Function at 0x4396f9
Capabilities:
Check os version
Get common file path

Disassembly:
push 0x54c
mov eax, 0x4b6364
call fcn.00487ec7
mov ebx, ecx
lea ecx, [ebp - 0x53c]
call fcn.0040364a
and dword [ebp - 4], 0
lea ecx, [ebp - 0x538]
call fcn.0040364a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x554]
call fcn.0040364a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x544]
call fcn.0040364a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x540]
call fcn.0040364a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x550]
call fcn.0040364a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x54c]
call fcn.0040364a
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x548]
call fcn.0040364a
mov byte [ebp - 4], 7
mov esi, 0x11c
push esi
lea eax, [ebp - 0x534]
push 0
push eax
call fcn.00488da0
add esp, 0xc
mov dword [ebp - 0x534], esi
lea eax, [ebp - 0x534]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x524]
sub eax, 1
je 0x439f49
sub eax, 1
jne 0x43a048
mov ecx, dword [ebp - 0x530]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ecx, 3
jne 0x4397f4
push dword [ebp - 0x52c]
lea eax, [ebp - 0x53c]
push str.Windows_NT3._d
push eax
call fcn.00403636
add esp, 0xc
jmp 0x439986
mov eax, dword [ebp - 0x52c]
cmp ecx, 4
jne 0x439811
test eax, eax
jne 0x439970
mov esi, str.Windows_NT4
jmp 0x43995a
cmp ecx, 5
jne 0x43988b
test eax, eax
jne 0x439824
mov esi, str.Windows_2000
jmp 0x43995a
cmp eax, 1
jne 0x439833
mov esi, str.Windows_XP
jmp 0x43995a
cmp eax, 2
jne 0x439970
push 0x59
call edi
test eax, eax
je 0x43984e
mov esi, str.Windows_Server_2003_R2
jmp 0x43995a
mov eax, 0x2000
cmp word [ebp - 0x41c], ax
jne 0x439866
mov esi, str.Windows_Storage_Server_2003
jmp 0x43995a
cmp byte [ebp - 0x41a], 1
jne 0x439881
call fcn.00438ec4
mov esi, str.Windows_XP
test eax, eax
jne 0x43995a
mov esi, str.Windows_Server_2003
jmp 0x43995a
cmp ecx, 6
jne 0x439909
test eax, eax
jne 0x4398b0
cmp byte [ebp - 0x41a], 1
mov esi, str.Windows_Server_2008
jne 0x43995a
mov esi, str.Windows_Vista
jmp 0x43995a
cmp eax, 1
jne 0x4398d0
mov esi, str.Windows_Server_2008_R2
cmp byte [ebp - 0x41a], al
jne 0x43995a
mov esi, str.Windows_7
jmp 0x43995a
cmp eax, 2
jne 0x4398ea
cmp byte [ebp - 0x41a], 1
mov esi, str.Windows_Server_2012
jne 0x43995a
mov esi, str.Windows_8
jmp 0x43995a
cmp eax, 3
jne 0x439904
cmp byte [ebp - 0x41a], 1
mov esi, str.Windows_Server_2012_R2
jne 0x43995a
mov esi, str.Windows_8.1
jmp 0x43995a
cmp eax, 4
je 0x43990e
cmp ecx, 0xa
jb 0x439970
cmp byte [ebp - 0x41a], 1
je 0x439944
