Function at 0x43f68e
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x358]
sub esp, 0x3d8
mov eax, dword [0x515854]
xor eax, ebp
mov dword [ebp + 0x354], eax
mov eax, dword [ebp + 0x360]
push ebx
push esi
push edi
push 0x24
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.004b9920
mov esi, 0x11c
push esi
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.004b9920
add esp, 0x18
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
mov ebx, str.kernel32.dll
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x43f70b
lea ecx, [ebp - 0x80]
push ecx
call eax
jmp 0x43f715
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
and word [ebp + 0x168], 0
push 0x1ea
lea eax, [ebp + 0x16a]
push 0
push eax
call fcn.004b9920
add esp, 0xc
cmp dword [ebp - 0x44], 1
je 0x43f74c
cmp dword [ebp - 0x44], 2
jne 0x43f745
cmp dword [ebp - 0x50], 4
ja 0x43f74c
xor al, al
jmp 0x43fb8e
push 0xf6
lea eax, [ebp + 0x168]
push str.Microsoft
push eax
call fcn.004bbf16
add esp, 0xc
cmp dword [ebp - 0x44], 1
jne 0x43f7a7
cmp dword [ebp - 0x4c], 0x5a
mov esi, dword [ebp - 0x58]
mov byte [esi + 0x12c], 1
jne 0x43f782
push str.Windows_Me
jmp 0x43f794
cmp dword [ebp - 0x4c], 0xa
jne 0x43f78f
push str.Windows_98
jmp 0x43f794
push str.Windows_95
lea eax, [ebp + 0x168]
push eax
call fcn.004bbed0
pop ecx
pop ecx
jmp 0x43fb7a
cmp dword [ebp - 0x50], 6
jne 0x43f936
cmp dword [ebp - 0x4c], 0
jne 0x43f7de
cmp byte [ebp + 0xc6], 1
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x12c], 0x10
lea eax, [ebp + 0x168]
jne 0x43f7d7
push str.Windows_Vista
jmp 0x43f810
push str.Windows_Server_2008
jmp 0x43f810
cmp dword [ebp - 0x4c], 1
jne 0x43f7f5
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x12c], 0x20
push str.Windows_7
jmp 0x43f80a
cmp dword [ebp - 0x4c], 2
jne 0x43f818
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x12c], 0x40
push str.Windows_8
lea eax, [ebp + 0x168]
push eax
call fcn.004bbed0
pop ecx
pop ecx
and dword [ebp - 0x5c], 0
push str.GetProductInfo
push ebx
call esi
push eax
call edi
test eax, eax
je 0x43f83d
lea ecx, [ebp - 0x5c]
push ecx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call eax
mov eax, dword [ebp - 0x5c]
cmp eax, 0x19
ja 0x43f8cb
je 0x43f8c4
dec eax
cmp eax, 0x11
ja case.0x43f855.5
jmp dword [eax*4 + 0x43fbaa]
push str.Ultimate_Edition
jmp 0x43f8f6
push str.Home_Premium_Edition
jmp 0x43f8f6
push str.Home_Basic_Edition
jmp 0x43f8f6
push str.Enterprise_Edition
jmp 0x43f8f6
push str.Business_Edition
jmp 0x43f8f6
push str.Cluster_Server_Edition
jmp 0x43f8f6
push str.Datacenter_Edition
jmp 0x43f8f6
push str.Datacenter_Edition__core_installation_
jmp 0x43f8f6
push str.Enterprise_Edition__core_installation_
jmp 0x43f8f6
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x43f8f6
push str.Small_Business_Server
jmp 0x43f8f6
push str.Standard_Edition
jmp 0x43f8f6
push str.Standard_Edition__core_installation_
jmp 0x43f8f6
push str.Web_Server_Edition
jmp 0x43f8f6
push str.Small_Business_Server_Premium_Edition
jmp 0x43f8f6
cmp eax, 0x2f
je case.0x43f855.11
jbe case.0x43f855.5
cmp eax, 0x31
ja case.0x43f855.5
push str.Professional_Edition
jmp 0x43f8f6
mov eax, dword [ebp - 0x58]
cmp byte [eax + 0x12c], 0x40
je 0x43f904
push str.Unknown
jmp 0x43f8f6
push str.Starter_Edition
lea eax, [ebp + 0x168]
push eax
call fcn.004bbed0
pop ecx
pop ecx
