Function at 0x406bc0
Capabilities:
Check os version
Get common file path
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
lea eax, [ebp - 0xc4]
push edi
push eax
mov dword [ebp - 0xc4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 2
xor ebx, ebx
pop eax
cmp dword [ebp - 0xb4], eax
jne 0x406c02
push 3
mov dword [0x409868], eax
pop eax
cmp dword [ebp - 0xc0], eax
jbe 0x406c12
jmp 0x406c0d
xor eax, eax
cmp dword [ebp - 0xb4], ebx
setne al
mov dword [0x409868], eax
mov eax, dword [ebp + 8]
push 0x2166c
push 0x40
mov dword [0x40987c], eax
mov dword [0x4098a4], ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [0x409878], eax
jne 0x406c4e
push 0x2010
push str.WinSFX32M
push str.Not_enough_memory
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x406c60
test byte [0x409868], 1
je 0x406c6c
call fcn.00406b2f
test eax, eax
jne 0x406c67
xor eax, eax
jmp 0x406ef1
mov eax, dword [0x409878]
mov dword [eax + 0x40], ebx
mov dword [eax + 0x3c], ebx
mov dword [eax + 0x48], ebx
mov dword [eax + 0x44], ebx
mov dword [eax + 0x4c], ebx
mov dword [eax + 0x54], ebx
mov dword [eax + 0x58], ebx
mov dword [eax + 0x5c], ebx
mov dword [eax + 0x64], ebx
mov dword [eax + 0x37fa], ebx
mov byte [eax + 0x35f5], bl
mov byte [eax + 0x20f88], bl
mov byte [eax + 0x20f38], bl
mov byte [eax + 0x205a8], bl
mov byte [eax + 0x18394], bl
mov byte [eax + 0x17f94], bl
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, dword [0x409878]
and eax, 0x3ff
cmp eax, 0x11
mov dword [ecx + 0x30], eax
jne 0x406cd5
push 1
pop edi
mov dword [ecx + 0x50], edi
mov dword [ecx + 0x60], edi
jmp 0x406cde
push 1
mov dword [ecx + 0x50], ebx
mov dword [ecx + 0x60], ebx
pop edi
push dword [ecx + 0x50]
call fcn.00403f27
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
call fcn.00406a04
mov dword [ebp - 8], eax
mov dword [0x409888], edi
mov dword [0x409884], ebx
mov dword [0x40989c], ebx
mov dword [0x40985c], ebx
mov dword [0x40986c], edi
mov dword [ebp + 0x10], ebx
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jge 0x406d86
mov ecx, dword [ebp - 4]
mov esi, dword [ecx + eax*4]
inc eax
mov dword [ebp + 0x10], eax
cmp byte [esi], 0x2d
jne 0x406d66
movzx eax, byte [esi + 1]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
cmp al, 0x6e
jne 0x406d4f
xor eax, eax
cmp byte [esi + 2], 0x2d
sete al
add eax, 0xb
mov dword [0x40985c], eax
jmp 0x406d16
cmp al, 0x63
jne 0x406d16
xor eax, eax
cmp byte [esi + 2], 0x2d
setne al
add eax, 0xa
mov dword [0x409888], eax
jmp 0x406d16
cmp eax, edi
jle 0x406d16
mov eax, dword [0x409878]
push 0x400
add eax, 0x17f94
push esi
push eax
mov dword [0x40989c], edi
call fcn.00401900
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00406acd
call fcn.00401ae2
cmp dword [0x409868], ebx
mov dword [0x409870], ebx
je 0x406ddc
lea eax, [ebp - 0x30]
push eax
push 0x8002
push ebx
call dword [sym.imp.USER32.dll_GetClassInfoA]
test eax, eax
je 0x406ddc
mov eax, dword [ebp - 0x2c]
mov dword [0x409860], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [ebp + 8]
push 0x40204a
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x409870], eax
mov eax, dword [0x409878]
push 0x104
add eax, 0x13b8c
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.0040693a
mov eax, dword [0x409878]
mov dword [0x409874], ebx
mov dword [0x409854], ebx
mov cl, byte [eax + 0x37f8]
test cl, 2
je 0x406e1c
mov dword [0x409854], edi
mov eax, dword [0x40985c]
cmp eax, ebx
jne 0x406e31
test cl, 1
je 0x406e31
mov eax, edi
mov dword [0x40985c], eax
cmp eax, 0xb
jne 0x406e3e
mov dword [0x40985c], edi
jmp 0x406e49
cmp eax, 0xc
jne 0x406e49
mov dword [0x40985c], ebx
cmp dword [0x409888], 0xb
je 0x406e57
test cl, 8
je 0x406e5d
mov dword [0x409888], ebx
cmp dword [0x409888], 0xa
jne 0x406e6c
mov dword [0x409888], edi
push edi
push ebx
call fcn.004052a2
test eax, eax
je 0x406ec2
mov eax, dword [0x409878]
push edi
mov esi, 0x100
push 0x409820
add eax, 0x35f5
push esi
push eax
call fcn.0040257c
mov eax, dword [0x409878]
add eax, 0x35f5
cmp byte [eax], bl
jne 0x406ea9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [0x409878]
push 0x406390
push ebx
push dword [eax + 0x15c]
push dword [ebp + 8]
call fcn.00402093
mov eax, dword [0x409870]
cmp eax, ebx
je 0x406ed2
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x409878]
push eax
mov esi, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test byte [0x409868], 1
je 0x406eef
call fcn.00406b00
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10