Function at 0x43a9d0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
mov eax, dword [0x48f85c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x490f2c], ebx
je 0x43aa2a
mov esi, 0x490f30
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x43a9fd
sub ecx, edi
sar ecx, 1
je 0x43afa6
test edx, edx
je 0x43afa6
push esi
push dword [ebp + 0xc]
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x43af9b
push 9
pop eax
mov ecx, eax
lea edi, [ebp - 0xcc]
xor eax, eax
push 0x118
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1e4]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1e8], 0x11c
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43afa6
push 0x484058
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x43afa6
push str.GetNativeSystemInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea eax, [ebp - 0xcc]
push eax
test esi, esi
je 0x43aaa7
mov ecx, esi
call dword [0x44977c]
call esi
jmp 0x43aaad
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x1d8], 2
jne 0x43afa0
cmp dword [ebp - 0x1e4], 4
jbe 0x43afa0
push str.Microsoft
push 0x100
mov esi, 0x490f30
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
imul eax, dword [ebp - 0x1e4], 0xa
add esp, 0xc
push 6
add eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x1e4], 0xa
mov dword [0x490f2c], eax
pop eax
jne 0x43ab3b
cmp dword [ebp - 0x1e0], ebx
jne 0x43aefd
cmp byte [ebp - 0xce], 1
jne 0x43ab1a
push str.Windows_10
jmp 0x43ab1f
push str.Windows_Server_2016
push 0x100
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov dword [0x490f2c], 0x64
push 6
pop eax
cmp dword [ebp - 0x1e4], eax
jne case.0x43ac76.5
cmp dword [ebp - 0x1e0], ebx
jne 0x43ab7d
cmp byte [ebp - 0xce], 1
jne 0x43ab5f
push str.Windows_Vista
jmp 0x43ab64
push str.Windows_Server_2008
push 0x100
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov dword [0x490f2c], 0x3c
cmp dword [ebp - 0x1e0], 1
jne 0x43abb4
cmp byte [ebp - 0xce], 1
jne 0x43ab96
push str.Windows_7
jmp 0x43ab9b
push str.Windows_Server_2008_R2
push 0x100
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov dword [0x490f2c], 0x3d
cmp dword [ebp - 0x1e0], 2
jne 0x43abeb
cmp byte [ebp - 0xce], 1
jne 0x43abcd
push str.Windows_8
jmp 0x43abd2
push str.Windows_Server_2012
push 0x100
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov dword [0x490f2c], 0x3e
cmp dword [ebp - 0x1e0], 3
jne 0x43ac22
cmp byte [ebp - 0xce], 1
jne 0x43ac04
push str.Windows_8.1
jmp 0x43ac09
push str.Windows_Server_2012_R2
push 0x100
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov dword [0x490f2c], 0x3f
push str.GetProductInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x43afa6
lea eax, [ebp - 0xa8]
mov ecx, edi
push eax
push ebx
push ebx
push dword [ebp - 0x1e0]
push dword [ebp - 0x1e4]
call dword [0x44977c]
call edi
mov eax, dword [ebp - 0xa8]
cmp eax, 0x19
ja 0x43ad00
je 0x43acf9
dec eax
cmp eax, 0x11
ja case.0x43ac76.5
jmp dword [eax*4 + 0x43afbc]
push str.Ultimate_Edition
mov edi, 0x100
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
jmp 0x43ad19
push str.Home_Premium_Edition
jmp 0x43ac82
push str.Home_Basic_Edition
jmp 0x43ac82
push str.Business_Edition
jmp 0x43ac82
push str.Starter_Edition
jmp 0x43ac82
push str.Cluster_Server_Edition
jmp 0x43ac82
push str.Datacenter_Edition
jmp 0x43ac82
push str.Datacenter_Edition__core_installation_
jmp 0x43ac82
push str.Enterprise_Edition
jmp 0x43ac82
push str.Enterprise_Edition__core_installation_
jmp 0x43ac82
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x43ac82
