Function at 0x1009a4c1
Capabilities:
Check os version
Get system information on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1072a790]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 9
pop eax
mov esi, ecx
lea edi, [ebp - 0x118]
mov ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, 0x9c
push edi
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.1043c810
add esp, 0xc
mov dword [ebp - 0xf0], edi
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1009a927
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
push 0x1054d248
push 0x1054d26c
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x1009a543
lea ecx, [ebp - 0x118]
push ecx
call eax
jmp 0x1009a550
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0xe0], 2
jne 0x1009a919
cmp dword [ebp - 0xec], 4
jbe 0x1009a919
push SysReAllocString
push str.Microsoft
push ecx
mov edx, 0x100
mov ecx, esi
call fcn.1009b603
xor ecx, ecx
push 6
pop eax
inc ecx
cmp dword [ebp - 0xec], eax
jne case.0x1009a649.5
mov eax, dword [ebp - 0xe8]
test eax, eax
jne 0x1009a5b2
cmp byte [ebp - 0x56], cl
mov ecx, esi
jne 0x1009a5ab
push str.Windows_Vista
jmp 0x1009a5fd
push str.Windows_Server_2008
jmp 0x1009a5fd
cmp eax, ecx
jne 0x1009a5cb
cmp byte [ebp - 0x56], cl
mov ecx, esi
jne 0x1009a5c4
push str.Windows_7
jmp 0x1009a5fd
push str.Windows_Server_2008_R2
jmp 0x1009a5fd
cmp eax, 2
jne 0x1009a5e5
cmp byte [ebp - 0x56], cl
mov ecx, esi
jne 0x1009a5de
push str.Windows_8
jmp 0x1009a5fd
push str.Windows_Server_2012
jmp 0x1009a5fd
cmp eax, 3
jne 0x1009a602
cmp byte [ebp - 0x56], cl
mov ecx, esi
jne 0x1009a5f8
push str.Windows_9
jmp 0x1009a5fd
push str.Windows_Server_9
call fcn.1009b5c7
push str.GetProductInfo
push 0x1054d314
call edi
push eax
call ebx
lea ecx, [ebp - 0xf4]
push ecx
push 0
push 0
push dword [ebp - 0xe8]
push dword [ebp - 0xec]
call eax
mov eax, dword [ebp - 0xf4]
cmp eax, 0x19
ja 0x1009a6c7
je 0x1009a6c0
dec eax
cmp eax, 0x11
ja case.0x1009a649.5
jmp dword [eax*4 + 0x1009a939]
push str.Ultimate_Edition
jmp 0x1009a6d1
push str.Home_Premium_Edition
jmp 0x1009a6d1
push str.Home_Basic_Edition
jmp 0x1009a6d1
push 0x1054d420
jmp 0x1009a6d1
push str.Business_Edition
jmp 0x1009a6d1
push str.Starter_Edition
jmp 0x1009a6d1
push str.Cluster_Server_Edition
jmp 0x1009a6d1
push 0x1054d4c0
jmp 0x1009a6d1
push str.Datacenter_Edition__core_installation_
jmp 0x1009a6d1
push 0x1054d550
jmp 0x1009a6d1
push str.Enterprise_Edition__core_installation_
jmp 0x1009a6d1
push 0x1054d610
jmp 0x1009a6d1
push str.Small_Business_Server
jmp 0x1009a6d1
push 0x1054d640
jmp 0x1009a6d1
push str.Standard_Edition__core_installation_
jmp 0x1009a6d1
push str.Web_Server_Edition
jmp 0x1009a6d1
push str.Small_Business_Server_Premium_Edition
jmp 0x1009a6d1
cmp eax, 0x30
jne case.0x1009a649.5
push 0x1054d334
mov ecx, esi
call fcn.1009b5c7
cmp dword [ebp - 0xec], 5
jne 0x1009a891
mov eax, dword [ebp - 0xe8]
cmp eax, 2
jne 0x1009a80a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1009a707
push str.Windows_Server_2003_R2
