Function at 0x4045f0
Capabilities:
Check os version
Get common file path
Get hostname
Get session user name
Identify system language via api

Disassembly:
sub rsp, 0x218
mov qword [rsp + 0x210], rbx
mov qword [rsp + 0x208], rbp
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x1f8], rdi
xor esi, esi
mov qword [rcx + 0xab0], r8
mov rdi, rcx
mov qword [rcx + 0xaa0], rdx
mov dword [rcx + 0xab8], r9d
mov dword [rcx + 0xa90], esi
mov qword [rcx], rsi
mov qword [rsp + 0x1f0], r12
mov qword [rsp + 0x1e8], r13
lea r13, [0x0040d245]
mov rbx, r8
mov qword [rcx + 0xaa8], r13
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x40469f
lea rcx, str.Help
mov qword [rax], rcx
lea rcx, [fcn.00403480]
mov qword [rax + 8], rcx
lea rcx, str.Command_Name
mov qword [rax + 0x10], rcx
lea rcx, str.If__Command_Name__is_provided_displayes_syntax_and_description_of_that_command_otherwise_displays_all_the_avilable_commands
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea r12, str.Command
test rax, rax
je 0x4046e3
lea rcx, str.System
mov qword [rax + 0x10], r12
mov qword [rax], rcx
lea rcx, [0x00401b20]
mov qword [rax + 8], rcx
lea rcx, str.Executes_the_given_system_command__returns_immidiately_
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x404727
lea rcx, str.SysCallAndWait
mov qword [rax], rcx
lea rcx, [0x00401b40]
mov qword [rax + 8], rcx
lea rcx, str.Exact_path_to_App__arguments
mov qword [rax + 0x10], rcx
lea rcx, str.call_and_wait_untill_app_is_done.
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x40476b
lea rcx, [0x0040d108]
mov qword [rax], rcx
lea rcx, [0x00402fb0]
mov qword [rax + 8], rcx
lea rcx, str.Name_Value_
mov qword [rax + 0x10], rcx
lea rcx, str.Defines_the_variable_if_not_defined_and_Sets_the_its_value_to_the_given_value._nIf__Value__is_not_given_it_undefines_the_given_variable
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x4047af
lea rcx, str.Echo
mov qword [rax], rcx
lea rcx, [0x004026d0]
mov qword [rax + 8], rcx
lea rcx, str.Data
mov qword [rax + 0x10], rcx
lea rcx, str.Outputs_data_after_evaluation
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x4047f3
lea rcx, str.Call
mov qword [rax], rcx
lea rcx, [0x00404570]
mov qword [rax + 8], rcx
lea rcx, str.Section_Name
mov qword [rax + 0x10], rcx
lea rcx, str.runs_all_the_commands_in_that_section_and_returnd_and_continues_executing_commands_after_that_line
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rbp, str.Path_to_an_NVU_File
test rax, rax
je 0x404837
lea rcx, [0x0040cfa4]
mov qword [rax + 0x10], rbp
mov qword [rax], rcx
lea rcx, [fcn.00403e30]
mov qword [rax + 8], rcx
lea rcx, str.Executes_all_the_commands_in_that_file_and_returns
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x404874
lea rcx, str.RunOnce
mov qword [rax + 0x10], rbp
mov qword [rax], rcx
lea rcx, [fcn.00404100]
mov qword [rax + 8], rcx
lea rcx, str.Run_all_the_commands_in_this_file_and_delete_the_file
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea rbp, str.Section_filename
test rax, rax
je 0x4048b8
lea rcx, str.ExportSection
mov qword [rax + 0x10], rbp
mov qword [rax], rcx
lea rcx, [0x004031f0]
mov qword [rax + 8], rcx
lea rcx, str.Adds_or_replaces_the_given_section_of_the_given_file_from_the_same_section_name_in_the_current_NVU_file
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x4048f5
lea rcx, str.ImportSection
mov qword [rax + 0x10], rbp
mov qword [rax], rcx
lea rcx, [0x004032b0]
mov qword [rax + 8], rcx
lea rcx, str.Adds_or_replaces_the_given_section_of_the_current_file_from_the_same_section_name_in_the_given_NVU_file
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbp, qword [rsp + 0x208]
test rax, rax
je 0x404941
lea rcx, str.RemoveSection
mov qword [rax], rcx
lea rcx, [0x00402970]
mov qword [rax + 8], rcx
lea rcx, str.Section
mov qword [rax + 0x10], rcx
lea rcx, str.Removes_the_given_section_from_the_current_file
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x404985
lea rcx, str.DirAndApply
mov qword [rax], rcx
lea rcx, [0x00404180]
mov qword [rax + 8], rcx
lea rcx, str.DirPath_Command
mov qword [rax + 0x10], rcx
lea rcx, str.A_dir_will_be_applied_to_the_given_path_and_for_each_file_found_it_sets_variable_current_file_to_that_file_and_calls_the_given_command.
