Function at 0x436030
Capabilities:
Check os version
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46591f
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x48602c]
xor eax, esp
mov dword [esp + 0x338], eax
push ebx
mov eax, dword [0x48602c]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
xor ebx, ebx
push 0x1fe
mov dword [esp + 0x350], ebx
lea eax, [esp + 0x146]
push ebx
mov dword [esp + 0x10], ebx
push eax
mov dword [esp + 0x18], esi
mov word [esp + 0x14c], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push pe_nt_image_headers32
lea ecx, [esp + 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x140]
push edx
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push 3
push ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x354], ebx
push eax
mov ecx, esi
mov dword [esp + 0x14], 1
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
push eax
mov ecx, esi
mov dword [esp + 0x350], 1
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x10]
mov byte [esp + 0x34c], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp byte [edi], bl
je 0x436139
push str.WindowsSystem32_
mov ecx, esi
call dword [0x46831c]
mov eax, dword [edi + 4]
sub eax, ebx
je 0x436132
sub eax, 1
je 0x43612b
sub eax, 1
jne 0x4361b0
push str.AnBakConfig.dat
jmp 0x4361a8
push str.PaBakConfig.dat
jmp 0x4361a8
push str.AbBakConfig.dat
jmp 0x4361a8
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x30], 6
mov ecx, esi
jb 0x43615c
push str.ProgramDataAomei
jmp 0x436161
push str.Documents_and_SettingsAll_UsersApplication_DataAomei
call dword [0x46831c]
push ebx
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x47bbdc
mov ecx, esi
call dword [0x46831c]
mov eax, dword [edi + 4]
sub eax, ebx
je 0x4361a3
sub eax, 1
je 0x43619c
sub eax, 1
jne 0x4361b0
push str.AnConfig.dat
jmp 0x4361a8
push str.PaConfig.dat
jmp 0x4361a8
push str.AbConfig.dat
mov ecx, esi
call dword [0x46831c]
mov eax, esi
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x338]
xor ecx, esp
call fcn.0043ad38
add esp, 0x348
ret