Function at 0x413b30
Capabilities:
Check os version
Get common file path
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
mov eax, dword [0x42f060]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4ac], ecx
mov eax, dword [ebp - 0x4ac]
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx], 0x17
push 0x94
push 0
lea edx, [ebp - 0x4a8]
push edx
call fcn.00416110
add esp, 0xc
mov dword [ebp - 0x4a8], 0x94
lea eax, [ebp - 0x4a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jne 0x413bbd
mov dword [ebp - 0x4a8], 0x94
lea ecx, [ebp - 0x4a8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x413bbd
xor eax, eax
jmp 0x41404d
mov edx, dword [ebp - 0x498]
mov dword [ebp - 0x4b0], edx
cmp dword [ebp - 0x4b0], 1
je 0x413cee
cmp dword [ebp - 0x4b0], 2
je 0x413be4
jmp 0x413d7b
cmp dword [ebp - 0x4a4], 4
ja 0x413bf9
mov eax, dword [ebp - 0x4ac]
mov dword [eax], 0x11
cmp dword [ebp - 0x4a4], 5
jne 0x413c17
cmp dword [ebp - 0x4a0], 0
jne 0x413c17
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx], 0x12
cmp dword [ebp - 0x4a4], 5
jne 0x413c35
cmp dword [ebp - 0x4a0], 1
jne 0x413c35
mov edx, dword [ebp - 0x4ac]
mov dword [edx], 0x13
cmp dword [ebp - 0x4a4], 5
jne 0x413c53
cmp dword [ebp - 0x4a0], 2
jne 0x413c53
mov eax, dword [ebp - 0x4ac]
mov dword [eax], 0x14
cmp dword [ebp - 0x4a4], 6
jne 0x413c71
cmp dword [ebp - 0x4a0], 0
jne 0x413c71
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx], 0x15
cmp dword [ebp - 0x4a4], 6
jne 0x413c8f
cmp dword [ebp - 0x4a0], 1
jne 0x413c8f
mov edx, dword [ebp - 0x4ac]
mov dword [edx], 0x17
cmp dword [ebp - 0x4a4], 6
jne 0x413cad
cmp dword [ebp - 0x4a0], 2
jne 0x413cad
mov eax, dword [ebp - 0x4ac]
mov dword [eax], 0x18
cmp dword [ebp - 0x4a4], 6
jne 0x413ccb
cmp dword [ebp - 0x4a0], 3
jne 0x413ccb
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx], 0x18
cmp dword [ebp - 0x4a4], 7
jne 0x413ce9
cmp dword [ebp - 0x4a0], 0
jne 0x413ce9
mov edx, dword [ebp - 0x4ac]
mov dword [edx], 0x18
jmp 0x413d7b
mov eax, dword [ebp - 0x4ac]
mov dword [eax], 3
cmp dword [ebp - 0x4a4], 4
jne 0x413d18
cmp dword [ebp - 0x4a0], 0
jne 0x413d18
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx], 1
cmp dword [ebp - 0x4a4], 4
jne 0x413d36
cmp dword [ebp - 0x4a0], 0xa
jne 0x413d36
mov edx, dword [ebp - 0x4ac]
mov dword [edx], 2
cmp dword [ebp - 0x4a4], 4
jne 0x413d54
cmp dword [ebp - 0x4a0], 0x5a
jne 0x413d54
mov eax, dword [ebp - 0x4ac]
mov dword [eax], 3
mov ecx, dword [ebp - 0x49c]
shr ecx, 0x10
cmp ecx, 0x45a
jne 0x413d71
mov edx, dword [ebp - 0x4ac]
mov dword [edx], 3
mov eax, dword [ebp - 0x4ac]
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0x4ac]
mov byte [ecx + 0x628], 0
xor edx, edx
mov eax, dword [ebp - 0x4ac]
mov word [eax + 0x72c], dx
push 0xa
lea ecx, [ebp - 0x408]
push ecx
push 9
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea edx, [ebp - 0x408]
push edx
mov ecx, dword [ebp - 0x4ac]
call fcn.00414140
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x4ac]
mov eax, dword [edx + 8]
