Function at 0x43c9fc
Capabilities:
Check os version

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
xor eax, eax
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
push ecx
sub esp, 0x188
cmp dword [0x527720], 0
mov ebx, dword [ecx]
mov dword [ebp - 0x15c], edi
mov word [ebp - 0x160], 0
mov word [ebp - 0x15e], 0
mov dword [ebp - 0x158], eax
jne 0x43ca62
mov eax, str.Kernel32
call fcn.0043bd78
mov dword [esp + 4], str.IsWow64Process2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push esi
push esi
mov dword [0x527720], eax
xor eax, eax
mov ecx, 0x27
lea esi, [ebx + 0x1a]
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x26
lea edi, [ebp - 0x14c]
movups xmm0, xmmword [str.Windows_Undefine]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x150]
mov dword [ebp - 0x170], esi
movups xmmword [ebx + 0x1a], xmm0
mov dword [ebp - 0x150], 0x9c
mov word [esi + 0x10], 0x64
mov esi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov dword [esp], edx
call esi
lea edx, [ebp - 0x150]
test eax, eax
push ecx
jne 0x43cadf
mov ecx, 0x26
lea edi, [ebp - 0x14c]
mov dword [ebp - 0x150], 0x94
rep stosd dword es:[edi], eax
mov dword [esp], edx
call esi
push edx
test eax, eax
je 0x43d4a2
cmp dword [ebp - 0x140], 2
jne 0x43cda7
cmp dword [ebp - 0x14c], 6
ja 0x43cb08
jne 0x43cc65
cmp dword [ebp - 0x148], 1
jbe 0x43cc65
xor eax, eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 2
mov dword [esp], eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_VerSetConditionMask]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x14c]
sub esp, 0x10
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 9
ja 0x43cc61
lea edx, [ebp - 0xac]
xor eax, eax
mov ecx, 0x25
mov dword [ebp - 0xb4], 0x9c
mov edi, edx
mov edx, dword [ebp - 0x174]
lea esi, [ebp - 0xb4]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x178]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_VerifyVersionInfoA]
sub esp, 0x10
test eax, eax
jne 0x43cbb0
inc dword [ebp - 0x16c]
jmp 0x43cb42
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x14c], eax
jae 0x43cbcc
xor edi, edi
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], edi
xor esi, esi
mov dword [esp + 0xc], 1
mov dword [esp], esi
mov dword [esp + 4], esi
mov dword [esp + 8], 1
call dword [sym.imp.KERNEL32.DLL_VerSetConditionMask]
mov esi, dword [ebp - 0x148]
mov dword [ebp - 0x178], eax
sub esp, 0x10
mov dword [ebp - 0x174], edx
cmp esi, 9
ja 0x43cc6f
xor eax, eax
mov ecx, 0x26
lea edi, [ebp - 0xb0]
mov edx, dword [ebp - 0x174]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xb4], 0x9c
mov dword [ebp - 0xac], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0xb4]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VerifyVersionInfoA]
sub esp, 0x10
test eax, eax
jne 0x43cc59
inc esi
jmp 0x43cc00
mov dword [ebp - 0x148], esi
jmp 0x43cc6f
xor esi, esi
jmp 0x43cc6f
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x16c], ecx
mov edx, dword [ebp - 0x14c]
cmp edx, 0xf
ja 0x43cdb1
mov ecx, dword [ebp - 0x148]
cmp ecx, 0xf
ja 0x43cdb1
shl edx, 4
mov al, byte [ebp - 0xb6]
or edx, ecx
mov dword [ebx], edx
cmp edx, 0x64
ja 0x43ccc5
cmp edx, 0x50
