Function at 0x40de40
Capabilities:
Check os version
Get common file path
Get geographical location
Get system information on windows

Disassembly:
sub esp, 0xbd8
mov eax, dword [0x45e068]
xor eax, esp
mov dword [esp + 0xbd4], eax
lea eax, [esp + 0x74]
mov dword [0x45f6c8], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x74]
shl edx, 4
sub edx, dword [esp + 0x74]
shl edx, 2
mov dword [0x45f734], edx
mov dword [0x45f738], edx
cmp eax, 2
jne 0x40de9b
mov ecx, dword [esp + 0x11c]
shl ecx, 4
sub ecx, dword [esp + 0x11c]
jmp 0x40deb1
cmp eax, 1
jne 0x40deb9
mov ecx, dword [esp + 0xc8]
shl ecx, 4
sub ecx, dword [esp + 0xc8]
lea eax, [edx + ecx*4]
mov dword [0x45f738], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
push 6
push section..data
push 0xe
push 0x400
call esi
push 6
push 0x45b00c
push 0xf
push 0x400
call esi
push 0xa0
lea eax, [esp + 0xb40]
push 0
push eax
call fcn.00423110
add esp, 0xc
lea eax, [esp + 0xb3c]
push 0x50
push eax
push 0x1f
push 0x400
call esi
mov ax, word [esp + 0xb3c]
mov edi, 1
mov ecx, dword [0x45f72c]
or ax, 0x20
cmp ax, 0x64
lea eax, [esp + 0xb3c]
push 0x50
push eax
push 0x1003
cmove ecx, edi
push 0x400
mov dword [0x45f72c], ecx
call esi
mov eax, dword [0x45f730]
cmp word [esp + 0xb3c], 0x48
push 0x114
cmove eax, edi
mov dword [0x45f730], eax
lea eax, [esp + 0x19c]
push 0
push eax
call fcn.00423110
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x1a4]
add esp, 0xc
mov dword [esp + 0x198], 0x114
push eax
call edi
mov eax, dword [esp + 0x1a8]
mov edx, dword [esp + 0x19c]
mov ecx, dword [esp + 0x1a0]
mov esi, dword [esp + 0x1a4]
mov dword [0x45f6cc], edx
mov dword [0x45f6d0], ecx
mov dword [0x45f6d4], esi
sub eax, 1
je 0x40e3dc
sub eax, 1
jne 0x40e446
mov dword [0x45b04c], 6
mov dword [0x45f6bc], 2
mov dword [0x45f6c0], 3
mov dword [0x45f6e4], eax
push ebx
cmp edx, 6
jb 0x40e297
cmp ecx, 2
jb 0x40e297
lea ecx, [esp + 0x2c]
mov dword [0x45b04c], 6
call fcn.0041aa30
push 0x45b4e0
lea ecx, [esp + 0x30]
call fcn.0041adf0
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x44], vtable.SmartCOMPointer_struct_IEnumWbemClassObject_.0
test al, al
je 0x40e0c6
cmp dword [esp + 0x58], 4
sbb eax, eax
and eax, dword [esp + 0x58]
mov dword [0x45f6e4], eax
movzx eax, word [esp + 0x4c]
mov dword [0x45f6cc], eax
movzx eax, word [esp + 0x4e]
mov dword [0x45f6d0], eax
movzx eax, word [esp + 0x50]
mov dword [0x45f6d4], eax
movzx eax, word [esp + 0x52]
mov dword [0x45f6d8], eax
movzx eax, word [esp + 0x54]
mov dword [0x45f6dc], eax
test ecx, ecx
je 0x40e084
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x3c], vtable.SmartCOMPointer_struct_IWbemServices_.0
test ecx, ecx
je 0x40e09a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x34], vtable.SmartCOMPointer_struct_IWbemLocator_.0
test ecx, ecx
je 0x40e0b0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [esp + 0x30], 0
jl 0x40e31f
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x40e31f
test ecx, ecx
je 0x40e0d0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x3c], vtable.SmartCOMPointer_struct_IWbemServices_.0
test ecx, ecx
je 0x40e0e6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x34], vtable.SmartCOMPointer_struct_IWbemLocator_.0
test ecx, ecx
je 0x40e0fc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [esp + 0x30], 0
jl 0x40e109
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [0x45b04c], 0x15
mov dword [0x45f6e4], 0
lea eax, [esp + 0x930]
mov dword [esp + 0x91c], 0
mov dword [esp + 0x92c], eax
lea ecx, [esp + 0x14]
xor eax, eax
mov dword [esp + 0x920], 0
mov word [esp + 0x930], ax
mov esi, 0x441510
mov dword [esp + 0x1c], eax
