Function at 0x6d487799
Capabilities:
Check os version
Get common file path
Get session user name
Get system information on windows
Identify system language via api

Disassembly:
push ebp
lea ebp, [esp - 0x2b8]
sub esp, 0x338
mov eax, dword [0x6d49bb70]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push ebx
xor ebx, ebx
cmp dword [0x6d49bc14], ebx
jne 0x6d487ba9
push esi
push edi
lea eax, [ebp + 0x44]
push eax
push 0x105
mov dword [0x6d49bc70], 0x6d494b78
call dword [sym.imp.kernel32.dll_GetTempPathW]
mov esi, dword [sym.imp.msvcr100.dll__wcsdup]
lea eax, [ebp + 0x44]
push eax
call esi
mov edi, dword [sym.imp.msvcr100.dll__wgetenv]
mov dword [0x6d49bc0c], eax
mov dword [0x6d49bc68], 0x6d494b5c
mov dword [0x6d49bc6c], 0x6d494b38
mov dword [esp], str.JAVA2D_FONTPATH
call edi
pop ecx
cmp eax, ebx
je 0x6d487822
push eax
call esi
pop ecx
mov dword [0x6d49bc10], eax
jmp 0x6d487828
mov dword [0x6d49bc10], ebx
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x58], 0x9c
call dword [sym.imp.kernel32.dll_GetVersionExA]
push 0x24
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.msvcr100.dll_memset
add esp, 0xc
push str.GetNativeSystemInfo
push 0x6d494af4
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
cmp eax, ebx
je 0x6d48786b
lea ecx, [ebp - 0x80]
push ecx
call eax
jmp 0x6d487875
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x48]
sub eax, ebx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x54]
je 0x6d48799f
dec eax
je 0x6d48795c
dec eax
je 0x6d48789f
mov dword [0x6d49bc00], str.Windows__unknown_
jmp 0x6d4879a9
cmp edx, 4
ja 0x6d4878b3
mov dword [0x6d49bc00], str.Windows_NT
jmp 0x6d4879a9
cmp edx, 5
jne 0x6d487902
mov eax, ecx
sub eax, ebx
je 0x6d4878f3
dec eax
je 0x6d4878e4
dec eax
jne 0x6d487950
cmp byte [ebp + 0x42], 1
jne 0x6d4878d5
cmp word [ebp - 0x80], 9
je 0x6d4878e4
mov dword [0x6d49bc00], str.Windows_2003
jmp 0x6d4879a9
mov dword [0x6d49bc00], str.Windows_XP
jmp 0x6d4879a9
mov dword [0x6d49bc00], str.Windows_2000
jmp 0x6d4879a9
cmp edx, 6
jne 0x6d487950
cmp byte [ebp + 0x42], 1
mov eax, ecx
jne 0x6d487931
sub eax, ebx
je 0x6d487925
dec eax
jne 0x6d487950
mov dword [0x6d49bc00], str.Windows_7
jmp 0x6d4879a9
mov dword [0x6d49bc00], str.Windows_Vista
jmp 0x6d4879a9
sub eax, ebx
je 0x6d487944
dec eax
jne 0x6d487950
mov dword [0x6d49bc00], str.Windows_Server_2008_R2
jmp 0x6d4879a9
mov dword [0x6d49bc00], str.Windows_Server_2008
jmp 0x6d4879a9
mov dword [0x6d49bc00], str.Windows_NT__unknown_
jmp 0x6d4879a9
cmp edx, 4
jne 0x6d487993
cmp ecx, ebx
je 0x6d487987
cmp ecx, 0xa
je 0x6d48797b
cmp ecx, 0x5a
jne 0x6d487993
mov dword [0x6d49bc00], str.Windows_Me
jmp 0x6d4879a9
mov dword [0x6d49bc00], str.Windows_98
jmp 0x6d4879a9
mov dword [0x6d49bc00], str.Windows_95
jmp 0x6d4879a9
mov dword [0x6d49bc00], str.Windows_9X__unknown_
jmp 0x6d4879a9
mov dword [0x6d49bc00], str.Windows_3.1
