Function at 0x100693f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x3d4
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x3d0], eax
push ebx
push esi
mov esi, dword [esp + 0x3e0]
push edi
mov edi, dword [esp + 0x3e8]
push 0x103
xor ebx, ebx
lea eax, [esp + 0x2dd]
push ebx
push eax
mov dword [esp + 0x44], edi
call fcn.10116880
push 0x103
lea ecx, [esp + 0xe1]
push ebx
push ecx
mov byte [esp + 0xe8], bl
call fcn.10116880
push 0x90
lea edx, [esp + 0x5c]
push ebx
push edx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x60], ebx
call fcn.10116880
add esp, 0x24
mov byte [esi], bl
mov byte [esp + 0x2d8], bl
cmp edi, ebx
je 0x1006949a
mov byte [edi], bl
push ebp
cmp dword [0x1019e748], ebx
jne 0x100694c4
mov ebp, 1
mov dword [0x1019e748], ebp
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x100694c4
cmp al, 6
jb 0x100694c4
mov dword [0x1019e74c], ebp
jmp 0x100694cc
cmp dword [0x1019e74c], ebx
je 0x100694f5
push ebx
lea eax, [esp + 0x44]
push eax
call sym.EncDec.dll_MyRtlGetVersion
test eax, eax
jne 0x1006951b
push 0x94
lea ecx, [esp + 0x44]
push ebx
push ecx
call fcn.10116880
add esp, 0xc
lea edx, [esp + 0x40]
push edx
jmp 0x1006950d
push 0x94
lea eax, [esp + 0x44]
push ebx
push eax
call fcn.10116880
add esp, 0xc
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.1004f190
mov ebp, eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x40]
push eax
lea ebx, [esp + 0x58]
lea edx, [esp + 0x40]
lea ecx, [esp + 0x4c]
call fcn.10050110
add esp, 0x20
cmp dword [0x1017e8ec], 0xffffffff
jne 0x10069588
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1017e8ec
xor ebx, ebx
xor edx, edx
xor ecx, ecx
call fcn.10050110
add esp, 0x20
test edi, edi
je 0x1006959c
push str.OS:
push esi
call fcn.1010d6a8
add esp, 8
jmp 0x1006959f
mov byte [esi], 0
cmp dword [esp + 0x34], 0
je 0x100695e0
mov eax, esi
lea edx, [eax + 1]
jmp 0x100695b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100695b0
sub eax, edx
cmp eax, 0x104
jge 0x100695d7
mov edx, str.Windows_95
mov cl, byte [edx]
test cl, cl
je 0x100695d7
mov byte [eax + esi], cl
inc eax
inc edx
cmp eax, 0x104
jl 0x100695c5
mov byte [eax + esi], 0
jmp 0x100697e4
cmp dword [esp + 0x18], 0
je 0x100695f1
push str.Windows_98
jmp 0x100697d7
cmp dword [esp + 0x2c], 0
je 0x10069602
push str.Windows_2000
jmp 0x100697d7
cmp dword [esp + 0x20], 0
je 0x10069613
push str.Windows_ME
jmp 0x100697d7
cmp dword [esp + 0x30], 0
je 0x1006963f
mov edi, 0x104
test ebp, ebp
je 0x1006962d
push str.Windows_XP_Pro_x64
jmp 0x100697dc
push str.Windows_XP
call fcn.1004d280
add esp, 4
jmp 0x100697f4
cmp dword [esp + 0x28], 0
je 0x1006965a
call fcn.1004c7c0
cmp eax, 2
jle 0x1006961a
push str.Windows_2003
jmp 0x100697d7
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
test ebx, ebx
jne 0x1006968b
cmp dword [esp + 0x14], 0
jne 0x1006968b
test edi, edi
jne 0x1006968b
cmp dword [esp + 0x1c], edi
jne 0x1006968b
cmp dword [esp + 0x24], edi
je 0x100697e4
push str.Windows_NT
jmp 0x100697d7
call fcn.1004c7c0
cmp eax, 2
