Function at 0x403a10
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x19c
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push ebp
mov ebp, dword [esp + 0x1a4]
mov dword [esp + 0x20], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov ecx, 0x27
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ecx
mov dword [ebp], 0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0x9c
call esi
test eax, eax
mov dword [esp + 0xc], eax
jne 0x403a97
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], 0x94
call esi
test eax, eax
jne 0x403a97
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x19c
ret 4
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403abb
lea ecx, [esp + 0x18]
push ecx
call eax
jmp 0x403ac6
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x4c]
sub eax, 0
push ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x18], ebx
je 0x404536
dec eax
je 0x4043e4
dec eax
jne 0x404572
cmp ebx, 6
jne 0x403b64
mov edx, dword [esp + 0x48]
test edx, edx
jne 0x403ce5
mov al, byte [esp + 0xda]
mov edi, ebp
dec edi
cmp al, 1
jne 0x403b48
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403b10
mov eax, dword [str.Windows_Vista]
mov dword [edi], eax
mov ecx, dword [0x43c060]
mov dword [edi + 4], ecx
mov eax, dword [0x43c064]
mov dword [edi + 8], eax
mov cx, word [0x43c068]
mov word [edi + 0xc], cx
mov al, byte [0x43c06a]
mov byte [edi + 0xe], al
jmp 0x403ce5
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403b48
mov ecx, 6
mov esi, str.Windows_Server__Longhorn_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x403ce5
cmp ebx, 5
jne 0x403c9c
mov edx, dword [esp + 0x48]
cmp edx, 2
jne 0x403c05
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x403ba4
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403b90
mov ecx, 9
mov esi, str.Microsoft_Windows_Server_2003__R2_
jmp 0x403bf2
cmp byte [esp + 0xda], 1
jne 0x403bd9
cmp word [esp + 0x1c], 9
jne 0x403bd9
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403bc0
mov ecx, 0xb
mov esi, str.Microsoft_Windows_XP_Professional_x64_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x403bf4
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403be0
mov ecx, 8
mov esi, str.Microsoft_Windows_Server_2003_
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 0x44]
cmp ebx, 5
jne 0x403c9c
mov edx, dword [esp + 0x48]
cmp edx, 1
jne 0x403c51
mov edi, ebp
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403c10
mov ecx, dword [str.Microsoft_Windows_XP]
mov dword [edi], ecx
mov eax, dword [0x43bfb8]
mov dword [edi + 4], eax
mov ecx, dword [0x43bfbc]
mov dword [edi + 8], ecx
mov eax, dword [0x43bfc0]
mov dword [edi + 0xc], eax
mov ecx, dword [0x43bfc4]
mov dword [edi + 0x10], ecx
mov ax, word [0x43bfc8]
mov word [edi + 0x14], ax
jmp 0x403ce5
test edx, edx
jne 0x403ce5
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403c60
mov ecx, dword [str.Microsoft_Windows_2000]
mov dword [edi], ecx
mov eax, dword [0x43bfa0]
mov dword [edi + 4], eax
mov ecx, dword [0x43bfa4]
mov dword [edi + 8], ecx
mov eax, dword [0x43bfa8]
mov dword [edi + 0xc], eax
mov ecx, dword [0x43bfac]
mov dword [edi + 0x10], ecx
mov eax, dword [0x43bfb0]
mov dword [edi + 0x14], eax
jmp 0x403ce5
cmp ebx, 4
ja 0x403ce1
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403ca4
mov ecx, dword [str.Microsoft_Windows_NT]
mov dword [edi], ecx
mov edx, dword [0x43bf88]
mov dword [edi + 4], edx
mov eax, dword [0x43bf8c]
mov dword [edi + 8], eax
mov ecx, dword [0x43bf90]
mov dword [edi + 0xc], ecx
mov edx, dword [0x43bf94]
mov dword [edi + 0x10], edx
mov ax, word [0x43bf98]
mov word [edi + 0x14], ax
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x404176
mov al, byte [esp + 0xda]
cmp al, 1
jne 0x403db9
cmp word [esp + 0x1c], 9
je 0x4042fc
mov edi, ebp
