Function at 0x403a60
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x19c
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push ebp
mov ebp, dword [esp + 0x1a4]
mov dword [esp + 0x20], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [esp + 0x28], eax
push edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov ecx, 0x27
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ecx
mov dword [ebp], 0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], 0x9c
call esi
test eax, eax
mov dword [esp + 0xc], eax
jne 0x403ae7
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], 0x94
call esi
test eax, eax
jne 0x403ae7
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x19c
ret 4
push str.GetNativeSystemInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403b0b
lea ecx, [esp + 0x18]
push ecx
call eax
jmp 0x403b16
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x4c]
sub eax, 0
push ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x18], ebx
je 0x404586
dec eax
je 0x404434
dec eax
jne 0x4045c2
cmp ebx, 6
jne 0x403bb4
mov edx, dword [esp + 0x48]
test edx, edx
jne 0x403d35
mov al, byte [esp + 0xda]
mov edi, ebp
dec edi
cmp al, 1
jne 0x403b98
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403b60
mov eax, dword [str.Windows_Vista]
mov dword [edi], eax
mov ecx, dword [0x43c078]
mov dword [edi + 4], ecx
mov eax, dword [0x43c07c]
mov dword [edi + 8], eax
mov cx, word [0x43c080]
mov word [edi + 0xc], cx
mov al, byte [0x43c082]
mov byte [edi + 0xe], al
jmp 0x403d35
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403b98
mov ecx, 6
mov esi, str.Windows_Server__Longhorn_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x403d35
cmp ebx, 5
jne 0x403cec
mov edx, dword [esp + 0x48]
cmp edx, 2
jne 0x403c55
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x403bf4
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403be0
mov ecx, 9
mov esi, str.Microsoft_Windows_Server_2003__R2_
jmp 0x403c42
cmp byte [esp + 0xda], 1
jne 0x403c29
cmp word [esp + 0x1c], 9
jne 0x403c29
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403c10
mov ecx, 0xb
mov esi, str.Microsoft_Windows_XP_Professional_x64_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x403c44
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403c30
mov ecx, 8
mov esi, str.Microsoft_Windows_Server_2003_
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 0x44]
cmp ebx, 5
jne 0x403cec
mov edx, dword [esp + 0x48]
cmp edx, 1
jne 0x403ca1
mov edi, ebp
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403c60
mov ecx, dword [str.Microsoft_Windows_XP]
mov dword [edi], ecx
mov eax, dword [0x43bfd0]
mov dword [edi + 4], eax
mov ecx, dword [0x43bfd4]
mov dword [edi + 8], ecx
mov eax, dword [0x43bfd8]
mov dword [edi + 0xc], eax
mov ecx, dword [0x43bfdc]
mov dword [edi + 0x10], ecx
mov ax, word [0x43bfe0]
mov word [edi + 0x14], ax
jmp 0x403d35
test edx, edx
jne 0x403d35
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403cb0
mov ecx, dword [str.Microsoft_Windows_2000]
mov dword [edi], ecx
mov eax, dword [0x43bfb8]
mov dword [edi + 4], eax
mov ecx, dword [0x43bfbc]
mov dword [edi + 8], ecx
mov eax, dword [0x43bfc0]
mov dword [edi + 0xc], eax
mov ecx, dword [0x43bfc4]
mov dword [edi + 0x10], ecx
mov eax, dword [0x43bfc8]
mov dword [edi + 0x14], eax
jmp 0x403d35
cmp ebx, 4
ja 0x403d31
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403cf4
mov ecx, dword [str.Microsoft_Windows_NT]
mov dword [edi], ecx
mov edx, dword [0x43bfa0]
mov dword [edi + 4], edx
mov eax, dword [0x43bfa4]
mov dword [edi + 8], eax
mov ecx, dword [0x43bfa8]
mov dword [edi + 0xc], ecx
mov edx, dword [0x43bfac]
mov dword [edi + 0x10], edx
mov ax, word [0x43bfb0]
mov word [edi + 0x14], ax
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4041c6
mov al, byte [esp + 0xda]
