Function at 0x406230
Capabilities:
Check os version
Get common file path
Write file on windows

Disassembly:
sub esp, 0x1d4
mov eax, dword [0x42b160]
xor eax, esp
mov dword [esp + 0x1d0], eax
push ebx
xor ebx, ebx
push esi
push 0x90
lea eax, [esp + 0x48]
push ebx
push eax
mov byte [esp + 0x14], 1
mov dword [esp + 0x19], ebx
mov dword [esp + 0x45], ebx
mov dword [esp + 0x41], ebx
mov dword [esp + 0x3d], ebx
mov dword [esp + 0x39], ebx
mov dword [esp + 0x35], ebx
mov dword [esp + 0x31], ebx
mov dword [esp + 0x2d], ebx
mov dword [esp + 0x29], ebx
mov dword [esp + 0x25], ebx
mov dword [esp + 0x21], ebx
mov dword [esp + 0x1d], ebx
mov dword [esp + 0x15], ebx
mov dword [esp + 0x4c], 0x94
call fcn.00418570
add esp, 0xc
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x44]
mov esi, str.Other
cmp eax, 5
jne 0x4062c3
cmp dword [esp + 0x48], 1
jne 0x4062ed
mov esi, 0x42685c
jmp 0x4062ed
cmp eax, 6
jne 0x4062ed
mov eax, dword [esp + 0x48]
cmp eax, ebx
jne 0x4062d7
mov esi, 0x426858
jmp 0x4062ed
cmp eax, 1
jne 0x4062e3
mov esi, str.7_08
jmp 0x4062ed
cmp eax, 2
jne 0x4062ed
mov esi, 0x42684c
call fcn.00404730
push eax
push esi
lea edx, [esp + 0xdc]
push str.System
push edx
call fcn.0041861e
add esp, 0x10
call fcn.00404d40
lea eax, [esp + 0xd4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406318
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push ebx
sub eax, edx
lea ecx, [esp + 0x54]
push ecx
push eax
mov eax, dword [0x42c47c]
lea edx, [esp + 0xe4]
push edx
push eax
call esi
mov ecx, dword [0x42c47c]
push ecx
call fcn.004047b0
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
add esp, 4
push ebx
push ebx
lea edx, [esp + 0xe0]
push edx
push ebx
call edi
test eax, eax
je 0x4063b5
lea eax, [esp + 0xd8]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x406370
mov cx, word [0x4265f8]
mov dl, byte [0x4265fa]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0xd8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406395
push ebx
sub eax, edx
lea ecx, [esp + 0x54]
push ecx
push eax
mov eax, dword [0x42c47c]
lea edx, [esp + 0xe4]
push edx
push eax
call esi
push ebx
push 0x19
lea ecx, [esp + 0xe0]
push ecx
push ebx
call edi
test eax, eax
je 0x406416
lea eax, [esp + 0xd8]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4063d0
mov dx, word [0x4265f8]
mov cl, byte [0x4265fa]
mov word [eax], dx
mov byte [eax + 2], cl
lea eax, [esp + 0xd8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4063f5
mov ecx, dword [0x42c47c]
sub eax, edx
push ebx
lea edx, [esp + 0x54]
push edx
push eax
lea eax, [esp + 0xe4]
push eax
push ecx
call esi
push ebx
push 5
lea edx, [esp + 0xe0]
push edx
push ebx
call edi
test eax, eax
je 0x406475
lea eax, [esp + 0xd8]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x406430
mov cx, word [0x4265f8]
mov dl, byte [0x4265fa]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0xd8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x406455
push ebx
sub eax, edx
lea ecx, [esp + 0x54]
push ecx
push eax
mov eax, dword [0x42c47c]
lea edx, [esp + 0xe4]
push edx
push eax
call esi
push ebx
push 0x23
lea ecx, [esp + 0xe0]
push ecx
push ebx
call edi
pop edi
test eax, eax
je 0x4064d6
lea eax, [esp + 0xd4]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x406490
mov dx, word [0x4265f8]
mov cl, byte [0x4265fa]
mov word [eax], dx
mov byte [eax + 2], cl
lea eax, [esp + 0xd4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4064b5
mov ecx, dword [0x42c47c]
sub eax, edx
push ebx
lea edx, [esp + 0x50]
push edx
push eax
lea eax, [esp + 0xe0]
push eax
push ecx
call esi
lea eax, [esp + 0xd4]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4064e0
mov dx, word [0x4265f8]
mov cl, byte [0x4265fa]
mov word [eax], dx
mov edx, dword [0x42c47c]
push edx
mov byte [eax + 2], cl
call fcn.00405cb0
lea eax, [esp + 0xd]
push eax
call fcn.00404d70
add esp, 8
mov esi, eax
push esi
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x42c650
call fcn.00414ce0
cmp esi, ebx
je 0x406533
push esi
call fcn.00418bde
add esp, 4
mov ecx, dword [esp + 0x1d8]
pop esi
pop ebx
xor ecx, esp
call fcn.0041869b
add esp, 0x1d4
ret