dec edi
cmp ebx, 4
jne 0x403d4c
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403d14
mov ecx, dword [str.Workstation_4.0]
mov dword [edi], ecx
mov edx, dword [0x43bf74]
mov dword [edi + 4], edx
mov eax, dword [0x43bf78]
mov dword [edi + 8], eax
mov ecx, dword [0x43bf7c]
mov dword [edi + 0xc], ecx
mov dl, byte [0x43bf80]
mov byte [edi + 0x10], dl
jmp 0x404305
mov eax, dword [esp + 0xd8]
test ah, 2
je 0x403d88
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403d58
mov eax, dword [str.Home_Edition]
mov dword [edi], eax
mov ecx, dword [0x43bf64]
mov dword [edi + 4], ecx
mov edx, dword [0x43bf68]
mov dword [edi + 8], edx
mov ax, word [0x43bf6c]
mov word [edi + 0xc], ax
jmp 0x4042fc
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403d88
mov ecx, dword [str.Professional]
mov dword [edi], ecx
mov edx, dword [0x43bf54]
mov dword [edi + 4], edx
mov eax, dword [0x43bf58]
mov dword [edi + 8], eax
mov cx, word [0x43bf5c]
mov word [edi + 0xc], cx
jmp 0x4042fc
cmp al, 3
je 0x403dc5
cmp al, 2
jne 0x4042fc
cmp ebx, 5
jne 0x40411d
cmp edx, 2
jne 0x40406a
mov eax, dword [esp + 0x1c]
cmp ax, 6
jne 0x403e28
mov al, byte [esp + 0xd8]
test al, al
jns 0x403e08
mov edi, ebp
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403df0
mov ecx, 0xb
mov esi, str.Datacenter_Edition_for_Itanium_based_Systems
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x403e7f
test al, 2
je 0x403e7f
mov edi, ebp
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403e10
mov ecx, 0xb
mov esi, str.Enterprise_Edition_for_Itanium_based_Systems
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x403e7f
mov edi, ebp
dec edi
cmp ax, 9
jne 0x403f72
mov al, byte [esp + 0xd8]
test al, al
jns 0x403ee9
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403e44
mov edx, dword [str.Datacenter_x64_Edition]
mov dword [edi], edx
mov eax, dword [0x43bedc]
mov dword [edi + 4], eax
mov ecx, dword [0x43bee0]
mov dword [edi + 8], ecx
mov edx, dword [0x43bee4]
mov dword [edi + 0xc], edx
mov eax, dword [0x43bee8]
mov dword [edi + 0x10], eax
mov ecx, dword [0x43beec]
mov dword [edi + 0x14], ecx
mov ecx, dword [esp + 0x4c]
and ecx, 0xffff
push ecx
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0xe4]
push str._s__Build__d_
push eax
call fcn.0041b77b
lea eax, [esp + 0xec]
add esp, 0x10
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403eb0
sub eax, edx
dec ebp
mov edi, ebp
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403ec0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x18]
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4
test al, 2
je 0x403f30
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403ef0
mov edx, dword [str.Enterprise_x64_Edition]
mov dword [edi], edx
mov eax, dword [0x43beb4]
mov dword [edi + 4], eax
mov ecx, dword [0x43beb8]
mov dword [edi + 8], ecx
mov edx, dword [0x43bebc]
mov dword [edi + 0xc], edx
mov eax, dword [0x43bec0]
mov dword [edi + 0x10], eax
mov ecx, dword [0x43bec4]
jmp 0x403e7c
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403f30
mov edx, dword [str.Standard_x64_Edition]
mov dword [edi], edx
mov eax, dword [0x43be9c]
mov dword [edi + 4], eax
mov ecx, dword [0x43bea0]
mov dword [edi + 8], ecx
mov edx, dword [0x43bea4]
mov dword [edi + 0xc], edx
mov eax, dword [0x43bea8]
mov dword [edi + 0x10], eax
mov cx, word [0x43beac]
mov word [edi + 0x14], cx
jmp 0x403e7f
mov eax, dword [esp + 0xd8]
test al, al
jns 0x403fb7
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403f80
mov edx, dword [str.Datacenter_Edition]
mov dword [edi], edx
mov eax, dword [0x43be88]
mov dword [edi + 4], eax
mov ecx, dword [0x43be8c]
mov dword [edi + 8], ecx
mov edx, dword [0x43be90]
mov dword [edi + 0xc], edx
mov eax, dword [0x43be94]
mov dword [edi + 0x10], eax
jmp 0x403e7f