push ecx
push edx
lea eax, [ebp + 0x250]
push str._d._d
push eax
call dword [sym.imp.msvcr100.dll_sprintf]
mov esi, dword [sym.imp.msvcr100.dll__strdup]
lea eax, [ebp + 0x250]
push eax
call esi
mov dword [0x6d49bc04], eax
lea eax, [ebp - 0x44]
push eax
mov dword [0x6d49bc08], 0x6d4949fc
call esi
mov dword [0x6d49bc84], eax
mov dword [0x6d49bc88], 0x6d4949f4
mov dword [0x6d49bc7c], 0x6d4949ec
call fcn.6d4900e0
push str.USERNAME
mov dword [0x6d49bc78], eax
call edi
mov esi, eax
add esp, 0x1c
cmp esi, ebx
je 0x6d487a2f
push esi
call dword [sym.imp.msvcr100.dll_wcslen]
pop ecx
test eax, eax
je 0x6d487a2f
push esi
call dword [sym.imp.msvcr100.dll__wcsdup]
pop ecx
mov dword [0x6d49bc24], eax
jmp 0x6d487a8a
mov edi, dword [sym.imp.advapi32.dll_GetUserNameW]
lea eax, [ebp - 0x5c]
push eax
push ebx
mov dword [ebp - 0x5c], ebx
call edi
test eax, eax
jne 0x6d487a74
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x6d487a74
mov eax, dword [ebp - 0x5c]
add eax, eax
push eax
call dword [sym.imp.msvcr100.dll_malloc]
mov esi, eax
pop ecx
cmp esi, ebx
je 0x6d487a80
lea eax, [ebp - 0x5c]
push eax
push esi
call edi
test eax, eax
jne 0x6d487a76
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
xor esi, esi
mov dword [0x6d49bc24], esi
cmp esi, ebx
jne 0x6d487a8a
mov dword [0x6d49bc24], str.unknown
call fcn.6d48745b
cmp eax, ebx
jne 0x6d487aa1
call fcn.6d48750a
cmp eax, ebx
jne 0x6d487aa1
mov eax, 0x6d4949c0
push eax
call dword [sym.imp.msvcr100.dll__wcsdup]
pop ecx
mov dword [0x6d49bc28], eax
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
mov edi, eax
call dword [sym.imp.kernel32.dll_GetSystemDefaultLCID]
mov ebx, eax
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx esi, ax
lea eax, [ebp - 0x5c]
push eax
push 0x6d49bc50
push 0x6d49bc44
push 0x6d49bc2c
mov edx, 0x6d49bc38
mov ecx, esi
call fcn.6d4900e0
push 0x6d49bc5c
push 0x6d49bc54
push 0x6d49bc48
push 0x6d49bc30
mov edx, 0x6d49bc3c
mov ecx, edi
call fcn.6d4900e0
lea eax, [ebp - 0x5c]
push eax
push 0x6d49bc58
push 0x6d49bc4c
push 0x6d49bc34
mov edx, 0x6d49bc40
mov ecx, esi
call fcn.6d4900e0
push ebx
call fcn.6d4872ae
add esp, 0x34
mov dword [0x6d49bc60], eax
mov eax, 0xc04
cmp di, ax
pop edi
pop esi
jne 0x6d487b54
cmp dword [ebp - 0x54], 6
jne 0x6d487b54
mov eax, str.MS950_HKSCS
mov dword [0x6d49bc5c], eax
mov dword [0x6d49bc60], eax
lea eax, [ebp + 0x44]
push eax
push 0x104
mov dword [0x6d49bc74], 0x6d4949a4
mov dword [0x6d49bc64], 0x6d493cef
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x6d487b8b
lea eax, [ebp + 0x44]
push eax
call dword [sym.imp.msvcr100.dll__wcsdup]
pop ecx
mov dword [0x6d49bc14], eax
mov dword [0x6d49bc18], 0x6d4947c4
mov dword [0x6d49bc1c], 0x6d4949a0
mov dword [0x6d49bc20], 0x6d49499c
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
mov eax, 0x6d49bc00
pop ebx
call fcn.6d491820
add ebp, 0x2b8
leave
ret