Function at 0x414c70
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x446004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Windows_Undefined
push 0x80
push 0x448f78
xor esi, esi
mov dword [0x44690c], 0xffffffff
mov ebx, str.32_bit
call fcn.004235a3
add esp, 0xc
lea eax, [ebp - 0x24c]
push 0x98
push esi
push eax
call fcn.00420360
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x250]
add esp, 0xc
mov dword [ebp - 0x250], 0x9c
push eax
call edi
test eax, eax
jne 0x414d10
push 0x98
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00420360
add esp, 0xc
mov dword [ebp - 0x250], 0x94
lea eax, [ebp - 0x250]
push eax
call edi
test eax, eax
je 0x415164
cmp dword [ebp - 0x240], 2
jne 0x414f91
cmp dword [ebp - 0x24c], 6
ja 0x414d39
jne 0x414e54
cmp dword [ebp - 0x248], 2
jb 0x414e61
push 1
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edi, dword [ebp - 0x24c]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], edx
cmp edi, 9
ja 0x414e54
mov ebx, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
nop dword [eax + eax]
push 0x94
lea eax, [ebp - 0x1a8]
push 0
push eax
call fcn.00420360
add esp, 0xc
mov dword [ebp - 0x1b0], 0x9c
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1ac], edi
push dword [ebp - 0x254]
push dword [ebp - 0x258]
push 2
push eax
call ebx
test eax, eax
jne 0x414dbc
inc edi
cmp edi, 9
jbe 0x414d70
jmp 0x414e4f
cmp dword [ebp - 0x24c], edi
jae 0x414dd0
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], esi
push 1
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edi, dword [ebp - 0x248]
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x258], edx
cmp edi, 9
ja 0x414e4f
nop word [eax + eax]
push 0x9c
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.00420360
add esp, 0xc
mov dword [ebp - 0x1b0], 0x9c
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1a8], edi
push dword [ebp - 0x258]
push dword [ebp - 0x254]
push 1
push eax
call ebx
test eax, eax
jne 0x414e49
inc edi
cmp edi, 9
jbe 0x414e00
jmp 0x414e4f
mov dword [ebp - 0x248], edi
mov ebx, str.32_bit
cmp dword [ebp - 0x24c], 0xf
ja 0x414f91
mov eax, dword [ebp - 0x248]
cmp eax, 0xf
ja 0x414f91
mov edx, dword [ebp - 0x24c]
mov ecx, 1
cmp cl, byte [ebp - 0x1b6]
sbb ecx, ecx
shl edx, 4
or edx, eax
inc ecx
mov dword [0x44690c], edx
lea eax, [edx - 0x51]
cmp eax, 0x5f
ja case.0x414ea2.83
movzx eax, byte [eax + 0x4151a0]
jmp dword [eax*4 + 0x415178]
mov esi, 0x44224c
jmp 0x414f91
test ecx, ecx
je 0x414ec1
mov esi, str.XP_64
jmp 0x414f91
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov esi, str.Server_2003
mov ecx, str.Server_2003_R2
cmovne esi, ecx
jmp 0x414f91
test ecx, ecx
mov esi, str.Vista
mov eax, str.Server_2008
cmove esi, eax
jmp 0x414f91
test ecx, ecx
mov esi, 0x442288
mov eax, str.Server_2008_R2
cmove esi, eax
jmp 0x414f91
test ecx, ecx
mov esi, 0x44229c
mov eax, str.Server_2012
cmove esi, eax
jmp 0x414f91
test ecx, ecx
mov esi, 0x4422ac
mov eax, str.Server_2012_R2
cmove esi, eax
jmp 0x414f91
test ecx, ecx
mov esi, str.10__Preview_1_
mov eax, str.Server_10__Preview_1_
cmove esi, eax
jmp 0x414f91
mov eax, dword [ebp - 0x244]
cmp eax, 0x4e20
jae 0x414f64
test ecx, ecx
je 0x414f50
mov esi, 0x4422e8
jmp 0x414f91
cmp eax, 0x4563
mov esi, str.Server_2016
mov ecx, str.Server_2019
cmovae esi, ecx
jmp 0x414f91
mov dword [0x44690c], 0xb0
test ecx, ecx
mov esi, 0x442304
mov eax, str.Server_2022
cmove esi, eax
jmp 0x414f91
cmp edx, 0x51
jge 0x414f8c
mov dword [0x44690c], esi
jmp 0x414f91
mov esi, str.12_or_later
push 0x43a068
push str.kernel32
mov dword [ebp - 0x254], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x414fc8
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [ebp - 0x254], 0
jne 0x415006
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
test eax, eax
je 0x414ffd
lea eax, [ebp - 0x110]
push eax
push str.GetSystemWow64DirectoryA__s_
call fcn.00414230
add esp, 8
jmp 0x415006
cmp dword [ebp - 0x254], 0
je 0x41500b
mov ebx, str.64_bit
lea eax, [ebp - 0x25c]
push eax
movzx eax, word [ebp - 0x1ba]
push eax
movzx eax, word [ebp - 0x1bc]
push eax
push dword [ebp - 0x248]
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push ebx
test esi, esi
jne 0x415061
push dword [ebp - 0x248]
cmp dword [ebp - 0x240], 2
mov eax, 0x442328
push dword [ebp - 0x24c]
mov ecx, 0x44232c
cmovne eax, ecx
push eax
push str._s__u._u__s
jmp 0x4150cc
mov ax, word [ebp - 0x1ba]
test ax, ax
je 0x415081
movzx eax, ax
push eax
movzx eax, word [ebp - 0x1bc]
push eax
push esi
push str._s_SP_u._u__s
jmp 0x4150cc
mov ax, word [ebp - 0x1bc]
test ax, ax
je 0x4150a8
movzx eax, ax
push eax
push esi
push str._s_SP_u__s
push 0x7f
push 0x448f78
call fcn.00401010
add esp, 0x18
jmp 0x4150db
mov edx, dword [ebp - 0x25c]
mov ecx, edx
call fcn.004145d0
push eax
test edx, edx
mov eax, 0x442358
mov ecx, 0x441bb3
cmove eax, ecx
push eax
push esi
push str._s_s_s___s
push 0x7f
push 0x448f78
call fcn.00401010
add esp, 0x1c
cmp dword [0x44690c], 0x62
mov eax, dword [ebp - 0x244]
mov dword [0x446910], eax
jl 0x415164
push ecx
lea eax, [ebp - 0x258]
push eax
push ecx
call fcn.00414a70
mov ecx, 0x448f78
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415108
sub ecx, edx
mov eax, 0x7f
sub eax, ecx
lea edx, [ecx + 0x448f78]
mov ecx, dword [ebp - 0x258]
test ecx, ecx
jle 0x41514f
push ecx
push dword [0x446910]
push str.__Build__d._d_
push eax
push edx
call fcn.00401010
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret
push dword [0x446910]
push str.__Build__d_
push eax
push edx
call fcn.00401010
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ee2e
mov esp, ebp
pop ebp
ret