xor edi, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x91c]
push 0x45b4e0
push eax
push 0x447b9c
mov dword [esp + 0x930], 2
mov dword [esp + 0x934], 0x108
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], str.SoftwareMicrosoftWindows_NTCurrentVersion
call fcn.00412390
test al, al
je 0x40e1f1
push dword [esp + 0x92c]
lea ecx, [esp + 0x10]
call fcn.004131f0
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
test al, al
je 0x40e1f1
test edi, edi
je 0x40e1d2
push esi
call dword [sym.imp.USER32.dll_CharLowerW]
push str.preinstallation_environment
push esi
call fcn.004221d0
add esp, 8
test eax, eax
je 0x40e1f1
sub eax, esi
sar eax, 1
js 0x40e1f1
or dword [0x45f6c8], 4
push 0x45b4e0
lea eax, [esp + 0x920]
mov dword [0x45f6e0], 0
push eax
push str.ReleaseId
lea ecx, [esp + 0x20]
call fcn.00412390
test al, al
je 0x40e253
mov ebx, dword [esp + 0x92c]
push 0
push 0x20
push 0xa
push 1
push 4
push 0x45f6e0
push ebx
call fcn.0040f260
add esp, 0x1c
test al, al
jne 0x40e253
mov eax, dword [vtable.ErrorClass.0]
push ebx
push str.Cannot_read_integer___s_
push 0x45b4e0
call dword [eax + 0x20]
add esp, 0xc
cmp dword [esp + 0x1c], 0
pop ebx
je 0x40e267
push dword [esp + 0x14]
call fcn.00426f61
add esp, 4
test edi, edi
je 0x40e274
push esi
call fcn.00426f61
add esp, 4
lea ecx, [esp + 0x918]
call fcn.0040bea0
mov edx, dword [0x45f6cc]
mov ecx, dword [0x45f6d0]
mov esi, dword [0x45f6d4]
jmp 0x40e446
cmp edx, 4
jbe 0x40e109
push 0x11c
lea eax, [esp + 0x84]
push 0
push eax
call fcn.00423110
add esp, 0xc
mov dword [esp + 0x80], 0x11c
lea eax, [esp + 0x80]
push eax
call edi
test eax, eax
je 0x40e109
movzx eax, byte [esp + 0x19a]
mov dword [0x45f6e4], eax
mov eax, dword [esp + 0x84]
mov dword [0x45f6cc], eax
mov eax, dword [esp + 0x88]
mov dword [0x45f6d0], eax
mov eax, dword [esp + 0x8c]
mov dword [0x45f6d4], eax
movzx eax, word [esp + 0x194]
mov dword [0x45f6d8], eax
movzx eax, word [esp + 0x196]
mov dword [0x45f6dc], eax
push dword [0x45f6dc]
push dword [0x45f6d8]
push str._u._u
push 8
push 0x45f71c
call fcn.00414590
mov esi, dword [0x45f6e4]
xor eax, eax
mov edi, dword [0x45f6cc]
add esp, 0x14
mov ebx, dword [0x45f6d0]
cmp esi, 4
mov dword [0x45b04c], 0x15
mov edx, 0x4415d8
cmovge esi, eax
mov dword [0x45f6e4], esi
nop
cmp edi, dword [edx]
jne 0x40e389
cmp ebx, dword [edx + 4]
jne 0x40e389
movzx eax, byte [edx + 8]
xor ecx, ecx
cmp esi, 1
sete cl
cmp ecx, eax
je 0x40e396
add edx, 0x10
cmp edx, 0x4416d8
jb 0x40e370
jmp 0x40e3ba
mov eax, dword [edx + 0xc]
mov dword [0x45b04c], eax
cmp eax, 0x13
jne 0x40e3ba
cmp dword [0x45f6d4], 0x44d7
mov ecx, 0x14
cmovae eax, ecx
mov dword [0x45b04c], eax
cmp edi, 5
ja 0x40e3cd
jne 0x40e11d
test ebx, ebx
je 0x40e11d
mov dword [0x45f6ec], 0x7f
jmp 0x40e11d
mov dword [0x45f6bc], 1
mov dword [0x45f6c0], 2
cmp ecx, 0x5a
jb 0x40e401
mov dword [0x45b04c], 5
jmp 0x40e43c
cmp ecx, 0xa
jb 0x40e412
mov dword [0x45b04c], 4
jmp 0x40e43c
mov eax, 0x438
cmp si, ax
jbe 0x40e428
mov dword [0x45b04c], 3
jmp 0x40e43c
mov dword [0x45f6c0], 1
mov dword [0x45b04c], 2
movzx eax, si
mov dword [esp + 0x1a4], eax
push esi
push ecx
push edx
push str._d._d._d
push 0x10
push 0x45f6fc
call fcn.00414590
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x45f6e8], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x45f6c4], eax
lea eax, [esp + 0x708]
mov dword [esp + 0x704], eax
xor eax, eax
mov word [esp + 0x708], ax
lea eax, [esp + 0x708]
push pe_nt_image_headers32
push eax
mov dword [esp + 0x6fc], 0
mov dword [esp + 0x700], 0
mov dword [esp + 0x704], 2
mov dword [esp + 0x708], 0x108
