Function at 0x10003237
Capabilities:
Get common file path
Get cpu information
Get disk information
Get disk size
Get hostname
Get memory capacity
Get session user name
Get system information on windows
Query environment variable
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x30edc
call fcn.1001e1c0
mov eax, dword [0x10028500]
xor eax, esp
mov dword [esp + 0x30ed8], eax
mov eax, dword [0x10029210]
push ebx
mov dword [esp + 0x4c], eax
push esi
push edi
xor eax, eax
lea edi, [esp + 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
push 0x864
lea eax, [esp + 0xe8]
push ebx
push eax
mov byte [esp + 0x6c], 5
mov dword [esp + 0xec], ebx
call fcn.10016310
add esp, 0xc
mov esi, 0xfffe
push esi
lea eax, [esp + 0x20ee5]
push ebx
push eax
mov byte [esp + 0x20eec], bl
call fcn.10016310
add esp, 0xc
push esi
lea eax, [esp + 0xee5]
push ebx
push eax
mov byte [esp + 0xeec], bl
call fcn.10016310
add esp, 0xc
push esi
lea eax, [esp + 0x10ee5]
push ebx
push eax
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x10eec], bl
call fcn.10016310
add esp, 0xc
mov esi, 0x103
push esi
lea eax, [esp + 0xddd]
push ebx
push eax
mov byte [esp + 0xde4], bl
call fcn.10016310
add esp, 0xc
lea eax, [esp + 0xdd8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
cmp byte [esp + 0xdd8], bl
lea eax, [esp + 0xdd8]
mov byte [esp + 0x13], bl
jmp 0x100034ca
cmp byte [esp + 0x13], 0x19
jg 0x100034d4
mov eax, dword [esp + 0x14]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000333e
sub eax, esi
movsx esi, byte [esp + 0x13]
imul esi, esi, 0x28
push eax
push dword [esp + 0x18]
lea ecx, [esp + esi + 0xec]
push ecx
mov dword [esp + 0x2c], ecx
call fcn.100101c0
add esp, 0xc
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [esp + esi + 0xe8], eax
xor eax, eax
mov byte [esp + 0xb5c], bl
lea edi, [esp + 0xb5d]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xb50], bl
lea edi, [esp + 0xb51]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa
stosb byte es:[edi], al
lea eax, [esp + 0xb54]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x38]
push eax
push 0xc
lea eax, [esp + 0xb74]
push eax
push dword [esp + 0x3c]
mov dword [esp + 0x68], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x100033f3
mov eax, dword [esp + 0x1c]
mov dword [esp + esi + 0xec], eax
lea eax, [esp + 0xb50]
push eax
jmp 0x100033ff
mov dword [esp + esi + 0xec], ebx
push str.Unknown
lea eax, [esp + esi + 0xf4]
push 0x10
push eax
call fcn.1000c69f
xor eax, eax
mov dword [esp + 0x64], ebx
lea edi, [esp + 0x68]
stosd dword es:[edi], eax
mov dword [esp + 0x44], ebx
lea edi, [esp + 0x48]
stosd dword es:[edi], eax
add esp, 0xc
mov dword [esp + 0x40], ebx
lea edi, [esp + 0x44]
stosd dword es:[edi], eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x100034a2
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
shrd eax, ecx, 0x1e
push ebx
shr ecx, 0x1e
mov ecx, dword [esp + 0x48]
mov dword [esp + esi + 0x104], eax
mov eax, dword [esp + 0x44]
push 0x64
push dword [esp + 0x4c]
shrd eax, ecx, 0x1e
push dword [esp + 0x4c]
shr ecx, 0x1e
mov dword [esp + esi + 0x114], eax
call fcn.1001f4b0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edx
push eax
call fcn.10014a90
push 0x64
pop ecx
sub ecx, eax
mov dword [esp + esi + 0x108], ecx
mov esi, dword [esp + 0x14]
inc dword [esp + 0xe0]
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100034b2
sub eax, edi
inc byte [esp + 0x13]
lea eax, [esi + eax + 1]
cmp byte [eax], bl
mov esi, 0x103
mov dword [esp + 0x14], eax
jne 0x1000332c
push 0x20
pop edi
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x558]
push eax
mov dword [esp + 0x58], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x578]
push eax
mov dword [esp + 0x54], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [esp + 0x4f4]
call fcn.10003a4c
lea eax, [esp + 0x534]
push eax
call fcn.10003e6f
pop ecx
push esi
lea eax, [esp + 0x598]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [esp + 0x69c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x79c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 8
pop ecx
push 0x100239d8
xor eax, eax
mov dword [esp + 0xc0], ebx
lea edi, [esp + 0xc4]
push 0x100239ec
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10003588
lea ecx, [esp + 0xbc]
push ecx
call eax
jmp 0x10003596
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x920], eax
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x924], eax
xor eax, eax
lea ecx, [esp + 0x24]
push ecx
inc eax
push eax
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push connect
mov dword [esp + 0x38], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100036bf
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x8a4]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
push str.ProcessorNameString
push dword [esp + 0x38]
mov dword [esp + 0x30], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 7
pop ecx
xor eax, eax
mov byte [esp + 0xb68], bl
