Function at 0x1000a94f
Capabilities:
Check os version
Get common file path
Get file version info
Get session user name
Get system information on windows
Identify system language via api

Disassembly:
sub esp, 0x2b4
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x2b0], eax
cmp dword [0x1001ff88], 0
jne 0x1000af1a
lea eax, [esp + 0x40]
mov dword [0x1001ffe0], 0x10017bf8
push eax
push 0x105
call dword [sym.imp.kernel32.dll_GetTempPathW]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov dword [0x1001ff74], eax
mov dword [0x1001ffd8], 0x10017c14
mov dword [0x1001ffdc], 0x10017c30
mov dword [esp], str.JAVA2D_FONTPATH
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
pop ecx
test eax, eax
je 0x1000a9cf
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
pop ecx
mov dword [0x1001ff78], eax
jmp 0x1000a9d6
and dword [0x1001ff78], 0
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0x9c
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp byte [esp + 0xea], 1
lea eax, [esp + 0x64]
mov ebx, dword [esp + 0x54]
mov edi, dword [esp + 0x5c]
sete byte [esp + 0x13]
mov esi, dword [esp + 0x58]
mov ebp, dword [esp + 0x60]
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
push 0x24
mov dword [0x1001fff4], eax
lea eax, [esp + 0x34]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
cmp word [esp + 0x2c], 9
push 0x10017c74
sete byte [esp + 0x1f]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
mov ecx, 0x103
sub ecx, eax
lea eax, [esp + 0x50]
push ecx
push eax
mov dword [esp + 0x28], ecx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x1000ab11
cmp ecx, dword [esp + 0x20]
ja 0x1000ab11
mov eax, 0x104
sub eax, ecx
push eax
lea eax, [esp + 0x54]
push 0x10017c84
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
add esp, 0xc
lea eax, [esp + 0x50]
push 0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [esp + 0x28], eax
test eax, eax
je 0x1000ab11
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000ab0d
push edi
push dword [esp + 0x2c]
lea eax, [esp + 0x58]
push 0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
jne 0x1000aad4
push edi
jmp 0x1000ab06
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0x10017ca0
push edi
call sub.version.dll_VerQueryValueW
push edi
test eax, eax
je 0x1000ab06
mov eax, dword [esp + 0x20]
movzx ebx, word [eax + 0x12]
movzx esi, word [eax + 0x10]
movzx eax, word [eax + 0x16]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, dword [esp + 0x14]
sub ebp, 1
je 0x1000ac92
sub ebp, 1
je 0x1000ab2e
mov dword [0x1001ff68], str.Windows__unknown_
jmp 0x1000acd1
cmp ebx, 4
jg 0x1000ab42
mov dword [0x1001ff68], str.Windows_NT
jmp 0x1000acd1
cmp ebx, 5
jne 0x1000ab95
mov eax, esi
sub eax, 0
je 0x1000ab86
sub eax, 1
je 0x1000ab77
sub eax, 1
jne 0x1000ac86
cmp byte [esp + 0x13], al
je 0x1000ab68
cmp byte [esp + 0x1b], al
jne 0x1000ab77
mov dword [0x1001ff68], str.Windows_2003
jmp 0x1000acd1
mov dword [0x1001ff68], str.Windows_XP
jmp 0x1000acd1
mov dword [0x1001ff68], str.Windows_2000
jmp 0x1000acd1
cmp ebx, 6
jne 0x1000ac4b
cmp byte [esp + 0x13], 0
mov eax, esi
je 0x1000abfb
sub eax, 0
je 0x1000abec
sub eax, 1
je 0x1000abdd
sub eax, 1
je 0x1000abce
sub eax, 1
jne 0x1000ac86
mov dword [0x1001ff68], str.Windows_8.1
jmp 0x1000acd1
mov dword [0x1001ff68], str.Windows_8
jmp 0x1000acd1
mov dword [0x1001ff68], str.Windows_7
jmp 0x1000acd1
mov dword [0x1001ff68], str.Windows_Vista
jmp 0x1000acd1
sub eax, 0
je 0x1000ac3c
sub eax, 1
je 0x1000ac2d
sub eax, 1
je 0x1000ac1e
sub eax, 1
jne 0x1000ac86
mov dword [0x1001ff68], str.Windows_Server_2012_R2
jmp 0x1000acd1
mov dword [0x1001ff68], str.Windows_Server_2012
jmp 0x1000acd1
mov dword [0x1001ff68], str.Windows_Server_2008_R2
jmp 0x1000acd1
