 0x40], edx
mov edx, dword [0x100241a0]
mov dword [eax + 0x44], edx
mov edx, dword [0x100241a4]
mov dword [eax + 0x48], edx
mov edx, dword [0x100241a8]
mov dword [eax + 0x4c], edx
mov edx, dword [0x100241ac]
mov dword [eax + 0x50], edx
mov edx, dword [0x100241b0]
mov dword [eax + 0x54], edx
mov edx, dword [0x100241b4]
mov dword [eax + 0x58], edx
movzx edx, word [0x100241b8]
mov word [eax + 0x5c], dx
jmp 0x10002646
mov edx, dword [str.XP_Professional]
mov dword [eax + 0x24], edx
mov edx, dword [0x10024164]
mov dword [eax + 0x28], edx
mov edx, dword [0x10024168]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002416c]
mov dword [eax + 0x30], edx
mov edx, dword [0x10024170]
mov dword [eax + 0x34], edx
mov edx, dword [0x10024174]
mov dword [eax + 0x38], edx
mov edx, dword [0x10024178]
mov dword [eax + 0x3c], edx
mov edx, dword [0x1002417c]
mov dword [eax + 0x40], edx
jmp 0x10002646
mov edx, dword [str.7_Professional]
mov dword [eax + 0x24], edx
mov edx, dword [0x10024294]
mov dword [eax + 0x28], edx
mov edx, dword [0x10024298]
mov dword [eax + 0x2c], edx
mov edx, dword [0x1002429c]
mov dword [eax + 0x30], edx
mov edx, dword [0x100242a0]
mov dword [eax + 0x34], edx
mov edx, dword [0x100242a4]
mov dword [eax + 0x38], edx
mov edx, dword [0x100242a8]
mov dword [eax + 0x3c], edx
movzx edx, word [0x100242ac]
mov word [eax + 0x40], dx
jmp 0x10002646
mov edx, dword [str.XP_Professional_x64_Edition]
mov dword [eax + 0x24], edx
mov edx, dword [0x100241c4]
mov dword [eax + 0x28], edx
mov edx, dword [0x100241c8]
mov dword [eax + 0x2c], edx
mov edx, dword [0x100241cc]
mov dword [eax + 0x30], edx
mov edx, dword [0x100241d0]
mov dword [eax + 0x34], edx
mov edx, dword [0x100241d4]
mov dword [eax + 0x38], edx
mov edx, dword [0x100241d8]
mov dword [eax + 0x3c], edx
mov edx, dword [0x100241dc]
mov dword [eax + 0x40], edx
mov edx, dword [0x100241e0]
mov dword [eax + 0x44], edx
mov edx, dword [0x100241e4]
mov dword [eax + 0x48], edx
mov edx, dword [0x100241e8]
mov dword [eax + 0x4c], edx
mov edx, dword [0x100241ec]
mov dword [eax + 0x50], edx
mov edx, dword [0x100241f0]
mov dword [eax + 0x54], edx
mov edx, dword [0x100241f4]
mov dword [eax + 0x58], edx
jmp 0x10002646
mov edx, dword [str.Vista_Ultimate]
mov dword [eax + 0x24], edx
mov edx, dword [0x10024230]
mov dword [eax + 0x28], edx
mov edx, dword [0x10024234]
mov dword [eax + 0x2c], edx
mov edx, dword [0x10024238]
mov dword [eax + 0x30], edx
mov edx, dword [0x1002423c]
mov dword [eax + 0x34], edx
mov edx, dword [0x10024240]
mov dword [eax + 0x38], edx
mov edx, dword [0x10024244]
mov dword [eax + 0x3c], edx
movzx edx, word [0x10024248]
mov word [eax + 0x40], dx
jmp 0x10002646
mov esi, 0xffffffff
jmp 0x10002ef7