Function at 0x1002dd52
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b02c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 9
pop ecx
xor eax, eax
push 0x11c
push eax
mov ebx, 0x100b33d0
mov edi, 0x100b33a8
push ebx
rep stosd dword es:[edi], eax
call fcn.10062b80
push str.Unknown
mov esi, 0x80
push esi
mov edi, 0x100b3328
push edi
call fcn.10060151
add esp, 0x18
push ebx
mov dword [0x100b33d0], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x10c], eax
test eax, eax
jne 0x1002ddd2
push ebx
mov dword [0x100b33d0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1002e16e
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100b33a8
test eax, eax
je 0x1002ddf6
call eax
jmp 0x1002ddfc
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x10c]
mov cx, word [0x100b34e4]
test ebx, ebx
je 0x1002de15
movzx eax, cx
mov dword [0x100b3324], eax
mov eax, dword [0x100b33e0]
cmp eax, 2
jne 0x1002e02a
mov eax, dword [0x100b33d4]
cmp eax, 7
jne 0x1002de9a
cmp dword [0x100b33d8], 0
jne 0x1002e09c
cmp byte [0x100b34ea], 1
jne 0x1002de4a
push str.WIN7.0
jmp 0x1002de4f
push str.WSV7.0
push esi
push edi
call fcn.10060151
add esp, 0xc
test ebx, ebx
je 0x1002e14f
cmp dword [0x100b3324], 0
je 0x1002e14f
push 0x100a0378
push esi
push edi
call fcn.100622f9
push 0xa
push esi
lea eax, [ebp - 0x84]
push eax
push dword [0x100b3324]
call fcn.10060c5c
lea eax, [ebp - 0x84]
jmp 0x1002e144
cmp eax, 6
jne 0x1002dec3
cmp dword [0x100b33d8], 0
jne 0x1002e09c
cmp byte [0x100b34ea], 1
jne 0x1002debc
push str.WIN6.0
jmp 0x1002de4f
push str.WSV6.0
jmp 0x1002de4f
cmp eax, 5
jne 0x1002e01b
mov eax, dword [0x100b33d8]
cmp eax, 2
jne 0x1002dfc6
xor bl, bl
cmp dword [ebp - 0x10c], 0
mov byte [ebp - 0x105], 0
je 0x1002df16
mov al, byte [0x100b34ea]
cmp al, 3
je 0x1002def9
cmp al, 2
jne 0x1002df16
mov ax, word [0x100b33a8]
cmp ax, 6
jne 0x1002df0e
mov byte [ebp - 0x105], 1
jmp 0x1002df16
cmp ax, 9
jne 0x1002df16
mov bl, 1
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1002df4e
test bl, bl
je 0x1002df37
push str.WSV5.2_R64
push esi
push edi
call fcn.10060151
jmp 0x1002e164
cmp byte [ebp - 0x105], 0
je 0x1002df47
push str.WSV5.2_RIT
jmp 0x1002df2b
push str.WSV5.2_R2
jmp 0x1002df2b
cmp byte [0x100b34ea], 1
jne 0x1002df9e
cmp word [0x100b33a8], 9
jne 0x1002df9e
cmp dword [ebp - 0x10c], 0
je 0x1002df97
mov ax, word [0x100b34e4]
cmp ax, 3
jb 0x1002df7d
push str.WIN5.2SP3_64
jmp 0x1002df2b
cmp ax, 2
jne 0x1002df8a
push str.WIN5.2SP2_64
jmp 0x1002df2b
cmp ax, 1
jne 0x1002df97
push str.WIN5.2SP1_64
jmp 0x1002df2b
push str.WIN5.2_64
jmp 0x1002df2b
test bl, bl
je 0x1002dfa9
push str.WSV5.2_64
jmp 0x1002df2b
cmp byte [ebp - 0x105], 0
je 0x1002dfbc
push str.WSV5.2_IT
jmp 0x1002df2b
push str.WSV5.2
jmp 0x1002df2b
cmp eax, 1
jne 0x1002e009
test ebx, ebx
je 0x1002dfff
cmp cx, 3
jb 0x1002dfdf
push str.WIN5.1SP3
jmp 0x1002df2b
cmp cx, 2
jne 0x1002dfef
push str.WIN5.1SP2
jmp 0x1002df2b
cmp cx, 1
jne 0x1002dfff
push str.WIN5.1SP1
jmp 0x1002df2b
push str.WIN5.1
jmp 0x1002df2b
test eax, eax
jne 0x1002e09c
push str.WIN5.0
jmp 0x1002df2b
cmp eax, 4
ja 0x1002e09c
push str.WIN4.0
jmp 0x1002df2b
cmp eax, 1
jne 0x1002e08e
push 0x100a044c
push esi
push edi
call fcn.10060151
push 0xa
push esi
lea eax, [ebp - 0x84]
push eax
push dword [0x100b33d4]
call fcn.10060c5c
lea eax, [ebp - 0x84]
push eax
push esi
push edi
call fcn.100622f9
push 0x100a0450
push esi
push edi
call fcn.100622f9
push 0xa
push esi
lea eax, [ebp - 0x84]
push eax
push dword [0x100b33d8]
call fcn.10060c5c
add esp, 0x44
lea eax, [ebp - 0x84]
push eax
jmp 0x1002e15d
test eax, eax
jne 0x1002e09c
push 0x100a0454
jmp 0x1002df2b
cmp byte [0x100b34ea], 1
jne 0x1002e0ac
push 0x100a0458
jmp 0x1002e0b1
push 0x100a045c
push esi
push edi
call fcn.10060151
add esp, 0xc
push 0xa
push esi
lea eax, [ebp - 0x84]
push eax
push dword [0x100b33d4]
call fcn.10060c5c
lea eax, [ebp - 0x84]
push eax
push esi
push edi
call fcn.100622f9
push 0x100a0450
push esi
push edi
call fcn.100622f9
push 0xa
push esi
lea eax, [ebp - 0x84]
push eax
push dword [0x100b33d8]
call fcn.10060c5c
lea eax, [ebp - 0x84]
push eax
push esi
push edi
call fcn.100622f9
add esp, 0x44
test ebx, ebx
je 0x1002e14f
cmp dword [0x100b3324], 0
je 0x1002e14f
push 0x100a0378
push esi
push edi
call fcn.100622f9
push 0xa
push esi
lea eax, [ebp - 0x104]
push eax
push dword [0x100b3324]
call fcn.10060c5c
lea eax, [ebp - 0x104]
push eax
push esi
push edi
call fcn.100622f9
add esp, 0x28
call fcn.1002dd12
test al, al
je 0x1002e167
push 0x100a037c
push esi
push edi
call fcn.100622f9
add esp, 0xc
mov byte [0x100b4081], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005fc2b
leave
ret