Function at 0x40fcd8
Capabilities:
Check os version
Create directory
Delete registry key
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x40fce0
xor eax, eax
push ebp
push 0x41137a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x41eb98], 0x66
jne 0x40fd61
mov eax, 0x41eb54
mov edx, 0x411390
call fcn.00403780
mov eax, dword [0x41d320]
push eax
push 0x400
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x41ecd4]
mov edx, dword [0x41ed00]
mov eax, 0x80000002
call fcn.00406c7c
mov edx, dword [ebp - 8]
mov eax, 0x41eb2c
call fcn.00403780
cmp byte [0x41eb95], 0
jne 0x40fd61
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x41eb2c]
call fcn.00406ad4
mov byte [0x41eb97], al
mov eax, 0x41eb54
mov edx, 0x411420
call fcn.00403780
mov ecx, dword [0x41ecd4]
mov edx, dword [0x41ed00]
mov eax, 0x80000002
call fcn.0040715c
lea eax, [ebp - 0xc]
call fcn.0040694c
mov edx, dword [ebp - 0xc]
mov eax, 0x41eb1c
call fcn.00403780
lea eax, [ebp - 0x10]
call fcn.004069b8
mov edx, dword [ebp - 0x10]
mov eax, 0x41eb20
call fcn.00403780
mov eax, 0x41eb54
mov edx, 0x411484
call fcn.00403780
mov eax, 0x41eb24
mov ecx, 0x411554
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, 0x41eb54
mov edx, 0x411564
call fcn.00403780
mov eax, dword [0x41eb2c]
call fcn.004038a4
test eax, eax
jne 0x40fe07
mov eax, 0x41eb2c
mov ecx, dword [0x41ecc4]
in al, dx
inc ecx
add byte [ebx + 0x41eb2015], cl
add al, ch
invalid
cmp bh, bh
invalid
mov eax, 0x41d28c
mov ecx, dword [0x41d28c]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, 0x41eb14
mov ecx, dword [0x41ecbc]
mov edx, dword [0x41d28c]
call fcn.004038f0
mov eax, 0x41eb18
mov ecx, dword [0x41ecc0]
mov edx, dword [0x41d28c]
call fcn.004038f0
xor eax, eax
mov dword [0x41eb9c], eax
call fcn.00412690
mov eax, 0x41eb54
mov edx, 0x4115bc
call fcn.00403780
cmp byte [0x41eb95], 0
je 0x410128
mov eax, dword [0x41ed80]
call fcn.00405b30
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00406b68
mov eax, 0x41eb54
mov edx, 0x4115f8
call fcn.00403780
lea eax, [ebp - 0x14]
mov ecx, dword [0x41ed3c]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x14]
call fcn.004059d4
lea eax, [ebp - 0x18]
mov ecx, dword [0x41ed40]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x18]
call fcn.004059d4
mov eax, dword [0x41eb14]
call fcn.004059d4
mov eax, 0x41eb54
mov edx, 0x41169c
call fcn.00403780
mov ecx, dword [0x41ecc4]
mov edx, dword [0x41ed24]
mov eax, 0x80000002
call fcn.0040715c
mov ecx, dword [0x41ecc4]
mov edx, dword [0x41ed2c]
mov eax, 0x80000002
call fcn.0040715c
mov ecx, dword [0x41ecc4]
mov edx, dword [0x41ed28]
mov eax, 0x80000001
call fcn.0040715c
mov ecx, dword [0x41ecc8]
mov edx, dword [0x41ed24]
mov eax, 0x80000001
call fcn.0040715c
mov ecx, dword [0x41eccc]
mov edx, dword [0x41ed28]
mov eax, 0x80000002
call fcn.0040715c
lea eax, [ebp - 0x1c]
mov ecx, dword [0x41ecd8]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x1c]
call fcn.004059d4
lea eax, [ebp - 0x20]
mov ecx, dword [0x41ecdc]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x20]
call fcn.004059d4
lea eax, [ebp - 0x24]
mov ecx, dword [0x41ece0]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x24]
call fcn.004059d4
lea eax, [ebp - 0x28]
mov ecx, dword [0x41ece4]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x28]
call fcn.004059d4
lea eax, [ebp - 0x2c]
mov ecx, dword [0x41ece8]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x2c]
call fcn.004059d4
lea eax, [ebp - 0x30]
mov ecx, dword [0x41ecec]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x30]
call fcn.004059d4
lea eax, [ebp - 0x34]
mov ecx, dword [0x41ecf0]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x34]
call fcn.004059d4
mov eax, dword [0x41ed34]
call fcn.00403aa4
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [0x41ed00]
call fcn.00403aa4
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x4116c4
call fcn.00416744
mov eax, 0x41eb54
mov edx, 0x4116d0
call fcn.00403780
mov eax, 0x4117ac
call fcn.00416744
mov eax, 0x41eb54
mov edx, 0x4117b8
call fcn.00403780
mov eax, 0x4117f4
call fcn.00416744
mov eax, dword [0x41eb18]
call fcn.004059d4
mov eax, 0x41eb54
mov edx, 0x411800
push 0
mov eax, dword [0x41d28c]
call fcn.00403aa4
push eax
invalid
invalid