Function at 0x2102ddd8
Capabilities:
Check os version
Get common file path
Get geographical location
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2106416c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c0
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x90], 0
call fcn.2102ec28
mov dword [ebp - 0x34], eax
push 0x21075af0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x13c], eax
push 0x21075afc
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x138], eax
lea edx, [ebp - 0x168]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x138], 0
je 0x2102de90
lea eax, [ebp - 0x30]
push eax
call dword [ebp - 0x138]
cmp dword [ebp + 0xc], 0
je 0x2102df43
cmp dword [ebp - 0x138], 0
je 0x2102df01
mov ecx, dword [ebp - 0x168]
and ecx, 0xffff
mov edx, dword [ebp - 0x30]
and edx, 0xffff
cmp ecx, edx
je 0x2102df01
mov eax, dword [ebp - 0x30]
and eax, 0xffff
mov ecx, dword [eax*4 + str._Z_a__Z_a_HZ_a_PZ_a_TZ_a_XZ_a_Z_a_dZ_a_lZ_a_tZ_a_Z_a_]
push ecx
mov edx, dword [ebp - 0x168]
and edx, 0xffff
mov eax, dword [edx*4 + str._Z_a__Z_a_HZ_a_PZ_a_TZ_a_XZ_a_Z_a_dZ_a_lZ_a_tZ_a_Z_a_]
push eax
push str.Architecture:__s__reported____s__actual__n
mov ecx, dword [ebp + 8]
push ecx
call fcn.21049450
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
push edx
call fcn.21048f5f
add esp, 0x10
jmp 0x2102df43
mov eax, dword [ebp - 0x168]
and eax, 0xffff
test eax, eax
je 0x2102df43
mov ecx, dword [ebp - 0x168]
and ecx, 0xffff
mov edx, dword [ecx*4 + str._Z_a__Z_a_HZ_a_PZ_a_TZ_a_XZ_a_Z_a_dZ_a_lZ_a_tZ_a_Z_a_]
push edx
push str.Architecture:__s_n
mov eax, dword [ebp + 8]
push eax
call fcn.21049450
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.21048f5f
add esp, 0xc
push 0x9c
push 0
lea edx, [ebp - 0x134]
push edx
call fcn.210493f0
add esp, 0xc
mov dword [ebp - 0x134], 0x9c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jne 0x2102dfb7
push 0x9c
push 0
lea ecx, [ebp - 0x134]
push ecx
call fcn.210493f0
add esp, 0xc
mov dword [ebp - 0x134], 0x94
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x2102dfb7
xor eax, eax
jmp 0x2102ec18
cmp dword [ebp - 0x144], 0
je 0x2102dfea
mov al, byte [ebp - 0x9a]
mov byte [ebp - 0x2b8], al
cmp byte [ebp - 0x2b8], 2
jb 0x2102dfea
cmp byte [ebp - 0x2b8], 3
jbe 0x2102dfe0
jmp 0x2102dfea
mov dword [ebp - 0x90], 1
push 0x104
lea ecx, [ebp - 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x270]
push edx
push str.user32.dll
lea eax, [ebp - 0x270]
push eax
call fcn.21010b3d
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x16c]
push edx
push 0
push 0
lea eax, [ebp - 0x270]
push eax
call fcn.21001046
mov ecx, dword [ebp - 0x16c]
and ecx, 0xffff
test ecx, ecx
jne 0x2102e052
mov edx, dword [ebp - 0x3c]
and edx, 0xffff
test edx, edx
je 0x2102e096
mov eax, dword [ebp - 0x16c]
and eax, 0xffff
cmp dword [ebp - 0x130], eax
jne 0x2102e076
mov ecx, dword [ebp - 0x3c]
and ecx, 0xffff
cmp dword [ebp - 0x12c], ecx
je 0x2102e096
mov edx, dword [ebp - 0x16c]
and edx, 0xffff
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x3c]
and eax, 0xffff
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x2bc], ecx
cmp dword [ebp - 0x2bc], 0
je 0x2102e1aa
cmp dword [ebp - 0x2bc], 1
je 0x2102e0ca
cmp dword [ebp - 0x2bc], 2
je 0x2102e1c0
jmp 0x2102e82d
mov edx, dword [ebp - 0x130]
shl edx, 8
or edx, dword [ebp - 0x12c]
mov dword [ebp - 0x2c0], edx
cmp dword [ebp - 0x2c0], 0x400
je 0x2102e105
cmp dword [ebp - 0x2c0], 0x40a
je 0x2102e135
cmp dword [ebp - 0x2c0], 0x45a
je 0x2102e165
jmp 0x2102e178
push str.Windows_95
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
movsx ecx, byte [ebp - 0x11f]
cmp ecx, 0x42
jne 0x2102e133
push str._OSR2
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e1a5
push str.Windows_98
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
movsx ecx, byte [ebp - 0x11f]
cmp ecx, 0x41
jne 0x2102e163
push 0x21075b7c
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e1a5
push str.Windows_Me
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102e1a5
