Function at 0x41d8fc
Capabilities:
Check os version
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x437c14]
push ebx
imul eax, eax, 0xac19ffff
add dword [0x437c2c], eax
push esi
mov esi, dword [ebp + 0x18]
push edi
xor edi, edi
mov eax, dword [esi]
cmp eax, edi
je 0x41d927
push eax
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
cmp byte [0x437bf0], 0
mov ebx, dword [ebp + 0x20]
setne al
cmp ebx, edi
mov byte [0x437be9], al
jne 0x41da29
mov cl, byte [0x437bef]
mov ebx, dword [ebp + 0x14]
sub cl, byte [0x437bf8]
push ebx
movsx ax, al
sub word [0x437bfc], ax
mov al, byte [0x437c00]
or al, byte [0x437c28]
add byte [0x437bed], cl
mov byte [0x437bea], al
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [esi], eax
movsx eax, byte [0x437bef]
push eax
movsx eax, word [0x437bfc]
push eax
call fcn.004100bc
push dword [0x437c28]
mov byte [0x437bec], al
push 0x7409ffff
call fcn.00410092
add word [0x437bf4], ax
push 0xdc2fffff
push 0xf1afffff
call fcn.0040ff4b
add esp, 0x1c
mov dword [0x437c10], eax
cmp dword [esi], edi
je 0x41df94
push dword [0x437c08]
mov dword [0x437c1c], 0x9ca1ffff
push dword [0x437c2c]
call fcn.0041004e
mov eax, dword [ebp + 0x1c]
push ebx
push dword [ebp + 8]
mov dword [eax], ebx
or word [0x437bfe], 0xffff
push dword [esi]
call sub.MSVCRT.dll_memcpy
mov ax, word [0x437c10]
mov word [0x437bf8], ax
movsx eax, word [0x437c00]
push eax
push 0x4299ffff
call fcn.0040ff78
add esp, 0x1c
add byte [0x437be9], al
jmp 0x41e041
movsx eax, word [0x437bfc]
push eax
push dword [0x437c08]
call fcn.0041004e
push dword [0x437c2c]
mov word [0x437bf4], ax
push 0x2cc5ffff
call fcn.00410092
add dword [0x437c14], eax
add esp, 0x10
call dword [sym.imp.USER32.dll_GetActiveWindow]
add word [0x437bf6], ax
cmp dword [ebp + 8], edi
jne 0x41dbc3
movsx eax, byte [0x437bef]
push dword [0x437c14]
push eax
call fcn.0040ff1a
push dword [0x437c20]
mov byte [0x437be9], al
movsx eax, word [0x437c00]
push eax
call fcn.0040ffe3
add word [0x437c04], ax
add esp, 0x10
test bl, 1
je 0x41db70
movsx eax, byte [0x437beb]
push eax
push 0xc13dffff
call fcn.0040fede
push dword [ebp + 0xc]
add dword [0x437c1c], eax
call sub.MSVCRT.dll_strlen
push dword [ebp + 0x10]
mov edi, eax
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea edi, [edi + eax + 3]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_IsCharLowerA]
add word [0x437bf6], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
add word [0x437bf6], ax
movsx eax, byte [0x437bef]
push eax
movsx eax, byte [0x437bec]
push eax
call fcn.0040ff4b
add word [0x437bf8], ax
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
push dword [ebp + 0xc]
mov dword [esi], eax
push eax
call sub.MSVCRT.dll_strcpy
push dword [ebp + 0x10]
push dword [esi]
call sub.MSVCRT.dll_strcat
mov edi, dword [0x43145c]
add esp, 0x1c
mov al, byte [edi]
add al, 0x16
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042c5d0
mov ecx, esp
mov edx, edi
call fcn.004298e5
push eax
push dword [esi]
call sub.MSVCRT.dll_strcat
add dword [0x437c20], 0x2001ffff
pop ecx
pop ecx
jmp 0x41e03b
movsx eax, byte [0x437bee]