jmp 0x1009a725
test dword [ebp - 0x58], 0x2000
je 0x1009a717
push str.Windows_Storage_Server_2003
jmp 0x1009a725
test dword [ebp - 0x58], 0x8000
je 0x1009a731
push str.Windows_Home_Server
mov ecx, esi
call fcn.1009b5c7
push 9
pop edi
jmp 0x1009a756
cmp byte [ebp - 0x56], 1
push 9
pop edi
jne 0x1009a74a
cmp word [ebp - 0x118], di
jne 0x1009a74a
push str.Windows_XP_Professional_x64_Edition
jmp 0x1009a74f
push str.Windows_Server_2003
mov ecx, esi
call fcn.1009b5c7
cmp byte [ebp - 0x56], 1
push 6
pop ebx
je 0x1009a7f5
cmp word [ebp - 0x118], bx
jne 0x1009a786
test byte [ebp - 0x58], 0x80
je 0x1009a779
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x1009a7cc
test byte [ebp - 0x58], 2
je 0x1009a7f5
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x1009a7cc
cmp word [ebp - 0x118], di
jne 0x1009a7b2
test byte [ebp - 0x58], 0x80
mov ecx, esi
je 0x1009a79e
push str.Datacenter_x64_Edition
jmp 0x1009a7f0
test byte [ebp - 0x58], 2
je 0x1009a7ab
push str.Enterprise_x64_Edition
jmp 0x1009a7f0
push str.Standard_x64_Edition
jmp 0x1009a7f0
mov eax, dword [ebp - 0x58]
test eax, 0x4000
je 0x1009a7c3
push str.Compute_Cluster_Edition
jmp 0x1009a7cc
test al, al
jns 0x1009a7d0
push str.Datacenter_Edition
mov ecx, esi
jmp 0x1009a7f0
mov ecx, esi
test al, 2
je 0x1009a7dd
push str.Enterprise_Edition
jmp 0x1009a7f0
test eax, 0x400
je 0x1009a7eb
push str.Web_Edition
jmp 0x1009a7f0
push str.Standard_Edition
call fcn.1009b5c7
cmp dword [ebp - 0xec], 5
jne 0x1009a897
mov eax, dword [ebp - 0xe8]
jmp 0x1009a810
push 9
pop edi
push 6
pop ebx
cmp eax, 1
jne 0x1009a84c
push str.Windows_XP
mov ecx, esi
call fcn.1009b5c7
test dword [ebp - 0x58], 0x200
mov ecx, esi
je 0x1009a833
push str.Home_Edition
jmp 0x1009a838
push 0x1054da64
call fcn.1009b5c7
cmp dword [ebp - 0xec], 5
jne 0x1009a897
mov eax, dword [ebp - 0xe8]
test eax, eax
jne 0x1009a897
push str.Windows_2000
mov ecx, esi
call fcn.1009b5c7
cmp byte [ebp - 0x56], 1
mov ecx, esi
jne 0x1009a86b
push str.Professional
jmp 0x1009a883
test byte [ebp - 0x58], 0x80
je 0x1009a878
push str.Datacenter_Server
jmp 0x1009a883
test byte [ebp - 0x58], 2
je 0x1009a88a
push str.Advanced_Server
call fcn.1009b5c7
jmp 0x1009a897
push str.Server
jmp 0x1009a883
push 9
pop edi
push 6
pop ebx
lea eax, [ebp - 0xdc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1009a8c2
push 0x1054d374
mov ecx, esi
call fcn.1009b5c7
lea eax, [ebp - 0xdc]
mov ecx, esi
push eax
call fcn.1009b5c7
push dword [ebp - 0xe4]
lea eax, [ebp - 0x54]
push str.__build__d_
push 0x50
push eax
call fcn.1009b574
add esp, 0x10
lea eax, [ebp - 0x54]
mov ecx, esi
push eax
call fcn.1009b5c7
cmp dword [ebp - 0xec], ebx
jb 0x1009a914
cmp word [ebp - 0x118], di
jne 0x1009a8fe
push str._64_bit
jmp 0x1009a90d
cmp word [ebp - 0x118], 0
jne 0x1009a914
push str._32_bit
mov ecx, esi
call fcn.1009b5c7
xor eax, eax
inc eax
jmp 0x1009a926
push str.This_sample_does_not_support_this_version_of_Windows._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10436e26
mov esp, ebp
pop ebp
ret