cmp dword [ebp - 0x528], 0x4f78
jb 0x43992a
mov esi, str.Windows_Server_2022
jmp 0x43995a
cmp dword [ebp - 0x528], 0x4563
jb 0x43993d
mov esi, str.Windows_Server_2019
jmp 0x43995a
mov esi, str.Windows_Server_2016
jmp 0x43995a
cmp dword [ebp - 0x528], 0x55ec
mov esi, str.Windows_11
jae 0x43995a
mov esi, str.Windows_10
push esi
call fcn.0048cb73
pop ecx
push eax
push esi
lea ecx, [ebp - 0x53c]
call fcn.00402266
jmp 0x439986
push eax
push ecx
lea eax, [ebp - 0x53c]
push str.Windows_NT__d._d
push eax
call fcn.00403636
add esp, 0x10
cmp dword [ebp - 0x530], 6
jb 0x439c1e
push str.GetProductInfo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je case.default.0x439a03
xor edx, edx
lea ecx, [ebp - 0x558]
push ecx
push edx
push edx
push dword [ebp - 0x52c]
mov dword [ebp - 0x558], edx
push dword [ebp - 0x530]
call eax
mov eax, dword [ebp - 0x558]
mov ecx, 0xa1
cmp eax, ecx
ja 0x439bd6
je 0x439bcc
cmp eax, 0x11
ja 0x439ab4
je 0x439aaa
dec eax
cmp eax, 0xf
ja case.default.0x439a03
jmp dword [eax*4 + 0x43a0e1]
mov esi, str.Business
jmp 0x439dfe
mov esi, str.Business_N
jmp 0x439dfe
mov esi, str.Datacenter__Full_installation_
jmp 0x439dfe
mov esi, str.Datacenter__Server_Core_installation_
jmp 0x439dfe
mov esi, str.Enterprise
jmp 0x439dfe
mov esi, str.Enterprise__Full_installation_
jmp 0x439dfe
mov esi, str.Enterprise__Server_Core_installation_
jmp 0x439dfe
mov esi, str.Datacenter_Enterprise_for_Itanium_based_Systems
jmp 0x439dfe
mov esi, str.Home_Basic
jmp 0x439dfe
mov esi, str.Home_Basic_N
jmp 0x439dfe
mov esi, str.Home_Premium
jmp 0x439dfe
mov esi, str.Small_Business_Server
jmp 0x439dfe
mov esi, str.Server_Standard__full_installation_
jmp 0x439dfe
mov esi, str.Server_Standard__core_installation_
jmp 0x439dfe
mov esi, str.Starter
jmp 0x439dfe
mov esi, str.Ultimate
jmp 0x439dfe
mov esi, str.Web_Server
jmp 0x439dfe
cmp eax, 0x3c
ja 0x439bb4
je 0x439bc2
cmp eax, 0x18
ja 0x439b32
je 0x439b28
sub eax, 0x12
je 0x439b1e
sub eax, 1
je 0x439b14
sub eax, 1
je 0x439b0a
sub eax, 1
je 0x439b00
sub eax, 1
je 0x439af6
sub eax, 1
jne case.default.0x439a03
mov esi, str.Storage_Server_Enterprise
jmp 0x439dfe
mov esi, str.Storage_Server_Workgroup
jmp 0x439dfe
mov esi, str.Storage_Server_Standard
jmp 0x439dfe
mov esi, str.Storage_Server_Express
jmp 0x439dfe
mov esi, str.Home_Server
jmp 0x439dfe
mov esi, str.Cluster_Server
jmp 0x439dfe
mov esi, str.Server_for_Small_Business
jmp 0x439dfe
sub eax, 0x19
je 0x439baa
sub eax, 1
je 0x439ba0
sub eax, 1
je 0x439b96
sub eax, 1
je 0x439b8c
sub eax, 0x14
je 0x439b70
