Function at 0x405c10
Capabilities:
Check os version
Get common file path
Get geographical location
Get system information on windows

Disassembly:
sub esp, 0xbc8
mov eax, dword [0x44a1a0]
xor eax, esp
mov dword [esp + 0xbc0], eax
push ebx
push esi
push edi
lea eax, [esp + 0x50]
mov dword [0x44f74c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x50]
shl edx, 4
sub edx, dword [esp + 0x50]
shl edx, 2
mov dword [0x44f6b8], edx
mov dword [0x44f684], edx
cmp eax, 2
jne 0x405c6e
mov ecx, dword [esp + 0xf8]
shl ecx, 4
sub ecx, dword [esp + 0xf8]
jmp 0x405c84
cmp eax, 1
jne 0x405c8c
mov ecx, dword [esp + 0xa4]
shl ecx, 4
sub ecx, dword [esp + 0xa4]
lea eax, [edx + ecx*4]
mov dword [0x44f684], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 6
push 0x44b49c
push 0xe
push 0x400
call esi
push 6
push 0x44b48c
push 0xf
push 0x400
call esi
xor eax, eax
push 0x9e
push eax
mov word [esp + 0xb30], ax
lea eax, [esp + 0xb32]
push eax
call fcn.00422270
add esp, 0xc
lea eax, [esp + 0xb28]
push 0x50
push eax
push 0x1f
push 0x400
call esi
mov ax, word [esp + 0xb28]
mov edi, 1
mov ecx, dword [0x44f75c]
or ax, 0x20
cmp ax, 0x64
lea eax, [esp + 0xb28]
push 0x50
push eax
push 0x1003
cmove ecx, edi
push 0x400
mov dword [0x44f75c], ecx
call esi
mov eax, dword [0x44f744]
cmp word [esp + 0xb28], 0x48
push 0x114
cmove eax, edi
mov dword [0x44f744], eax
lea eax, [esp + 0x174]
push 0
push eax
call fcn.00422270
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [esp + 0x17c]
add esp, 0xc
mov dword [esp + 0x170], 0x114
push eax
call edi
mov eax, dword [esp + 0x180]
mov edx, dword [esp + 0x174]
mov ecx, dword [esp + 0x178]
mov esi, dword [esp + 0x17c]
mov dword [0x44f750], edx
mov dword [0x44f748], ecx
mov dword [0x44f850], esi
dec eax
je 0x40600f
dec eax
jne 0x406079
mov dword [0x44b498], 6
mov dword [0x44f848], 2
mov dword [0x44f6bc], 3
mov dword [0x44f758], eax
cmp edx, 6
jb 0x405dea
cmp ecx, 2
jb 0x405dea
call fcn.00406460
test al, al
je 0x405eeb
mov eax, dword [0x44f844]
mov ecx, dword [0x44f84c]
jmp 0x405e61
cmp edx, 4
jbe 0x405eeb
push 0x11c
lea eax, [esp + 0x54]
push 0
push eax
call fcn.00422270
add esp, 0xc
mov dword [esp + 0x50], 0x11c
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x405eeb
movzx eax, byte [esp + 0x16a]
movzx ecx, word [esp + 0x166]
mov dword [0x44f758], eax
mov eax, dword [esp + 0x54]
mov dword [0x44f750], eax
mov eax, dword [esp + 0x58]
mov dword [0x44f748], eax
mov eax, dword [esp + 0x5c]
mov dword [0x44f850], eax
movzx eax, word [esp + 0x164]
mov dword [0x44f844], eax
mov dword [0x44f84c], ecx
push ecx
push eax
push str._u._u
push 8
push 0x44f688
call fcn.004045b0
mov esi, dword [0x44f758]
xor eax, eax
mov edi, dword [0x44f750]
add esp, 0x14
mov ebx, dword [0x44f748]
cmp esi, 4
mov dword [0x44b498], 0x13
mov edx, 0x43ca60
cmovge esi, eax
mov dword [0x44f758], esi
cmp edi, dword [edx]
jne 0x405ebf
cmp ebx, dword [edx + 4]
jne 0x405ebf
movzx eax, byte [edx + 8]
xor ecx, ecx
cmp esi, 1
sete cl
cmp ecx, eax
je 0x405ecc
add edx, 0x10
cmp edx, 0x43cb60
jb 0x405ea6
jmp 0x405ed4
mov eax, dword [edx + 0xc]
mov dword [0x44b498], eax
cmp edi, 5
ja 0x405edf
jne 0x405eff
test ebx, ebx
je 0x405eff
mov dword [0x44f6c4], 0x7f
jmp 0x405eff
mov dword [0x44b498], 0x13
mov dword [0x44f758], 0
lea eax, [esp + 0x914]
mov dword [esp + 0x900], 0
mov dword [esp + 0x910], eax
mov esi, 0x43c8e0
xor eax, eax
mov dword [esp + 0x904], 0
push ecx
mov word [esp + 0x918], ax
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], eax
xor edi, edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x904]
push eax
push 0x44008c
mov dword [esp + 0x914], 2
mov dword [esp + 0x918], 0x108
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], str.SoftwareMicrosoftWindows_NTCurrentVersion
call fcn.00411180
test al, al
je 0x405fcf
push dword [esp + 0x910]
lea ecx, [esp + 0x10]
call fcn.004065a0
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
test al, al
je 0x405fcf
test edi, edi
je 0x405fb0
push esi
call dword [sym.imp.USER32.dll_CharLowerW]
push str.preinstallation_environment
push esi
call fcn.0041faf0
add esp, 8
test eax, eax
je 0x405fcf
sub eax, esi
sar eax, 1
js 0x405fcf
or dword [0x44f74c], 4
cmp dword [esp + 0x1c], 0
je 0x405fe2
push dword [esp + 0x18]
call fcn.0041f5f1
add esp, 4
test edi, edi
je 0x405fef
push esi
call fcn.0041f5f1
add esp, 4
lea ecx, [esp + 0x900]
call fcn.00408240
mov edx, dword [0x44f750]
mov ecx, dword [0x44f748]
mov esi, dword [0x44f850]
jmp 0x406079
mov dword [0x44f848], 1
mov dword [0x44f6bc], 2
cmp ecx, 0x5a
jb 0x406034
mov dword [0x44b498], 5
jmp 0x40606f
cmp ecx, 0xa
jb 0x406045
mov dword [0x44b498], 4
jmp 0x40606f
mov eax, 0x438
cmp si, ax
jbe 0x40605b
mov dword [0x44b498], 3
jmp 0x40606f
mov dword [0x44f6bc], 1
mov dword [0x44b498], 2
movzx eax, si
mov dword [esp + 0x17c], eax
push esi
push ecx
push edx
push str._d._d._d
push 0x10
push 0x44f698
call fcn.004045b0
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x44f840], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x44f854], eax
lea eax, [esp + 0x6ec]
mov dword [esp + 0x6e8], eax
xor eax, eax
mov word [esp + 0x6ec], ax
lea eax, [esp + 0x6ec]
push pe_nt_image_headers32
push eax
mov dword [esp + 0x6e0], 0
mov dword [esp + 0x6e4], 0
mov dword [esp + 0x6e8], 2
mov dword [esp + 0x6ec], 0x108
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x406114
mov eax, dword [esp + 0x6e8]
xor ecx, ecx
mov word [eax], cx
mov dword [esp + 0x6dc], ecx
mov eax, dword [esp + 0x6e8]
movzx eax, word [eax]
push eax
call fcn.00420a4b
mov word [0x44f680], ax
lea ecx, [esp + 0x18]
mov eax, 0x43
mov dword [esp + 0x18], reloc.OLEAUT32.dll_SysReAllocString
mov word [0x44f6c0], ax
lea eax, [esp + 0x6dc]
push eax
push str.BootFolder
mov dword [esp + 0x24], 0x4400f0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.00411180
test al, al
je 0x406190
mov eax, dword [esp + 0x6e8]
movzx eax, word [eax]
push eax
call fcn.00420a4b
add esp, 4
mov word [0x44f6c0], ax
mov eax, dword [0x45060c]
test eax, eax
je 0x4061a2
lea ecx, [esp + 0x2c]
push ecx
call eax
jmp 0x4061ad
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [0x44b540], eax
test ecx, ecx
je 0x4061e4
cmp ecx, 6
je 0x4061d8
xor edx, edx
mov eax, 4
cmp ecx, 9
cmovne eax, edx
mov dword [0x44b57c], eax
jmp 0x4061ee
mov dword [0x44b57c], 5
jmp 0x4061ee
mov dword [0x44b57c], 1
cmp dword [0x450610], 0
mov dword [esp + 0x28], 0
je 0x406223
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x450610]
test eax, eax
je 0x406223
cmp dword [esp + 0x28], 0
je 0x406223
or dword [0x44f74c], 1
lea eax, [esp + 0x29c]
mov dword [esp + 0x288], 0
mov dword [esp + 0x298], eax
xor eax, eax
mov word [esp + 0x29c], ax
mov dword [esp + 0x4b0], eax
mov dword [esp + 0x4b4], eax
lea eax, [esp + 0x4c4]
mov dword [esp + 0x4c0], eax
xor eax, eax
push ecx
lea ecx, [esp + 0x28c]
mov dword [esp + 0x290], 0
mov dword [esp + 0x294], 2
mov dword [esp + 0x298], pe_nt_image_headers32
mov dword [esp + 0x4bc], 2
mov dword [esp + 0x4c0], 0x108
mov word [esp + 0x4c8], ax
call fcn.0040c6c0
test al, al
je 0x40634b
mov esi, dword [esp + 0x298]
xor eax, eax
mov ecx, esi
movzx edx, word [esi]
test dx, dx
je 0x4062e2
jmp 0x4062d0
add ecx, 2
cmp dx, 0x5c
cmove eax, ecx
movzx edx, word [ecx]
test dx, dx
jne 0x4062d0
test eax, eax
mov ecx, esi
cmovne ecx, eax
cmp ecx, esi
jbe 0x4062f0
sub ecx, 2
sub esp, 0xc
xor eax, eax
mov word [ecx], ax
lea ecx, [esp + 0x4bc]
push dword [esp + 0x2a4]
call fcn.0040c760
test al, al
je 0x40634b
push 0
push 0x4000000
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x4d8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x406344
push 0
mov byte [0x44b488], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40634b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004081a0
lea ecx, [esp + 0x4b0]
call fcn.00408240
and dword [esp + 0x4b0], 0xfffffffc
lea ecx, [esp + 0x288]
mov dword [esp + 0x4b4], 0
mov dword [esp + 0x4bc], 0
call fcn.00408240
and dword [esp + 0x288], 0xfffffffc
cmp dword [esp + 0x1c], 0
mov dword [esp + 0x28c], 0
mov dword [esp + 0x294], 0
je 0x4063b7
push dword [esp + 0x18]
call fcn.0041f5f1
add esp, 4
lea ecx, [esp + 0x6d8]
call fcn.00408240
mov ecx, dword [esp + 0xbcc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041e8c8
add esp, 0xbc8
ret