Function at 0x401000
Capabilities:
Check os version
Get common file path

Disassembly:
push 0x224
push 0x49f2a0
call fcn.0045a600
and dword [ebp - 0x214], 0
xor esi, esi
mov eax, esi
cdq
push 5
pop ecx
idiv ecx
cmp edx, 1
je 0x401032
cmp edx, 4
je 0x401032
and dword [ebp - 0x214], esi
jmp 0x401038
sub dword [ebp - 0x214], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
inc esi
cmp esi, 0x1c
jl 0x401018
xor eax, eax
add dword [ebp - 0x214], eax
inc eax
cmp eax, 0x22
jl 0x401046
mov esi, 0xffff
cmp dword [ebp - 0x214], esi
jle 0x40106e
mov eax, dword [ebp - 0x214]
imul eax, eax, 7
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xb
pop ecx
idiv ecx
cmp edx, 7
jne 0x401089
mov dword [ebp - 0x214], 0xd
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor edx, edx
push 3
pop ecx
div ecx
cmp edx, 1
jne 0x4010a5
call edi
add dword [ebp - 0x214], eax
xor ecx, ecx
xor dword [ebp - 0x214], ecx
jge 0x4010b5
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ebx
idiv ebx
test edx, edx
jne 0x4010cb
and dword [ebp - 0x214], edx
inc ecx
cmp ecx, 0xa
jl 0x4010a7
xor ecx, ecx
xor dword [ebp - 0x214], ecx
jge 0x4010e1
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ebx
idiv ebx
test edx, edx
jne 0x4010f7
and dword [ebp - 0x214], edx
inc ecx
cmp ecx, 2
jl 0x4010d3
xor eax, eax
add dword [ebp - 0x214], eax
inc eax
cmp eax, 9
jl 0x4010ff
cmp dword [ebp - 0x214], esi
jle 0x401122
mov eax, dword [ebp - 0x214]
imul eax, eax, 7
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xb
pop ecx
idiv ecx
cmp edx, 7
jne 0x40113d
mov dword [ebp - 0x214], 0xd
call edi
xor edx, edx
push 3
pop ecx
div ecx
cmp edx, 1
jne 0x401153
call edi
add dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
cmp eax, esi
jle 0x40116c
imul eax, eax, 7
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xb
pop ecx
idiv ecx
cmp edx, 7
jne 0x401187
mov dword [ebp - 0x214], 0xd
call edi
xor edx, edx
push 3
pop ecx
div ecx
cmp edx, 1
jne 0x40119d
call edi
add dword [ebp - 0x214], eax
xor ecx, ecx
mov eax, ecx
cdq
push 3
pop ebx
idiv ebx
xor ebx, ebx
inc ebx
cmp edx, ebx
jne 0x4011b6
and dword [ebp - 0x214], ecx
jmp 0x4011bc
or dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 0xd
jl 0x40119f
xor eax, eax
add dword [ebp - 0x214], eax
inc eax
cmp eax, 8
jl 0x4011c4
cmp dword [ebp - 0x214], esi
jle 0x4011e7
mov eax, dword [ebp - 0x214]
imul eax, eax, 7
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xb
pop ecx
idiv ecx
cmp edx, 7
jne 0x401202
mov dword [ebp - 0x214], 0xd
call edi
xor edx, edx
push 3
pop esi
mov ecx, esi
div ecx
cmp edx, ebx
jne 0x401219
call edi
add dword [ebp - 0x214], eax
mov edx, ebx
mov eax, ebx
lea ecx, [eax + edx]
mov edx, eax
mov eax, ecx
add dword [ebp - 0x214], ecx
dec esi
jne 0x40121d
add dword [ebp - 0x214], 3
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, esi
cdq
push 5
pop ecx
idiv ecx
cmp edx, 1
je 0x401254
cmp edx, 4
je 0x401254
and dword [ebp - 0x214], esi
jmp 0x40125a