mov ecx, dword [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 0x130]
push edx
push str.Windows_9x_Me_v_d._02d
mov eax, dword [ebp + 8]
push eax
call fcn.21049450
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.21048f5f
add esp, 0x10
jmp 0x2102e82d
push str.Win32s
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e82d
mov eax, dword [ebp - 0x130]
shl eax, 8
or eax, dword [ebp - 0x12c]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x502
ja 0x2102e20a
cmp dword [ebp - 0x2c4], 0x502
je 0x2102e255
cmp dword [ebp - 0x2c4], 0x500
je 0x2102e21f
cmp dword [ebp - 0x2c4], 0x501
je 0x2102e23f
jmp 0x2102e2f3
cmp dword [ebp - 0x2c4], 0x600
je 0x2102e2b0
jmp 0x2102e2f3
push str.Windows_2000
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
mov dword [ebp - 0x94], 1
jmp 0x2102e33a
push 0x21075bbc
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e33a
cmp dword [ebp - 0x90], 0
je 0x2102e29a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2102e27d
push str.Windows_Server_2003_R2
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102e28e
push str.Windows_Server_2003
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
mov dword [ebp - 0x274], 1
jmp 0x2102e2ab
push str.Windows_XP
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e33a
cmp dword [ebp - 0x90], 0
je 0x2102e2d6
push str.Windows_Server_2008
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
mov dword [ebp - 0x140], 1
jmp 0x2102e2f1
push str.Windows_Vista
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
mov dword [ebp - 0x98], 1
jmp 0x2102e33a
cmp dword [ebp - 0x90], 0
je 0x2102e30f
push str.Windows_Server
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e320
push str.Windows_NT
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
cmp dword [ebp - 0x130], 4
jne 0x2102e333
mov dword [ebp - 0x27c], 1
mov dword [ebp - 0x38], 1
cmp dword [ebp - 0x144], 0
je 0x2102e5dc
cmp dword [ebp - 0x90], 0
je 0x2102e4f6
cmp dword [ebp - 0x27c], 0
je 0x2102e399
mov ecx, dword [ebp - 0x9c]
and ecx, 0xffff
and ecx, 2
test ecx, ecx
je 0x2102e383
push str._Server_Enterprise_Edition
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e394
push 0x21075c5c
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102e4f1
cmp dword [ebp - 0x94], 0
je 0x2102e406
mov ecx, dword [ebp - 0x9c]
and ecx, 0xffff
and ecx, 0x80
test ecx, ecx
je 0x2102e3cb
push str._Datacenter_Server
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e401
mov eax, dword [ebp - 0x9c]
and eax, 0xffff
and eax, 2
test eax, eax
je 0x2102e3f0
push str._Advanced_Server
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
jmp 0x2102e401
push 0x21075c8c
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e4f1
cmp dword [ebp - 0x274], 0
je 0x2102e49c
mov eax, dword [ebp - 0x9c]
and eax, 0xffff
and eax, 0x400
test eax, eax
je 0x2102e43a
push str._Web_Edition
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
jmp 0x2102e49a
mov edx, dword [ebp - 0x9c]
and edx, 0xffff
and edx, 0x80
test edx, edx
je 0x2102e463
push str._Datacenter_Edition
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102e49a
mov ecx, dword [ebp - 0x9c]
and ecx, 0xffff
and ecx, 2
test ecx, ecx
je 0x2102e489
push str._Enterprise_Edition
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e49a
push str._Standard_Edition
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102e4f1
cmp dword [ebp - 0x140], 0
je 0x2102e4f1
mov ecx, dword [ebp - 0x9c]
and ecx, 0xffff
and ecx, 0x80
test ecx, ecx
je 0x2102e4ce
push str._Datacenter
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e4f1
mov eax, dword [ebp - 0x9c]
and eax, 0xffff
and eax, 2
test eax, eax
je 0x2102e4f1
push str._Enterprise
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
jmp 0x2102e5d7
mov edx, dword [ebp - 0x9c]
and edx, 0xffff
and edx, 0x200
test edx, edx
je 0x2102e558
push str._Home
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
cmp dword [ebp - 0x98], 0
je 0x2102e556
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2102e545
push str._Premium
