Function at 0x4edfbc
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
xor edx, edx
mov dword [ebp - 0x1a8], edx
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a0], edx
mov dword [ebp - 0x19c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ee399
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x98]
mov edx, 0x94
call fcn.00407a94
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
push 0xff
lea eax, [ebp - 0x198]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x198]
call fcn.0040a0d8
mov eax, ebx
call fcn.004047a0
cmp dword [ebp - 0x88], 2
jne 0x4ee373
mov eax, dword [ebp - 0x94]
sub eax, 3
je 0x4ee05f
dec eax
je 0x4ee06d
dec eax
je 0x4ee07b
jmp 0x4ee087
mov eax, ebx
mov edx, 0x4ee3b0
call fcn.004047f4
jmp 0x4ee087
mov eax, ebx
mov edx, 0x4ee3c0
call fcn.004047f4
jmp 0x4ee087
mov eax, ebx
mov edx, 0x4ee3d0
call fcn.004047f4
cmp dword [ebp - 0x94], 5
jne 0x4ee0aa
cmp dword [ebp - 0x90], 0
jne 0x4ee0aa
mov eax, ebx
mov edx, 0x4ee3d0
call fcn.004047f4
jmp 0x4ee16f
cmp dword [ebp - 0x94], 5
jne 0x4ee0cd
cmp dword [ebp - 0x90], 1
jne 0x4ee0cd
mov eax, ebx
mov edx, 0x4ee3dc
call fcn.004047f4
jmp 0x4ee16f
cmp dword [ebp - 0x94], 5
jne 0x4ee10f
cmp dword [ebp - 0x90], 2
jne 0x4ee10f
lea eax, [ebp - 0x19c]
mov ecx, 0x4ee3e8
mov edx, dword [ebp - 4]
call fcn.00404aac
mov eax, dword [ebp - 0x19c]
call fcn.004099b4
test al, al
je 0x4ee10f
mov eax, ebx
mov edx, 0x4ee3fc
call fcn.004047f4
jmp 0x4ee16f
cmp dword [ebp - 0x94], 5
jne 0x4ee12f
cmp dword [ebp - 0x90], 2
jne 0x4ee12f
mov eax, ebx
mov edx, 0x4ee408
call fcn.004047f4
jmp 0x4ee16f
cmp dword [ebp - 0x94], 5
jne 0x4ee16f
cmp dword [ebp - 0x90], 2
jne 0x4ee16f
lea eax, [ebp - 0x1a0]
mov ecx, 0x4ee3e8
mov edx, dword [ebp - 4]
call fcn.00404aac
mov eax, dword [ebp - 0x1a0]
call fcn.004099b4
test al, al
je 0x4ee16f
mov eax, ebx
mov edx, 0x4ee414
call fcn.004047f4
cmp dword [ebp - 0x94], 6
jne 0x4ee1b1
cmp dword [ebp - 0x90], 0
jne 0x4ee1b1
lea eax, [ebp - 0x1a4]
mov ecx, 0x4ee3e8
mov edx, dword [ebp - 4]
call fcn.00404aac
mov eax, dword [ebp - 0x1a4]
call fcn.004099b4
test al, al
je 0x4ee1b1
mov eax, ebx
mov edx, 0x4ee420
call fcn.004047f4
jmp 0x4ee1cf
cmp dword [ebp - 0x94], 6
jne 0x4ee1cf
cmp dword [ebp - 0x90], 0
jne 0x4ee1cf
mov eax, ebx
mov edx, 0x4ee42c
call fcn.004047f4
cmp dword [ebp - 0x94], 6
jne 0x4ee211
cmp dword [ebp - 0x90], 1
jne 0x4ee211
lea eax, [ebp - 0x1a8]
mov ecx, 0x4ee3e8
mov edx, dword [ebp - 4]
call fcn.00404aac
mov eax, dword [ebp - 0x1a8]
call fcn.004099b4
test al, al
je 0x4ee211
mov eax, ebx
mov edx, 0x4ee438
call fcn.004047f4
jmp 0x4ee22f
cmp dword [ebp - 0x94], 6
jne 0x4ee22f
cmp dword [ebp - 0x90], 1
jne 0x4ee22f
mov eax, ebx
mov edx, 0x4ee448
call fcn.004047f4
mov eax, dword [ebx]
mov edx, 0x4ee3d0
call fcn.00404bac
jne 0x4ee24e
mov eax, ebx
mov edx, 0x4ee454
call fcn.004047f4
jmp 0x4ee373
mov eax, dword [ebx]
mov edx, 0x4ee3dc
call fcn.00404bac
jne 0x4ee26d
mov eax, ebx
mov edx, 0x4ee3d0
call fcn.004047f4
jmp 0x4ee373
mov eax, dword [ebx]
mov edx, 0x4ee3fc
call fcn.00404bac
jne 0x4ee28c
mov eax, ebx
mov edx, 0x4ee3d0
call fcn.004047f4
jmp 0x4ee373
mov eax, dword [ebx]
mov edx, 0x4ee408
call fcn.00404bac
jne 0x4ee2ab
mov eax, ebx
mov edx, 0x4ee3fc
call fcn.004047f4
jmp 0x4ee373
mov eax, dword [ebx]
mov edx, 0x4ee420
call fcn.00404bac
jne 0x4ee2ca
mov eax, ebx
mov edx, 0x4ee460
call fcn.004047f4
jmp 0x4ee373
mov eax, dword [ebx]
mov edx, 0x4ee42c
call fcn.00404bac
jne 0x4ee2e9
mov eax, ebx
mov edx, 0x4ee460
call fcn.004047f4
jmp 0x4ee373
mov eax, dword [ebx]
mov edx, 0x4ee414
call fcn.00404bac
jne 0x4ee305
mov eax, ebx
mov edx, 0x4ee3fc
call fcn.004047f4
jmp 0x4ee373
mov eax, dword [ebx]
mov edx, 0x4ee46c
call fcn.00404bac
jne 0x4ee321
mov eax, ebx
mov edx, 0x4ee3dc
call fcn.004047f4
jmp 0x4ee373
mov eax, dword [ebx]
mov edx, 0x4ee478
call fcn.00404bac
jne 0x4ee33d
mov eax, ebx
mov edx, 0x4ee3dc
call fcn.004047f4
jmp 0x4ee373
mov eax, dword [ebx]
mov edx, 0x4ee448
call fcn.00404bac
jne 0x4ee359
mov eax, ebx
mov edx, 0x4ee484
call fcn.004047f4
jmp 0x4ee373
mov eax, dword [ebx]
mov edx, 0x4ee438
call fcn.00404bac
jne 0x4ee373
mov eax, ebx
mov edx, 0x4ee484
call fcn.004047f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee3a0
lea eax, [ebp - 0x1a8]
mov edx, 4
call fcn.004047c4
lea eax, [ebp - 4]
call fcn.004047a0
ret