Function at 0x1000529a
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 9
pop eax
mov ecx, eax
lea edi, [ebp - 0x148]
xor eax, eax
push 0x98
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x11c]
push eax
call fcn.1000a7f0
add esp, 0xc
mov dword [ebp - 0x120], 0x9c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x1000531f
push dword [ebp - 0x118]
add ebx, 0x7f
mov esi, 0x1002a940
push dword [ebp - 0x11c]
push str.UNKNOWN
push 0x10021988
push ebx
push esi
call fcn.10001176
add esp, 0x18
jmp 0x10005756
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005345
lea ecx, [ebp - 0x148]
push ecx
call eax
jmp 0x10005352
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x11c]
push 2
pop edi
cmp ecx, 0xa
jne 0x10005394
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x1000551f
cmp byte [ebp - 0x86], bl
mov ecx, 0x1002a940
lea ebx, [edi + 0x7e]
mov edx, ebx
jne 0x1000538a
push str.WIN_10
jmp 0x10005512
push str.SERVER_2016
jmp 0x10005512
cmp ecx, 6
jne 0x10005456
mov eax, dword [ebp - 0x118]
cmp eax, 3
jne 0x100053ce
cmp byte [ebp - 0x86], bl
mov ecx, 0x1002a940
lea ebx, [eax + 0x7d]
mov edx, ebx
jne 0x100053c4
push str.WIN_8.1
jmp 0x10005512
push str.SERVER_2012_R2
jmp 0x10005512
cmp eax, edi
jne 0x100053fa
cmp byte [ebp - 0x86], bl
mov ecx, 0x1002a940
mov ebx, 0x80
mov edx, ebx
jne 0x100053f0
push str.WIN_8
jmp 0x10005512
push str.SERVER_2012
jmp 0x10005512
cmp eax, ebx
jne 0x10005426
cmp byte [ebp - 0x86], bl
mov ecx, 0x1002a940
mov ebx, 0x80
mov edx, ebx
jne 0x1000541c
push str.WIN_7
jmp 0x10005512
push str.SERVER_2008_R2
jmp 0x10005512
test eax, eax
jne 0x1000551f
cmp byte [ebp - 0x86], bl
mov ecx, 0x1002a940
mov ebx, 0x80
mov edx, ebx
je 0x1000544c
push str.SERVER_2008
jmp 0x10005512
push str.VISTA
jmp 0x10005512
cmp ecx, 5
jne 0x10005519
mov eax, dword [ebp - 0x118]
cmp eax, edi
jne 0x100054f2
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
je 0x10005485
push str.SERVER_2003_R2
jmp 0x10005506
mov ecx, dword [ebp - 0x11c]
cmp ecx, 5
jne 0x10005519
mov eax, dword [ebp - 0x118]
cmp eax, edi
jne 0x100054f2
mov eax, 0x2000
cmp word [ebp - 0x88], ax
jne 0x100054b3
push str.HOME_SERVER
jmp 0x10005506
push 0x59
call esi
test eax, eax
jne 0x100054c2
push str.SERVER_2003
jmp 0x10005506
mov ecx, dword [ebp - 0x11c]
cmp ecx, 5
jne 0x10005519
mov eax, dword [ebp - 0x118]
cmp eax, edi
jne 0x100054f2
cmp byte [ebp - 0x86], bl
jne 0x1000551f
push 9
pop edx
cmp word [ebp - 0x148], dx
jne 0x1000551f
push str.XP_x64
jmp 0x10005506
cmp eax, ebx
jne 0x100054fd
push 0x10021978
jmp 0x10005506
test eax, eax
jne 0x1000551f
push str.WIN_2000
mov ebx, 0x80
mov ecx, 0x1002a940
mov edx, ebx
call fcn.100010e3
jmp 0x1000553f
mov eax, dword [ebp - 0x118]
push eax
push ecx
push str.UNKNOWN
push str._s__1d._2d
mov ebx, 0x80
mov eax, 0x1002a940
push ebx
push eax
call fcn.10001176
add esp, 0x18
push ebx
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.1000a7f0
add esp, 0xc
lea esi, [ebp - 0x120]
cmp dword [ebp - 0x11c], 6
lea edi, [ebp - 0x1e4]
push 0x27
pop ecx
rep movsd dword es:[edi], dword [esi]
jne 0x1000566a
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x124]
push ecx
push 0
push 0
push dword [ebp - 0x1dc]
push 6
call eax
mov eax, dword [ebp - 0x124]
cmp eax, 0x19
ja 0x10005657
je 0x1000564d
dec eax
cmp eax, 0x11
ja case.0x100055ba.5
jmp dword [eax*4 + 0x10005786]
push str.ULTIMATE
jmp 0x1000571a
push str.HOME_PREMIUM
jmp 0x1000571a
push str.HOME_BASIC
jmp 0x1000571a
push str.BUSINESS
jmp 0x1000571a
push str.STARTER
jmp 0x1000571a
push str.CLUSTER
jmp 0x1000571a
push str.DATACENTER
jmp 0x1000571a
push str.DATACENTER_CORE
jmp 0x1000571a
push str.ENTERPRISE
jmp 0x1000571a
push str.ENTERPRISE_CORE
jmp 0x1000571a
push str.ENTERPRISE_IA64
jmp 0x1000571a
push str.SMALLBUSINESS
jmp 0x1000571a
push str.STANDARD
jmp 0x1000571a
push str.STANDARD_CORE
jmp 0x1000571a
push str.SMALLBUSINESS_PREMIUM
jmp 0x1000571a
cmp eax, 0x30
jne case.0x100055ba.5
push 0x100217c0
jmp 0x1000571a
cmp dword [ebp - 0x11c], 5
jne 0x10005729
mov eax, dword [ebp - 0x118]
cmp eax, 2
jne 0x100056c5
cmp byte [ebp - 0x86], 1
je case.0x100055ba.5
mov eax, dword [ebp - 0x88]
test eax, 0x4000
je 0x100056a3
push str.COMPUTE_CLUSTER
jmp 0x1000571a
test bl, al
jne case.0x100055ba.8
test al, 2
jne case.0x100055ba.4
test eax, 0x400
je case.0x100055ba.5
push 0x10021888
jmp 0x1000571a
cmp eax, 1
jne 0x100056e3
test dword [ebp - 0x88], 0x200
mov eax, 0x100217c0
mov ecx, str.HOME
cmovne eax, ecx
jmp 0x10005719
test eax, eax
jne 0x10005729
cmp byte [ebp - 0x86], 1
jne 0x100056f7
mov eax, 0x100217c0
jmp 0x10005719
test byte [ebp - 0x88], bl
je 0x10005706
mov eax, str.DATACENTER
jmp 0x10005719
test byte [ebp - 0x88], 2
mov eax, str.ADVANCED
jne 0x10005719
mov eax, str.SERVER
push eax
mov edx, ebx
lea ecx, [ebp - 0x84]
call fcn.100010e3
jmp case.0x100055ba.5
push SysReAllocString
push 0x100215fc
push ecx
mov edx, ebx
lea ecx, [ebp - 0x84]
call fcn.100011d3
lea eax, [ebp - 0x84]
mov esi, 0x1002a940
push eax
mov edx, ebx
mov ecx, esi
call fcn.10001112
cmp dword [0x10029658], 1
mov eax, str._64_
je 0x10005769
mov eax, str._32_
push eax
mov edx, ebx
mov ecx, esi
call fcn.10001112
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.10008f85
leave
ret