Function at 0x6da5adfd
Capabilities:
Check os version
Get common file path
Get file version info
Get session user name
Get system information on windows
Identify system language via api

Disassembly:
push ebp
lea ebp, [esp - 0x2cc]
sub esp, 0x348
mov eax, dword [0x6da6df10]
xor eax, ebp
mov dword [ebp + 0x2c8], eax
push edi
xor edi, edi
cmp dword [0x6da6df98], edi
jne 0x6da5b360
push esi
lea eax, [ebp + 0x58]
push eax
push 0x105
mov dword [0x6da6dff0], 0x6da65e48
call dword [sym.imp.kernel32.dll_GetTempPathW]
mov esi, dword [sym.imp.msvcr100.dll__wcsdup]
lea eax, [ebp + 0x58]
push eax
call esi
mov dword [0x6da6df84], eax
mov dword [0x6da6dfe8], 0x6da65e2c
mov dword [0x6da6dfec], 0x6da65e08
mov dword [esp], str.JAVA2D_FONTPATH
call dword [sym.imp.msvcr100.dll__wgetenv]
pop ecx
cmp eax, edi
je 0x6da5ae83
push eax
call esi
pop ecx
mov dword [0x6da6df88], eax
jmp 0x6da5ae89
mov dword [0x6da6df88], edi
push ebx
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x44], 0x9c
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov eax, dword [ebp - 0x40]
cmp byte [ebp + 0x56], 1
mov esi, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x30]
push eax
sete byte [ebp - 0x45]
call dword [sym.imp.msvcr100.dll__strdup]
push 0x24
mov dword [0x6da6e004], eax
lea eax, [ebp - 0x7c]
push edi
push eax
call sub.msvcr100.dll_memset
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x7c], 9
push 0x6da65dd8
sete byte [ebp - 0x46]
call sub.msvcr100.dll_strlen
pop ecx
mov ecx, 0x103
sub ecx, eax
push ecx
lea eax, [ebp + 0x58]
push eax
mov dword [ebp - 0x58], ecx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
cmp eax, edi
je 0x6da5af82
cmp eax, dword [ebp - 0x58]
ja 0x6da5af82
mov ecx, 0x104
sub ecx, eax
push ecx
lea eax, [ebp + 0x58]
push 0x6da65dbc
push eax
call dword [sym.imp.msvcr100.dll_wcsncat]
add esp, 0xc
push edi
lea eax, [ebp + 0x58]
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x4c], eax
cmp eax, edi
je 0x6da5af82
push eax
call dword [sym.imp.msvcr100.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x6da5af82
push edi
push dword [ebp - 0x4c]
lea eax, [ebp + 0x58]
push 0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x6da5af7a
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x6da65db8
push edi
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6da5af7a
mov eax, dword [ebp - 0x54]
movzx ecx, word [eax + 0x12]
movzx esi, word [eax + 0x10]
mov dword [ebp - 0x50], ecx
push edi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
dec ebx
je 0x6da5b0dc
dec ebx
je 0x6da5af9b
mov dword [0x6da6df78], str.Windows__unknown_
jmp 0x6da5b11e
mov eax, dword [ebp - 0x50]
cmp eax, 4
jg 0x6da5afb2
mov dword [0x6da6df78], str.Windows_NT
jmp 0x6da5b11e
cmp eax, 5
jne 0x6da5afff
mov eax, esi
sub eax, 0
je 0x6da5aff0
dec eax
je 0x6da5afe1
dec eax
jne 0x6da5b0d0
cmp byte [ebp - 0x45], al
je 0x6da5afd2
cmp byte [ebp - 0x46], al
jne 0x6da5afe1
mov dword [0x6da6df78], str.Windows_2003
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_XP
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_2000
jmp 0x6da5b11e
cmp eax, 6
jne 0x6da5b0a5
cmp byte [ebp - 0x45], 0
mov eax, esi
je 0x6da5b05e
sub eax, 0
je 0x6da5b04f
dec eax
je 0x6da5b040
dec eax
je 0x6da5b031
dec eax
jne 0x6da5b0d0
mov dword [0x6da6df78], str.Windows_8.1
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_8
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_7
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_Vista
jmp 0x6da5b11e
sub eax, 0
je 0x6da5b099
dec eax
je 0x6da5b08a
dec eax
je 0x6da5b07b
dec eax
jne 0x6da5b0d0
mov dword [0x6da6df78], str.Windows_Server_2012_R2
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_Server_2012
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_Server_2008_R2
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_Server_2008
jmp 0x6da5b11e
cmp eax, 0xa
jne 0x6da5b0d0