jbe 0x43cda1
sub edx, 0x51
cmp edx, 0x13
ja case.0x43ccb4.83
jmp dword [edx*4 + 0x4a8624]
mov edi, 0x4a7ef8
jmp 0x43cdba
cmp edx, 0xa0
je 0x43cd57
cmp edx, 0xb0
je 0x43cd93
jmp case.0x43ccb4.83
mov edi, str.XP_64
cmp al, 1
jbe 0x43cdba
mov dword [esp], 0x59
mov edi, str.Server_2003_R2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov eax, str.Server_2003
push edx
cmove edi, eax
jmp 0x43cdba
cmp al, 1
mov edi, str.Server_2008
mov eax, str.Vista
jmp 0x43cd7e
cmp al, 1
mov edi, str.Server_2008_R2
mov eax, 0x4a7ef6
jmp 0x43cd7e
cmp al, 1
mov edi, str.Server_2012
mov eax, 0x4a7ef4
jmp 0x43cd7e
cmp al, 1
mov edi, str.Server_2012_R2
mov eax, 0x4a7ef0
jmp 0x43cd7e
cmp al, 1
mov edi, str.Server_10__Preview_1_
mov eax, str.10__Preview_1_
jmp 0x43cd7e
mov edx, dword [ebp - 0x144]
cmp edx, 0x4e1f
ja 0x43cd83
mov edi, 0x4a7e9c
cmp al, 1
jbe 0x43cdba
cmp edx, 0x4562
mov edi, str.Server_2019
mov eax, str.Server_2016
cmovbe edi, eax
jmp 0x43cdba
mov dword [ebx], 0xb0
mov dword [ebp - 0x16c], 0xb
cmp al, 1
mov edi, str.Server_2022
mov eax, 0x4a7ec6
jmp 0x43cd7e
xor edi, edi
mov dword [ebx], edi
jmp 0x43cdb1
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x16c], ecx
xor edi, edi
jmp 0x43cdba
mov edi, str.12_or_later
mov dword [ebx + 8], esi
mov eax, dword [ebp - 0x16c]
mov esi, dword [0x527720]
mov dword [ebx + 4], eax
test esi, esi
je 0x43ce03
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea ecx, [ebp - 0x15e]
mov dword [esp + 8], ecx
lea ecx, [ebp - 0x160]
mov dword [esp + 4], ecx
mov dword [esp], eax
call esi
sub esp, 0xc
test eax, eax
je 0x43ce03
mov ax, word [ebp - 0x15e]
mov word [ebx + 0x18], ax
jmp 0x43ce79
mov word [ebx + 0x18], 0x14c
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea edx, [ebp - 0x158]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_IsWow64Process]
push edx
push edx
test eax, eax
je 0x43ce6d
cmp dword [ebp - 0x158], 0
je 0x43ce6d
mov eax, dword [ebx + 0x18]
cmp ax, 0x14c
jne 0x43ce42
mov word [ebx + 0x18], 0x8664
jmp 0x43ce6d
cmp ax, 0x1c0
jne 0x43ce50
mov word [ebx + 0x18], 0xaa64
jmp 0x43ce6d
mov dword [esp + 8], 0x1cb
mov dword [esp + 4], str.stdfn.c
mov dword [esp], str.FALSE
call dword [0x494088]
mov dword [esp], str.Note:_Underlying_Windows_architecture_was_guessed_and_may_be_incorrect...
call fcn.0043efa9
mov eax, dword [ebx + 0x18]
mov esi, 0x4a7efb
cmp ax, 0x8664
je 0x43ceb5
ja 0x43cea4
mov esi, 0x4a7eff
cmp ax, 0x14c
je 0x43ceb5
cmp ax, 0x1c0
mov esi, 0x4a7f0d
mov eax, 0x4a7f09
jmp 0x43ceb2
cmp ax, 0xaa64
mov esi, 0x4a7f0d
mov eax, 0x4a7f03
cmove esi, eax
lea eax, [ebp - 0x15c]
mov dword [esp + 0x10], eax
movzx eax, word [ebp - 0xba]
mov dword [esp + 0xc], eax
movzx eax, word [ebp - 0xbc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x148]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProductInfo]
lea eax, [ebx + 0x22]
mov dword [ebp - 0x16c], eax
sub esp, 0x14
test edi, edi
jne 0x43cf3b
cmp dword [ebp - 0x140], 2
mov edx, 0x4a7f15
mov eax, 0x4a7f18
mov dword [esp + 0x18], esi
cmove eax, edx
mov edx, dword [ebp - 0x148]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x14c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], str._s__u._u__s