lea edi, [esp + 0xb69]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f
stosb byte es:[edi], al
lea eax, [esp + 0xb8d]
push ebx
push eax
mov byte [esp + 0xb94], bl
call fcn.10016310
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xb6c]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
push str.VendorIdentifier
push dword [esp + 0x38]
mov dword [esp + 0x30], 0x20
call edi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xb8c]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
push str.Identifier
push dword [esp + 0x38]
mov dword [esp + 0x30], 0x40
call edi
lea eax, [esp + 0xb88]
push eax
lea eax, [esp + 0xb6c]
push eax
push str._s__s
lea eax, [esp + 0x8ec]
push 0x3f
push eax
call fcn.10003f1f
add esp, 0x14
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3c
lea eax, [esp + 0x80]
push ebx
push eax
call fcn.10016310
add esp, 0xc
lea eax, [esp + 0x78]
push eax
mov dword [esp + 0x7c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x928], eax
mov eax, dword [esp + 0x80]
shrd eax, ecx, 0x14
shr ecx, 0x14
cmp eax, ebx
jne 0x10003712
mov dword [esp + 0x92c], ebx
jmp 0x10003727
mov ecx, eax
and ecx, 7
je 0x10003720
push 8
pop edx
sub edx, ecx
add eax, edx
mov dword [esp + 0x92c], eax
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x8c]
shrd eax, ecx, 0x14
shr ecx, 0x14
mov ecx, dword [esp + 0xa4]
mov dword [esp + 0x930], eax
mov eax, dword [esp + 0xa0]
shrd eax, ecx, 0x14
shr ecx, 0x14
mov ecx, dword [esp + 0xac]
mov dword [esp + 0x934], eax
mov eax, dword [esp + 0xa8]
shrd eax, ecx, 0x14
shr ecx, 0x14
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x938], eax
mov eax, dword [esp + 0x90]
shrd eax, ecx, 0x14
shr ecx, 0x14
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x93c], eax
mov eax, dword [esp + 0x98]
shrd eax, ecx, 0x14
mov dword [esp + 0x940], eax
lea eax, [esp + 0x2c]
push eax
push 1
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push connect
shr ecx, 0x14
mov dword [esp + 0x40], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000395f
push esi
lea eax, [esp + 0xbcd]
push ebx
push eax
mov dword [esp + 0x2c], 0x104
mov byte [esp + 0xbd4], bl
call fcn.10016310
add esp, 0xc
push esi
lea eax, [esp + 0xcd5]
push ebx
push eax
mov byte [esp + 0xcdc], bl
call fcn.10016310
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0xbdc]
push eax
push ebx
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, esi
je 0x10003955
lea eax, [esp + 0x1748]
mov dword [esp + 0x14], eax
push esi
lea eax, [esp + 0xcd4]
push eax
lea eax, [esp + 0xbd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x100038f0
push esi
lea eax, [esp + 0x94d]
push ebx
push eax
call fcn.10016310
add esp, 0xc
push 0x104
lea eax, [esp + 0xa50]
push ebx
push eax
call fcn.10016310
add esp, 0xc
cmp dword [esp + 0x944], 0x79
push 0x40
pop ecx
lea esi, [esp + 0xbc8]
lea edi, [esp + 0x948]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x40
pop ecx
lea esi, [esp + 0xcd0]
lea edi, [esp + 0xa4c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jae 0x10003955
mov edi, dword [esp + 0x14]
mov eax, 0x208
add dword [esp + 0x30], eax
add dword [esp + 0x14], eax
inc dword [esp + 0x944]
mov ecx, 0x82
lea esi, [esp + 0x948]
rep movsd dword es:[edi], dword [esi]
mov esi, 0x103
inc dword [esp + 0x1c]
push esi
lea eax, [esp + 0xbcd]
push ebx
push eax
mov dword [esp + 0x2c], 0x104
mov byte [esp + 0xbd4], bl
call fcn.10016310
add esp, 0xc
push esi
lea eax, [esp + 0xcd5]
push ebx
push eax
mov byte [esp + 0xcdc], bl
call fcn.10016310
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0xbdc]
push eax
push dword [esp + 0x34]
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, esi
jne 0x10003844
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x21a
lea esi, [esp + 0xe0]
lea edi, [esp + 0xee0]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x30]
add edi, 0x868
push edi
call fcn.1000a432
pop ecx
push eax
mov dword [esp + 0x2c], eax
call fcn.1000b2ea
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x1000399a
xor eax, eax
jmp 0x100039d2
push dword [esp + 0x28]
push ebx
push esi
call fcn.10016310
add esp, 0xc
push ebx
push ebx
push esi
push edi
lea eax, [esp + 0x20ef0]
push eax
lea eax, [esp + 0xef4]
push eax
call fcn.1000a446
push esi
mov dword [esp + 0x44], eax
call fcn.1000b3b4
mov eax, dword [esp + 0x44]
add esp, 0x1c
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], eax
cmp eax, ebx
je 0x100039ec
mov ecx, eax
and ecx, 7
je 0x100039ea
sub eax, ecx
add eax, 8
mov ebx, eax
push ebx
lea eax, [esp + 0x20ee4]
push eax
lea eax, [esp + 0x10f00]
push eax
call fcn.10005078
add esp, 0xc
push 6
pop ecx
mov dword [esp + 0x68], ebx
add ebx, 0x18
push ebx
lea eax, [esp + 0x10ee4]
push eax
push dword [esp + 0x5c]
lea esi, [esp + 0x6c]
lea edi, [esp + 0x10eec]
rep movsd dword es:[edi], dword [esi]
call fcn.100047c2
mov ecx, dword [esp + 0x30ef0]
add esp, 0xc
pop edi
neg eax
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
neg eax
call fcn.1000b28c
mov esp, ebp
pop ebp
ret