Function at 0x43dc90
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x268
mov eax, dword [0x613ad0]
xor eax, esp
mov dword [esp + 0x264], eax
xor eax, eax
cmp dword [ecx + 0x24], eax
mov dword [esp + 8], ecx
mov dword [esp], eax
jle 0x43e14f
push ebx
push ebp
push esi
push edi
lea ebx, [ebx]
test eax, eax
jl 0x43e164
cmp eax, dword [ecx + 0x24]
jge 0x43e164
mov edx, dword [ecx + 0x20]
mov esi, dword [edx + eax*4]
mov eax, dword [esi + 0x14]
and dword [esi + 0x6c], 0xfffffffe
test eax, 0x40000
jne 0x43e133
test eax, 0x100000
je 0x43defe
mov eax, dword [esi + 4]
cmp eax, 0xfffffef5
jne 0x43dec5
push 0x114
lea eax, [esp + 0x24]
push 0
push eax
call fcn.005abb20
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x43dd35
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x30]
sub eax, 0
je 0x43deb3
sub eax, 1
je 0x43de56
sub eax, 1
je 0x43dd5d
lea ecx, [esi + 0x10]
call fcn.00401f60
jmp 0x43e133
cmp dword [esp + 0x24], 4
ja 0x43dd71
push str.Microsoft_Windows_NT
lea ecx, [esi + 0x10]
call fcn.00403db0
cmp dword [esp + 0x24], 5
jne 0x43dd85
push str.Microsoft_Windows_2000
lea ecx, [esi + 0x10]
call fcn.00403db0
lea edx, [esp + 0x14]
push edx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1d8]
push ecx
push 0
push 0
push str.ProductType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1d4]
push ecx
push str.WINNT
call fcn.005ab553
add esp, 8
test eax, eax
jne 0x43ddf0
push str.Workstation
lea ecx, [esi + 0x10]
call fcn.00404560
lea edx, [esp + 0x1d4]
push edx
push str.SERVERNT
call fcn.005ab553
add esp, 8
test eax, eax
jne 0x43de16
push str.Server
lea ecx, [esi + 0x10]
call fcn.00404560
movzx eax, word [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x38]
push ecx
push edx
push eax
lea ecx, [esp + 0x144]
push str.version__d._d__s__Build__d_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea edx, [esp + 0x134]
push edx
lea ecx, [esi + 0x10]
call fcn.00404560
jmp 0x43e133
mov eax, dword [esp + 0x24]
cmp eax, 4
ja 0x43de6f
jne 0x43de68
cmp dword [esp + 0x28], 0
ja 0x43de6f
push str.Microsoft_Windows_95
jmp 0x43de74
push str.Microsoft_Windows_98
add esi, 0x10
mov ecx, esi
call fcn.00403db0
movzx eax, word [esp + 0x2c]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x13c]
push str._s__Build__d_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 0x134]
push eax
mov ecx, esi
call fcn.00404560
jmp 0x43e133
push 0x5df734
lea ecx, [esi + 0x10]
call fcn.00403db0
jmp 0x43e133
cmp eax, 0xfffffef4
jne 0x43e133
add esi, 0x10
mov ecx, esi
call fcn.00401f60
push 0xe000
call fcn.0057f7a1
test eax, eax
je 0x43e133
push 0xe000
push eax
mov ecx, esi
call fcn.00403630
jmp 0x43e133
test eax, 0x80000
je 0x43df2e
cmp dword [esi + 4], 0xfffffef6
jne 0x43e133
push 0
call fcn.005ab6cb
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], edx
add esp, 4
mov dword [esi + 0x58], 2
jmp 0x43e133
test eax, 0x1000000
je 0x43e133
test eax, 0x4000000
je 0x43e133
mov edx, dword [esi + 0x1c]
mov ecx, dword [ecx + 4]
push edx
call fcn.004124a0
mov edi, eax
test edi, edi
je 0x43e133
mov eax, dword [edi + 8]
cmp eax, 0x424f5743
jne 0x43e0ca
cmp dword [edi + 0x54], 0xb
jne 0x43e133
mov eax, dword [edi + 0xcc]
cmp eax, 0x4f444152
jg 0x43e030
je 0x43dfdf
cmp eax, 0x424b4843
je 0x43dfdf
cmp eax, 0x424d4f43
jne 0x43e133
cmp dword [edi + 0xf0], esi
jne 0x43e133
xor ebp, ebp
cmp dword [edi + 0x184], ebp
jle 0x43e133
lea ebx, [edi + 0x17c]
push ebp
mov ecx, ebx
call fcn.00401700
mov eax, dword [eax]
cmp dword [eax + 8], 0
jne 0x43dfd7
add ebp, 1
cmp ebp, dword [edi + 0x184]
jl 0x43dfb7
jmp 0x43e133
lea ecx, [esi + 0xc]
jmp 0x43e12a
cmp dword [edi + 0xf0], esi
jne 0x43e133
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 8]
cmp eax, 0x50524752
je 0x43e023
cmp eax, 0x5453514f
je 0x43e023
test byte [edi + 0xd0], 2
je 0x43e023
push 0x7e7f
call fcn.00443770
add esp, 4
push eax
lea ecx, [esi + 0xc]
call fcn.00403db0
jmp 0x43e133
lea ecx, [esi + 0xc]
call fcn.00401f60
jmp 0x43e133
cmp eax, 0x5453494c
je 0x43e05d
cmp eax, 0x59544e45
jne 0x43e133
cmp dword [edi + 0xf0], esi
jne 0x43e133
add edi, 0x180
push edi
lea ecx, [esi + 0xc]
jmp 0x43e12e
lea ebx, [esi + 0xc]
mov ecx, ebx
call fcn.00401f60
cmp dword [edi + 0xf0], esi
jne 0x43e133
xor ebp, ebp
cmp dword [edi + 0x184], ebp
jle 0x43e133
push ebp
lea ecx, [edi + 0x17c]
call fcn.00401700
mov esi, dword [eax]
cmp dword [esi + 8], 0
je 0x43e0bd
mov ecx, dword [ebx]
cmp dword [ecx - 0xc], 0
je 0x43e0a9
push 0x5d8f14
mov ecx, ebx
call fcn.00404560
add esi, 4
push esi
mov ecx, ebx
call fcn.00404540
test byte [edi + 0xd0], 0x20
je 0x43e133
add ebp, 1
cmp ebp, dword [edi + 0x184]
jl 0x43e081
jmp 0x43e133
cmp eax, 0x50524752
jne 0x43e133
cmp dword [edi + 0xa0], esi
jne 0x43e133
lea ebp, [esi + 0xc]
mov ecx, ebp
call fcn.00401f60
xor esi, esi
cmp dword [edi + 0x1c], esi
jle 0x43e133
lea ebx, [edi + 0x14]
lea ecx, [ecx]
push esi
mov ecx, ebx
call fcn.00401700
mov eax, dword [eax]
cmp dword [eax + 8], 0x424f5743
jne 0x43e11e
cmp dword [eax + 0x54], 0xb
jne 0x43e11e
cmp dword [eax + 0xcc], 0x4f444152
jne 0x43e11e
test byte [eax + 0xd0], 2
jne 0x43e128
add esi, 1
cmp esi, dword [edi + 0x1c]
jl 0x43e0f0
jmp 0x43e133
mov ecx, ebp
add eax, 4
push eax
call fcn.00402570
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add eax, 1
cmp eax, dword [ecx + 0x24]
mov dword [esp + 0x10], eax
jl 0x43dcc0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.005aac48
add esp, 0x268
ret
jmp fcn.0057e0f5