cmp al, 1
jne 0x403e09
cmp word [esp + 0x1c], 9
je 0x40434c
mov edi, ebp
dec edi
cmp ebx, 4
jne 0x403d9c
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403d64
mov ecx, dword [str.Workstation_4.0]
mov dword [edi], ecx
mov edx, dword [0x43bf8c]
mov dword [edi + 4], edx
mov eax, dword [0x43bf90]
mov dword [edi + 8], eax
mov ecx, dword [0x43bf94]
mov dword [edi + 0xc], ecx
mov dl, byte [0x43bf98]
mov byte [edi + 0x10], dl
jmp 0x404355
mov eax, dword [esp + 0xd8]
test ah, 2
je 0x403dd8
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403da8
mov eax, dword [str.Home_Edition]
mov dword [edi], eax
mov ecx, dword [0x43bf7c]
mov dword [edi + 4], ecx
mov edx, dword [0x43bf80]
mov dword [edi + 8], edx
mov ax, word [0x43bf84]
mov word [edi + 0xc], ax
jmp 0x40434c
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403dd8
mov ecx, dword [str.Professional]
mov dword [edi], ecx
mov edx, dword [0x43bf6c]
mov dword [edi + 4], edx
mov eax, dword [0x43bf70]
mov dword [edi + 8], eax
mov cx, word [0x43bf74]
mov word [edi + 0xc], cx
jmp 0x40434c
cmp al, 3
je 0x403e15
cmp al, 2
jne 0x40434c
cmp ebx, 5
jne 0x40416d
cmp edx, 2
jne 0x4040ba
mov eax, dword [esp + 0x1c]
cmp ax, 6
jne 0x403e78
mov al, byte [esp + 0xd8]
test al, al
jns 0x403e58
mov edi, ebp
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403e40
mov ecx, 0xb
mov esi, str.Datacenter_Edition_for_Itanium_based_Systems
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x403ecf
test al, 2
je 0x403ecf
mov edi, ebp
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403e60
mov ecx, 0xb
mov esi, str.Enterprise_Edition_for_Itanium_based_Systems
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x403ecf
mov edi, ebp
dec edi
cmp ax, 9
jne 0x403fc2
mov al, byte [esp + 0xd8]
test al, al
jns 0x403f39
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403e94
mov edx, dword [str.Datacenter_x64_Edition]
mov dword [edi], edx
mov eax, dword [0x43bef4]
mov dword [edi + 4], eax
mov ecx, dword [0x43bef8]
mov dword [edi + 8], ecx
mov edx, dword [0x43befc]
mov dword [edi + 0xc], edx
mov eax, dword [0x43bf00]
mov dword [edi + 0x10], eax
mov ecx, dword [0x43bf04]
mov dword [edi + 0x14], ecx
mov ecx, dword [esp + 0x4c]
and ecx, 0xffff
push ecx
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0xe4]
push str._s__Build__d_
push eax
call fcn.0041b463
lea eax, [esp + 0xec]
add esp, 0x10
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403f00
sub eax, edx
dec ebp
mov edi, ebp
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403f10
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x18]
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4
test al, 2
je 0x403f80
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403f40
mov edx, dword [str.Enterprise_x64_Edition]
mov dword [edi], edx
mov eax, dword [0x43becc]
mov dword [edi + 4], eax
mov ecx, dword [0x43bed0]
mov dword [edi + 8], ecx
mov edx, dword [0x43bed4]
mov dword [edi + 0xc], edx
mov eax, dword [0x43bed8]
mov dword [edi + 0x10], eax
mov ecx, dword [0x43bedc]
jmp 0x403ecc
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403f80
mov edx, dword [str.Standard_x64_Edition]
mov dword [edi], edx
mov eax, dword [0x43beb4]
mov dword [edi + 4], eax
mov ecx, dword [0x43beb8]
mov dword [edi + 8], ecx
mov edx, dword [0x43bebc]
mov dword [edi + 0xc], edx
mov eax, dword [0x43bec0]
mov dword [edi + 0x10], eax
mov cx, word [0x43bec4]
mov word [edi + 0x14], cx
jmp 0x403ecf
mov eax, dword [esp + 0xd8]
test al, al
jns 0x404007
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403fd0
mov edx, dword [str.Datacenter_Edition]
mov dword [edi], edx
mov eax, dword [0x43bea0]
mov dword [edi + 4], eax
mov ecx, dword [0x43bea4]
mov dword [edi + 8], ecx
mov edx, dword [0x43bea8]
mov dword [edi + 0xc], edx
mov eax, dword [0x43beac]