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x40e4e1
mov eax, dword [esp + 0x704]
xor ecx, ecx
mov word [eax], cx
mov dword [esp + 0x6f8], ecx
mov eax, dword [esp + 0x704]
movzx eax, word [eax]
push eax
call fcn.0042b45e
add esp, 4
mov word [0x45f6f4], ax
mov eax, 0x43
mov dword [esp + 0x10], reloc.OLEAUT32.dll_SysReAllocString
mov word [0x45f6f8], ax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x6f4]
mov dword [esp + 0x14], 0x447c18
push 0x45b4e0
push eax
push str.BootFolder
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call fcn.00412390
test al, al
je 0x40e565
mov eax, dword [esp + 0x704]
movzx eax, word [eax]
push eax
call fcn.0042b45e
add esp, 4
mov word [0x45f6f8], ax
mov eax, dword [0x45ffb4]
test eax, eax
je 0x40e577
lea ecx, [esp + 0x58]
push ecx
call eax
jmp 0x40e582
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x5c]
mov dword [0x45b050], eax
movzx eax, word [esp + 0x58]
cmp eax, 9
ja case.0x40e59c.1
movzx eax, byte [eax + 0x40e85c]
jmp dword [eax*4 + 0x40e848]
mov dword [0x45b048], 1
jmp 0x40e5dd
mov dword [0x45b048], 4
jmp 0x40e5dd
mov dword [0x45b048], 5
jmp 0x40e5dd
mov dword [0x45b048], 8
jmp 0x40e5dd
mov dword [0x45b048], 0
cmp dword [0x45ffb8], 0
mov dword [esp + 0x24], 0
je 0x40e612
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x45ffb8]
test eax, eax
je 0x40e612
cmp dword [esp + 0x24], 0
je 0x40e612
or dword [0x45f6c8], 1
lea eax, [esp + 0x4e4]
mov dword [esp + 0x4d0], 0
mov dword [esp + 0x4e0], eax
lea ecx, [esp + 0x4d0]
xor eax, eax
mov dword [esp + 0x4d4], 0
mov word [esp + 0x4e4], ax
mov dword [esp + 0x2ac], eax
mov dword [esp + 0x2b0], eax
lea eax, [esp + 0x2c0]
mov dword [esp + 0x2bc], eax
xor eax, eax
push eax
push eax
mov dword [esp + 0x4e0], 2
mov dword [esp + 0x4e4], 0x108
mov dword [esp + 0x2bc], 2
mov dword [esp + 0x2c0], pe_nt_image_headers32
mov word [esp + 0x2c8], ax
call fcn.0040c180
test al, al
je 0x40e703
push 0
push 0x441e48
push str.writableCheck
push dword [esp + 0x4ec]
lea ecx, [esp + 0x2bc]
call fcn.0040d4c0
test al, al
je 0x40e703
push 0
push 0x4000000
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x2d4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40e6fc
push 0
mov byte [0x45b01e], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40e703
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x45f72c], 1
jne 0x40e75f
mov eax, dword [str.dd_MM_yy]
mov esi, 0x3c
mov ecx, 0x45b188
test eax, eax
je 0x40e750
movzx edx, word [eax]
add eax, 2
test dx, dx
je 0x40e750
nop word [eax + eax]
sub esi, 1
je 0x40e750
mov word [ecx], dx
add ecx, 2
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0x40e730
nop word [eax + eax]
xor eax, eax
mov dword [0x45b28c], 0x447ea0
mov word [ecx], ax
cmp dword [0x45f730], 1
jne 0x40e7bb
mov edi, dword [0x45b288]
mov esi, 0x3c
mov eax, edi
mov ecx, str.hh:mm:ss_tt
test eax, eax
je 0x40e7b0
movzx edx, word [eax]
add eax, 2
test dx, dx
je 0x40e7b0
nop dword [eax]
sub esi, 1
je 0x40e7b0
mov word [ecx], dx
add ecx, 2
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0x40e790
nop word [eax + eax]
xor eax, eax
mov dword [0x45f804], edi
mov word [ecx], ax
lea ecx, [esp + 0x2ac]
call fcn.0040bea0
and dword [esp + 0x2ac], 0xfffffffc
lea ecx, [esp + 0x4d0]
mov dword [esp + 0x2b0], 0
mov dword [esp + 0x2b8], 0
call fcn.0040bea0
and dword [esp + 0x4d0], 0xfffffffc
cmp dword [esp + 0x18], 0
pop edi
mov dword [esp + 0x4d0], 0
mov dword [esp + 0x4d8], 0
pop esi
je 0x40e824
push dword [esp + 0xc]
call fcn.00426f61
add esp, 4
lea ecx, [esp + 0x6ec]
call fcn.0040bea0
mov ecx, dword [esp + 0xbd4]
xor ecx, esp
call fcn.00420bdf
add esp, 0xbd8
ret