Function at 0x405ea5
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x42f968]
test eax, eax
lea esi, [ecx + eax]
jns 0x405ecd
inc eax
mov edx, dword [0x430290]
imul eax, eax, 0xfffffffc
mov esi, ecx
add esi, dword [edx + eax]
mov edi, 0x4302a0
mov eax, dword [ebp + 8]
sub eax, edi
cmp eax, 0x7ff
ja 0x4060da
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
jmp 0x4060da
mov eax, edi
sub eax, 0x4302a0
cmp eax, 0x3ff
jg 0x4060e4
inc esi
cmp cl, 0xfc
jbe 0x4060ca
movsx ebx, byte [esi + 1]
movsx edx, byte [esi]
and ebx, 0x7f
mov eax, edx
and eax, 0x7f
mov dword [ebp - 0x1c], edx
shl ebx, 7
or ebx, eax
movsx eax, byte [esi]
or ah, 0x80
mov dword [ebp - 0x18], eax
movsx eax, byte [esi + 1]
mov dword [ebp - 0x14], eax
movsx eax, byte [esi + 1]
or ah, 0x80
add esi, 2
mov dword [ebp - 0x10], eax
cmp cl, 0xfe
jne 0x40607a
mov dword [ebp - 0x24], 2
call sub.KERNEL32.dll_GetVersion
mov dword [ebp - 0x28], 0
test eax, eax
jns 0x405f7c
cmp ax, 0x5a04
je 0x405f7c
mov eax, dword [ebp - 0x14]
cmp eax, 0x23
sete dl
cmp eax, 0x2e
sete al
or eax, edx
test al, 1
je 0x405f83
mov dword [ebp - 0x28], 1
cmp dword [0x42f8e4], 0
je 0x405f93
mov dword [ebp - 0x24], 4
mov edx, dword [ebp - 0x1c]
test dl, dl
jns 0x405fca
mov eax, edx
and edx, 0x3f
add edx, dword [0x42f968]
and eax, 0x40
push eax
push edi
push edx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405bee
cmp byte [edi], 0
jne 0x405fec
push dword [ebp - 0x14]
push edi
call fcn.00405ea5
jmp 0x405fec
cmp edx, 0x25
jne 0x405fdc
push 0x400
push edi
call sub.KERNEL32.dll_GetSystemDirectoryA
jmp 0x405fec
cmp edx, 0x24
jne 0x405ff3
push 0x400
push edi
call sub.KERNEL32.dll_GetWindowsDirectoryA
mov dword [ebp - 0x24], 0
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffff
je 0x406062
mov ecx, dword [0x42f9d0]
test ecx, ecx
setne dl
xor eax, eax
cmp dword [ebp - 0x28], 0
setne al
test edx, eax
je 0x40602c
mov eax, dword [ebp - 0x24]
push edi
push 0
push 0
push dword [ebp + eax*4 - 0x1c]
push dword [0x42f9e0]
call ecx
test eax, eax
je 0x406062
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
push dword [ebp + eax*4 - 0x1c]
push dword [0x42f9e0]
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
jne 0x40605d
push edi
push dword [ebp - 0x20]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov ebx, eax
push dword [ebp - 0x20]
call sub.OLE32.dll_CoTaskMemFree
test ebx, ebx
jne 0x406062
mov byte [edi], 0
jmp 0x405ff3
cmp byte [edi], 0
je 0x4060ab
cmp dword [ebp - 0x14], 0x1a
jne 0x4060ab
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call fcn.00405dc4
jmp 0x4060ab
cmp cl, 0xfd
jne 0x4060b3
cmp ebx, 0x1d
jne 0x406092
push dword [0x42f9e0]
push edi
call fcn.00405c61
jmp 0x4060a3
mov eax, ebx
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.00405d1f
lea eax, [ebx - 0x15]
cmp eax, 6
ja 0x4060c0
push edi
call fcn.00405a9c
jmp 0x4060c0
inc cl
jne 0x4060c0
not ebx
push ebx
push edi
call fcn.00405ea5
push edi
call fcn.00405d36
add edi, eax
jmp 0x4060da
lea edx, [edi + 1]
jne 0x4060d6
mov al, byte [esi]
inc esi
mov byte [edi], al
jmp 0x4060d8
mov byte [edi], cl
mov edi, edx
mov cl, byte [esi]
test cl, cl
jne 0x405ef1
mov byte [edi], 0
mov eax, 0x4302a0
cmp dword [ebp + 8], 0
je 0x4060fb
push eax
push dword [ebp + 8]
call fcn.00405d1f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8