mov dword [edi + 0x10], eax
jmp 0x403ecf
test al, 2
je 0x404048
jmp 0x404010
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404010
mov ecx, dword [str.Enterprise_Edition]
mov dword [edi], ecx
mov edx, dword [0x43be8c]
mov dword [edi + 4], edx
mov eax, dword [0x43be90]
mov dword [edi + 8], eax
mov ecx, dword [0x43be94]
mov dword [edi + 0xc], ecx
mov edx, dword [0x43be98]
mov dword [edi + 0x10], edx
jmp 0x403ecf
test ah, 4
je 0x404080
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404050
mov eax, dword [str.Web_Edition]
mov dword [edi], eax
mov ecx, dword [0x43be7c]
mov dword [edi + 4], ecx
mov edx, dword [0x43be80]
mov dword [edi + 8], edx
mov al, byte [0x43be84]
mov byte [edi + 0xc], al
jmp 0x403ecf
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404080
mov ecx, dword [str.Standard_Edition]
mov dword [edi], ecx
mov edx, dword [0x43be68]
mov dword [edi + 4], edx
mov eax, dword [0x43be6c]
mov dword [edi + 8], eax
mov ecx, dword [0x43be70]
mov dword [edi + 0xc], ecx
mov dx, word [0x43be74]
mov word [edi + 0x10], dx
jmp 0x403ecf
test edx, edx
jne 0x40416d
mov al, byte [esp + 0xd8]
mov edi, ebp
dec edi
test al, al
jns 0x404112
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4040d0
mov eax, dword [str.Datacenter_Server]
mov dword [edi], eax
mov ecx, dword [0x43be54]
mov dword [edi + 4], ecx
mov edx, dword [0x43be58]
mov dword [edi + 8], edx
mov eax, dword [0x43be5c]
mov dword [edi + 0xc], eax
mov cx, word [0x43be60]
mov word [edi + 0x10], cx
mov dl, byte [0x43be62]
mov byte [edi + 0x12], dl
jmp 0x403ecf
test al, 2
je 0x404150
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404116
mov eax, dword [str.Advanced_Server]
mov dword [edi], eax
mov ecx, dword [0x43be40]
mov dword [edi + 4], ecx
mov edx, dword [0x43be44]
mov dword [edi + 8], edx
mov eax, dword [0x43be48]
mov dword [edi + 0xc], eax
mov cl, byte [0x43be4c]
mov byte [edi + 0x10], cl
jmp 0x403ecf
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404150
mov edx, dword [str.Server]
mov dword [edi], edx
mov eax, dword [0x43be38]
mov dword [edi + 4], eax
jmp 0x403ecf
mov al, byte [esp + 0xd8]
mov edi, ebp
dec edi
test al, 2
je 0x4041a0
jmp 0x404180
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404180
mov ecx, 8
mov esi, str.Server_4.0__Enterprise_Edition
rep movsd dword es:[edi], dword [esi]
jmp 0x40434c
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4041a0
mov ecx, dword [str.Server_4.0]
mov dword [edi], ecx
mov edx, dword [0x43be0c]
mov dword [edi + 4], edx
mov eax, dword [0x43be10]
mov dword [edi + 8], eax
jmp 0x40434c
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
mov edi, 0x50
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4041fc
pop ebx
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x19c
ret 4
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x160]
push eax
push 0
push 0
push str.ProductType
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4041ec
cmp dword [esp + 0x10], edi
ja 0x4041ec
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [esp + 0x15c]
push eax
push str.WINNT
call esi
test eax, eax
jne 0x40427a
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404250
mov ecx, dword [str.Workstation]
mov dword [edi], ecx
mov edx, dword [0x43bdb8]
mov dword [edi + 4], edx
mov eax, dword [0x43bdbc]
mov dword [edi + 8], eax
mov cl, byte [0x43bdc0]
mov byte [edi + 0xc], cl
lea edx, [esp + 0x15c]
push edx
push str.LANMANNT
call esi
test eax, eax
jne 0x4042a8
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404290
mov eax, dword [str.Server]
mov dword [edi], eax
mov ecx, dword [0x43be38]
mov dword [edi + 4], ecx
lea edx, [esp + 0x15c]
push edx
push str.SERVERNT
call esi
test eax, eax
jne 0x4042f2
mov edi, ebp
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4042c0