jmp 0x43d3b6
movzx edx, word [ebp - 0xba]
movzx eax, word [ebp - 0xbc]
test dx, dx
je 0x43cf6b
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], str._s_SP_u._u__s
jmp 0x43d3b6
test ax, ax
je 0x43cfa0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], str._s_SP_u__s
mov dword [esp + 4], 0x76
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf]
jmp 0x43d3cd
mov edx, dword [ebp - 0x15c]
cmp edx, 0xcb
ja case.default.0x43cfae
jmp dword [edx*4 + 0x4a8674]
mov eax, 0x4a7f1b
jmp 0x43d38a
cmp edx, 0x198
ja 0x43cfdd
mov eax, str.Azure_Server
cmp edx, 0x195
ja 0x43d38a
jmp case.0x43cfae.15
mov eax, str._Unlicensed_
cmp edx, 0xabcdabcd
je 0x43d38a
jmp case.0x43cfae.15
mov eax, str.Home_Basic
jmp 0x43d38a
mov eax, str.Home_Premium
jmp 0x43d38a
mov eax, str.Enterprise
jmp 0x43d38a
mov eax, str.Home_Basic_N
jmp 0x43d38a
mov eax, str.Business
jmp 0x43d38a
mov eax, str.Server_Standard
jmp 0x43d38a
mov eax, str.Server_Datacenter
jmp 0x43d38a
mov eax, str.Smallbusiness_Server
jmp 0x43d38a
mov eax, str.Server_Enterprise
jmp 0x43d38a
mov eax, str.Starter
jmp 0x43d38a
mov eax, str.Server_Datacenter__Core_
jmp 0x43d38a
mov eax, str.Server_Standard__Core_
jmp 0x43d38a
mov eax, str.Server_Enterprise__Core_
jmp 0x43d38a
mov eax, str.Business_N
jmp 0x43d38a
mov eax, str.Web_Server
jmp 0x43d38a
mov eax, str.HPC_Edition
jmp 0x43d38a
mov eax, str.Storage_Server__Essentials_
jmp 0x43d38a
mov eax, str.Home_Premium_N
jmp 0x43d38a
mov eax, str.Enterprise_N
jmp 0x43d38a
mov eax, str.Ultimate_N
jmp 0x43d38a
mov eax, str.Home_Server
jmp 0x43d38a
mov eax, str.Server_Standard_without_Hyper_V
jmp 0x43d38a
mov eax, str.Server_Datacenter_without_Hyper_V
jmp 0x43d38a
mov eax, str.Server_Enterprise_without_Hyper_V
jmp 0x43d38a
mov eax, str.Server_Datacenter_without_Hyper_V__Core_
jmp 0x43d38a
mov eax, str.Server_Standard_without_Hyper_V__Core_
jmp 0x43d38a
mov eax, str.Server_Enterprise_without_Hyper_V__Core_
jmp 0x43d38a
mov eax, str.Hyper_V_Server
jmp 0x43d38a
mov eax, str.Starter_N
jmp 0x43d38a
mov eax, 0x4a8156
jmp 0x43d38a
mov eax, str.Pro_N
jmp 0x43d38a
mov eax, str.Server_Solutions_Premium
jmp 0x43d38a
mov eax, str.Server_Solutions_Premium__Core_
jmp 0x43d38a
mov eax, str.Server_Hyper_Core_V
jmp 0x43d38a
mov eax, str.Starter_E
jmp 0x43d38a
mov eax, str.Home_Basic_E
jmp 0x43d38a
mov eax, str.Premium_E
jmp 0x43d38a
mov eax, str.Pro_E
jmp 0x43d38a
mov eax, str.Enterprise_E
jmp 0x43d38a
mov eax, str.Ultimate_E
jmp 0x43d38a
mov eax, str.Enterprise__Eval_
jmp 0x43d38a
mov eax, str.Server_Standard__Eval_
jmp 0x43d38a
mov eax, str.Server_Datacenter__Eval_
jmp 0x43d38a
mov eax, str.Enterprise_N__Eval_
jmp 0x43d38a
mov eax, str.Thin_PC
jmp 0x43d38a
mov eax, str.Embedded
jmp 0x43d38a
mov eax, str.Home_N
jmp 0x43d38a
mov eax, str.Home_China
jmp 0x43d38a
mov eax, str.Home_Single_Language
jmp 0x43d38a
mov eax, str.Home
jmp 0x43d38a
mov eax, str.Pro_with_Media_Center
jmp 0x43d38a
mov eax, str.Home_Connected
jmp 0x43d38a
mov eax, str.Pro_Student
jmp 0x43d38a
mov eax, str.Home_Connected_N
jmp 0x43d38a
mov eax, str.Pro_Student_N
jmp 0x43d38a
mov eax, str.Home_Connected_Single_Language