jle 0x10069787
cmp dword [esp + 0x44], 6
jne 0x100696c1
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x100696b2
push str.Windows_2008
jmp 0x100697d7
cmp eax, 1
jne 0x100696c1
push str.Windows_2008_R2
jmp 0x100697d7
push 0x90
lea ecx, [esp + 0x1e0]
push 0
push ecx
mov dword [esp + 0x1e4], 0
call fcn.10116880
add esp, 0xc
push 0
lea edx, [esp + 0x1dc]
push edx
call sym.EncDec.dll_MyRtlGetVersion
cmp eax, 1
jne 0x1006975f
mov eax, dword [esp + 0x1e0]
cmp eax, 2
jne 0x1006970d
push str.Windows_2012
jmp 0x100697d7
cmp eax, 3
jne 0x1006971c
push str.Windows_2012_R2
jmp 0x100697d7
cmp dword [esp + 0x1dc], 0xa
jb 0x100697e4
mov eax, dword [esp + 0x1e4]
cmp eax, 0x44c0
jae 0x10069742
push str.Windows_2016
jmp 0x100697d7
mov edi, 0x104
cmp eax, 0x4c30
jae 0x10069758
push str.Windows_2019
jmp 0x100697dc
push str.Windows_2022
jmp 0x100697dc
mov eax, dword [esp + 0x48]
cmp eax, 2
jne 0x1006976f
push str.Windows_2012
jmp 0x100697d7
mov edi, 0x104
cmp eax, 3
jne 0x10069780
push str.Windows_2012_R2
jmp 0x100697dc
push str.Windows_2016
jmp 0x100697dc
test edi, edi
je 0x100697c7
call fcn.1004fd20
test eax, eax
je 0x1006979b
push str.Windows_11
jmp 0x100697d7
call fcn.1004fcf0
test eax, eax
je 0x100697ab
push str.Windows_10
jmp 0x100697d7
call fcn.1004fad0
mov edi, 0x104
test eax, eax
je 0x100697c0
push str.Windows_8.1
jmp 0x100697dc
push str.Windows_8
jmp 0x100697dc
test ebx, ebx
je 0x100697d2
push str.Windows_Vista
jmp 0x100697d7
push str.Windows_7
mov edi, 0x104
call fcn.1004d280
add esp, 4
test ebp, ebp
je 0x100697f4
push str._64_Bit
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [esp + 0x3c]
pop ebp
test ebx, ebx
je 0x10069916
lea eax, [esp + 0x2d8]
push eax
call fcn.10069930
add esp, 4
cmp byte [esp + 0x2d8], 0
je 0x10069863
push 0x103
lea ecx, [esp + 0x1d9]
push 0
push ecx
mov byte [esp + 0x1e0], 0
call fcn.10116880
lea edx, [esp + 0x2e4]
push edx
lea eax, [esp + 0x1e4]
push str.__OS_Install_Date:__s_
push eax
call fcn.1010d6a8
add esp, 0x18
lea ecx, [esp + 0x1d4]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor edi, edi
lea esi, [esp + 0xd0]
mov byte [ebx], 0
mov byte [esp + 0xd0], 0
call fcn.1004f5a0
lea edx, [esp + 0xd0]
push edx
mov esi, eax
call fcn.100454f0
add esp, 4
cmp byte [esp + 0xd0], 0
je 0x10069916
test esi, esi
jne 0x100698ab
lea eax, [esp + 0xd0]
push eax
push str.Ver:__s
jmp 0x1006990d
cmp esi, 1
jne 0x100698bf
lea ecx, [esp + 0xd0]
push ecx
push str.Ver:_Personal__s
jmp 0x1006990d
cmp esi, 2
jne 0x100698d3
lea edx, [esp + 0xd0]
push edx
push str.Ver:_Professional__s
jmp 0x1006990d
cmp esi, 3
jne 0x100698e7
lea eax, [esp + 0xd0]
push eax
push str.Ver:_Standard_Server__s
jmp 0x1006990d
cmp esi, 4
jne 0x100698fb
lea ecx, [esp + 0xd0]
push ecx
push str.Ver:_DataCenter_Server__s
jmp 0x1006990d
cmp esi, 5
jne 0x10069916
lea edx, [esp + 0xd0]
push edx
push str.Ver:_Enterprise_Advanced__s
push ebx
call fcn.1010d6a8
add esp, 0xc
mov ecx, dword [esp + 0x3dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x3d4
ret 8