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 0xc04
jg 0x413e09
cmp dword [ebp - 0x4b4], 0xc04
je 0x413e41
cmp dword [ebp - 0x4b4], 0x404
je 0x413e23
cmp dword [ebp - 0x4b4], 0x804
je 0x413e32
jmp 0x413e6c
cmp dword [ebp - 0x4b4], 0x1004
je 0x413e50
cmp dword [ebp - 0x4b4], 0x1404
je 0x413e5f
jmp 0x413e6c
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx + 8], 0x4c1
jmp 0x413e6c
mov edx, dword [ebp - 0x4ac]
mov dword [edx + 8], 0x8c0
jmp 0x413e6c
mov eax, dword [ebp - 0x4ac]
mov dword [eax + 8], 0xcc1
jmp 0x413e6c
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx + 8], 0x10c0
jmp 0x413e6c
mov edx, dword [ebp - 0x4ac]
mov dword [edx + 8], 0x14c1
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x4ac]
mov eax, dword [edx + 8]
and eax, 0xff
mov dword [ebp - 0x4b8], eax
mov ecx, dword [ebp - 0x4b8]
sub ecx, 8
mov dword [ebp - 0x4b8], ecx
cmp dword [ebp - 0x4b8], 0xb9
ja case.0x413eb7.1
mov edx, dword [ebp - 0x4b8]
movzx eax, byte [edx + 0x41407c]
jmp dword [eax*4 + 0x41405c]
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx + 0xc], 0x3a4
jmp case.0x413eb7.1
mov edx, dword [ebp - 0x4ac]
mov dword [edx + 0xc], 0x3a8
jmp case.0x413eb7.1
mov eax, dword [ebp - 0x4ac]
mov dword [eax + 0xc], 0x3b6
jmp case.0x413eb7.1
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx + 0xc], 0x3b5
jmp case.0x413eb7.1
mov edx, dword [ebp - 0x4ac]
mov dword [edx + 0xc], 0x4e3
jmp case.0x413eb7.1
mov eax, dword [ebp - 0x4ac]
mov dword [eax + 0xc], 0x4e5
jmp case.0x413eb7.1
mov ecx, dword [ebp - 0x4ac]
mov dword [ecx + 0xc], 0x4e9
mov edx, dword [ebp - 0x4ac]
movzx eax, byte [edx + 4]
test eax, eax
je 0x413fc2
push 0x104
mov ecx, dword [ebp - 0x4ac]
add ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x104
mov edx, dword [ebp - 0x4ac]
add edx, 0x114
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [ebp - 0x4ac]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x4ac]
add edx, 0x10
push edx
mov eax, dword [ebp - 0x4ac]
add eax, 0x218
push eax
mov ecx, dword [ebp - 0x4ac]
call fcn.00414480
mov ecx, dword [ebp - 0x4ac]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x4ac]
add eax, 0x114
push eax
mov ecx, dword [ebp - 0x4ac]
add ecx, 0x420
push ecx
mov ecx, dword [ebp - 0x4ac]
call fcn.00414480
jmp 0x41404b
push 0x104
mov edx, dword [ebp - 0x4ac]
add edx, 0x218
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x104
mov eax, dword [ebp - 0x4ac]
add eax, 0x420
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [ebp - 0x4ac]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x4ac]
add eax, 0x218
push eax
mov ecx, dword [ebp - 0x4ac]
add ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x4ac]
call fcn.004143f0
mov edx, dword [ebp - 0x4ac]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x4ac]
add ecx, 0x420
push ecx
mov edx, dword [ebp - 0x4ac]
add edx, 0x114
push edx
mov ecx, dword [ebp - 0x4ac]
call fcn.004143f0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415aa8
mov esp, ebp
pop ebp
ret