Function at 0x41a144
Capabilities:
Check os version
Enumerate disk volumes
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov dword [ebp - 0x35c], ecx
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x35c]
cmp dword [eax + 0x58b8], 0xffffffff
jne 0x41a465
mov eax, dword [ebp - 0x35c]
and dword [eax + 0x58b8], 0
lea eax, [ebp - 8]
push eax
mov edx, 0x41a10f
mov ecx, dword [ebp - 0x35c]
call fcn.00412a07
mov byte [ebp - 0x331], 0
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0x34c], eax
and dword [ebp - 0x340], 0
and dword [ebp - 0x33c], 0
cmp dword [ebp - 0x34c], 0xffffffff
je 0x41a257
and dword [ebp - 0x358], 0
and dword [ebp - 0x354], 0
and dword [ebp - 0x348], 0
and dword [ebp - 0x344], 0
push 0
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x41a22f
mov eax, dword [ebp - 0x340]
add eax, dword [ebp - 0x358]
mov ecx, dword [ebp - 0x33c]
adc ecx, dword [ebp - 0x354]
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x33c], ecx
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x34c]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x41a1ce
push dword [ebp - 0x34c]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push 0
push 0x100000
push dword [ebp - 0x33c]
push dword [ebp - 0x340]
call fcn.0041f670
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x33c], edx
cmp dword [ebp - 0x33c], 0
ja 0x41a299
jb 0x41a292
cmp dword [ebp - 0x340], 0x4000
jae 0x41a299
mov byte [ebp - 0x331], 1
movzx eax, byte [ebp - 4]
test eax, eax
jne 0x41a2ac
movzx eax, byte [ebp - 0x331]
test eax, eax
je 0x41a2e8
push str.DEBUGMAC1
mov ecx, dword [ebp - 0x35c]
call fcn.00415c87
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41a2d7
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x58b8], 0x309
mov eax, dword [ebp - 0x35c]
mov eax, dword [eax + 0x58b8]
jmp 0x41a471
push 0x11c
lea eax, [ebp - 0x330]
push eax
call fcn.0040103d
pop ecx
pop ecx
mov dword [ebp - 0x330], 0x11c
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41a34f
mov dword [ebp - 0x330], 0x114
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41a34f
mov eax, dword [ebp - 0x35c]
and dword [eax + 0x58b8], 0
mov eax, dword [ebp - 0x35c]
mov eax, dword [eax + 0x58b8]
jmp 0x41a471
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
jb 0x41a465
cmp dword [ebp - 0x360], 1
jbe 0x41a458
cmp dword [ebp - 0x360], 2
je 0x41a383
jmp 0x41a465
cmp dword [ebp - 0x32c], 6
jbe 0x41a3a1
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x58b8], 5
jmp 0x41a465
cmp dword [ebp - 0x32c], 6
jne 0x41a3c8
cmp dword [ebp - 0x328], 1
jb 0x41a3c8
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x58b8], 5
jmp 0x41a465
cmp dword [ebp - 0x32c], 6
jne 0x41a3ec
cmp dword [ebp - 0x328], 0
jne 0x41a3ec
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x58b8], 3
jmp 0x41a465
cmp dword [ebp - 0x32c], 5
jne 0x41a410
cmp dword [ebp - 0x328], 2
jne 0x41a410
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x58b8], 2
jmp 0x41a465
cmp dword [ebp - 0x32c], 5
jne 0x41a434
cmp dword [ebp - 0x328], 1
jne 0x41a434
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x58b8], 2
jmp 0x41a465
cmp dword [ebp - 0x32c], 5
jne 0x41a458
cmp dword [ebp - 0x328], 0
jne 0x41a458
mov eax, dword [ebp - 0x35c]
mov dword [eax + 0x58b8], 1
jmp 0x41a465
mov eax, dword [ebp - 0x35c]
and dword [eax + 0x58b8], 0
mov eax, dword [ebp - 0x35c]
mov eax, dword [eax + 0x58b8]
leave
ret