test al, 2
je 0x403ff8
jmp 0x403fc0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403fc0
mov ecx, dword [str.Enterprise_Edition]
mov dword [edi], ecx
mov edx, dword [0x43be74]
mov dword [edi + 4], edx
mov eax, dword [0x43be78]
mov dword [edi + 8], eax
mov ecx, dword [0x43be7c]
mov dword [edi + 0xc], ecx
mov edx, dword [0x43be80]
mov dword [edi + 0x10], edx
jmp 0x403e7f
test ah, 4
je 0x404030
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404000
mov eax, dword [str.Web_Edition]
mov dword [edi], eax
mov ecx, dword [0x43be64]
mov dword [edi + 4], ecx
mov edx, dword [0x43be68]
mov dword [edi + 8], edx
mov al, byte [0x43be6c]
mov byte [edi + 0xc], al
jmp 0x403e7f
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404030
mov ecx, dword [str.Standard_Edition]
mov dword [edi], ecx
mov edx, dword [0x43be50]
mov dword [edi + 4], edx
mov eax, dword [0x43be54]
mov dword [edi + 8], eax
mov ecx, dword [0x43be58]
mov dword [edi + 0xc], ecx
mov dx, word [0x43be5c]
mov word [edi + 0x10], dx
jmp 0x403e7f
test edx, edx
jne 0x40411d
mov al, byte [esp + 0xd8]
mov edi, ebp
dec edi
test al, al
jns 0x4040c2
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404080
mov eax, dword [str.Datacenter_Server]
mov dword [edi], eax
mov ecx, dword [0x43be3c]
mov dword [edi + 4], ecx
mov edx, dword [0x43be40]
mov dword [edi + 8], edx
mov eax, dword [0x43be44]
mov dword [edi + 0xc], eax
mov cx, word [0x43be48]
mov word [edi + 0x10], cx
mov dl, byte [0x43be4a]
mov byte [edi + 0x12], dl
jmp 0x403e7f
test al, 2
je 0x404100
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4040c6
mov eax, dword [str.Advanced_Server]
mov dword [edi], eax
mov ecx, dword [0x43be28]
mov dword [edi + 4], ecx
mov edx, dword [0x43be2c]
mov dword [edi + 8], edx
mov eax, dword [0x43be30]
mov dword [edi + 0xc], eax
mov cl, byte [0x43be34]
mov byte [edi + 0x10], cl
jmp 0x403e7f
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404100
mov edx, dword [str.Server]
mov dword [edi], edx
mov eax, dword [0x43be20]
mov dword [edi + 4], eax
jmp 0x403e7f
mov al, byte [esp + 0xd8]
mov edi, ebp
dec edi
test al, 2
je 0x404150
jmp 0x404130
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404130
mov ecx, 8
mov esi, str.Server_4.0__Enterprise_Edition
rep movsd dword es:[edi], dword [esi]
jmp 0x4042fc
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404150
mov ecx, dword [str.Server_4.0]
mov dword [edi], ecx
mov edx, dword [0x43bdf4]
mov dword [edi + 4], edx
mov eax, dword [0x43bdf8]
mov dword [edi + 8], eax
jmp 0x4042fc
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov edi, 0x50
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4041ac
pop ebx
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x19c
ret 4
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x160]
push eax
push 0
push 0
push str.ProductType
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40419c
cmp dword [esp + 0x10], edi
ja 0x40419c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [esp + 0x15c]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x40422a
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404200
mov ecx, dword [str.Workstation]
mov dword [edi], ecx
mov edx, dword [0x43bda0]
mov dword [edi + 4], edx
mov eax, dword [0x43bda4]
mov dword [edi + 8], eax
mov cl, byte [0x43bda8]
mov byte [edi + 0xc], cl
lea edx, [esp + 0x15c]
push edx
push str.LANMANNT
call esi
test eax, eax
jne 0x404258
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404240
mov eax, dword [str.Server]
mov dword [edi], eax
mov ecx, dword [0x43be20]
mov dword [edi + 4], ecx
lea edx, [esp + 0x15c]
push edx
push str.SERVERNT
call esi
test eax, eax
jne 0x4042a2
mov edi, ebp
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404270
mov eax, dword [str.Advanced_Server]