sub eax, 1
jne case.default.0x439a03
cmp dword [ebp - 0x52c], 2
mov esi, str.Pro_N
jae 0x439dfe
mov esi, str.Professional_N
jmp 0x439dfe
cmp dword [ebp - 0x52c], 2
mov esi, 0x4d7234
jae 0x439dfe
mov esi, str.Professional
jmp 0x439dfe
mov esi, str.Ultimate_N
jmp 0x439dfe
mov esi, str.Enterprise_N
jmp 0x439dfe
mov esi, str.Home_Premium_N
jmp 0x439dfe
mov esi, str.Small_Business_Server_Premium
jmp 0x439dfe
sub eax, 0x3d
je 0x439bc2
sub eax, 1
jne case.default.0x439a03
mov esi, str.Essentials_Server
jmp 0x439dfe
mov esi, str.Pro_for_Workstation
jmp 0x439dfe
cmp eax, 0xa2
je 0x439c14
cmp eax, 0xa4
je 0x439c0a
cmp eax, 0xa5
je 0x439c00
cmp eax, 0xabcdabcd
jne case.default.0x439a03
mov esi, str.Unlicensed
jmp 0x439dfe
mov esi, str.Pro_for_Education_N
jmp 0x439dfe
mov esi, str.Pro_for_Education
jmp 0x439dfe
mov esi, str.Pro_for_Workstation_N
jmp 0x439dfe
cmp dword [ebp - 0x530], 5
jne case.default.0x439a03
cmp dword [ebp - 0x52c], 0
jne 0x439c7a
mov al, byte [ebp - 0x41a]
cmp al, 1
je 0x439b82
cmp al, 3
jne case.default.0x439a03
test byte [ebp - 0x41c], 0x80
je 0x439c5d
mov esi, str.DataCenter_Server
jmp 0x439dfe
test byte [ebp - 0x41c], 2
je 0x439c70
mov esi, str.Advanced_Server
jmp 0x439dfe
mov esi, str.Server
jmp 0x439dfe
cmp dword [ebp - 0x52c], 1
jb case.default.0x439a03
mov eax, dword [ebp - 0x41c]
test eax, 0x200
je 0x439c9b
mov esi, str.Home_Edition
jmp 0x439ccd
test al, al
jns 0x439ca6
mov esi, str.Datacenter_Edition
jmp 0x439ccd
test al, 2
je 0x439cb1
mov esi, str.Enterprise_Edition
jmp 0x439ccd
test eax, 0x400
je 0x439cbf
mov esi, str.Web_Edition
jmp 0x439ccd
cmp byte [ebp - 0x41a], 1
jne 0x439ce1
mov esi, str.Professional
push esi
call fcn.0048cb73
pop ecx
push eax
push esi
lea ecx, [ebp - 0x538]
call fcn.00402266
push 0x57
call edi
test eax, eax
je 0x439df1
mov edi, 0x104
lea eax, [ebp - 0x418]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.ehomeehshell.exe
mov esi, eax
lea eax, [ebp - 0x418]
push edi
push eax
call fcn.00495194
add esp, 0xc
test esi, esi
je case.default.0x439a03
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x418]
call fcn.0043c135
test eax, eax
je case.default.0x439a03
lea eax, [ebp - 0x210]
push eax
call fcn.0048cb73
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x548]
call fcn.00402266
push 0
push 0x4d7448
lea ecx, [ebp - 0x548]
call fcn.0040a80a
test eax, eax
jne case.default.0x439a03
mov esi, str.Media_Center
push esi
call fcn.0048cb73
pop ecx
push eax
push esi
lea ecx, [ebp - 0x538]
call fcn.00402266
push 0x4c9ff4
push str.5.1.
lea ecx, [ebp - 0x548]
call fcn.0040a844
push dword [ebp - 0x548]
call fcn.00498b1f
fld qword [0x4dfe58]
fcomp st(1)
fnstsw ax
pop ecx
test ah, 1
jne 0x439dc4
fstp st(0)
mov esi, str.2002
jmp 0x439ddb
fcomp qword [0x4dfe60]
fnstsw ax
mov esi, str.2004
test ah, 0x41
jnp 0x439ddb
mov esi, str.2005
push esi
call fcn.0048cb73
pop ecx
push eax
push esi
lea ecx, [ebp - 0x538]
call fcn.00403393
jmp case.default.0x439a03
push 0x56
call edi
test eax, eax
je case.default.0x439a03
mov esi, str.Tablet_PC
push esi
call fcn.0048cb73
pop ecx
push eax
push esi
lea ecx, [ebp - 0x538]
call fcn.00402266
lea eax, [ebp - 0x520]
push eax
call fcn.0048cb73
pop ecx
push eax
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x554]
call fcn.00402266
push 0x4d74b0
push str.Service_Pack
lea ecx, [ebp - 0x554]
call fcn.0040a844
push dword [ebp - 0x52c]
lea eax, [ebp - 0x544]
push dword [ebp - 0x530]
push str._d._d
push eax
call fcn.00403636
push dword [ebp - 0x528]
lea eax, [ebp - 0x540]
push 0x4ca738
push eax
call fcn.00403636
add esp, 0x1c
call fcn.00438ec4
test eax, eax
je 0x439e8e
mov esi, 0x4d74d4
jmp 0x439ec1
call fcn.00438f7f
test eax, eax
je 0x439e9e
mov esi, str.ARM32
jmp 0x439ec1
call fcn.00438fdb
test eax, eax
je 0x439eae
mov esi, str.ARM64
jmp 0x439ec1
call fcn.00438f23
mov esi, str.IA64
test eax, eax
jne 0x439ec1
mov esi, 0x4c9a18
push esi
call fcn.0048cb73
pop ecx
push eax
push esi
lea ecx, [ebp - 0x54c]
call fcn.00402266
push dword [ebp - 0x54c]
mov eax, dword [ebp - 0x554]
push dword [ebp - 0x540]
push dword [ebp - 0x544]
cmp dword [eax - 0xc], 0
je 0x439f16
push eax
push dword [ebp - 0x538]
lea eax, [ebp - 0x550]
push dword [ebp - 0x53c]
push str._s__s__s___s_Build__s____s_
push eax
call fcn.00403636
add esp, 0x20
jmp 0x439f36
push dword [ebp - 0x538]
lea eax, [ebp - 0x550]
push dword [ebp - 0x53c]
push str._s__s___s_Build__s____s_
push eax
call fcn.00403636
add esp, 0x1c
lea eax, [ebp - 0x550]
mov ecx, ebx
push eax
call fcn.00401ffd
jmp 0x43a048
mov eax, dword [ebp - 0x52c]
test eax, eax
je 0x439f9c
cmp eax, 0xa
je 0x439f6b
cmp eax, 0x5a
je 0x439f64
mov esi, str.Windows_9x
jmp 0x439fde
mov esi, str.Windows_Me
jmp 0x439fde
mov eax, 0x8ae
cmp word [ebp - 0x528], ax
jb 0x439f80
mov esi, str.Windows_98_SE
jmp 0x439fde
mov eax, 0x7d0
cmp word [ebp - 0x528], ax
jb 0x439f95
mov esi, str.Windows_98_SP1
jmp 0x439fde
mov esi, str.Windows_98
jmp 0x439fde
mov eax, 0x4be
cmp word [ebp - 0x528], ax
jb 0x439fb1
mov esi, str.Windows_95_OSR2.5
jmp 0x439fde
mov eax, 0x4bc
cmp word [ebp - 0x528], ax
jb 0x439fc6
mov esi, str.Windows_95_OSR2.1
jmp 0x439fde
mov eax, 0x457
mov esi, str.Windows_95_OSR2
cmp word [ebp - 0x528], ax
je 0x439fde
mov esi, str.Windows_95
push esi
call fcn.0048cb73
pop ecx
push eax
push esi
lea ecx, [ebp - 0x53c]
call fcn.00402266
push dword [ebp - 0x52c]
lea eax, [ebp - 0x544]
push dword [ebp - 0x530]
push str._d._d
push eax
call fcn.00403636
movzx eax, word [ebp - 0x528]
push eax
lea eax, [ebp - 0x540]
push 0x4ca738
push eax
call fcn.00403636
push dword [ebp - 0x540]
push dword [ebp - 0x544]
push dword [ebp - 0x53c]
push str._s___s_Build__s_
push ebx
call fcn.00403636
add esp, 0x30
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x548]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x54c]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x550]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x540]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x544]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x554]
lea ecx, [ecx - 0x10]
call fcn.0040259b
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x538]
lea ecx, [ecx - 0x10]
call fcn.0040259b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x53c]
lea ecx, [ecx - 0x10]
call fcn.0040259b
call fcn.00487e76
ret