Function at 0x404771
Capabilities:
Check os version
Get common file path
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
lea eax, [ebp - 0xc0]
push edi
push eax
mov dword [ebp - 0xc0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 2
xor ebx, ebx
pop eax
cmp dword [ebp - 0xb0], eax
jne 0x4047b3
push 3
mov dword [0x406548], eax
pop eax
cmp dword [ebp - 0xbc], eax
jbe 0x4047c3
jmp 0x4047be
xor eax, eax
cmp dword [ebp - 0xb0], ebx
setne al
mov dword [0x406548], eax
mov eax, dword [ebp + 8]
push 0x19954
push 0x40
mov dword [0x406554], eax
mov dword [0x406568], ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [0x406550], eax
jne 0x404804
push 0x2010
push str.WinSFX32
push str.Not_enough_memory
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x404a44
mov dword [eax + 0x44], ebx
mov dword [eax + 0x37c6], ebx
mov byte [eax + 0x35c1], bl
mov byte [eax + 0x18374], bl
mov byte [eax + 0x17f74], bl
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, dword [0x406550]
and eax, 0x3ff
cmp eax, 0x11
mov dword [ecx + 0x30], eax
jne 0x404843
push 1
pop eax
mov dword [ecx + 0x3c], eax
mov dword [ecx + 0x40], eax
jmp 0x404849
mov dword [ecx + 0x3c], ebx
mov dword [ecx + 0x40], ebx
mov ecx, dword [ecx + 0x3c]
call fcn.00402e0a
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 4]
call fcn.00404691
mov dword [ebp + 0x10], eax
mov dword [0x40655c], ebx
mov dword [0x406558], ebx
mov dword [0x406564], ebx
mov dword [0x406540], ebx
xor edi, edi
cmp edi, dword [ebp + 0x10]
jge 0x4048e9
mov eax, dword [ebp - 4]
mov esi, dword [eax + edi*4]
inc edi
cmp byte [esi], 0x2d
jne 0x4048c3
movzx eax, byte [esi + 1]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
cmp al, 0x6e
jne 0x4048ac
xor eax, eax
cmp byte [esi + 2], 0x2d
sete al
add eax, 0xb
mov dword [0x406540], eax
jmp 0x404879
cmp al, 0x63
jne 0x404879
xor eax, eax
cmp byte [esi + 2], 0x2d
setne al
add eax, 0xa
mov dword [0x40655c], eax
jmp 0x404879
cmp edi, 1
jle 0x404879
mov eax, dword [0x406550]
push 0x400
mov edx, esi
mov dword [0x406564], 1
lea ecx, [eax + 0x17f74]
call fcn.0040112c
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
call fcn.00404749
call fcn.00401239
cmp dword [0x406548], ebx
mov dword [0x40654c], ebx
je 0x40493d
lea eax, [ebp - 0x2c]
push eax
push 0x8002
push ebx
call dword [sym.imp.USER32.dll_GetClassInfoA]
test eax, eax
je 0x40493d
mov eax, dword [ebp - 0x28]
mov dword [0x406544], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x4015fa
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x40654c], eax
mov eax, dword [0x406550]
push 0x104
add eax, 0x13b6c
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.004045cd
mov eax, dword [0x406550]
push 1
mov dword [0x40653c], ebx
pop esi
mov cl, byte [eax + 0x37c4]
test cl, 2
je 0x40497a
mov dword [0x40653c], esi
mov eax, dword [0x406540]
cmp eax, ebx
jne 0x40498f
test cl, 1
je 0x40498f
mov eax, esi
mov dword [0x406540], eax
cmp eax, 0xb
jne 0x40499c
mov dword [0x406540], esi
jmp 0x4049a7
cmp eax, 0xc
jne 0x4049a7
mov dword [0x406540], ebx
cmp dword [0x40655c], 0xa
je 0x4049b5
test cl, 8
jne 0x4049bb
mov dword [0x40655c], esi
cmp dword [0x40655c], 0xb
jne 0x4049ca
mov dword [0x40655c], ebx
mov edx, esi
xor ecx, ecx
call fcn.00403549
test eax, eax
je 0x404a23
mov eax, dword [0x406550]
push esi
mov esi, 0x100
push 0x406534
mov edx, esi
lea ecx, [eax + 0x35c1]
call 0x4018eb
mov eax, dword [0x406550]
add eax, 0x35c1
cmp byte [eax], bl
jne 0x404a0a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [0x406550]
mov ecx, dword [ebp + 8]
push 0x4041ef
push ebx
mov edx, dword [eax + 0x128]
call fcn.00401570
mov eax, dword [0x40654c]
cmp eax, ebx
je 0x404a33
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x406550]
push eax
mov esi, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10