mov dword [edi], eax
mov ecx, dword [0x43be28]
mov dword [edi + 4], ecx
mov edx, dword [0x43be2c]
mov dword [edi + 8], edx
mov eax, dword [0x43be30]
mov dword [edi + 0xc], eax
mov cl, byte [0x43be34]
mov byte [edi + 0x10], cl
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0xe4]
push str._d._d
push ecx
call fcn.0041b77b
lea eax, [esp + 0xec]
add esp, 0x10
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4042d0
mov edi, ebp
sub eax, edx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4042e0
mov ebx, dword [esp + 0x44]
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, 4
jne 0x403e7f
push str.Service_Pack_6
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403e7f
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
lea edx, [esp + 0xdc]
jne 0x40437a
mov ecx, dword [esp + 0x4c]
and ecx, 0xffff
push ecx
push str.Service_Pack_6a__Build__d_
push edx
call fcn.0041b77b
lea eax, [esp + 0xe8]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404363
sub eax, edx
dec ebp
mov edi, ebp
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404370
jmp 0x4043b8
mov eax, dword [esp + 0x4c]
and eax, 0xffff
push eax
lea ecx, [esp + 0x58]
push ecx
push str._s__Build__d_
push edx
call fcn.0041b77b
lea eax, [esp + 0xec]
add esp, 0x10
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4043a0
sub eax, edx
dec ebp
mov edi, ebp
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4043b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4
cmp ebx, 4
jne 0x404572
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x40447a
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404400
mov ecx, dword [str.Microsoft_Windows_95]
mov dword [edi], ecx
mov edx, dword [0x43bd00]
mov dword [edi + 4], edx
mov eax, dword [0x43bd04]
mov dword [edi + 8], eax
mov ecx, dword [0x43bd08]
mov dword [edi + 0xc], ecx
mov edx, dword [0x43bd0c]
mov dword [edi + 0x10], edx
mov ax, word [0x43bd10]
mov word [edi + 0x14], ax
mov al, byte [esp + 0x55]
cmp al, 0x43
je 0x40444d
cmp al, 0x42
jne 0x404572
dec ebp
mov edi, ebp
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404450
mov ecx, dword [str.OSR2]
mov eax, dword [esp + 0x18]
mov dword [edi], ecx
mov dl, byte [0x43bcf8]
pop ebx
mov byte [edi + 4], dl
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4
cmp eax, 0xa
jne 0x404501
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404486
mov eax, dword [str.Microsoft_Windows_98]
mov dword [edi], eax
mov ecx, dword [0x43bce0]
mov dword [edi + 4], ecx
mov edx, dword [0x43bce4]
mov dword [edi + 8], edx
mov eax, dword [0x43bce8]
mov dword [edi + 0xc], eax
mov ecx, dword [0x43bcec]
mov al, byte [esp + 0x55]
cmp al, 0x41
mov dword [edi + 0x10], ecx
mov dx, word [0x43bcf0]
mov word [edi + 0x14], dx
je 0x4044d3
cmp al, 0x42
jne 0x404572
dec ebp
mov edi, ebp
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4044d6
mov ax, word [0x43bcd8]
mov word [edi], ax
mov cl, byte [0x43bcda]
mov eax, dword [esp + 0x18]
pop ebx
mov byte [edi + 2], cl
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4
cmp eax, 0x5a
jne 0x404572
dec ebp
mov edi, ebp
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404510
mov eax, dword [esp + 0x18]
mov ecx, 9
mov esi, str.Microsoft_Windows_Millennium_Edition
rep movsd dword es:[edi], dword [esi]
pop ebx
movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4
dec ebp
mov edi, ebp
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404540
mov edx, dword [str.Microsoft_Win32s]
mov dword [edi], edx
mov eax, dword [0x43bca0]
mov dword [edi + 4], eax
mov ecx, dword [0x43bca4]
mov dword [edi + 8], ecx
mov edx, dword [0x43bca8]
mov dword [edi + 0xc], edx
mov al, byte [0x43bcac]
mov byte [edi + 0x10], al
mov eax, dword [esp + 0x18]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4