sub dword [ebp - 0x214], esi
call ebx
inc esi
cmp esi, 4
jl 0x40123a
xor ecx, ecx
xor dword [ebp - 0x214], ecx
jge 0x401272
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop esi
idiv esi
test edx, edx
jne 0x401288
and dword [ebp - 0x214], edx
inc ecx
cmp ecx, 5
jl 0x401264
xor ecx, ecx
mov eax, ecx
cdq
push 3
pop esi
idiv esi
cmp edx, 1
jne 0x4012a5
and dword [ebp - 0x214], ecx
jmp 0x4012ab
or dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 4
jl 0x401290
xor esi, esi
mov eax, esi
cdq
push 5
pop ecx
idiv ecx
cmp edx, 1
je 0x4012cd
cmp edx, 4
je 0x4012cd
and dword [ebp - 0x214], esi
jmp 0x4012d3
sub dword [ebp - 0x214], esi
call ebx
inc esi
cmp esi, 0xf
jl 0x4012b3
xor eax, eax
add dword [ebp - 0x214], eax
inc eax
cmp eax, 4
jl 0x4012dd
cmp dword [ebp - 0x214], 0xffff
jle 0x401304
mov eax, dword [ebp - 0x214]
imul eax, eax, 7
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xb
pop ecx
idiv ecx
cmp edx, 7
jne 0x40131f
mov dword [ebp - 0x214], 0xd
call edi
xor edx, edx
push 3
pop ecx
div ecx
cmp edx, 1
jne 0x401335
call edi
add dword [ebp - 0x214], eax
push 6
pop esi
mov ebx, 0xfa
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebp - 0x214], 0
jge 0x401352
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x401369
and dword [ebp - 0x214], 0
push ebx
lea eax, [ebp - 0x210]
push eax
call edi
dec esi
jne 0x401343
xor eax, eax
add dword [ebp - 0x214], eax
inc eax
cmp eax, 5
jl 0x401378
mov eax, dword [ebp - 0x214]
cmp eax, 0xffff
jle 0x40139a
imul eax, eax, 7
mov dword [ebp - 0x214], eax
cdq
push 0xb
pop ecx
idiv ecx
cmp edx, 7
jne 0x4013af
mov dword [ebp - 0x214], 0xd
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor edx, edx
push 3
pop ecx
div ecx
cmp edx, 1
jne 0x4013cb
call esi
add dword [ebp - 0x214], eax
xor ecx, ecx
xor dword [ebp - 0x214], ecx
jge 0x4013db
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop esi
idiv esi
test edx, edx
jne 0x4013f1
and dword [ebp - 0x214], edx
inc ecx
cmp ecx, 7
jl 0x4013cd
xor ecx, ecx
xor dword [ebp - 0x214], ecx
jge 0x401407
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop esi
idiv esi
test edx, edx
jne 0x40141d
and dword [ebp - 0x214], edx
inc ecx
cmp ecx, 3
jl 0x4013f9
push 5
pop esi
cmp dword [ebp - 0x214], 0
jge 0x401435
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x40144c
and dword [ebp - 0x214], 0
push ebx
lea eax, [ebp - 0x210]
push eax
call edi
dec esi
jne 0x401426
xor ecx, ecx
mov eax, ecx
cdq
push 3
pop esi
idiv esi
cmp edx, 1
jne 0x401470
and dword [ebp - 0x214], ecx
jmp 0x401476
or dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 6
jl 0x40145b
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
cmp eax, 0xffff
jle 0x401498
imul eax, eax, 7
mov dword [ebp - 0x214], eax
cdq
push 0xb
pop ecx
idiv ecx
cmp edx, 7
jne 0x4014ad
mov dword [ebp - 0x214], 0xd
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor edx, edx
push 3
pop ecx
div ecx
cmp edx, 1
jne 0x4014c9
call esi
add dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
test eax, eax
jns 0x4014e1
neg eax
mov dword [ebp - 0x214], eax
cdq
push 7
pop ecx
idiv ecx
test edx, edx
jne 0x4014f1
and dword [ebp - 0x214], edx
push 7
pop esi
cmp dword [ebp - 0x214], 0
jge 0x401503
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
push 7
pop ecx
idiv ecx
test edx, edx
je 0x40151a
and dword [ebp - 0x214], 0
push ebx
lea eax, [ebp - 0x210]
push eax
call edi
dec esi
jne 0x4014f4
and dword [ebp - 4], esi
and dword [ebp - 0x230], esi
push 7
pop edi
cmp dword [ebp - 0x230], 3
jge 0x401564
mov eax, dword [ebp - 0x230]
cdq
push 3
pop ecx
idiv ecx
cmp eax, edi
jle 0x401555
sub dword [ebp - 0x214], 2
jmp 0x40155c
add dword [ebp - 0x214], 3
inc dword [ebp - 0x230]
jmp 0x401533
mov dword [ebp - 4], 0xfffffffe
call fcn.004015a3
mov dword [ebp - 4], 1
and dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 5
jge 0x4015c8
mov eax, dword [ebp - 0x234]
cdq
push 3
pop ecx
idiv ecx
cmp eax, edi
jle 0x4015b9
sub dword [ebp - 0x214], 2
jmp 0x4015c0
add dword [ebp - 0x214], 3
inc dword [ebp - 0x234]
jmp 0x40157e
mov dword [ebp - 4], 0xfffffffe
call fcn.0040168e
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
test eax, eax
jns 0x4015ea
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
mov ecx, edi
idiv ecx
test edx, edx
jne 0x4015ff
and dword [ebp - 0x214], edx
xor eax, eax
add dword [ebp - 0x214], eax
inc eax
cmp eax, 6
jl 0x401601
cmp dword [ebp - 0x214], 0xffff
jle 0x401628
mov eax, dword [ebp - 0x214]
imul eax, eax, 7
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xb
pop ecx
idiv ecx
cmp edx, edi
jne 0x401642
mov dword [ebp - 0x214], 0xd
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor edx, edx
push 3
pop ecx
div ecx
cmp edx, 1
jne 0x40165e
call esi
add dword [ebp - 0x214], eax
push 2
pop ecx
mov dword [ebp - 4], ecx
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], ecx
jge 0x4016b3
mov eax, dword [ebp - 0x220]
cdq
push 3
pop esi
idiv esi
cmp eax, edi
jle 0x4016a4
sub dword [ebp - 0x214], ecx
jmp 0x4016ab
add dword [ebp - 0x214], 3
inc dword [ebp - 0x220]
jmp 0x40166b
mov dword [ebp - 4], 0xfffffffe
call fcn.004016f8
xor eax, eax
inc eax
mov edx, eax
mov esi, edi
lea ecx, [eax + edx]
mov edx, eax
mov eax, ecx
add dword [ebp - 0x214], ecx
dec esi
jne 0x4016c6
add dword [ebp - 0x214], edi
xor ecx, ecx
push 3
pop ebx
mov eax, ecx
cdq
mov esi, ebx
idiv esi
cmp edx, 1
jne 0x40170e
and dword [ebp - 0x214], ecx
jmp 0x401714
or dword [ebp - 0x214], ecx
inc ecx
cmp ecx, 2
jl 0x4016e1
xor ecx, ecx
mov eax, ecx
cdq
mov esi, ebx
idiv esi
cmp edx, 1
jne 0x401730
and dword [ebp - 0x214], ecx
jmp 0x401736
or dword [ebp - 0x214], ecx
inc ecx
cmp ecx, ebx
jl 0x40171c
xor ecx, ecx
xor dword [ebp - 0x214], ecx
jge 0x40174b
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
mov esi, edi
idiv esi
test edx, edx
jne 0x401760
and dword [ebp - 0x214], edx
inc ecx
cmp ecx, ebx
jl 0x40173d
xor esi, esi
mov eax, esi
cdq
push 5