mov eax, dword [str.Advanced_Server]
mov dword [edi], eax
mov ecx, dword [0x43be40]
mov dword [edi + 4], ecx
mov edx, dword [0x43be44]
mov dword [edi + 8], edx
mov eax, dword [0x43be48]
mov dword [edi + 0xc], eax
mov cl, byte [0x43be4c]
mov byte [edi + 0x10], cl
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0xe4]
push str._d._d
push ecx
call fcn.0041b463
lea eax, [esp + 0xec]
add esp, 0x10
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404320
mov edi, ebp
sub eax, edx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404330
mov ebx, dword [esp + 0x44]
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, 4
jne 0x403ecf
push str.Service_Pack_6
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403ecf
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
lea edx, [esp + 0xdc]
jne 0x4043ca
mov ecx, dword [esp + 0x4c]
and ecx, 0xffff
push ecx
push str.Service_Pack_6a__Build__d_
push edx
call fcn.0041b463
lea eax, [esp + 0xe8]
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4043b3
sub eax, edx
dec ebp
mov edi, ebp
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4043c0
jmp 0x404408
mov eax, dword [esp + 0x4c]
and eax, 0xffff
push eax
lea ecx, [esp + 0x58]
push ecx
push str._s__Build__d_
push edx
call fcn.0041b463
lea eax, [esp + 0xec]
add esp, 0x10
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4043f0
sub eax, edx
dec ebp
mov edi, ebp
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404400
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4
cmp ebx, 4
jne 0x4045c2
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x4044ca
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404450
mov ecx, dword [str.Microsoft_Windows_95]
mov dword [edi], ecx
mov edx, dword [0x43bd18]
mov dword [edi + 4], edx
mov eax, dword [0x43bd1c]
mov dword [edi + 8], eax
mov ecx, dword [0x43bd20]
mov dword [edi + 0xc], ecx
mov edx, dword [0x43bd24]
mov dword [edi + 0x10], edx
mov ax, word [0x43bd28]
mov word [edi + 0x14], ax
mov al, byte [esp + 0x55]
cmp al, 0x43
je 0x40449d
cmp al, 0x42
jne 0x4045c2
dec ebp
mov edi, ebp
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4044a0
mov ecx, dword [str.OSR2]
mov eax, dword [esp + 0x18]
mov dword [edi], ecx
mov dl, byte [0x43bd10]
pop ebx
mov byte [edi + 4], dl
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4
cmp eax, 0xa
jne 0x404551
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4044d6
mov eax, dword [str.Microsoft_Windows_98]
mov dword [edi], eax
mov ecx, dword [0x43bcf8]
mov dword [edi + 4], ecx
mov edx, dword [0x43bcfc]
mov dword [edi + 8], edx
mov eax, dword [0x43bd00]
mov dword [edi + 0xc], eax
mov ecx, dword [0x43bd04]
mov al, byte [esp + 0x55]
cmp al, 0x41
mov dword [edi + 0x10], ecx
mov dx, word [0x43bd08]
mov word [edi + 0x14], dx
je 0x404523
cmp al, 0x42
jne 0x4045c2
dec ebp
mov edi, ebp
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404526
mov ax, word [0x43bcf0]
mov word [edi], ax
mov cl, byte [0x43bcf2]
mov eax, dword [esp + 0x18]
pop ebx
mov byte [edi + 2], cl
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4
cmp eax, 0x5a
jne 0x4045c2
dec ebp
mov edi, ebp
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404560
mov eax, dword [esp + 0x18]
mov ecx, 9
mov esi, str.Microsoft_Windows_Millennium_Edition
rep movsd dword es:[edi], dword [esi]
pop ebx
movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4
dec ebp
mov edi, ebp
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404590
mov edx, dword [str.Microsoft_Win32s]
mov dword [edi], edx
mov eax, dword [0x43bcb8]
mov dword [edi + 4], eax
mov ecx, dword [0x43bcbc]
mov dword [edi + 8], ecx
mov edx, dword [0x43bcc0]
mov dword [edi + 0xc], edx
mov al, byte [0x43bcc4]
mov byte [edi + 0x10], al
mov eax, dword [esp + 0x18]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x19c
ret 4