Function at 0x41dbb0
Capabilities:
Check os version
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436e30
mov eax, dword fs:[0]
push eax
sub esp, 0x940
mov eax, dword [0x442308]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8bc], 0
lea ecx, [ebp - 0x6b4]
call fcn.00413a70
mov dword [ebp - 4], 1
push 0x114
push 0
lea eax, [ebp - 0x548]
push eax
call fcn.00423660
add esp, 0xc
mov dword [ebp - 0x548], 0x114
lea ecx, [ebp - 0x548]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x538], 2
jb 0x41dc42
cmp dword [ebp - 0x544], 6
jb 0x41dc42
mov dword [ebp - 0x8c0], 1
jmp 0x41dc4c
mov dword [ebp - 0x8c0], 0
mov dl, byte [ebp - 0x8c0]
mov byte [ebp - 0x42b], dl
cmp dword [ebp - 0x538], 2
jb 0x41dc88
cmp dword [ebp - 0x544], 6
ja 0x41dc7c
cmp dword [ebp - 0x544], 6
jne 0x41dc88
cmp dword [ebp - 0x540], 2
jb 0x41dc88
mov dword [ebp - 0x8c4], 1
jmp 0x41dc92
mov dword [ebp - 0x8c4], 0
mov al, byte [ebp - 0x8c4]
mov byte [ebp - 0x42c], al
mov dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0
jne 0x41dcc5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.004084c0
mov dword [ebp - 0x430], eax
jmp 0x41dccf
mov dword [ebp - 0x430], 0
xor ecx, ecx
mov word [ebp - 0x424], cx
push 0x206
push 0
lea edx, [ebp - 0x422]
push edx
call fcn.00423660
add esp, 0xc
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.00423660
add esp, 0xc
push 0x104
lea edx, [ebp - 0x424]
push edx
call fcn.00408460
add esp, 8
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x6b4]
call fcn.004015d0
mov ecx, dword [0x43c748]
push ecx
push 0x5c
lea ecx, [ebp - 0x6b4]
call fcn.00403d30
push eax
push 0
lea edx, [ebp - 0x6f8]
push edx
lea ecx, [ebp - 0x6b4]
call fcn.00405cc0
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x8cc], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x8cc]
push ecx
lea ecx, [ebp - 0x698]
call fcn.00403d00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6f8]
call fcn.00401080
lea edx, [ebp - 0x698]
push edx
lea eax, [ebp - 0x714]
push eax
call fcn.0041e360
add esp, 8
mov dword [ebp - 0x8d0], eax
mov ecx, dword [ebp - 0x8d0]
mov dword [ebp - 0x8d4], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x8d4]
push edx
lea ecx, [ebp - 0x67c]
call fcn.00403d00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x714]
call fcn.00401080
mov eax, dword [0x43c748]
push eax
push 0x5c
lea ecx, [ebp - 0x698]
call fcn.00403d30
push eax
push 0
lea ecx, [ebp - 0x730]
push ecx
lea ecx, [ebp - 0x698]
call fcn.00405cc0
mov dword [ebp - 0x8d8], eax
mov edx, dword [ebp - 0x8d8]
mov dword [ebp - 0x8dc], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x8dc]
push eax
lea ecx, [ebp - 0x660]
call fcn.00403d00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x730]
call fcn.00401080
push 0x438bf0
push 0x438bfc
push 0x17
lea ecx, [ebp - 0x74c]
push ecx
call fcn.0040cea0
add esp, 8
mov dword [ebp - 0x8e0], eax
mov edx, dword [ebp - 0x8e0]
mov dword [ebp - 0x8e4], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x8e4]
push eax
lea ecx, [ebp - 0x768]
push ecx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x8e8], eax
mov edx, dword [ebp - 0x8e8]
mov dword [ebp - 0x8ec], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x8ec]
push eax
lea ecx, [ebp - 0x784]
push ecx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x8f0], eax
mov edx, dword [ebp - 0x8f0]
mov dword [ebp - 0x8f4], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x8f4]
push eax
lea ecx, [ebp - 0x644]
call fcn.00403d00
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x784]
call fcn.00401080
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x768]
call fcn.00401080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74c]
call fcn.00401080
push 0x25
lea ecx, [ebp - 0x7a0]
push ecx
call fcn.0040cea0
add esp, 8
mov dword [ebp - 0x8f8], eax
mov edx, dword [ebp - 0x8f8]
mov dword [ebp - 0x8fc], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x8fc]
push eax
lea ecx, [ebp - 0x628]
call fcn.00403d00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x7a0]
call fcn.00401080
push 0x29
lea ecx, [ebp - 0x7bc]
push ecx
call fcn.0040cea0
add esp, 8
mov dword [ebp - 0x900], eax
mov edx, dword [ebp - 0x900]
mov dword [ebp - 0x904], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x904]
push eax
lea ecx, [ebp - 0x60c]
call fcn.00403d00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x7bc]