cmp word [ebp - 0x80], 9
jne 0x43f91c
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x12d], 1
push str.__64_bit
jmp 0x43f928
cmp word [ebp - 0x80], 0
jne 0x43f936
push str.__32_bit
lea eax, [ebp + 0x168]
push eax
call fcn.004bbed0
pop ecx
pop ecx
cmp dword [ebp - 0x50], 5
mov esi, dword [ebp - 0x58]
jne 0x43fb1e
cmp dword [ebp - 0x4c], 2
jne 0x43fa73
push 0x59
mov byte [esi + 0x12c], 8
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x43f967
push str.Windows_Server_2003_R2_
jmp 0x43f995
cmp word [ebp + 0xc4], 0x2000
jne 0x43f979
push str.Windows_Storage_Server_2003
jmp 0x43f995
cmp byte [ebp + 0xc6], 1
jne 0x43f990
cmp word [ebp - 0x80], 9
jne 0x43f990
push str.Windows_XP_Professional_x64_Edition
jmp 0x43f995
push str.Windows_Server_2003_
lea eax, [ebp + 0x168]
push eax
call fcn.004bbed0
cmp byte [ebp + 0xc6], 1
pop ecx
pop ecx
je 0x43fa69
cmp word [ebp - 0x80], 6
jne 0x43f9e5
test byte [ebp + 0xc4], 0x80
mov byte [esi + 0x12d], 1
je 0x43f9d1
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x43fa5b
test byte [ebp + 0xc4], 2
je 0x43fa69
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x43fa5b
cmp word [ebp - 0x80], 9
jne 0x43fa20
test byte [ebp + 0xc4], 0x80
mov byte [esi + 0x12d], 1
je 0x43fa03
push str.Datacenter_x64_Edition
jmp 0x43fa5b
test byte [ebp + 0xc4], 2
lea eax, [ebp + 0x168]
je 0x43fa19
push str.Enterprise_x64_Edition
jmp 0x43fa61
push str.Standard_x64_Edition
jmp 0x43fa61
mov eax, dword [ebp + 0xc4]
test ax, 0x4000
je 0x43fa33
push str.Compute_Cluster_Edition
jmp 0x43fa5b
test al, al
jns 0x43fa3e
push str.Datacenter_Edition
jmp 0x43fa5b
test al, 2
je 0x43fa49
push str.Enterprise_Edition
jmp 0x43fa5b
test ax, 0x400
je 0x43fa56
push str.Web_Edition
jmp 0x43fa5b
push str.Standard_Edition
lea eax, [ebp + 0x168]
push eax
call fcn.004bbed0
pop ecx
pop ecx
cmp dword [ebp - 0x50], 5
jne 0x43fb1e
cmp dword [ebp - 0x4c], 1
mov edi, str.Professional
jne 0x43fabf
lea eax, [ebp + 0x168]
push str.Windows_XP
push eax
mov byte [esi + 0x12c], 4
call fcn.004bbed0
test word [ebp + 0xc4], 0x200
pop ecx
pop ecx
lea eax, [ebp + 0x168]
je 0x43fab0
push str.Home_Edition
jmp 0x43fab1
push edi
push eax
call fcn.004bbed0
cmp dword [ebp - 0x50], 5
pop ecx
pop ecx
jne 0x43fb1e
cmp dword [ebp - 0x4c], 0
jne 0x43fb1e
lea eax, [ebp + 0x168]
push str.Windows_2000
push eax
mov byte [esi + 0x12c], 2
call fcn.004bbed0
cmp byte [ebp + 0xc6], 1
pop ecx
pop ecx
lea eax, [ebp + 0x168]
jne 0x43faf1
push edi
jmp 0x43fb16
test byte [ebp + 0xc4], 0x80
je 0x43fb01
push str.Datacenter_Server
jmp 0x43fb16
test byte [ebp + 0xc4], 2
je 0x43fb11
push str.Advanced_Server
jmp 0x43fb16
push str.Server
push eax
call fcn.004bbed0
pop ecx
pop ecx
lea eax, [ebp - 0x40]
push eax
call fcn.004b98fb
test eax, eax
pop ecx
jbe 0x43fb50
lea eax, [ebp + 0x168]
push 0x4f2aac
push eax
call fcn.004bbed0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x168]
push eax
call fcn.004bbed0
add esp, 0x10
push dword [ebp - 0x48]
lea eax, [ebp + 0xc8]
push str.__build__d_
push eax
call fcn.0043fdac
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x168]
push eax
call fcn.004bbed0
add esp, 0x14
add esi, 0x110
push esi
lea edx, [ebp + 0x168]
call fcn.004074f0
mov al, 1
mov ecx, dword [ebp + 0x354]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b6e9f
add ebp, 0x358
leave
ret 4