push 0x1ed1ffff
push eax
call fcn.00410092
mov byte [0x437be8], al
mov ax, word [0x437c28]
sub word [0x437bf6], ax
mov eax, dword [ebp + 0x1c]
mov dword [esi], edi
pop ecx
or dword [eax], 0xffffffff
xor eax, eax
cmp byte [0x437be8], al
pop ecx
mov byte [0x437bed], 1
mov word [0x437bfe], di
setne al
add word [0x437bf4], ax
jmp 0x41e041
mov eax, dword [ebp + 0x14]
cmp eax, 0xffffffff
jne 0x41dbd4
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
mov dword [ebp + 0x18], eax
add dword [0x437c08], 0x69a60000
movsx eax, byte [0x437bee]
and eax, 0x4191ffff
mov dword [ebp - 4], ebx
add dword [0x437c28], eax
inc word [0x437c00]
and dword [ebp - 4], 8
je 0x41dc0b
mov eax, dword [ebp + 0x18]
lea ebx, [eax + 1]
jmp 0x41dc28
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
push dword [ebp + 0x10]
mov ebx, eax
call sub.MSVCRT.dll_strlen
pop ecx
pop ecx
mov ecx, dword [ebp + 0x18]
add ecx, ebx
lea ebx, [eax + ecx + 3]
or al, 0xff
sub al, byte [0x437bf0]
mov byte [0x437bf0], al
movsx eax, byte [0x437be8]
push eax
push 0x106fffff
call fcn.0040ff4b
add dword [0x437c10], eax
push ebx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 0xc
mov dword [esi], eax
test eax, eax
je 0x41df94
inc word [0x437bf6]
mov eax, dword [esi]
and byte [ebp + 0x17], 0
and byte [eax], 0
mov eax, dword [0x437c20]
imul eax, eax, 0x5bebffff
mov dword [0x437c1c], eax
movsx eax, word [0x437bf6]
push eax
push 0x877bffff
call fcn.0040ff4b
add dword [0x437c28], eax
push 0x6c6dffff
push 0x4cd3ffff
call fcn.0040ff1a
add esp, 0x10
mov byte [0x437bef], al
test byte [ebp + 0x20], 0xe
je 0x41df1c
movsx eax, byte [0x437bea]
push dword [0x437c0c]
push eax
call fcn.00410092
add dword [0x437c10], eax
push dword [0x437c10]
push 0x6849ffff
call fcn.0040ff1a
add byte [0x437bea], al
add esp, 0x10
cmp dword [ebp + 0x18], 0
jbe 0x41df1c
mov al, byte [0x437bef]
push 0xd313ffff
sub byte [0x437be8], al
movsx eax, word [0x437bfa]
push eax
call fcn.0040ff1a
push dword [ebp + 0xc]
add dword [0x437c10], eax
call sub.MSVCRT.dll_strlen
mov ebx, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
lea eax, [edi + ebx]
push eax
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0x18
test eax, eax
je 0x41dd97
call dword [sym.imp.USER32.dll_GetFocus]
mov word [0x437bf6], ax
cmp edi, dword [ebp + 0x18]
jae 0x41dd58
mov al, byte [edi + ebx]
cmp al, 0xa
je 0x41dd58
cmp al, 0xd
je 0x41dd58
inc edi
jmp 0x41dd45
push dword [0x437c28]
push 0x9825ffff
call fcn.0040ff4b
cmp edi, dword [ebp + 0x18]
pop ecx
pop ecx
mov byte [0x437bea], al
jae 0x41df1f
mov al, byte [edi + ebx]
cmp al, 0xa
je 0x41dd83
cmp al, 0xd
jne 0x41dd89
inc edi
cmp edi, dword [ebp + 0x18]
jb 0x41dd78
cmp edi, dword [ebp + 0x18]
jb 0x41dcf6
jmp 0x41df1f
push edi
push ebx
push dword [esi]
call dword [sym.imp.MSVCRT.dll_strncpy]
mov eax, dword [esi]
add esp, 0xc
and byte [eax + edi], 0
mov eax, dword [0x437c2c]
mov ecx, dword [0x437c18]
lea eax, [eax + ecx - 0x3d720001]
mov dword [0x437c2c], eax
movsx eax, byte [0x437be8]
imul eax, eax, 0x7977ffff
add dword [0x437c10], eax
cmp word [0x437bf6], 0
je 0x41ddf0
cmp dword [0x437c28], 0
