Function at 0x601460b0
Capabilities:
Check if file exists
Check os version
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6014c011
push eax
mov dword fs:[0], esp
sub esp, 0xa4
push ebp
mov ebp, ecx
mov eax, dword [ebp]
call dword [eax + 8]
test eax, eax
je 0x601460f0
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
add esp, 0xb0
ret
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x6014611c
cmp dword [esp + 0x24], 2
jne 0x6014611c
cmp dword [esp + 0x18], 5
jne 0x6014611c
cmp dword [esp + 0x1c], 1
jbe 0x60146137
mov eax, 0x80004001
pop ebp
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
add esp, 0xb0
ret
mov edx, dword [0x6015b6f8]
push ebx
push esi
mov ecx, 0x6015b6f8
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
xor ebx, ebx
sub eax, 0x104
or eax, ecx
mov dword [esp + 0xb8], ebx
jge 0x6014617f
push 0x104
lea ecx, [esp + 0x10]
call fcn.601042f0
mov esi, dword [esp + 0xc]
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x6015b6f8]
mov ecx, 0x6015b6f8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
push 0x601506bc
push esi
lea ecx, [esp + 0x20]
mov byte [esp + 0xc0], 1
call fcn.60126fd0
cmp esi, ebx
jne 0x601461be
xor eax, eax
jmp 0x601461d2
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x601461c3
sub eax, edx
js 0x60146355
cmp eax, dword [esi - 8]
jg 0x60146355
push edi
mov edi, dword [esp + 0x1c]
mov dword [esi - 0xc], eax
push edi
mov byte [eax + esi], bl
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x60146255
lea eax, [edi - 0x10]
mov byte [esp + 0xbc], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x60146212
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esi - 0x10]
mov dword [esp + 0xbc], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x60146237
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 0x80004001
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebx
pop ebp
mov dword fs:[0], ecx
add esp, 0xb0
ret
mov eax, dword [str.ApiMon]
push edi
push eax
lea ecx, [esp + 0x1c]
call fcn.60147430
lea ecx, [esp + 0x14]
mov byte [esp + 0xbc], 2
call fcn.60147110
test eax, eax
jne 0x601462cf
push 1
push 3
lea ecx, [esp + 0x1c]
call fcn.60146e40
mov esi, eax
cmp esi, ebx
jge 0x601462cf
lea ecx, [esp + 0x14]
mov byte [esp + 0xbc], 1
call fcn.60146e00
lea eax, [edi - 0x10]
mov byte [esp + 0xbc], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x601462bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x10]
call fcn.601042d0
mov eax, esi
jmp 0x6014623c
lea ecx, [esp + 0x14]
call fcn.60147300
test eax, eax
jne 0x601462eb
lea ecx, [esp + 0x14]
call fcn.60147180
mov esi, eax
cmp esi, ebx
jl 0x6014628d
mov eax, dword [str..ApiMon]
push ebx
push ebx
push 0x40000000
push 3
push 3
push 0xc0000000
push eax
lea ecx, [ebp + 4]
call fcn.601180d0
lea ecx, [esp + 0x14]
mov esi, eax
mov byte [esp + 0xbc], 1
call fcn.60146e00
lea eax, [edi - 0x10]
or edx, 0xffffffff
mov byte [esp + 0xbc], bl
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
cmp esi, ebx
jl 0x601462b3
test edx, edx
jg 0x60146345
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x10]
call fcn.601042d0
xor eax, eax
jmp 0x6014623c
push 0x80070057
call fcn.601040a0
int3