Function at 0x6108c0
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb6c
push ebx
push esi
push edi
lea edi, [ebp - 0xb6c]
mov ecx, 0x2db
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.uo9c4Pvvw45B6u6hnIlcOG5lqxX3Oy9nKlG4qBmL5Yta_wqu0Uqtzy2eoW3Kj13KFXhQ
push 0x64f0
call fcn.00655b80
add esp, 8
push eax
call fcn.00654400
add esp, 0x14
mov byte [ebp - 9], 0
push 0x11c
push 0
lea eax, [ebp - 0x130]
push eax
call fcn.00673dc0
add esp, 0xc
mov dword [ebp - 0x130], 0x11c
mov esi, esp
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.00673bc2
cmp dword [ebp - 0x12c], 6
jb 0x61095a
mov byte [ebp - 9], 1
mov esi, esp
lea eax, [ebp - 0x340]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, esp
call fcn.00673bc2
test eax, eax
jne 0x6109a9
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.00673bc2
push eax
push str.Failed_to_get_the_Temp_folder:__d
call fcn.00676ddb
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x610fff
push 0
call fcn.00649000
add esp, 4
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], edx
mov eax, dword [ebp + 0x18]
imul eax, eax, 0x3c
cdq
add eax, dword [ebp - 0x350]
adc edx, dword [ebp - 0x34c]
mov dword [ebp - 0x360], eax
mov dword [ebp - 0x35c], edx
lea eax, [ebp - 0x360]
push eax
call fcn.00626890
add esp, 4
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x36c]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x340]
push edx
push str._sami_s_d_d.exe
push 0x104
lea eax, [ebp - 0x57c]
push eax
call fcn.0067693f
add esp, 0x1c
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x36c]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x36c]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax + 0x10]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x36c]
mov eax, dword [edx + 0x14]
add eax, 0x76c
push eax
push str._d__.2d__.2dT_.2d:_.2d:00
push 0x19
lea ecx, [ebp - 0x5b8]
push ecx
call fcn.0067693f
add esp, 0x20
mov eax, dword [ebp - 0x360]
add eax, 0x834
mov ecx, dword [ebp - 0x35c]
adc ecx, 0
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x600], ecx
lea eax, [ebp - 0x604]
push eax
call fcn.00626890
add esp, 4
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x610]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x610]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x610]
mov ecx, dword [eax + 0x10]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x610]
mov eax, dword [edx + 0x14]
add eax, 0x76c
push eax
push str._d__.2d__.2dT_.2d:_2d:00
push 0x19
lea ecx, [ebp - 0x5f4]
push ecx
call fcn.0067693f
add esp, 0x20
mov eax, dword [ebp + 0x18]
shl eax, 1
imul eax, eax, 0x3c
cdq
add eax, dword [ebp - 0x350]
adc edx, dword [ebp - 0x34c]
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x61c], edx
lea eax, [ebp - 0x620]
push eax
call fcn.00626890
add esp, 4
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x668]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x668]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax + 0x10]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x668]
mov eax, dword [edx + 0x14]
add eax, 0x76c
push eax
push str._d__.2d__.2dT_.2d:_.2d:00
push 0x19
lea ecx, [ebp - 0x65c]
push ecx
call fcn.0067693f
add esp, 0x20
movzx eax, byte [ebp - 9]
test eax, eax
je 0x610c57
lea eax, [ebp - 0x5f4]
push eax
lea ecx, [ebp - 0x5b8]
push ecx
lea edx, [ebp - 0x57c]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0066bf40
add esp, 0x14
test eax, eax
je 0x610bed
mov eax, dword [ebp + 0xc]
push eax
push str.u6Jc7Xvur9W7vuwvaJE4eO6mKlg7Oewnbhf6tu0iqYJr8m0kKFW66hlu1Q_eq0jagT7qxlrpd4C0ne1H7vy2atc_a_wqu05
push 0x2df7
call fcn.00655b80
add esp, 8
push eax
call fcn.00654400
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x610fff
lea eax, [ebp - 0x5f4]
push eax
lea ecx, [ebp - 0x65c]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x57c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0066c510
add esp, 0x14
test eax, eax
je 0x610c52
mov eax, dword [ebp + 0xc]
push eax
push 0x20a6
push 0xfdf
push str.uo9c4Pvvw45B6u6hnIlcOG5lqxX3Oy9nKlG4qBmL5YtaTmKRf6uv1jaIT7P2wmLlWr672aRd_Pu0laET6mku1V4P313J4ThQ
push 0xb87
call fcn.00655b80
add esp, 0x10
push eax
call fcn.00654400
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x610fff
jmp 0x610de6
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x57c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0066cb40
add esp, 0x10
test eax, eax
je 0x610cad
mov eax, dword [ebp + 0xc]
push eax
push 0x264d