pop ecx
idiv ecx
cmp edx, 1
je 0x401781
cmp edx, 4
je 0x401781
and dword [ebp - 0x214], esi
jmp 0x401787
sub dword [ebp - 0x214], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
inc esi
cmp esi, edi
jl 0x401767
xor ecx, ecx
xor dword [ebp - 0x214], ecx
jge 0x4017a2
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
mov esi, edi
idiv esi
test edx, edx
jne 0x4017b7
and dword [ebp - 0x214], edx
inc ecx
cmp ecx, 6
jl 0x401794
mov dword [ebp - 4], ebx
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x218], 0
jge 0x4017f6
mov eax, dword [ebp - 0x218]
cdq
mov ecx, ebx
idiv ecx
cmp eax, edi
jle 0x4017e8
sub dword [ebp - 0x214], 2
jmp 0x4017ee
add dword [ebp - 0x214], ebx
inc dword [ebp - 0x218]
jmp 0x4017c7
mov dword [ebp - 4], 0xfffffffe
call fcn.00401862
xor ecx, ecx
xor dword [ebp - 0x214], ecx
jge 0x401812
neg dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
cdq
mov esi, edi
idiv esi
test edx, edx
jne 0x401827
and dword [ebp - 0x214], edx
inc ecx
cmp ecx, 5
jl 0x401804
mov dword [ebp - 4], 4
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 2
jge 0x401886
mov eax, dword [ebp - 0x228]
cdq
mov ecx, ebx
idiv ecx
cmp eax, edi
jle 0x401878
sub dword [ebp - 0x214], 2
jmp 0x40187e
add dword [ebp - 0x214], ebx
inc dword [ebp - 0x228]
jmp 0x40183b
mov dword [ebp - 4], 0xfffffffe
call fcn.004018e1
xor eax, eax
inc eax
mov edx, eax
mov esi, edi
lea ecx, [eax + edx]
mov edx, eax
mov eax, ecx
add dword [ebp - 0x214], ecx
dec esi
jne 0x401899
add dword [ebp - 0x214], edi
mov dword [ebp - 4], 5
and dword [ebp - 0x21c], esi
cmp dword [ebp - 0x21c], 1
jge 0x401906
mov eax, dword [ebp - 0x21c]
cdq
push 3
pop ecx
idiv ecx
cmp eax, edi
jle 0x4018f7
sub dword [ebp - 0x214], 2
jmp 0x4018fe
add dword [ebp - 0x214], 3
inc dword [ebp - 0x21c]
jmp 0x4018bc
mov dword [ebp - 4], 0xfffffffe
call fcn.00401945
mov dword [ebp - 4], 6
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 1
jge 0x40196a
mov eax, dword [ebp - 0x224]
cdq
push 3
pop ecx
idiv ecx
cmp eax, edi
jle 0x40195b
sub dword [ebp - 0x214], 2
jmp 0x401962
add dword [ebp - 0x214], 3
inc dword [ebp - 0x224]
jmp 0x401920
mov dword [ebp - 4], 0xfffffffe
call fcn.004019a5
mov dword [ebp - 4], edi
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 3
jge 0x4019ca
mov eax, dword [ebp - 0x22c]
cdq
push 3
pop ecx
idiv ecx
cmp eax, edi
jle 0x4019bb
sub dword [ebp - 0x214], 2
jmp 0x4019c2
add dword [ebp - 0x214], 3
inc dword [ebp - 0x22c]
jmp 0x401980
mov dword [ebp - 4], 0xfffffffe
call fcn.00401a37
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x214], eax
cmp eax, 0xffff
jle 0x4019f2
imul eax, eax, 7
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cdq
push 0xb
pop ecx
idiv ecx
cmp edx, edi
jne 0x401a0c
mov dword [ebp - 0x214], 0xd
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor edx, edx
push 3
pop ecx
div ecx
cmp edx, 1
jne 0x401a28
call esi
add dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
call fcn.0045a648
ret