mov dword [0x1001ff68], str.Windows_Server_2008
jmp 0x1000acd1
cmp ebx, 0xa
jne 0x1000ac86
cmp byte [esp + 0x13], 0
je 0x1000ac6d
mov eax, str.Windows_NT__unknown_
mov ecx, str.Windows_10
test esi, esi
cmove eax, ecx
mov dword [0x1001ff68], eax
jmp 0x1000acd1
test esi, esi
jne 0x1000ac86
cmp edi, 0x4562
mov eax, str.Windows_Server_2019
mov ecx, str.Windows_Server_2016
cmovle eax, ecx
jmp 0x1000ac66
mov dword [0x1001ff68], str.Windows_NT__unknown_
jmp 0x1000acd1
cmp ebx, 4
jne 0x1000acc7
test esi, esi
je 0x1000acbb
cmp esi, 0xa
je 0x1000acaf
mov eax, str.Windows_9X__unknown_
mov ecx, str.Windows_Me
cmp esi, 0x5a
jmp 0x1000ac63
mov dword [0x1001ff68], str.Windows_98
jmp 0x1000acd1
mov dword [0x1001ff68], str.Windows_95
jmp 0x1000acd1
mov dword [0x1001ff68], str.Windows_9X__unknown_
push esi
push ebx
lea eax, [esp + 0x264]
push str._d._d
push eax
call fcn.10001f92
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov dword [0x1001ff6c], eax
mov dword [0x1001ff70], 0x10017e04
mov dword [0x1001fff8], 0x10017e08
mov dword [0x1001ffec], 0x10017e10
call fcn.1000e6a0
push str.USERNAME
mov dword [0x1001ffe8], eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x1000ad4a
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
test eax, eax
je 0x1000ad4a
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
pop ecx
jmp 0x1000ada1
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
mov edi, dword [sym.imp.advapi32.dll_GetUserNameW]
push eax
push 0
call edi
test eax, eax
jne 0x1000ad95
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000ad95
mov eax, dword [esp + 0x14]
add eax, eax
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x1000ad97
lea eax, [esp + 0x14]
push eax
push esi
call edi
test eax, eax
jne 0x1000ad97
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor esi, esi
test esi, esi
mov eax, str.unknown
cmovne eax, esi
mov dword [0x1001ff8c], eax
call fcn.1000b3c8
test eax, eax
mov ecx, 0x10017e3c
cmovne ecx, eax
mov dword [0x1001ff90], ecx
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetSystemDefaultLCID]
mov ebx, eax
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx edi, ax
mov eax, 0x3ff
movzx ebp, si
mov cx, bp
xor cx, di
test ax, cx
lea eax, [esp + 0x1c]
push eax
push 0x1001ffb8
push 0x1001ffac
push 0x1001ffa0
cmove edi, esi
push 0x1001ff94
push edi
call fcn.1000af58
push 0x1001ffc4
push 0x1001ffbc
push 0x1001ffb0
push 0x1001ffa4
push 0x1001ff98
push esi
call fcn.1000af58
lea eax, [esp + 0x4c]
push eax
push 0x1001ffc0
push 0x1001ffb4
push 0x1001ffa8
push 0x1001ff9c
push edi
call fcn.1000af58
add esp, 0x48
push ebx
call fcn.1000b220
mov dword [0x1001ffc8], eax
mov eax, 0xc04
pop ecx
cmp bp, ax
jne 0x1000ae74
cmp dword [esp + 0x24], 6
jne 0x1000ae74
mov eax, str.MS950_HKSCS
mov dword [0x1001ffc4], eax
mov dword [0x1001ffc8], eax
mov edi, dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff5
call edi
mov esi, dword [sym.imp.kernel32.dll_GetFileType]
cmp eax, 0xffffffff
je 0x1000ae9b
push eax
call esi
cmp eax, 2
jne 0x1000ae9b
call fcn.1000b1d7
mov dword [0x1001ffcc], eax
push 0xfffffffffffffff4
call edi
cmp eax, 0xffffffff
je 0x1000aebf
push eax
call esi
cmp eax, 2
jne 0x1000aebf
mov eax, dword [0x1001ffcc]
test eax, eax
jne 0x1000aeba
call fcn.1000b1d7
mov dword [0x1001ffd0], eax
lea eax, [esp + 0x50]
mov dword [0x1001ffe4], 0x10017e50
push eax
push 0x104
mov dword [0x1001ffd4], 0x10016913
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x1000aefc
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
pop ecx
mov dword [0x1001ff7c], eax
mov dword [0x1001ff80], 0x10017e60
mov dword [0x1001ff84], 0x10017e64
mov dword [0x1001ff88], 0x10017e68
mov ecx, dword [esp + 0x2b0]
mov eax, 0x1001ff68
xor ecx, esp
call fcn.10014785
add esp, 0x2b4
ret