je 0x41ddf0
mov byte [0x437bee], 1
jmp 0x41ddf7
and byte [0x437bee], 0
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
add edi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
push dword [0x437c0c]
mov dword [0x437c18], eax
push dword [0x437c28]
call fcn.00410016
add word [0x437bfe], ax
pop ecx
test byte [ebp + 0x20], 0xa
pop ecx
je 0x41debd
test byte [ebp + 0x20], 2
je 0x41de4e
push dword [ebp + 0xc]
push dword [esi]
call sub.MSVCRT.dll_strcat
push dword [ebp + 0x10]
push dword [esi]
call sub.MSVCRT.dll_strcat
add esp, 0x10
movsx eax, byte [0x437bea]
push eax
movsx eax, word [0x437c00]
push eax
call fcn.0040ff4b
add word [0x437bf8], ax
pop ecx
movsx ax, byte [0x437be9]
pop ecx
mov word [0x437bf2], ax
cmp edi, dword [ebp + 0x18]
jae 0x41de8f
mov cl, byte [edi + ebx]
cmp cl, 0xa
je 0x41de8f
cmp cl, 0xd
je 0x41de8f
inc edi
jmp 0x41de7a
mov ecx, dword [0x437c2c]
movsx eax, ax
push eax
and ecx, 0x35abffff
movsx eax, word [0x437c00]
add dword [0x437c14], ecx
push eax
call fcn.0040fede
add word [0x437bf8], ax
pop ecx
pop ecx
jmp 0x41ded5
test byte [ebp + 0x20], 4
je 0x41ded5
push dword [ebp + 0x10]
push dword [esi]
call sub.MSVCRT.dll_strcat
dec byte [0x437bef]
pop ecx
pop ecx
movsx eax, byte [0x437be8]
or word [0x437bf4], 0xffff
push eax
push 0x6c31ffff
call fcn.004100bc
mov word [0x437c00], ax
mov ax, word [0x437c10]
add ax, word [0x437bf4]
add edi, ebx
push edi
add word [0x437c02], ax
push dword [esi]
call sub.MSVCRT.dll_strcat
add esp, 0x10
mov byte [ebp + 0x17], 1
jmp 0x41df1f
mov ebx, dword [ebp + 8]
movsx eax, word [0x437c02]
push eax
push dword [0x437c14]
call fcn.0041004e
inc word [0x437bfa]
mov byte [0x437be9], al
mov ax, word [0x437c24]
xor edi, edi
sub word [0x437bf4], ax
cmp dword [ebp - 4], edi
pop ecx
pop ecx
je 0x41df9b
cmp byte [ebp + 0x17], 0
jne 0x41df9b
push dword [esi]
call dword [sym.imp.MSVCRT.dll_free]
push dword [0x437c2c]
push 0xa7e9ffff
call fcn.00410092
add dword [0x437c24], eax
add esp, 0xc
inc byte [0x437bf0]
mov dword [esi], edi
xor eax, eax
cmp word [0x437bf2], di
setne al
mov dword [0x437c2c], eax
xor eax, eax
jmp 0x41e044
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
add word [0x437bf2], ax
movsx eax, byte [0x437bef]
or eax, 0xf85bffff
add dword [0x437c18], eax
test byte [ebp + 0x20], 1
je 0x41e010
cmp byte [ebp + 0x17], 0
jne 0x41e010
push dword [ebp + 0xc]
push dword [esi]
call sub.MSVCRT.dll_strcpy
push dword [ebp + 0x10]
push dword [esi]
call sub.MSVCRT.dll_strcat
mov edi, dword [0x43145c]
add esp, 0x10
mov al, byte [edi]
add al, 0x16
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042c5d0
mov ecx, esp
mov edx, edi
call fcn.004298e5
push eax
push dword [esi]
call sub.MSVCRT.dll_strcat
push ebx
push dword [esi]
call sub.MSVCRT.dll_strcat
add esp, 0x10
movsx eax, byte [0x437bea]
push 0x5bf7ffff
push eax
call fcn.0040ffe3
mov byte [0x437be9], al
mov eax, dword [0x437c2c]
add eax, eax
pop ecx
sub eax, dword [0x437c14]
pop ecx
mov dword [0x437c2c], eax
mov eax, dword [ebp + 0x1c]
or dword [eax], 0xffffffff
push 1
pop eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret