Function at 0x1000e6b0
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
push edi
call fcn.1001f4a6
add esp, 4
test eax, eax
jne 0x1000e6ff
cmp dword [0x1002ae08], 0
je 0x1000e6e9
call fcn.1000fed0
push 0x1002f43c
push 0xa7
push 0x2d
call fcn.10003840
add esp, 0xc
push 2
call fcn.1000ddc0
mov word [eax], 0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0x1000
call fcn.1000ddc0
mov cl, byte [esp + 0x24]
add esp, 4
mov ebx, eax
cmp cl, 7
jne 0x1000e7e9
push 0x800
call fcn.1000ddc0
add esp, 4
mov esi, eax
xor eax, eax
mov ax, word [edi]
cmp eax, 0x31
je 0x1000e74f
cmp eax, 0x32
je 0x1000e75d
push 2
call fcn.1000ddc0
mov word [eax], 0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0x800
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1000e769
push 0x800
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
push esi
call fcn.10018b30
add esp, 8
push esi
call fcn.1001f43e
add esp, 4
push ebx
call fcn.1001f4a6
add esp, 4
lea eax, [ebx + eax*2 - 2]
cmp word [eax], 0x5c
je 0x1000e79b
mov word [eax + 2], 0x5c
mov word [eax + 4], 0
mov esi, dword [esp + 0x28]
cmp word [esi], 0x5c
jne 0x1000e7a8
add esi, 2
push esi
push ebx
call fcn.1001ef52
add esp, 8
push ebx
call fcn.1001f4a6
add esp, 4
lea eax, [eax*2 + 2]
push eax
call fcn.1000ddc0
add esp, 4
mov esi, eax
push ebx
push esi
call fcn.1001ef83
add esp, 8
push ebx
call fcn.1001f43e
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
test cl, cl
jne 0x1000e8e3
lea eax, [esp + 0x18]
lea ecx, [esp + 0xc]
mov edx, dword [esp + 0x2c]
push eax
mov esi, dword [esp + 0x2c]
push ecx
mov dword [esp + 0x18], 1
push edx
push esi
push edi
call fcn.1000f390
add esp, 0x14
cmp dword [0x1002ae08], 0
je 0x1000e84a
mov edi, dword [esp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x1000e84a
call fcn.1000fed0
push 0x1002f43c
push 0xa7
push 0x2d
call fcn.10003840
add esp, 0xc
push ebx
call fcn.1001f43e
add esp, 4
cmp dword [0x100307cc], 0
je 0x1000e863
mov eax, dword [0x100307d0]
jmp 0x1000e868
call fcn.100188c0
mov edi, dword [esp + 0xc]
mov ecx, 0xffffffff
test eax, eax
je 0x1000e89d
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx*2]
push eax
call fcn.1000ddc0
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0xc]
push ebx
push eax
call fcn.10018b30
add esp, 8
jmp 0x1000e8d1
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.1000ddc0
mov edi, dword [esp + 0x10]
add esp, 4
mov ebx, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xc]
push eax
call fcn.1001f43e
add esp, 4
jmp 0x1000e9a3
xor eax, eax
mov al, cl
dec eax
cmp eax, 8
ja case.0x1000e8ed.7
jmp dword [eax*4 + 0x1000eaac]
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov eax, 0x80000000
jmp 0x1000e92c
mov eax, 0x80000005
jmp 0x1000e92c
mov eax, 0x80000001
jmp 0x1000e92c
mov eax, 0x80000002
jmp 0x1000e92c
mov eax, 0x80000004
jmp 0x1000e92c
mov eax, 0x80000006
jmp 0x1000e92c
mov eax, 0x80000003
lea ecx, [esp + 0x14]
push 1
push ecx
push edi
push eax
call fcn.10013260
mov esi, dword [esp + 0x38]
add esp, 0x10
push esi
call fcn.1001f4a6
lea ecx, [esp + 0x14]
add esp, 4
cmp eax, 1
mov eax, 0
adc eax, 0xffffffff
push ecx
and eax, esi
push 0x1000
push ebx
push eax
mov eax, dword [esp + 0x24]
push eax
call fcn.10013af0
mov ecx, dword [esp + 0x28]
add esp, 0x14
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1002ae08], 0
je 0x1000e9a3
test esi, esi
je 0x1000e9a3
call fcn.1000fed0
push 0x1002f43c
push 0xa7
push 0x2d
call fcn.10003840
add esp, 0xc
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 5
ja case.0x1000e9ad.3
jmp dword [eax*4 + 0x1000ead0]
push 2
call fcn.1000ddc0
mov word [eax], 0
add esp, 4
mov esi, eax
push ebx
call fcn.1001f43e
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
cmp dword [0x100307cc], 0
je 0x1000e9e7
mov eax, dword [0x100307d0]
jmp 0x1000e9ec
call fcn.100188c0
test eax, eax
jne 0x1000ea2b
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx*2]
push eax
call fcn.1000ddc0
add esp, 4
mov esi, eax
push esi
push ebx
call fcn.10018b30
add esp, 8
push ebx
call fcn.1001f43e
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push ebx
call fcn.1001f4a6
add esp, 4
lea eax, [eax*2 + 2]
push eax
call fcn.1000ddc0
add esp, 4
mov esi, eax
push ebx
push esi
call fcn.1001ef83
add esp, 8
push ebx
call fcn.1001f43e
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov al, byte [ebx]
mov cl, byte [ebx + 3]
mov dl, byte [ebx + 1]
mov byte [ebx], cl
mov byte [ebx + 3], al
mov al, byte [ebx + 2]
mov byte [ebx + 1], al
mov byte [ebx + 2], dl
mov eax, dword [ebx]
push 0x1a
mov dword [esp + 0x14], eax
call fcn.1000ddc0
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x10]
push 0xa
push esi
push eax
call fcn.100204df
add esp, 0xc
push ebx
call fcn.1001f43e
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10
ret