push str.Small_Business_Server
jmp 0x43ac82
push str.Standard_Edition
jmp 0x43ac82
push str.Standard_Edition__core_installation_
jmp 0x43ac82
push str.Web_Server_Edition
jmp 0x43ac82
push str.Small_Business_Server_Premium_Edition
jmp 0x43ac82
mov edi, 0x100
cmp eax, 0x30
jne 0x43ad19
push str.Professional
jmp 0x43ac87
mov edi, 0x100
cmp dword [ebp - 0x1e4], 5
jne 0x43aefd
cmp dword [ebp - 0x1e0], 2
jne 0x43ae60
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x43ad46
push str.Windows_Server_2003_R2_
jmp 0x43ad8d
test dword [ebp - 0xd0], 0x2000
je 0x43ad59
push str.Windows_Storage_Server_2003
jmp 0x43ad8d
test dword [ebp - 0xd0], 0x8000
je 0x43ad6c
push str.Windows_Home_Server
jmp 0x43ad8d
cmp byte [ebp - 0xce], 1
jne 0x43ad88
push 9
pop eax
cmp word [ebp - 0xcc], ax
jne 0x43ad88
push str.Windows_XP_Professional_x64_Edition
jmp 0x43ad8d
push str.Windows_Server_2003_
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp byte [ebp - 0xce], 1
je 0x43ae53
push 6
pop eax
cmp word [ebp - 0xcc], ax
jne 0x43add8
test byte [ebp - 0xd0], 0x80
je 0x43adc4
push str.Datacenter_Edition_for_Itanium_based_Systems
jmp 0x43ae48
test byte [ebp - 0xd0], 2
je 0x43ae53
push str.Enterprise_Edition_for_Itanium_based_Systems
jmp 0x43ae48
push 9
pop eax
cmp word [ebp - 0xcc], ax
jne 0x43ae0b
test byte [ebp - 0xd0], 0x80
je 0x43adf4
push str.Datacenter_x64_Edition
jmp 0x43ae48
test byte [ebp - 0xd0], 2
je 0x43ae04
push str.Enterprise_x64_Edition
jmp 0x43ae48
push str.Standard_x64_Edition
jmp 0x43ae48
mov eax, dword [ebp - 0xd0]
test eax, 0x4000
je 0x43ae1f
push str.Compute_Cluster_Edition
jmp 0x43ae48
test al, al
jns 0x43ae2a
push str.Datacenter_Edition
jmp 0x43ae48
test al, 2
je 0x43ae35
push str.Enterprise_Edition
jmp 0x43ae48
test eax, 0x400
je 0x43ae43
push str.Web_Edition
jmp 0x43ae48
push str.Standard_Edition
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp dword [ebp - 0x1e4], 5
jne 0x43aefd
cmp dword [ebp - 0x1e0], 1
jne 0x43aea5
push str.Windows_XP
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test dword [ebp - 0xd0], 0x200
je 0x43ae8c
push str.Home_Edition
jmp 0x43ae91
push str.Professional
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp dword [ebp - 0x1e4], 5
jne 0x43aefd
cmp dword [ebp - 0x1e0], ebx
jne 0x43aefd
push str.Windows_2000
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp byte [ebp - 0xce], 1
jne 0x43aecd
push str.Professional
jmp 0x43aef2
test byte [ebp - 0xd0], 0x80
je 0x43aedd
push str.Datacenter_Server
jmp 0x43aef2
test byte [ebp - 0xd0], 2
je 0x43aeed
push str.Advanced_Server
jmp 0x43aef2
push str.Server
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea ecx, [ebp - 0x1d4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x43af06
sub ecx, edx
mov ebx, 0x100
sar ecx, 1
je 0x43af3b
push 0x483078
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x1d4]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x18
push dword [ebp - 0x1dc]
lea eax, [ebp - 0xa4]
push str.__build__d_
push 0x50
push eax
call fcn.0040ad86
lea eax, [ebp - 0xa4]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x1c
push 6
pop eax
cmp dword [ebp - 0x1e4], eax
jb 0x43afa6
push 9
pop eax
cmp word [ebp - 0xcc], ax
jne 0x43af84
push str.__64_bit
jmp 0x43af93
cmp word [ebp - 0xcc], 0
jne 0x43afa6
push str.__32_bit
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
jmp 0x43afa6
mov dword [0x490f2c], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [0x490f2c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00442ef0
leave
ret