Function at 0x401960
Capabilities:
Check os version
Get common file path
Get geographical location

Disassembly:
sub rsp, 0x508
mov rax, qword [0x0040f008]
mov qword [rsp + 0x4e0], rax
mov byte [rcx + 4], 0
mov dword [rcx], 0x13
mov qword [rsp + 0x4f8], r12
mov r12, rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x94
call fcn.00402920
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4019cf
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401d87
mov eax, dword [rsp + 0x50]
dec eax
je 0x401a29
dec eax
jne 0x401a84
mov eax, dword [rsp + 0x44]
cmp eax, 4
ja 0x4019f0
mov dword [r12], 0x11
cmp eax, 5
jne 0x401a84
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x401a0b
mov dword [r12], 0x12
jmp 0x401a84
cmp eax, 1
jne 0x401a1a
mov dword [r12], 0x13
jmp 0x401a84
cmp eax, 2
jne 0x401a84
mov dword [r12], 0x14
jmp 0x401a84
cmp dword [rsp + 0x44], 4
mov dword [r12], 3
jne 0x401a66
mov eax, dword [rsp + 0x48]
test eax, eax
jne 0x401a4a
mov dword [r12], 1
jmp 0x401a66
cmp eax, 0xa
jne 0x401a59
mov dword [r12], 2
jmp 0x401a66
cmp eax, 0x5a
jne 0x401a66
mov dword [r12], 3
mov eax, dword [rsp + 0x4c]
and eax, 0xffff0000
cmp eax, 0x45a0000
jne 0x401a7e
mov dword [r12], 3
mov byte [r12 + 4], 1
mov r9d, 0xa
lea r8, [rsp + 0xe0]
mov ecx, 0x400
lea edx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea rdx, [rsp + 0xe0]
mov rcx, r12
call fcn.00401430
cmp eax, 0x404
mov dword [r12 + 8], eax
je 0x401b05
cmp eax, 0x804
je 0x401afa
cmp eax, 0xc04
je 0x401aef
cmp eax, 0x1004
je 0x401ae4
cmp eax, 0x1404
jne 0x401b0e
mov dword [r12 + 8], 0x14c1
jmp 0x401b0e
mov dword [r12 + 8], 0x10c0
jmp 0x401b0e
mov dword [r12 + 8], 0xcc1
jmp 0x401b0e
mov dword [r12 + 8], 0x8c0
jmp 0x401b0e
mov dword [r12 + 8], 0x4c1
mov r8d, dword [r12 + 8]
lea rdx, [rsp + 0xe0]
lea rcx, str.Locale___s___04x_n
call fcn.004012c0
movzx ecx, byte [r12 + 8]
mov dword [r12 + 0xc], 0x4e4
sub ecx, 0x11
je 0x401b6c
dec ecx
je 0x401b61
sub ecx, 0xae
je 0x401b56
dec ecx
jne 0x401b75
mov dword [r12 + 0xc], 0x3b6
jmp 0x401b75
mov dword [r12 + 0xc], 0x3a8
jmp 0x401b75
mov dword [r12 + 0xc], 0x3b5
jmp 0x401b75
mov dword [r12 + 0xc], 0x3a4
cmp byte [r12 + 4], 0
mov qword [rsp + 0x518], rbx
mov qword [rsp + 0x520], rbp
mov qword [rsp + 0x528], rsi
mov qword [rsp + 0x500], rdi
je 0x401c71
lea rcx, [r12 + 0x10]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [r12 + 0x114]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r10d, dword [r12 + 0xc]
lea rdi, [r12 + 0x10]
test r10d, r10d
mov rcx, 0xffffffffffffffff
lea rbx, [r12 + 0x218]
cmove r10d, r10d
xor eax, eax
lea r8, [r12 + 0x10]
repne scasb al, byte [rdi]
xor edx, edx
mov dword [rsp + 0x28], 0xffc
not rcx
mov qword [rsp + 0x20], rbx
lea r9, [rcx - 1]
mov ecx, r10d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdi, [r12 + 0x114]
mov rcx, 0xffffffffffffffff
movsxd rdx, eax
lea r8, [r12 + 0x114]
mov dword [rsp + 0x28], 0xffc
mov word [rbx + rdx*2], 0
mov r10d, dword [r12 + 0xc]
lea rbx, [r12 + 0x420]
test r10d, r10d
mov qword [rsp + 0x20], rbx
cmove r10d, r10d
xor eax, eax
xor edx, edx
repne scasb al, byte [rdi]
not rcx
lea r9, [rcx - 1]
mov ecx, r10d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rcx, eax
mov word [rbx + rcx*2], 0
jmp 0x401d67
lea rcx, [r12 + 0x218]
mov edx, 0x104
mov qword [rsp + 0x4f0], r13
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [r12 + 0x420]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r10d, dword [r12 + 0xc]
lea rdi, [r12 + 0x218]
test r10d, r10d
mov rcx, 0xffffffffffffffff
lea rbx, [r12 + 0x10]
cmove r10d, r10d
xor eax, eax
xor r13d, r13d
repne scasw ax, word [rdi]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
not rcx
lea r8, [r12 + 0x218]
xor edx, edx
lea r9, [rcx - 1]
mov ecx, r10d
mov dword [rsp + 0x28], 0xffc
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x38], r13
movsxd rcx, eax
mov qword [rsp + 0x30], r13
lea rdi, [r12 + 0x420]
mov byte [rcx + rbx], r13b
mov r10d, dword [r12 + 0xc]
mov rcx, 0xffffffffffffffff
test r10d, r10d
lea rbx, [r12 + 0x114]
lea r8, [r12 + 0x420]
cmove r10d, r10d
xor eax, eax
xor edx, edx
repne scasw ax, word [rdi]
mov dword [rsp + 0x28], 0xffc
mov qword [rsp + 0x20], rbx
not rcx
lea r9, [rcx - 1]
mov ecx, r10d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rcx, eax
mov byte [rcx + rbx], r13b
mov r13, qword [rsp + 0x4f0]
mov rdi, qword [rsp + 0x500]
mov rsi, qword [rsp + 0x528]
mov rbp, qword [rsp + 0x520]
mov rbx, qword [rsp + 0x518]
xor eax, eax
mov r12, qword [rsp + 0x4f8]
mov rcx, qword [rsp + 0x4e0]
call fcn.0040a3f0
add rsp, 0x508
ret