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
jmp 0x2102e556
push str._Basic
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e5d7
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 4
je 0x2102e578
cmp dword [ebp - 0x2c8], 5
je 0x2102e58b
jmp 0x2102e59e
push 0x21075d14
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
jmp 0x2102e5d7
push str._Professional
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e5d7
cmp dword [ebp - 0x98], 0
je 0x2102e5d7
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2102e5c6
push str._Ultimate
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102e5d7
push str._Business
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
jmp 0x2102e6a4
mov dword [ebp - 0x288], 0
mov byte [ebp - 0x270], 0
mov dword [ebp - 0x284], 0x104
lea edx, [ebp - 0x288]
push edx
push 0x21075d4c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2102e6a4
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x280]
push edx
push 0
push 0x21075d7c
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2102e697
push str.WinNt
lea ecx, [ebp - 0x270]
push ecx
call fcn.21049780
add esp, 8
test eax, eax
jne 0x2102e66e
push str._Workstation
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102e697
push 0x21075da0
lea eax, [ebp - 0x270]
push eax
call fcn.21049780
add esp, 8
test eax, eax
jne 0x2102e697
push str._Server
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
mov edx, dword [ebp - 0x288]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x38], 0
je 0x2102e6d7
mov eax, dword [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
push str.__d._d
mov edx, dword [ebp + 8]
push edx
call fcn.21049450
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.21048f5f
add esp, 0x10
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x2cc], edx
cmp dword [ebp - 0x2cc], 6
je 0x2102e707
cmp dword [ebp - 0x2cc], 9
je 0x2102e6f4
jmp 0x2102e718
push str._x64
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102e718
push str._Itanium
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x2102e82d
cmp dword [ebp - 0x144], 0
je 0x2102e7b8
mov edx, dword [ebp - 0xa0]
and edx, 0xffff
test edx, edx
jne 0x2102e741
jmp 0x2102e7b6
mov eax, dword [ebp - 0x9e]
and eax, 0xffff
test eax, eax
jne 0x2102e77e
mov ecx, dword [ebp - 0xa0]
and ecx, 0xffff
push ecx
push str._SP_d
mov edx, dword [ebp + 8]
push edx
call fcn.21049450
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.21048f5f
add esp, 0xc
jmp 0x2102e7b6
mov edx, dword [ebp - 0x9e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0xa0]
and eax, 0xffff
push eax
push str._SP_d._02d
mov ecx, dword [ebp + 8]
push ecx
call fcn.21049450
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
push edx
call fcn.21048f5f
add esp, 0x10
jmp 0x2102e801
movsx eax, byte [ebp - 0x120]
test eax, eax
je 0x2102e801
push 0x21075de4
lea ecx, [ebp - 0x120]
push ecx
call fcn.210496f0
add esp, 8
test eax, eax
je 0x2102e801
lea edx, [ebp - 0x120]
push edx
push 0x21075de8
mov eax, dword [ebp + 8]
push eax
call fcn.21049450
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.21048f5f
add esp, 0xc
mov edx, dword [ebp - 0x128]
and edx, 0xffff
push edx
push str._Build__d
mov eax, dword [ebp + 8]
push eax
call fcn.21049450
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.21048f5f
add esp, 0xc
push 0x50
lea edx, [ebp - 0x8c]
push edx
push 9
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jle 0x2102e8ce
push 0
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x8c]
push ecx
call fcn.210472e1
test eax, eax
je 0x2102e8ce
mov edx, dword [ebp - 0x278]
and edx, 0xffff
mov dword [ebp - 0x28c], edx
mov eax, dword [ebp - 0x278]
and eax, 0xffff
and eax, 0x3ff
cmp eax, 9
je 0x2102e8ce
push 0x50
lea ecx, [ebp - 0x8c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x28c]
push eax
call fcn.2102eed2
test eax, eax
je 0x2102e8ce
lea ecx, [ebp - 0x8c]
push ecx
push 0x21075df8
mov edx, dword [ebp + 8]
push edx
call fcn.21049450
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.21048f5f
add esp, 0xc
cmp dword [ebp + 0xc], 1
jne 0x2102e90e
push 0x57
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2102e8f1
push str._nMedia_Center_Edition
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
push 0x58
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2102e90e
push str._nStarter_Edition
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
cmp dword [ebp + 0xc], 1
jne 0x2102e931
push 0x56
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x2102e931
push str._nTablet_PC_Edition
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
cmp dword [ebp - 0x124], 2
jne 0x2102eb5f
cmp dword [ebp + 0xc], 1
jne 0x2102eb5f
call fcn.210416e9
test eax, eax
je 0x2102ea21
mov edx, dword [ebp - 0x9c]
and edx, 0xffff
and edx, 0x10
test edx, edx
je 0x2102e97b
push str._nTerminal_Server
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102e9a2
mov ecx, dword [ebp - 0x9c]
and ecx, 0xffff
and ecx, 0x100
test ecx, ecx
je 0x2102e9a2
push str._nTerminal_Server__single_user_
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
call fcn.21041995
test eax, eax
je 0x2102ea21
push str._nremote_client
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
lea ecx, [ebp - 0x2b4]
call fcn.21041060
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x270]
push ecx
lea ecx, [ebp - 0x2b4]
call fcn.21041541
test eax, eax
je 0x2102ea0f
lea edx, [ebp - 0x270]
push edx
push 0x21075e80
mov eax, dword [ebp + 8]
push eax
call fcn.21049450
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.21048f5f
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b4]
call fcn.2104144a
lea edx, [ebp - 0x294]
push edx
lea eax, [ebp - 0x290]
push eax
call fcn.2103f8a9
test eax, eax
jle 0x2102ea81
push str._nadministrative_user
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
cmp dword [0x2107bdb8], 5
jl 0x2102ea7f
cmp dword [ebp - 0x290], 0
je 0x2102ea6e
push str.__elevated_
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102ea7f
push str.__not_elevated_
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102ea92
push str._nnon_administrative_user
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
cmp dword [0x2107bdb8], 5
jl 0x2102eb5f
push str._nprocess_integrity_level:
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
cmp dword [ebp - 0x294], 0x1000
jae 0x2102ead2
push str.untrusted
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102eb5f
cmp dword [ebp - 0x294], 0x2000
jae 0x2102eaf1
push 0x21075f00
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
jmp 0x2102eb5f
cmp dword [ebp - 0x294], 0x3000
jae 0x2102eb10
push str.medium
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
jmp 0x2102eb5f
cmp dword [ebp - 0x294], 0x4000
jae 0x2102eb2f
push str.high
mov eax, dword [ebp + 8]
push eax
call fcn.21048fd0
add esp, 8
jmp 0x2102eb5f
cmp dword [ebp - 0x294], 0x5000
jae 0x2102eb4e
push str.system
mov ecx, dword [ebp + 8]
push ecx
call fcn.21048fd0
add esp, 8
jmp 0x2102eb5f
push str.protected
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
cmp dword [ebp + 0xc], 1
jne 0x2102ebae
movsx eax, byte [ebp - 0x120]
test eax, eax
je 0x2102ebae
push 0x21075f28
lea ecx, [ebp - 0x120]
push ecx
call fcn.210496f0
add esp, 8
test eax, eax
je 0x2102ebae
lea edx, [ebp - 0x120]
push edx
push str._nszCSDVersion____s_
mov eax, dword [ebp + 8]
push eax
call fcn.21049450
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.21048f5f
add esp, 0xc
cmp dword [ebp + 0xc], 1
jne 0x2102ec12
push 0x21075f44
mov edx, dword [ebp + 8]
push edx
call fcn.21048fd0
add esp, 8
mov eax, dword [ebp - 0x9c]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x9a]
and ecx, 0xff
mov edx, dword [ecx*4 + 0x21075a28]
push edx
mov eax, dword [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
push str.Windows__d._02d__s_wSuiteMask_04x
mov edx, dword [ebp + 8]
push edx
call fcn.21049450
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.21048f5f
add esp, 0x18
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8