call fcn.00401080
push 0x438c00
push 0x438c28
push 0x23
lea ecx, [ebp - 0x7d8]
push ecx
call fcn.0040cea0
add esp, 8
mov dword [ebp - 0x908], eax
mov edx, dword [ebp - 0x908]
mov dword [ebp - 0x90c], edx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x90c]
push eax
lea ecx, [ebp - 0x7f4]
push ecx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x910], eax
mov edx, dword [ebp - 0x910]
mov dword [ebp - 0x914], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x914]
push eax
lea ecx, [ebp - 0x810]
push ecx
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x918], eax
mov edx, dword [ebp - 0x918]
mov dword [ebp - 0x91c], edx
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x91c]
push eax
lea ecx, [ebp - 0x5f0]
call fcn.00403d00
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x810]
call fcn.00401080
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7f4]
call fcn.00401080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x7d8]
call fcn.00401080
push 0x438c2c
push 0x438c48
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00402c40
add esp, 0x10
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x5d4]
call fcn.004015d0
push 0x438c8c
push 0x438c44
push 0x1a
lea eax, [ebp - 0x82c]
push eax
call fcn.0040cea0
add esp, 8
mov dword [ebp - 0x920], eax
mov ecx, dword [ebp - 0x920]
mov dword [ebp - 0x924], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x924]
push edx
lea eax, [ebp - 0x848]
push eax
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x928], eax
mov ecx, dword [ebp - 0x928]
mov dword [ebp - 0x92c], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x92c]
push edx
lea eax, [ebp - 0x864]
push eax
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x930], eax
mov ecx, dword [ebp - 0x930]
mov dword [ebp - 0x934], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x934]
push edx
lea ecx, [ebp - 0x5b8]
call fcn.00403d00
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x864]
call fcn.00401080
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x848]
call fcn.00401080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x82c]
call fcn.00401080
push 0x438cb4
push 0x438cdc
push 0x1c
lea eax, [ebp - 0x880]
push eax
call fcn.0040cea0
add esp, 8
mov dword [ebp - 0x938], eax
mov ecx, dword [ebp - 0x938]
mov dword [ebp - 0x93c], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x93c]
push edx
lea eax, [ebp - 0x89c]
push eax
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x940], eax
mov ecx, dword [ebp - 0x940]
mov dword [ebp - 0x944], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x944]
push edx
lea eax, [ebp - 0x8b8]
push eax
call fcn.00404120
add esp, 0xc
mov dword [ebp - 0x948], eax
mov ecx, dword [ebp - 0x948]
mov dword [ebp - 0x94c], ecx
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x94c]
push edx
lea ecx, [ebp - 0x564]
call fcn.00403d00
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x8b8]
call fcn.00401080
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x89c]
call fcn.00401080
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x880]
call fcn.00401080
lea eax, [ebp - 0x5b8]
push eax
lea ecx, [ebp - 0x59c]
call fcn.00403d00
movzx ecx, byte [ebp - 0x42b]
test ecx, ecx
je 0x41e2e9
push 1
push 0x438ce0
lea ecx, [ebp - 0x6d8]
call entry0
mov byte [ebp - 4], 0x13
push str.SHGetKnownFolderPath
lea ecx, [ebp - 0x6d8]
call fcn.00422f30
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 0
je 0x41e2da
mov dword [ebp - 0x6dc], 0
lea edx, [ebp - 0x6dc]
push edx
push 0
push 0x8000
push 0x439fe4
call dword [ebp - 0x6b8]
cmp dword [ebp - 0x6dc], 0
je 0x41e2da
mov eax, dword [ebp - 0x6dc]
push eax
lea ecx, [ebp - 0x59c]
call fcn.004015d0
push str.BaiduBaiduPinyin_
lea ecx, [ebp - 0x59c]
call fcn.004016e0
mov ecx, dword [ebp - 0x6dc]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x6dc], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6d8]
call fcn.00401080
push 0x104
lea edx, [ebp - 0x21c]
push edx
push str._TEMP_BaiduBaiduPinyin_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x580]
call fcn.004015d0
lea ecx, [ebp - 0x6b4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041e560
mov edx, dword [ebp - 0x8bc]
or edx, 1
mov dword [ebp - 0x8bc], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6b4]
call fcn.00409560
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042364d
mov esp, ebp
pop ebp
ret