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x4049c9
lea rcx, [0x0040cd1c]
mov qword [rax], rcx
lea rcx, [0x00404300]
mov qword [rax + 8], rcx
lea rcx, str.___Exp1___Exp2_then_Command
mov qword [rax + 0x10], rcx
lea rcx, str.Executes_command_if_Exp1_is_the_same_as_Exp2_for__or_Exp1_has_Exp2_for___if___is_added_to_the_beging_of_Exp1_it_will_negate_the_result
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x404a06
lea rcx, str.Eval
mov qword [rax + 0x10], r12
mov qword [rax], rcx
lea rcx, [fcn.00403690]
mov qword [rax + 8], rcx
lea rcx, str.reEvaluates_the_given_command_and_executes_it
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r12, qword [rsp + 0x1f0]
test rax, rax
je 0x404a52
lea rcx, str.StartLogging
mov qword [rax], rcx
lea rcx, [0x00402810]
mov qword [rax + 8], rcx
lea rcx, str.Filename
mov qword [rax + 0x10], rcx
lea rcx, str.Opens_the_given_log_files_ad_Logs_all_the_commands_in_the_given_file
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x404a8f
lea rdx, str.StopLogging
mov qword [rax + 0x10], r13
mov qword [rax], rdx
lea rdx, [0x00401af0]
mov qword [rax + 8], rdx
lea rdx, str.Stops_logging_close_the_file
mov qword [rax + 0x18], rdx
mov rdx, qword [rdi]
mov qword [rax + 0x20], rdx
mov qword [rdi], rax
mov ecx, 0x28
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r13, qword [rsp + 0x1e8]
test rax, rax
je 0x404adb
lea rcx, [0x0040cb8c]
mov qword [rax], rcx
lea rcx, [0x00401d30]
mov qword [rax + 8], rcx
lea rcx, str.milisconds
mov qword [rax + 0x10], rcx
lea rcx, str.Waits_for_a_number_of_miliseconds_passed_before_executing_the_next_command
mov qword [rax + 0x18], rcx
mov rcx, qword [rdi]
mov qword [rax + 0x20], rcx
mov qword [rdi], rax
lea rax, str.Generic_command_class_basic_functionality.