cmp byte [ebp - 0x45], 0
je 0x6da5b0c0
test esi, esi
jne 0x6da5b0d0
mov dword [0x6da6df78], str.Windows_10
jmp 0x6da5b11e
test esi, esi
jne 0x6da5b0d0
mov dword [0x6da6df78], str.Windows_Server_2016
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_NT__unknown_
jmp 0x6da5b11e
cmp dword [ebp - 0x50], 4
jne 0x6da5b114
test esi, esi
je 0x6da5b108
cmp esi, 0xa
je 0x6da5b0fc
cmp esi, 0x5a
jne 0x6da5b114
mov dword [0x6da6df78], str.Windows_Me
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_98
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_95
jmp 0x6da5b11e
mov dword [0x6da6df78], str.Windows_9X__unknown_
push esi
push dword [ebp - 0x50]
lea eax, [ebp + 0x264]
push str._d._d
push eax
call dword [sym.imp.msvcr100.dll_sprintf]
lea eax, [ebp + 0x264]
push eax
call dword [sym.imp.msvcr100.dll__strdup]
mov dword [0x6da6df7c], eax
mov dword [0x6da6df80], 0x6da65c68
mov dword [0x6da6e008], 0x6da65c60
mov dword [0x6da6dffc], 0x6da65c58
call fcn.6da5e020
push str.USERNAME
mov dword [0x6da6dff8], eax
call dword [sym.imp.msvcr100.dll__wgetenv]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x6da5b19d
push esi
call dword [sym.imp.msvcr100.dll_wcslen]
pop ecx
test eax, eax
je 0x6da5b19d
push esi
call dword [sym.imp.msvcr100.dll__wcsdup]
pop ecx
mov dword [0x6da6df9c], eax
jmp 0x6da5b1fa
mov edi, dword [sym.imp.advapi32.dll_GetUserNameW]
and dword [ebp - 0x4c], 0
lea eax, [ebp - 0x4c]
push eax
push 0
call edi
test eax, eax
jne 0x6da5b1e4
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x6da5b1e4
mov eax, dword [ebp - 0x4c]
add eax, eax
push eax
call dword [sym.imp.msvcr100.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x6da5b1f0
lea eax, [ebp - 0x4c]
push eax
push esi
call edi
test eax, eax
jne 0x6da5b1e6
push esi
call dword [sym.imp.msvcr100.dll_free]
pop ecx
xor esi, esi
mov dword [0x6da6df9c], esi
test esi, esi
jne 0x6da5b1fa
mov dword [0x6da6df9c], str.unknown
call fcn.6da5ab1f
test eax, eax
jne 0x6da5b208
mov eax, 0x6da65c2c
mov dword [0x6da6dfa0], eax
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
mov edi, eax
call dword [sym.imp.kernel32.dll_GetSystemDefaultLCID]
mov ebx, eax
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx esi, ax
mov eax, esi
xor eax, edi
test eax, 0x3ff
jne 0x6da5b233
mov esi, edi
lea eax, [ebp - 0x54]
push eax
push 0x6da6dfc8
push 0x6da6dfbc
push 0x6da6dfa4
mov edx, 0x6da6dfb0
mov ecx, esi
call fcn.6da5e020
push 0x6da6dfd4
push 0x6da6dfcc
push 0x6da6dfc0
push 0x6da6dfa8
mov edx, 0x6da6dfb4
mov ecx, edi
call fcn.6da5e020
lea eax, [ebp - 0x54]
push eax
push 0x6da6dfd0
push 0x6da6dfc4
push 0x6da6dfac
mov edx, 0x6da6dfb8
mov ecx, esi
call fcn.6da5e020
push ebx
call fcn.6da5a92c
mov dword [0x6da6dfd8], eax
add esp, 0x34
mov eax, 0xc04
pop ebx
cmp di, ax
jne 0x6da5b2bf
cmp dword [ebp - 0x50], 6
jne 0x6da5b2bf
mov eax, str.MS950_HKSCS
mov dword [0x6da6dfd4], eax
mov dword [0x6da6dfd8], eax
mov esi, dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff5
call esi
mov edi, dword [sym.imp.kernel32.dll_GetFileType]
cmp eax, 0xffffffff
je 0x6da5b2e6
push eax
call edi
cmp eax, 2
jne 0x6da5b2e6
call fcn.6da5aad4
mov dword [0x6da6dfdc], eax
push 0xfffffffffffffff4
call esi
pop esi
cmp eax, 0xffffffff
je 0x6da5b30b
push eax
call edi
cmp eax, 2
jne 0x6da5b30b
mov eax, dword [0x6da6dfdc]
test eax, eax
jne 0x6da5b306
call fcn.6da5aad4
mov dword [0x6da6dfe0], eax
lea eax, [ebp + 0x58]
push eax
push 0x104
mov dword [0x6da6dff4], 0x6da65c10
mov dword [0x6da6dfe4], 0x6da6494d
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x6da5b342
lea eax, [ebp + 0x58]
push eax
call dword [sym.imp.msvcr100.dll__wcsdup]
pop ecx
mov dword [0x6da6df8c], eax
mov dword [0x6da6df90], 0x6da65c0c
mov dword [0x6da6df94], 0x6da65c08
mov dword [0x6da6df98], 0x6da65c04
mov ecx, dword [ebp + 0x2c8]
xor ecx, ebp
mov eax, 0x6da6df78
pop edi
call fcn.6da62890
add ebp, 0x2cc
leave
ret