push str.uo9c4Pvvw45B6u6hnIlcOG5lqxX3Oy9nKlG4qBmL5YtaTmKRf6uv1jaIT7P2wmLlWr71naJE4eO6mKkT6mku1V4P313J4ThQ
push 0x7836
call fcn.00655b80
add esp, 0xc
push eax
call fcn.00654400
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x610fff
mov eax, dword [ebp + 0x18]
add eax, 0xa
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x57c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0066d360
add esp, 0x10
test eax, eax
je 0x610d0b
mov eax, dword [ebp + 0xc]
push eax
push 0x92f
push 0xde7
push str.uo9c4Pvvw45B6u6hnIlcOG5lqxX3Oy9nKlG4qBmL5YtaTmKRf6uv1jaIT7P2wmLlWr672aRd_Pu0laET6mku1V4P313J4ThQ
push 0x10d2
call fcn.00655b80
add esp, 0x10
push eax
call fcn.00654400
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x610fff
mov eax, dword [ebp + 0x18]
add eax, 0x14
push eax
lea ecx, [ebp - 0x57c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0066da20
add esp, 0xc
test eax, eax
je 0x610d5b
mov eax, dword [ebp + 0xc]
push eax
push str.uo9c4Pvvw45B6u6hnIlW4qhnJ5Q5qxjKFW26mkvcTye68lahXr_u62a5B6u6hnO1SruwlahH6qhmL5Yrm6i0W3K_f
push 0x7e65
call fcn.00655b80
add esp, 8
push eax
call fcn.00654400
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x610fff
lea eax, [ebp - 0x68c]
push eax
call fcn.0066e260
add esp, 4
mov eax, dword [ebp + 0x18]
add eax, 0x15
push eax
lea ecx, [ebp - 0x68c]
call fcn.00603950
push eax
push str.sfile
call fcn.0066da20
add esp, 0xc
test eax, eax
je 0x610ddb
mov eax, dword [ebp + 0xc]
push eax
push 0x3883
push str.uo9c4Pvvw45B6u6hnIlW4qhnJ5Q5qxjKFW26mkvcTye68lahXr_u62a5B6u6hnO1SruwlahH6qhmL5Yrm6i0W3K_f
push 0x216a
call fcn.00655b80
add esp, 0xc
push eax
call fcn.00654400
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov dword [ebp - 0xb68], 1
lea ecx, [ebp - 0x68c]
call fcn.006038c0
mov eax, dword [ebp - 0xb68]
jmp 0x610fff
lea ecx, [ebp - 0x68c]
call fcn.006038c0
mov eax, dword [ebp + 0xc]
push eax
push str.uo9c4Pvvw45B6u6hnIlcOG5lqxX3Oy9nKlG4qBmL5YtaRlrpd4C0ne1S4ev1kKNA65le1H7vyiu1E6v2w2a5B6u6hnKkT6eCn2ehgr4U
push 0x4465
call fcn.00655b80
add esp, 8
push eax
call fcn.00654400
add esp, 8
push 0x695fc4
mov eax, dword [ebp + 0xc]
push eax
push str.mpYW_NKO3L5u
push 0x780e
call fcn.00655c40
add esp, 8
push eax
lea ecx, [ebp - 0x894]
push ecx
call fcn.0061e220
add esp, 0x10
push 0xa
lea eax, [ebp - 0xa9c]
push eax
push 0
call fcn.00676d0b
add esp, 0xc
lea eax, [ebp - 0xa9c]
push eax
lea ecx, [ebp - 0x894]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, 0x64
call fcn.00610780
push 0x69510c
mov eax, dword [ebp + 0xc]
push eax
push str.mpYW_NKO3L5u
push 0x58f0
call fcn.00655c40
add esp, 8
push eax
lea ecx, [ebp - 0x894]
push ecx
call fcn.0061e220
add esp, 0x10
push 0xa
lea eax, [ebp - 0xa9c]
push eax
mov ecx, dword [ebp - 0x34c]
push ecx
mov edx, dword [ebp - 0x350]
push edx
call fcn.00676da8
add esp, 0x10
lea eax, [ebp - 0xa9c]
push eax
lea ecx, [ebp - 0x894]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, 0x64
call fcn.00610780
push 0x695ac4
mov eax, dword [ebp + 0xc]
push eax
push str.mpYW_NKO3L5u
push 0x3a62
call fcn.00655c40
add esp, 8
push eax
lea ecx, [ebp - 0x894]
push ecx
call fcn.0061e220
add esp, 0x10
push 0xa
push 0x100
lea eax, [ebp - 0xa9c]
push eax
mov ecx, dword [ebp - 0x350]
add ecx, 0x834
mov edx, dword [ebp - 0x34c]
adc edx, 0
push edx
push ecx
call fcn.00676c56
add esp, 0x14
lea eax, [ebp - 0xa9c]
push eax
lea ecx, [ebp - 0x894]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, 0x64
call fcn.00610780
push 0x694ba8
mov eax, dword [ebp + 0xc]
push eax
push 0x3686
push 0x3006
push str.mpYW_NKO3L5u
push 0x4869
call fcn.00655c40
add esp, 0x10
push eax
lea ecx, [ebp - 0x894]
push ecx
call fcn.0061e220
add esp, 0x10
push 0xa
push 0x100
lea eax, [ebp - 0xa9c]
push eax
push 0
push 8
call fcn.00676c56
add esp, 0x14
lea eax, [ebp - 0xa9c]
push eax
lea ecx, [ebp - 0x894]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, 0x64
call fcn.00610780
push 0x695fac
mov eax, dword [ebp + 0xc]
push eax
push 0x57c0
push str.mpYW_NKO3L5u
push 0x7380
call fcn.00655c40
add esp, 0xc
push eax
lea ecx, [ebp - 0x894]
push ecx
call fcn.0061e220
add esp, 0x10
push 0xa
lea eax, [ebp - 0xa9c]
push eax
push 1
call fcn.00676d0b
add esp, 0xc
lea eax, [ebp - 0xa9c]
push eax
lea ecx, [ebp - 0x894]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, 0x64
call fcn.00610780
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x611030]
call fcn.00673be5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00673bb3
add esp, 0xb6c
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret 0x18