mov dword [rdi + 0x808], esi
mov qword [rdi + 0xa98], rax
nop
movsxd rax, dword [rdi + 0x808]
shl rax, 4
mov qword [rax + rdi + 8], rsi
movsxd rax, dword [rdi + 0x808]
inc rax
shl rax, 4
mov qword [rax + rdi], rsi
inc dword [rdi + 0x808]
cmp dword [rdi + 0x808], 0x80
jl 0x404af0
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, [rsp + 0x30]
lea rdx, str.windir
mov rcx, rdi
call fcn.00402ae0
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x30]
lea rdx, str.sysdir
mov rcx, rdi
call fcn.00402ae0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetSystemWow64DirectoryA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x104
lea rcx, [rsp + 0x30]
test rax, rax
je 0x404b9c
call rax
jmp 0x404ba2
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x30]
lea rdx, str.syswow64dir
mov rcx, rdi
call fcn.00402ae0
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea r8, [rsp + 0x30]
lea rdx, str.Currentdir
mov rcx, rdi
call fcn.00402ae0
lea rdx, [rsp + 0x30]
mov r9d, 1
mov r8d, 0x17
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea r8, [rsp + 0x30]
lea rdx, str.commonprograms
mov rcx, rdi
call fcn.00402ae0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea rdx, str.Language_Resource__d
movzx ebx, ax
lea rcx, [rsp + 0x30]
mov r8d, ebx
call qword [sym.imp.msvcrt.dll_sprintf]
lea r8, [rsp + 0x30]
lea rdx, str.Language_Resource
mov rcx, rdi
call fcn.00402ae0
and ebx, 0x3ff
lea rdx, str.Language_Resource__d
lea rcx, [rsp + 0x30]
mov r8d, ebx
call qword [sym.imp.msvcrt.dll_sprintf]
lea r8, [rsp + 0x30]
lea rdx, str.Primary_Language_Resource
mov rcx, rdi
call fcn.00402ae0
lea r8, [0x0040c7dc]
lea rdx, [0x0040caac]
mov rcx, rdi
call fcn.00402ae0
mov rcx, qword [rdi + 0xaa0]
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x30]
lea rdx, str.Current_Parser_Path
mov rcx, rdi
call fcn.00402ae0
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll__mbsrchr]
mov rbx, qword [rsp + 0x210]
test rax, rax
jne 0x404ccf
lea rax, [rsp + 0x30]
jmp 0x404cd2
inc rax
lea rdx, str.Current_Parser_Name
mov r8, rax
mov rcx, rdi
call fcn.00402ae0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea r8, [rsp + 0x30]
lea rdx, str.Computer_Name
mov rcx, rdi
call fcn.00402ae0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea r8, [rsp + 0x30]
lea rdx, str.User_Name
mov rcx, rdi
call fcn.00402ae0
lea rcx, [rsp + 0x140]
mov dword [rsp + 0x140], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r8d, dword [rsp + 0x144]
lea rdx, [0x0040ca5c]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_sprintf]
lea r8, [rsp + 0x30]
lea rdx, str.OS_Major_Version
mov rcx, rdi
call fcn.00402ae0
mov r8d, dword [rsp + 0x148]
lea rdx, [0x0040ca5c]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_sprintf]
lea r8, [rsp + 0x30]
lea rdx, str.OS_Minor_Version
mov rcx, rdi
call fcn.00402ae0
mov eax, dword [rsp + 0x150]
mov qword [rdi + 0xac0], rsi
dec eax
mov rsi, qword [rsp + 0x200]
je 0x404e49
dec eax
jne 0x404eb3
lea r8, str.ControlClass
lea rdx, str.DriverBaseRegPath
mov rcx, rdi
call fcn.00402ae0
mov r11d, dword [rsp + 0x144]
cmp r11d, 5
jne 0x404e3a
mov eax, dword [rsp + 0x148]
test eax, eax
je 0x404e31
dec eax
je 0x404e28
dec eax
lea rdx, [0x0040ca04]
mov rcx, rdi
je 0x404e1c
lea r8, str.Unknown_WIN32_NT5
jmp 0x404eae
lea r8, str.WinServer2003Family
jmp 0x404eae
lea r8, str.WinXP
jmp 0x404ea4
lea r8, str.Win2K
jmp 0x404ea4
cmp r11d, 4
jne 0x404eb3
lea r8, str.WinNT4
jmp 0x404ea4
lea r8, str.ServicesClass
lea rdx, str.DriverBaseRegPath
mov rcx, rdi
call fcn.00402ae0
mov r11d, dword [rsp + 0x148]
test r11d, r11d
je 0x404e9d
cmp r11d, 0xa
je 0x404e94
cmp r11d, 0x5a
lea rdx, [0x0040ca04]
mov rcx, rdi
je 0x404e8b
lea r8, str.Unknown_WIN32_Windows
jmp 0x404eae
lea r8, str.WinME
jmp 0x404eae
lea r8, str.Win98
jmp 0x404ea4
lea r8, str.Win95
lea rdx, [0x0040ca04]
mov rcx, rdi
call fcn.00402ae0
mov rax, rdi
mov rdi, qword [rsp + 0x1f8]
add rsp, 0x218
ret