Function at 0x403680
Capabilities:
Check os version
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x720], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x71c], 0x20
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20c], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x71c]
imul ecx, ecx, 0x90
push ecx
call fcn.0041e0a0
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov dword [edx + 0x208], eax
push 0x4030
call fcn.0041e0a0
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x80000000
jae 0x40372b
mov eax, dword [ebp - 4]
and eax, 0xffff
cmp eax, 5
jl 0x40371d
mov ecx, dword [ebp - 0x10]
mov word [ecx + 0x614], 2
jmp 0x403729
mov edx, dword [ebp - 0x10]
mov word [edx + 0x614], 1
jmp 0x403737
mov eax, dword [ebp - 0x10]
mov word [eax + 0x614], 0
push 0x104
mov ecx, dword [ebp - 0x10]
add ecx, 0x616
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x10]
add edx, 0x616
push edx
call fcn.0042814d
add esp, 4
push 0x42d1c4
mov eax, dword [ebp - 0x10]
add eax, 0x616
push eax
call fcn.0041dfc0
add esp, 8
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x750], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x754], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x758], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x75c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x734], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x738], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x73c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x740], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x744], 0
push 0x42d1c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x72c], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x72c], 0
je 0x4038df
push str.CreateToolhelp32Snapshot
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x72c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x734], eax
push str.Process32First
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x72c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x738], eax
push str.Process32Next
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x72c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x73c], eax
push str.Module32First
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x72c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x740], eax
push str.Module32Next
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x72c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x744], eax
push str.Thread32First
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x72c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x748], eax
push str.Thread32Next
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x72c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x74c], eax
push str.Psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x728], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x728], 0
je 0x403977
push str.EnumProcessModules
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x728]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x750], eax
push str.EnumProcesses
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x728]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x754], eax
push str.GetModuleFileNameExA
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x728]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x758], eax
push str.GetModuleInformation
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x728]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x75c], eax
push str.NTDll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x730], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x730], 0
je 0x4039b5
push str.NtQuerySystemInformation
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x730]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x760], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret