Function at 0x405f03
Capabilities:
Check os version
Get common file path
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x418]
sub esp, 0x498
mov eax, dword [0x434044]
xor eax, ebp
mov dword [ebp + 0x414], eax
push ebx
push edi
mov edi, 0x94
push edi
lea eax, [ebp - 0x80]
push 0
push eax
mov byte [esi + 4], 0
mov dword [esi], 0x13
call fcn.00417990
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], edi
call ebx
test eax, eax
jne 0x405f62
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], edi
call ebx
test eax, eax
je 0x40616e
mov eax, dword [ebp - 0x70]
dec eax
je 0x405fb6
dec eax
jne 0x405ff8
cmp dword [ebp - 0x7c], 4
ja 0x405f7b
mov dword [esi], 0x11
cmp dword [ebp - 0x7c], 5
mov eax, dword [ebp - 0x78]
jne 0x405fa4
test eax, eax
jne 0x405f8e
mov dword [esi], 0x12
cmp eax, 1
jne 0x405f99
mov dword [esi], 0x13
cmp eax, 2
jne 0x405ff8
mov dword [esi], 0x14
cmp dword [ebp - 0x7c], 6
jne 0x405ff8
test eax, eax
jne 0x405ff8
mov dword [esi], 0x15
jmp 0x405ff8
cmp dword [ebp - 0x7c], 4
push 3
pop eax
mov dword [esi], eax
jne 0x405fe1
cmp dword [ebp - 0x78], 0
jne 0x405fcd
mov dword [esi], 1
cmp dword [ebp - 0x78], 0xa
jne 0x405fd9
mov dword [esi], 2
cmp dword [ebp - 0x78], 0x5a
jne 0x405fe1
mov dword [esi], eax
mov ecx, dword [ebp - 0x74]
and ecx, 0xffff0000
cmp ecx, 0x45a0000
jne 0x405ff4
mov dword [esi], eax
mov byte [esi + 4], 1
and word [esi + 0x72c], 0
push 0xa
lea eax, [ebp + 0x14]
push eax
push 9
push 0x400
mov byte [esi + 0x628], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [ebp + 0x14]
call fcn.00406187
cmp eax, 0x404
mov dword [esi + 8], eax
je 0x40606c
cmp eax, 0x804
je 0x406063
cmp eax, 0xc04
je 0x40605a
cmp eax, 0x1004
je 0x406051
cmp eax, 0x1404
jne 0x406073
mov dword [esi + 8], 0x14c1
jmp 0x406073
mov dword [esi + 8], 0x10c0
jmp 0x406073
mov dword [esi + 8], 0xcc1
jmp 0x406073
mov dword [esi + 8], 0x8c0
jmp 0x406073
mov dword [esi + 8], 0x4c1
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
and eax, 0xff
sub eax, 8
je 0x4060db
sub eax, 9
je 0x4060d2
dec eax
je 0x4060c9
sub eax, 7
je 0x4060c0
sub eax, 0xe
je 0x4060b7
sub eax, 0x99
je 0x4060ae
dec eax
jne 0x4060e2
mov dword [esi + 0xc], 0x3b6
jmp 0x4060e2
mov dword [esi + 0xc], 0x3a8
jmp 0x4060e2
mov dword [esi + 0xc], 0x4e9
jmp 0x4060e2
mov dword [esi + 0xc], 0x4e3
jmp 0x4060e2
mov dword [esi + 0xc], 0x3b5
jmp 0x4060e2
mov dword [esi + 0xc], 0x3a4
jmp 0x4060e2
mov dword [esi + 0xc], 0x4e5
cmp byte [esi + 4], 0
mov edi, 0x104
push edi
je 0x406130
lea ebx, [esi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esi + 0x114]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [esi + 0xc]
push ebx
lea edi, [esi + 0x218]
mov eax, esi
call fcn.004063d8
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x114]
push eax
lea edi, [esi + 0x420]
mov eax, esi
call fcn.004063d8
jmp 0x40616e
lea ebx, [esi + 0x218]
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esi + 0x420]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [esi + 0xc]
push ebx
lea edi, [esi + 0x10]
push esi
call fcn.00406381
lea eax, [esi + 0x420]
push eax
mov eax, dword [esi + 0xc]
lea edi, [esi + 0x114]
push esi
call fcn.00406381
mov ecx, dword [ebp + 0x414]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004175dc
add ebp, 0x418
leave
ret