Function at 0x415510
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x448004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Windows_Undefined
push 0x80
push 0x44af90
xor esi, esi
mov dword [0x44890c], 0xffffffff
mov ebx, str.32_bit
call fcn.004241d3
add esp, 0xc
lea eax, [ebp - 0x24c]
push 0x98
push esi
push eax
call fcn.00420f90
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x250]
add esp, 0xc
mov dword [ebp - 0x250], 0x9c
push eax
call edi
test eax, eax
jne 0x4155b0
push 0x98
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.00420f90
add esp, 0xc
mov dword [ebp - 0x250], 0x94
lea eax, [ebp - 0x250]
push eax
call edi
test eax, eax
je 0x415a04
cmp dword [ebp - 0x240], 2
jne 0x415831
cmp dword [ebp - 0x24c], 6
ja 0x4155d9
jne 0x4156f4
cmp dword [ebp - 0x248], 2
jb 0x415701
push 1
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edi, dword [ebp - 0x24c]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], edx
cmp edi, 9
ja 0x4156f4
mov ebx, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
nop dword [eax + eax]
push 0x94
lea eax, [ebp - 0x1a8]
push 0
push eax
call fcn.00420f90
add esp, 0xc
mov dword [ebp - 0x1b0], 0x9c
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1ac], edi
push dword [ebp - 0x254]
push dword [ebp - 0x258]
push 2
push eax
call ebx
test eax, eax
jne 0x41565c
inc edi
cmp edi, 9
jbe 0x415610
jmp 0x4156ef
cmp dword [ebp - 0x24c], edi
jae 0x415670
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], esi
push 1
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edi, dword [ebp - 0x248]
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x258], edx
cmp edi, 9
ja 0x4156ef
nop word [eax + eax]
push 0x9c
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.00420f90
add esp, 0xc
mov dword [ebp - 0x1b0], 0x9c
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1a8], edi
push dword [ebp - 0x258]
push dword [ebp - 0x254]
push 1
push eax
call ebx
test eax, eax
jne 0x4156e9
inc edi
cmp edi, 9
jbe 0x4156a0
jmp 0x4156ef
mov dword [ebp - 0x248], edi
mov ebx, str.32_bit
cmp dword [ebp - 0x24c], 0xf
ja 0x415831
mov eax, dword [ebp - 0x248]
cmp eax, 0xf
ja 0x415831
mov edx, dword [ebp - 0x24c]
mov ecx, 1
cmp cl, byte [ebp - 0x1b6]
sbb ecx, ecx
shl edx, 4
or edx, eax
inc ecx
mov dword [0x44890c], edx
lea eax, [edx - 0x51]
cmp eax, 0x5f
ja case.0x415742.83
movzx eax, byte [eax + 0x415a40]
jmp dword [eax*4 + 0x415a18]
mov esi, 0x44335c
jmp 0x415831
test ecx, ecx
je 0x415761
mov esi, str.XP_64
jmp 0x415831
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov esi, str.Server_2003
mov ecx, str.Server_2003_R2
cmovne esi, ecx
jmp 0x415831
test ecx, ecx
mov esi, str.Vista
mov eax, str.Server_2008
cmove esi, eax
jmp 0x415831
test ecx, ecx
mov esi, 0x443398
mov eax, str.Server_2008_R2
cmove esi, eax
jmp 0x415831
test ecx, ecx
mov esi, 0x4433ac
mov eax, str.Server_2012
cmove esi, eax
jmp 0x415831
test ecx, ecx
mov esi, 0x4433bc
mov eax, str.Server_2012_R2
cmove esi, eax
jmp 0x415831
test ecx, ecx
mov esi, str.10__Preview_1_
mov eax, str.Server_10__Preview_1_
cmove esi, eax
jmp 0x415831
mov eax, dword [ebp - 0x244]
cmp eax, 0x4e20
jae 0x415804
test ecx, ecx
je 0x4157f0
mov esi, 0x4433f8
jmp 0x415831
cmp eax, 0x4563
mov esi, str.Server_2016
mov ecx, str.Server_2019
cmovae esi, ecx
jmp 0x415831
mov dword [0x44890c], 0xb0
test ecx, ecx
mov esi, 0x443414
mov eax, str.Server_2022
cmove esi, eax
jmp 0x415831
cmp edx, 0x51
jge 0x41582c
mov dword [0x44890c], esi
jmp 0x415831
mov esi, str.12_or_later
push 0x43b068
push str.kernel32
mov dword [ebp - 0x254], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x415868
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [ebp - 0x254], 0
jne 0x4158a6
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
test eax, eax
je 0x41589d
lea eax, [ebp - 0x110]
push eax
push str.GetSystemWow64DirectoryA__s_
call fcn.00414ac0
add esp, 8
jmp 0x4158a6
cmp dword [ebp - 0x254], 0
je 0x4158ab
mov ebx, str.64_bit
lea eax, [ebp - 0x25c]
push eax
movzx eax, word [ebp - 0x1ba]
push eax
movzx eax, word [ebp - 0x1bc]
push eax
push dword [ebp - 0x248]
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push ebx
test esi, esi
jne 0x415901
push dword [ebp - 0x248]
cmp dword [ebp - 0x240], 2
mov eax, 0x443438
push dword [ebp - 0x24c]
mov ecx, 0x44343c
cmovne eax, ecx
push eax
push str._s__u._u__s
jmp 0x41596c
mov ax, word [ebp - 0x1ba]
test ax, ax
je 0x415921
movzx eax, ax
push eax
movzx eax, word [ebp - 0x1bc]
push eax
push esi
push str._s_SP_u._u__s
jmp 0x41596c
mov ax, word [ebp - 0x1bc]
test ax, ax
je 0x415948
movzx eax, ax
push eax
push esi
push str._s_SP_u__s
push 0x7f
push 0x44af90
call fcn.00401010
add esp, 0x18
jmp 0x41597b
mov edx, dword [ebp - 0x25c]
mov ecx, edx
call fcn.00414e70
push eax
test edx, edx
mov eax, 0x443468
mov ecx, 0x442cc3
cmove eax, ecx
push eax
push esi
push str._s_s_s___s
push 0x7f
push 0x44af90
call fcn.00401010
add esp, 0x1c
cmp dword [0x44890c], 0x62
mov eax, dword [ebp - 0x244]
mov dword [0x448910], eax
jl 0x415a04
push ecx
lea eax, [ebp - 0x258]
push eax
push ecx
call fcn.00415310
mov ecx, 0x44af90
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4159a8
sub ecx, edx
mov eax, 0x7f
sub eax, ecx
lea edx, [ecx + 0x44af90]
mov ecx, dword [ebp - 0x258]
test ecx, ecx
jle 0x4159ef
push ecx
push dword [0x448910]
push str.__Build__d._d_
push eax
push edx
call fcn.00401010
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
push dword [0x448910]
push str.__Build__d_
push eax
push edx
call fcn.00401010
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret