Function at 0x401967
Capabilities:
Check os version
Get common file path
Get hostname
Get memory capacity
Get session user name
Get system information on windows
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x4ddf5e
call fcn.004baf44
mov eax, 0x227c
call fcn.004bb490
push ebx
push esi
push edi
mov edi, 0x509614
push edi
call fcn.0040445f
pop ecx
and dword [ebp - 4], 0
lea eax, [ebp - 0x21]
push eax
push 0x509608
lea ecx, [ebp - 0x118]
call fcn.00403ed8
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 1
push eax
call fcn.004b3a98
mov ecx, eax
call fcn.004b3d15
push eax
push 0x5095e8
call fcn.0040445f
pop ecx
pop ecx
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.00403d38
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2288]
mov esi, 0x1000
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.kernel32.dll_GetComputerNameA]
test eax, eax
je 0x401a0b
lea eax, [ebp - 0x2288]
push eax
push 0x5095d4
call fcn.0040445f
pop ecx
pop ecx
jmp 0x401a1b
push 0x42
push edi
push 0x5095b0
call fcn.00401466
add esp, 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], esi
push eax
lea eax, [ebp - 0x2288]
push eax
call dword [sym.imp.advapi32.dll_GetUserNameA]
test eax, eax
je 0x401a48
lea eax, [ebp - 0x2288]
push eax
push 0x5095a0
call fcn.0040445f
pop ecx
pop ecx
jmp 0x401a58
push 0x4a
push edi
push 0x509580
call fcn.00401466
add esp, 0xc
lea eax, [ebp - 0x2288]
push esi
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x401a7f
lea eax, [ebp - 0x2288]
push eax
push 0x509568
call fcn.0040445f
pop ecx
pop ecx
jmp 0x401a8f
push 0x51
push edi
push 0x509540
call fcn.00401466
add esp, 0xc
lea eax, [ebp - 0x2288]
push esi
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x401ab6
lea eax, [ebp - 0x2288]
push eax
push 0x509528
call fcn.0040445f
pop ecx
pop ecx
jmp 0x401ac6
push 0x58
push edi
push 0x509500
call fcn.00401466
add esp, 0xc
push 0x5094e4
mov dword [ebp - 0x10c], 0x5094dc
mov dword [ebp - 0x108], 0x5094d0
mov dword [ebp - 0x104], 0x5094a4
mov dword [ebp - 0x100], 0x509474
mov dword [ebp - 0xfc], 0x509448
mov dword [ebp - 0xf8], 0x509424
mov dword [ebp - 0xf4], 0x5093fc
mov dword [ebp - 0xf0], 0x5093f0
mov dword [ebp - 0xec], 0x5093e4
call fcn.0040445f
and dword [ebp - 0x1c], 0
pop ecx
lea ebx, [ebp - 0x10c]
mov edi, dword [ebx]
lea eax, [ebp - 0x2288]
push esi
push eax
push edi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsA]
cmp eax, esi
mov dword [ebp - 0x20], eax
jbe 0x401b5c
push 0x71
push 0x509614
push edi
push 0x5093b8
jmp 0x401b84
test eax, eax
je 0x401b75
lea eax, [ebp - 0x2288]
push eax
push 0x5093b4
call fcn.0040445f
pop ecx
pop ecx
jmp 0x401b8c
push 0x76
push 0x509614
push dword [ebp - 0x1c]
push 0x509380
call fcn.00401466
add esp, 0x10
inc dword [ebp - 0x1c]
add ebx, 4
cmp dword [ebp - 0x1c], 9
jb 0x401b35
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push 0x509364
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
cmp eax, 5
je 0x401dde
push 0x50934c
call fcn.0040445f
pop ecx
lea eax, [ebp - 0x10]
push 1
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
pop ebx
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x509340
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x401c05
lea eax, [ebp - 0x1288]
push eax
push 0x509330
call fcn.0040445f
pop ecx
pop ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x50931c
mov dword [ebp - 0x14], 9
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x401ca1
cmp dword [ebp - 0x10], eax
je 0x401ca1
movzx eax, byte [ebp - 0x1288]
push eax
push 0x509314
lea eax, [ebp - 0x2288]
push esi
push eax
call fcn.004bb643
add esp, 0x10
push 1
pop ebx
cmp dword [ebp - 0x10], ebx
jbe 0x401c8b
movzx eax, byte [ebp + ebx - 0x1288]
push eax
push 0x50930c
lea eax, [ebp - 0x1c]
push 4
push eax
call fcn.004bb643
lea eax, [ebp - 0x1c]
push esi
push eax
lea eax, [ebp - 0x2288]
push eax
call fcn.004bb520
add esp, 0x1c
inc ebx
cmp ebx, dword [ebp - 0x10]
jb 0x401c58
lea eax, [ebp - 0x2288]
push eax
push 0x5092f4
call fcn.0040445f
pop ecx
pop ecx
push 1
pop ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x5092e4
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x401cd9
lea eax, [ebp - 0x1288]
push eax
push 0x5092d0
call fcn.0040445f
pop ecx
pop ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x5092bc
mov dword [ebp - 0x14], 7
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x401d3a
mov eax, dword [ebp - 0x10]
xor ecx, ecx
lea edx, [eax - 1]
test edx, edx
jbe 0x401d27
cmp byte [ebp + ecx - 0x1288], 0
lea eax, [ebp + ecx - 0x1288]
jne 0x401d22
mov byte [eax], 0x20
inc ecx
cmp ecx, edx
jb 0x401d0e
lea eax, [ebp - 0x1288]
push eax
push 0x5092a4
call fcn.0040445f
pop ecx
pop ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x509294
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x401d72
lea eax, [ebp - 0x1288]
push eax
push 0x509280
call fcn.0040445f
pop ecx
pop ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x50926c
mov dword [ebp - 0x14], 7
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x401dd3
mov eax, dword [ebp - 0x10]
xor ecx, ecx
lea edx, [eax - 1]
test edx, edx
jbe 0x401dc0
cmp byte [ebp + ecx - 0x1288], 0
lea eax, [ebp + ecx - 0x1288]
jne 0x401dbb
mov byte [eax], 0x20
inc ecx
cmp ecx, edx
jb 0x401da7
lea eax, [ebp - 0x1288]
push eax
push 0x509254
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x401df5
push 0xca
push 0x509614
push 0x509224
call fcn.00401466
add esp, 0xc
push 0x24
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.004bb4c0
mov ebx, dword [sym.imp.kernel32.dll_GetModuleHandleA]
add esp, 0xc
push 0x509210
push 0x509200
call ebx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x401e2a
lea ecx, [ebp - 0x48]
push ecx
call eax
jmp 0x401e34
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
cmp word [ebp - 0x48], 0
je 0x401e5c
push 0xdc
push 0x509614
push 0x5091c4
push 0x508548
push 0x508530
call fcn.00401466
add esp, 0x14
push 0x5091b0
call fcn.0040445f
pop ecx
push dword [ebp - 0x48]
push 0x5091a4
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x34]
push 0x509188
call fcn.0040445f
pop ecx
pop ecx
movzx ecx, word [ebp - 0x28]
mov eax, ecx
sub eax, 5
je 0x401ee5
dec eax
je 0x401ecd
sub eax, 9
movzx eax, word [ebp - 0x26]
je 0x401eb9
mov edx, eax
and edx, 0xff
shr eax, 8
push edx
push eax
push ecx
push 0x509150
call fcn.0040445f
add esp, 0x10
jmp 0x401f03
mov ecx, eax
and ecx, 0xff
shr eax, 8
push ecx
push eax
push 0x509118
jmp 0x401efb
movzx eax, word [ebp - 0x26]
mov ecx, eax
and ecx, 0xff
shr eax, 8
push ecx
push eax
push 0x5090d8
jmp 0x401efb
movzx eax, word [ebp - 0x26]
mov ecx, eax
and ecx, 0xff
shr eax, 8
push ecx
push eax
push 0x5090a4
call fcn.0040445f
add esp, 0xc
push dword [ebp - 0x38]
push 0x509084
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x44]
push 0x509074
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x40]
push 0x50904c
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x3c]
push 0x509024
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x2c]
push 0x509004
call fcn.0040445f
pop ecx
lea eax, [ebp - 0x138]
pop ecx
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
cmp dword [ebp - 0x138], 0x20
jne 0x401fdd
push 0x508ff4
call fcn.0040445f
pop ecx
push dword [ebp - 0x130]
push 0x508fc4
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x12c]
push 0x508f90
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x128]
push 0x508f54
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x124]
push 0x508f14
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x120]
push 0x508ec0
call fcn.0040445f
pop ecx
pop ecx
push dword [ebp - 0x11c]
push 0x508e78
call fcn.0040445f
pop ecx
pop ecx
jmp 0x401ff4
push 0x111
push 0x509614
push 0x508e50
call fcn.00401466
add esp, 0xc
mov al, byte [0x5265c8]
push 0x3f
mov byte [ebp - 0x238], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x237]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x9c
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0xe8]
push 0
push eax
call fcn.004bb4c0
mov edi, dword [sym.imp.kernel32.dll_GetVersionExA]
add esp, 0xc
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xe8], esi
push eax
call edi
test eax, eax
jne 0x402118
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
push 0x11e
push 0x509614
call ebx
push eax
push 0x508e10
call fcn.0040445f
add esp, 0x10
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xe8], esi
push eax
call edi
test eax, eax
je 0x4020b1
push dword [ebp - 0xd8]
movzx eax, word [ebp - 0x52]
push dword [ebp - 0xdc]
push eax
movzx eax, word [ebp - 0x54]
push eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
push 0x508ddc
call fcn.0040445f
add esp, 0x20
jmp 0x402575
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xe8], 0x94
push eax
call edi
test eax, eax
je 0x4020f9
push dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
push dword [ebp - 0xdc]
push eax
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
push 0x508db0
call fcn.0040445f
add esp, 0x18
jmp 0x402575
push 0x12f
push 0x509614
call ebx
push eax
push 0x508d74
call fcn.00401466
add esp, 0x10
jmp 0x402575
cmp dword [ebp - 0xd8], 2
jne 0x402550
cmp dword [ebp - 0xe4], 4
jbe 0x402550
mov esi, 0x100
lea eax, [ebp - 0x238]
push esi
push 0x508d68
push eax
call fcn.004bb520
mov eax, dword [ebp - 0xe4]
add esp, 0xc
sub eax, 5
je 0x40234b
dec eax
je 0x402180
push dword [ebp - 0xd8]
push dword [ebp - 0xdc]
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
push 0x508d34
jmp 0x40256d
cmp dword [ebp - 0xe0], 0
jne 0x402331
cmp byte [ebp - 0x4e], 1
push esi
jne 0x40219b
push 0x508d24
jmp 0x4021a0
push 0x508d0c
lea eax, [ebp - 0x238]
push eax
call fcn.004bb520
add esp, 0xc
push 0x508cfc
push 0x509200
call ebx
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x4021e9
push 0x14b
push 0x509614
push 0x508cf4
push 0x508548
push 0x508530
call fcn.00401466
add esp, 0x14
lea eax, [ebp - 0x4c]
xor ebx, ebx
push eax
push ebx
push ebx
push ebx
push 6
call edi
mov eax, dword [ebp - 0x4c]
dec eax
cmp eax, 0x1f
ja case.default.0x402203
jmp dword [eax*4 + 0x402584]
push esi
push 0x508ce0
jmp 0x4022fe
push esi
push 0x508cc8
jmp 0x4022fe
push esi
push 0x508cb4
jmp 0x4022fe
push esi
push 0x508ca0
jmp 0x4022fe
push esi
push 0x508c8c
jmp 0x4022fe
push esi
push 0x508c58
jmp 0x4022fe
push esi
push 0x508c24
jmp 0x4022fe
push esi
push 0x508bf0
jmp 0x4022fe
push esi
push 0x508be0
jmp 0x4022fe
push esi
push 0x508bc8
jmp 0x4022fe
push esi
push 0x508bb4
jmp 0x4022fe
push esi
push 0x508b8c
jmp 0x4022fe
push esi
push 0x508b78
jmp 0x4022fe
push esi
push 0x508b50
jmp 0x4022fe
push esi
push 0x508b20
jmp 0x4022fe
push esi
push 0x508b08
jmp 0x4022fe
push esi
push 0x508ae4
jmp 0x4022fe
push esi
push 0x508abc
jmp 0x4022fe
push esi
push 0x508aa8
jmp 0x4022fe
push esi
push 0x508a80
jmp 0x4022fe
push esi
push 0x508a5c
jmp 0x4022fe
push esi
push 0x508a3c
jmp 0x4022fe
push esi
push 0x508a1c
jmp 0x4022fe
push esi
push 0x5089f8
jmp 0x4022fe
push esi
push 0x5089e4
jmp 0x4022fe
push esi
push 0x5089bc
jmp 0x4022fe
push esi
push 0x5089b0
lea eax, [ebp - 0x238]
push eax
call fcn.004bb520
movzx eax, word [ebp - 0x48]
add esp, 0xc
cmp eax, ebx
je 0x402329
cmp eax, 9
push esi
je 0x402322
push 0x5089a0
jmp 0x402337
push 0x508994
jmp 0x402337
push esi
push 0x508988
jmp 0x402337
push esi
push 0x508978
lea eax, [ebp - 0x238]
push eax
call fcn.004bb520
add esp, 0xc
jmp 0x402575
mov eax, dword [ebp - 0xe0]
sub eax, 0
je 0x402484
dec eax
je 0x402461
dec eax
jne 0x4024d7
push 0x59
call dword [sym.imp.user32.dll_GetSystemMetrics]
test eax, eax
je 0x40237c
push esi
push 0x50895c
jmp 0x4023a7
cmp word [ebp - 0x50], 0x200
jne 0x40238c
push esi
push 0x508940
jmp 0x4023a7
cmp byte [ebp - 0x4e], 1
jne 0x4023a1
cmp word [ebp - 0x48], 9
jne 0x4023a1
push esi
push 0x50891c
jmp 0x4023a7
push esi
push 0x508904
lea eax, [ebp - 0x238]
push eax
call fcn.004bb520
add esp, 0xc
cmp byte [ebp - 0x4e], 1
je 0x4024d7
movzx eax, word [ebp - 0x48]
cmp eax, 6
je 0x402445
cmp eax, 9
je 0x402419
mov eax, dword [ebp - 0x50]
test ah, 0x40
je 0x4023e1
push esi
push 0x5088ec
jmp 0x4024c8
test al, 0x80
je 0x4023f0
push esi
push 0x508bb4
jmp 0x4024c8
test al, 2
je 0x4023ff
push esi
push 0x508b78
jmp 0x4024c8
test ah, 4
push esi
je 0x40240f
push 0x5088e0
jmp 0x4024c8
push 0x508aa8
jmp 0x4024c8
test byte [ebp - 0x50], 0x80
je 0x40242a
push esi
push 0x5088c8
jmp 0x4024c8
test byte [ebp - 0x50], 2
push esi
je 0x40243b
push 0x5088b0
jmp 0x4024c8
push 0x508898
jmp 0x4024c8
test byte [ebp - 0x50], 0x80
je 0x402453
push esi
push 0x508868
jmp 0x4024c8
test byte [ebp - 0x50], 2
je 0x4024d7
push esi
push 0x508b20
jmp 0x4024c8
push esi
lea eax, [ebp - 0x238]
push 0x50885c
push eax
call fcn.004bb520
add esp, 0xc
test byte [ebp - 0x4f], 2
push esi
je 0x4024a0
push 0x50884c
jmp 0x4024c8
push esi
lea eax, [ebp - 0x238]
push 0x50883c
push eax
call fcn.004bb520
add esp, 0xc
cmp byte [ebp - 0x4e], 1
jne 0x4024a7
push esi
push 0x50882c
jmp 0x4024c8
test byte [ebp - 0x50], 0x80
je 0x4024b5
push esi
push 0x508818
jmp 0x4024c8
test byte [ebp - 0x50], 2
push esi
je 0x4024c3
push 0x508808
jmp 0x4024c8
push 0x508800
lea eax, [ebp - 0x238]
push eax
call fcn.004bb520
add esp, 0xc
lea eax, [ebp - 0xd4]
push eax
call fcn.004baf70
test eax, eax
pop ecx
jbe 0x402511
push esi
lea eax, [ebp - 0x238]
push 0x5087fc
push eax
call fcn.004bb520
lea eax, [ebp - 0xd4]
push esi
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.004bb520
add esp, 0x18
push dword [ebp - 0xdc]
lea eax, [ebp - 0x288]
push 0x5087f0
push 0x50
push eax
call fcn.004bb643
lea eax, [ebp - 0x288]
push esi
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.004bb520
add esp, 0x1c
lea eax, [ebp - 0x238]
push eax
call fcn.0040445f
pop ecx
jmp 0x402575
push dword [ebp - 0xd8]
push dword [ebp - 0xdc]
push dword [ebp - 0xe0]
push dword [ebp - 0xe4]
push 0x5087b4
call fcn.00401466
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret