Function at 0x410bf0
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb6c
push ebx
push esi
push edi
lea edi, [ebp - 0xb6c]
mov ecx, 0x2db
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4abc14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x6edd
push str.t8shiMI_zso8gtdxkc0hkNhpmgqtNVtke07i9NRlfol3ZYgp6lpwuUi1K5rtJEl0eUq7Q
push 0x40ac
push 0x314a
call fcn.004565f0
add esp, 0x10
push eax
call fcn.00454e30
add esp, 0x14
mov byte [ebp - 9], 0
push 0x11c
push 0
lea eax, [ebp - 0x130]
push eax
call fcn.004746d0
add esp, 0xc
mov dword [ebp - 0x130], 0x11c
mov esi, esp
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp esi, esp
call fcn.004744d2
cmp dword [ebp - 0x12c], 6
jb 0x410c94
mov byte [ebp - 9], 1
mov esi, esp
lea eax, [ebp - 0x340]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, esp
call fcn.004744d2
test eax, eax
jne 0x410ce3
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004744d2
push eax
push str.Failed_to_get_the_Temp_folder:__d
call fcn.004776eb
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x41137a
push 0
call fcn.00454860
add esp, 4
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], edx
mov eax, dword [ebp + 0x18]
imul eax, eax, 0x3c
cdq
add eax, dword [ebp - 0x350]
adc edx, dword [ebp - 0x34c]
mov dword [ebp - 0x360], eax
mov dword [ebp - 0x35c], edx
lea eax, [ebp - 0x360]
push eax
call fcn.004550a0
add esp, 4
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x36c]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x340]
push edx
push str._sami_s_d_d.exe
push 0x104
lea eax, [ebp - 0x57c]
push eax
call fcn.0047724f
add esp, 0x1c
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x36c]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x36c]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax + 0x10]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x36c]
mov eax, dword [edx + 0x14]
add eax, 0x76c
push eax
push str._d__.2d__.2dT_.2d:_.2d:00
push 0x19
lea ecx, [ebp - 0x5b8]
push ecx
call fcn.0047724f
add esp, 0x20
mov eax, dword [ebp - 0x360]
add eax, 0x834
mov ecx, dword [ebp - 0x35c]
adc ecx, 0
mov dword [ebp - 0x604], eax
mov dword [ebp - 0x600], ecx
lea eax, [ebp - 0x604]
push eax
call fcn.004550a0
add esp, 4
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x610]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x610]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x610]
mov ecx, dword [eax + 0x10]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x610]
mov eax, dword [edx + 0x14]
add eax, 0x76c
push eax
push str._d__.2d__.2dT_.2d:_2d:00
push 0x19
lea ecx, [ebp - 0x5f4]
push ecx
call fcn.0047724f
add esp, 0x20
mov eax, dword [ebp + 0x18]
shl eax, 1
imul eax, eax, 0x3c
cdq
add eax, dword [ebp - 0x350]
adc edx, dword [ebp - 0x34c]
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x61c], edx
lea eax, [ebp - 0x620]
push eax
call fcn.004550a0
add esp, 4
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x668]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x668]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax + 0x10]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x668]
mov eax, dword [edx + 0x14]
add eax, 0x76c
push eax
push str._d__.2d__.2dT_.2d:_.2d:00
push 0x19
lea ecx, [ebp - 0x65c]
push ecx
call fcn.0047724f
add esp, 0x20
movzx eax, byte [ebp - 9]
test eax, eax
je 0x410f91
lea eax, [ebp - 0x5f4]
push eax
lea ecx, [ebp - 0x5b8]
push ecx
lea edx, [ebp - 0x57c]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0046c620
add esp, 0x14
test eax, eax
je 0x410f2c
mov eax, dword [ebp + 0xc]
push eax
push str.tuYhk4w_t_srhsJgsOY5idpqle0dhN5gkPwiguJkhJ0x_BkneUrg5Zxm6ktldNkgOxuhpZhm_4gi9lkkKk6hsVu1O8hlZYgp6lE
push 0x5bf4
push 0x699c
call fcn.004565f0
add esp, 0xc
push eax
call fcn.00454e30
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x41137a
lea eax, [ebp - 0x5f4]
push eax
lea ecx, [ebp - 0x65c]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x57c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0046cc40
add esp, 0x14
test eax, eax
je 0x410f8c
mov eax, dword [ebp + 0xc]
push eax
push str.t8shiMI_zso8gtdxkc0hkNhpmgqtNVtke07i9NRlfol3ZZDleAigtIlgOZuhMRglf0rx9dr1OAglMJkmOVuk9d2n6koiMQl0dpu7Q
push 0xba
push 0x517
call fcn.004565f0
add esp, 0xc
push eax
call fcn.00454e30
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x41137a
jmp 0x411139
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x57c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046d290
add esp, 0x10
test eax, eax
je 0x410ff1
mov eax, dword [ebp + 0xc]
push eax
push 0x4030
push 0x3ced
push str.t8shiMI_zso8gtdxkc0hkNhpmgqtNVtke07i9NRlfol3ZZDleAigtIlgOZuhMRglf0rx9clkOY5idpqle1uk9d2n6koiMQl0dpu7Q
push 0x4573
push 0x4e87
call fcn.004565f0
add esp, 0x14
push eax
call fcn.00454e30
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x41137a
mov eax, dword [ebp + 0x18]
add eax, 0xa
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x57c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046daf0
add esp, 0x10
test eax, eax
je 0x41104f
mov eax, dword [ebp + 0xc]
push eax
push 0x2d36
push str.t8shiMI_zso8gtdxkc0hkNhpmgqtNVtke07i9NRlfol3ZZDleAigtIlgOZuhMRglf0rx9dr1OAglMJkmOVuk9d2n6koiMQl0dpu7Q
push 0x5ac7
push 0x4d61
call fcn.004565f0
add esp, 0x10
push eax
call fcn.00454e30
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x41137a
mov eax, dword [ebp + 0x18]
add eax, 0x14
push eax
lea ecx, [ebp - 0x57c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0046e1b0
add esp, 0xc
test eax, eax
je 0x4110ae
mov eax, dword [ebp + 0xc]
push eax
push 0x29d9
push 0x59d9
push str.t8shiMI_zso8gtdxkc0ri9Nxkdotj9NhgeUrs9d2n7NuoddsmOwqx8Jq1Oo8gtdxkakvx9JgmOw6gpZxlfolx9BqhqlrtJYP
push 0x566
push 0x69f8
call fcn.004565f0
add esp, 0x14
push eax
call fcn.00454e30
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov eax, 1
jmp 0x41137a
lea eax, [ebp - 0x68c]
push eax
call fcn.0046e9f0
add esp, 4
mov eax, dword [ebp + 0x18]
add eax, 0x15
push eax
lea ecx, [ebp - 0x68c]
call fcn.00403a00
push eax
push str.sfile
call fcn.0046e1b0
add esp, 0xc
test eax, eax
je 0x41112e
mov eax, dword [ebp + 0xc]
push eax
push str.t8shiMI_zso8gtdxkc0ri9Nxkdotj9NhgeUrs9d2n7NuoddsmOwqx8Jq1Oo8gtdxkakvx9JgmOw6gpZxlfolx9BqhqlrtJYP
push 0x6ada
push 0x5acd
call fcn.004565f0
add esp, 0xc
push eax
call fcn.00454e30
add esp, 8
mov eax, dword [ebp + 0x1c]
mov dword [eax], 1
mov dword [ebp - 0xb68], 1
lea ecx, [ebp - 0x68c]
call fcn.00403970
mov eax, dword [ebp - 0xb68]
jmp 0x41137a
lea ecx, [ebp - 0x68c]
call fcn.00403970
mov eax, dword [ebp + 0xc]
push eax
push 0x79c
push 0x7157
push str.t8shiMI_zso8gtdxkc0hkNhpmgqtNVtke07i9NRlfol3ZZBm_4gi9lkkKkvidIlnec9k9dpmKk6hsVuh6k5gsRg1Oo8gtdxke1ugdl31Kwdx7w
push 0x62b1
push 0x6835
call fcn.004565f0
add esp, 0x14
push eax
call fcn.00454e30
add esp, 8
push 0x496fa4
mov eax, dword [ebp + 0xc]
push eax
push 0x38d0
push str.l9JrlOte0foT
push 0x32b6
push 0x4094
call fcn.004566b0
add esp, 0x10
push eax
lea ecx, [ebp - 0x894]
push ecx
call fcn.0041e580
add esp, 0x10
push 0xa
lea eax, [ebp - 0xa9c]
push eax
push 0
call fcn.0047761b
add esp, 0xc
lea eax, [ebp - 0xa9c]
push eax
lea ecx, [ebp - 0x894]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, 0x64
call fcn.00410a90
push 0x496124
mov eax, dword [ebp + 0xc]
push eax
push str.l9JrlOte0foT
push 0x3653
push 0x49f2
call fcn.004566b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x894]
push ecx
call fcn.0041e580
add esp, 0x10
push 0xa
lea eax, [ebp - 0xa9c]
push eax
mov ecx, dword [ebp - 0x34c]
push ecx
mov edx, dword [ebp - 0x350]
push edx
call fcn.004776b8
add esp, 0x10
lea eax, [ebp - 0xa9c]
push eax
lea ecx, [ebp - 0x894]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, 0x64
call fcn.00410a90
push 0x496ab8
mov eax, dword [ebp + 0xc]
push eax
push str.l9JrlOte0foT
push 0x4fae
push 0x7c3a
call fcn.004566b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x894]
push ecx
call fcn.0041e580
add esp, 0x10
push 0xa
push 0x100
lea eax, [ebp - 0xa9c]
push eax
mov ecx, dword [ebp - 0x350]
add ecx, 0x834
mov edx, dword [ebp - 0x34c]
adc edx, 0
push edx
push ecx
call fcn.00477566
add esp, 0x14
lea eax, [ebp - 0xa9c]
push eax
lea ecx, [ebp - 0x894]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, 0x64
call fcn.00410a90
push 0x495bc0
mov eax, dword [ebp + 0xc]
push eax
push str.l9JrlOte0foT
push 0x71ef
push 0x3a98
call fcn.004566b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x894]
push ecx
call fcn.0041e580
add esp, 0x10
push 0xa
push 0x100
lea eax, [ebp - 0xa9c]
push eax
push 0
push 8
call fcn.00477566
add esp, 0x14
lea eax, [ebp - 0xa9c]
push eax
lea ecx, [ebp - 0x894]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, 0x64
call fcn.00410a90
push 0x496f8c
mov eax, dword [ebp + 0xc]
push eax
push 0x6c4b
push 0x1e38
push str.l9JrlOte0foT
push 0x57f7
push 0x5554
call fcn.004566b0
add esp, 0x14
push eax
lea ecx, [ebp - 0x894]
push ecx
call fcn.0041e580
add esp, 0x10
push 0xa
lea eax, [ebp - 0xa9c]
push eax
push 1
call fcn.0047761b
add esp, 0xc
lea eax, [ebp - 0xa9c]
push eax
lea ecx, [ebp - 0x894]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, 0x64
call fcn.00410a90
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x4113ac]
call fcn.004744f5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004744c3
add esp, 0xb6c
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret 0x18