Function at 0x401de0
Capabilities:
Get common file path
Get memory capacity
Get session user name
Get system information on windows
Read .ini file

Disassembly:
sub esp, 0x26c
push ebp
push esi
push edi
push 1
push 0x104
call fcn.0040893f
mov esi, eax
push 1
push 0x104
mov dword [esp + 0x20], esi
call fcn.0040893f
mov ebp, dword [esp + 0x294]
mov edi, eax
mov eax, dword [esp + 0x29c]
add esp, 0x10
mov byte [esi], 0
mov esi, dword [esp + 0x280]
test eax, eax
mov dword [esp + 0xc], edi
mov byte [edi], 0
je 0x401e46
mov ecx, dword [esp + 0x288]
mov edx, dword [esp + 0x27c]
push ecx
push ebp
push esi
push edx
call eax
add esp, 0x10
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x4020de
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.date
push esi
call ebx
test eax, eax
jne 0x401e9d
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x104
push edi
lea ecx, [esp + 0x20]
push 0
push ecx
push 0x80000000
push 0x800
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4020de
push str.time
push esi
call ebx
test eax, eax
jne 0x401ede
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x104
push edi
lea eax, [esp + 0x20]
push 0
push eax
push 0x80000000
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4020de
push str.username
push esi
call ebx
test eax, eax
jne 0x401f0b
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4020de
push 0x410138
push esi
call ebx
test eax, eax
jne 0x401f7f
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x30]
cmp eax, 0x182
jne 0x401f3e
push str.386_or_compatible
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4020de
cmp eax, 0x1e6
jne 0x401f56
push str.486_or_compatible
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4020de
cmp eax, 0x24a
jne 0x401f6e
push str.Pentium_Pentium_Pro_Pentium_II_or_compatible
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4020de
push str.Unknown_processor_type
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4020de
push 0x4100c4
push esi
call ebx
test eax, eax
jne 0x401fba
mov eax, 0x20
xor ecx, ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea edi, [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x20]
push 0xa
push ebp
push ecx
call fcn.00408b84
add esp, 0xc
jmp 0x4020da
push str.virtual
push esi
call ebx
test eax, eax
jne 0x401ff8
lea edx, [esp + 0x18]
mov eax, 0x20
xor ecx, ecx
push edx
lea edi, [esp + 0x1c]
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x34]
push 0xa
shr eax, 0x14
push ebp
push eax
call fcn.00408b84
add esp, 0xc
jmp 0x4020da
push str.diskspace
push esi
call ebx
test eax, eax
jne 0x40209f
mov cl, byte [0x411680]
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], cl
mov ecx, 0x3f
mov edx, dword [esp + 0x28c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x280]
push edx
stosw word es:[edi], ax
lea eax, [esp + 0x40]
push eax
push str.rootdir
push ecx
call dword [esp + 0x2a0]
add esp, 0x10
lea edx, [esp + 0x3c]
push 0x411680
push edx
call ebx
test eax, eax
jne 0x402063
lea eax, [esp + 0x3c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x13c]
lea edx, [esp + 0x3c]
push ecx
push edx
mov byte [esp + 0x47], 0
call fcn.004032b0
mov ecx, dword [esp + 0x250]
mov edx, dword [esp + 0x24c]
xor esi, esi
xor eax, eax
push 0xa
or ecx, esi
push ebp
or eax, edx
push ecx
push eax
call fcn.00408c34
add esp, 0x18
jmp 0x4020da
push str.tasks
push esi
call ebx
test eax, eax
jne 0x402109
push 1
push 0x104
call fcn.0040893f
mov ebx, eax
push ebx
call fcn.00403100
add esp, 0xc
mov ecx, 0x41
mov esi, ebx
mov edi, ebp
test ebx, ebx
rep movsd dword es:[edi], dword [esi]
je 0x4020da
push ebx
call fcn.00408910
add esp, 4
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
pop ebx
test eax, eax
je 0x4020f0
push eax
call fcn.00408910
add esp, 4
test edi, edi
je 0x4020fd
push edi
call fcn.00408910
add esp, 4
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x26c
ret
push str.386Enh
push esi
call ebx
test eax, eax
jne 0x402186
push 1
push 0x104
call fcn.0040893f
mov esi, eax
mov al, byte [0x411680]
mov byte [esp + 0x44], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x45]
rep stosd dword es:[edi], eax
add esp, 8
lea ecx, [esp + 0x3c]
stosw word es:[edi], ax
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x3c]
push str._system.ini
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push eax
push 0x104
push esi
push str.386Enh
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
je 0x4020da
push esi
jmp 0x4020d2
push 0x410088
push esi
call ebx
test eax, eax
je 0x4020de
push str.USER
push esi
call ebx
test eax, eax
je 0x4020de
push 0x410078
push esi
call ebx
jmp 0x4020de