jmp 0x43d38a
mov eax, str.Home_Connected_China
jmp 0x43d38a
mov eax, str.Education
jmp 0x43d38a
mov eax, str.Education_N
jmp 0x43d38a
mov eax, str.Enterprise_LTSB
jmp 0x43d38a
mov eax, str.Enterprise_LTSB_N
jmp 0x43d38a
mov eax, str.Pro_S
jmp 0x43d38a
mov eax, str.Pro_S_N
jmp 0x43d38a
mov eax, str.Enterprise_LTSB__Eval_
jmp 0x43d38a
mov eax, str.Enterprise_LTSB_N__Eval_
jmp 0x43d38a
mov eax, str.Pro_Single_Language
jmp 0x43d38a
mov eax, str.Pro_China
jmp 0x43d38a
mov eax, str.Enterprise_Subscription
jmp 0x43d38a
mov eax, str.Enterprise_Subscription_N
jmp 0x43d38a
mov eax, str.Server_Datacenter_SA__Core_
jmp 0x43d38a
mov eax, str.Server_Standard_SA__Core_
jmp 0x43d38a
mov eax, str.Utility_VM
jmp 0x43d38a
mov eax, str.Pro_for_Workstations
jmp 0x43d38a
mov eax, str.Pro_for_Workstations_N
jmp 0x43d38a
mov eax, str.Pro_for_Education
jmp 0x43d38a
mov eax, str.Pro_for_Education_N
jmp 0x43d38a
mov eax, str.Enterprise_G
jmp 0x43d38a
mov eax, str.Enterprise_G_N
jmp 0x43d38a
mov eax, str.Cloud
jmp 0x43d38a
mov eax, str.Cloud_N
jmp 0x43d38a
mov eax, str.Home_OS
jmp 0x43d38a
mov eax, str.Cloud_E
jmp 0x43d38a
mov eax, str.IoT_OS
jmp 0x43d38a
mov eax, str.Cloud_E_N
jmp 0x43d38a
mov eax, str.IoT_Edge_OS
jmp 0x43d38a
mov eax, str.IoT_Enterprise
jmp 0x43d38a
mov eax, str.Lite
jmp 0x43d38a
mov eax, str.IoT_Enterprise_S
jmp 0x43d38a
mov eax, str.XBox
jmp 0x43d38a
mov eax, str.Azure_Server
jmp 0x43d38a
mov dword [esp + 0xc], edx
mov dword [esp + 8], str._Unknown_Edition_0x_02X_
mov dword [esp + 4], 0x40
mov dword [esp], 0x5276e0
call dword [sym.imp.msvcrt.dll__snprintf]
mov byte [0x52771f], 0
mov eax, 0x5276e0
jmp 0x43d38a
mov eax, str.Ultimate
cmp dword [ebp - 0x15c], 0
mov edx, 0x4a7f1b
mov ecx, 0x4a8500
mov dword [esp + 0x18], esi
cmovne edx, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 8], str._s_s_s__s
mov dword [esp + 4], 0x76
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf]
mov eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x154]
mov edx, str.SoftwareMicrosoftWindows_NTCurrentVersionUBR
mov byte [ebx + 0x97], 0
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x144]
mov dword [ebx + 0xc], eax
mov eax, 0x80000002
call fcn.0043c4c1
mov edi, dword [ebp - 0x154]
mov eax, dword [ebp - 0x170]
mov dword [ebx + 0x10], edi
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov esi, dword [sym.imp.msvcrt.dll__snprintf]
mov ecx, eax
lea edx, [ebx + eax + 0x1a]
mov eax, 0x7f
sub eax, ecx
test edi, edi
je 0x43d447
mov dword [esp + 0x10], edi
mov ecx, dword [ebx + 0xc]
mov dword [esp + 8], str.__Build__lu._lu_
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call esi
jmp 0x43d45f
mov ecx, dword [ebx + 0xc]
mov dword [esp + 8], str.__Build__lu_
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
mov dword [esp], edx
call esi
mov byte [ebx + 0x98], 0
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edi, eax
call fcn.0043c960
test eax, eax
je 0x43d4a2
mov eax, 0x7f
mov dword [esp + 8], str._in_S_Mode
sub eax, edi
mov dword [esp + 4], eax
lea eax, [ebx + edi + 0x1a]
mov dword [esp], eax
call esi
mov byte [ebx + 0x98], 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret