Function at 0x41f313
Capabilities:
Check if file exists
Check os version
Get common file path
Get file attributes

Disassembly:
mov eax, 0x4738dd
call fcn.00465b54
sub esp, 0x304
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jbe 0x41f34b
cmp dword [ebp + 0xc], 5
je 0x41f344
cmp dword [ebp + 0xc], 0x1a
jne 0x41f34b
mov dword [ebp + 0xc], 2
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x30f]
mov byte [ebp - 0x310], bl
mov byte [ebp - 0xe], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
mov dword [ebp - 0x4c], eax
jl 0x41f3b0
lea eax, [ebp - 0x310]
mov byte [ebp - 0xe], bl
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x41f3b0
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x15]
push ebx
push eax
lea eax, [ebp - 0x310]
mov edi, 0x47b4b8
mov esi, 0x47b4b0
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x54], esi
call fcn.004059b3
push 0x491d34
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 1
call fcn.004073da
lea ecx, [ebp - 0x74]
call fcn.00420336
cmp dword [ebp + 0xc], 0x2b
je 0x41f3ff
cmp dword [ebp + 0xc], 0x26
jne 0x41f445
lea ecx, [ebp - 0x74]
call fcn.0040650f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
cmp al, bl
je 0x41f441
lea eax, [ebp - 0xa8]
lea ecx, [ebp - 0x74]
push eax
call fcn.004072b6
cmp dword [eax + 0xc], ebx
lea ecx, [ebp - 0xa8]
setne byte [ebp - 0xd]
call fcn.00407f77
cmp byte [ebp - 0xd], bl
mov byte [ebp - 0xd], bl
jne 0x41f445
mov byte [ebp - 0xd], 1
cmp byte [ebp - 0xe], bl
jne 0x41f46d
cmp byte [ebp - 0xd], bl
jne 0x41f46d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00405884
mov dword [ebp - 0x14], 1
jmp 0x41f748
mov eax, dword [ebp + 0xc]
cmp eax, 5
je 0x41f72f
cmp eax, 0x1a
je 0x41f685
cmp eax, 0x26
je 0x41f57e
cmp eax, 0x2b
je 0x41f4af
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xc4]
call fcn.00413b0c
lea eax, [ebp - 0xc4]
push 0x483600
push eax
call fcn.00465b73
lea eax, [ebp - 0x48]
push 1
push eax
call fcn.00420769
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 9
call fcn.00420336
lea ecx, [ebp - 0x48]
call fcn.0040650f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
cmp al, bl
je 0x41f507
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x48]
push eax
call fcn.004072b6
cmp dword [eax + 0xc], ebx
lea ecx, [ebp - 0x20c]
sete byte [ebp + 0xf]
call fcn.00407f77
cmp byte [ebp + 0xf], bl
je 0x41f559
lea eax, [ebp - 0x114]
push 0x26
push eax
call fcn.0041f313
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.0041a934
push dword [0x47b518]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.00406639
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 9
call fcn.00407f77
push 0x49272c
lea ecx, [ebp - 0x48]
call fcn.004073da
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00405884
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
jmp 0x41f728
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.00420769
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xb
call fcn.00420336
lea ecx, [ebp - 0x48]
call fcn.0040650f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
cmp al, bl
je 0x41f5d9
lea eax, [ebp - 0x170]
lea ecx, [ebp - 0x48]
push eax
call fcn.004072b6
cmp dword [eax + 0xc], ebx
lea ecx, [ebp - 0x170]
sete byte [ebp + 0xf]
call fcn.00407f77
cmp byte [ebp + 0xf], bl
je 0x41f660
lea eax, [ebp - 0x13c]
push ebx
push eax
call fcn.0041f776
pop ecx
pop ecx
push dword [0x47b518]
mov ecx, eax
add eax, 4
mov byte [ebp - 4], 0xc
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.00406639
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0xb
call fcn.00407f77
lea eax, [ebp - 0x1a4]
lea ecx, [ebp - 0x48]
push eax
call fcn.004072b6
push dword [0x47b518]
mov ecx, eax
add eax, 4
mov byte [ebp - 4], 0xd
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.00406639
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 0xb
call fcn.00407f77
push 0x492710
lea ecx, [ebp - 0x48]
call fcn.004073da
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00405884
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
jmp 0x41f728
lea eax, [ebp - 0x9c]
push 5
push eax
call fcn.0041f313
pop ecx
pop ecx
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.0041a934
mov ecx, eax
call fcn.004071be
push 0x492748
push eax
lea eax, [ebp - 0xec]
mov byte [ebp - 4], 3
push eax
call fcn.00409cdb
add esp, 0xc
push ebx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x28], esi
call fcn.00405884
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 8
call fcn.00407f77
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 7
call fcn.00407f77
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 6
call fcn.00407f77
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00405884
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.00407f77
jmp 0x41f748
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xe]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.0040580f
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], bl
call fcn.00407f77
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret