Function at 0x409a00
Capabilities:
Check os version
Get disk information
Get disk size

Disassembly:
sub esp, 0x584
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push ebp
push esi
lea eax, [esp + 0xa4]
push edi
mov ebp, 0x9c
push eax
mov byte [esp + 0xa8], 0x66
mov byte [esp + 0x196], 0
mov dword [esp + 0xac], ebp
call ebx
lea ecx, [esp + 0x494]
push 0x100
push ecx
call dword [0x42999c]
xor edx, edx
lea eax, [esp + 0x24]
mov dword [esp + 0x30], edx
push eax
mov dword [esp + 0x38], edx
lea ecx, [esp + 0x34]
mov dword [esp + 0x3c], edx
push ecx
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x5a4]
mov dword [esp + 0x2c], 0x10
mov eax, dword [edx + 0xa8]
push eax
call dword [0x429978]
lea esi, [esp + 0x494]
lea edi, [esp + 0x160]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x15c], ecx
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00409960
lea edx, [esp + 0x2cc]
mov dword [esp + 0x144], eax
push edx
mov dword [esp + 0x2d0], ebp
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, dword [0x4298bc]
cmp dword [esp + 0x2d0], 5
jne 0x409b0c
mov eax, dword [esp + 0x2d4]
test eax, eax
jne 0x409b0c
mov edi, 0x424d30
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x148]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x409b43
push str.GetSystemInfo
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebx
lea ecx, [esp + 0x80]
push ecx
call eax
lea eax, [esp + 0x148]
mov edx, dword [esp + 0x94]
push edx
push 0x424ee0
push eax
call ebp
add esp, 0xc
mov cl, byte [0x42aa54]
mov al, 1
test al, cl
mov dword [esp + 0x40], 0x40
jne 0x409b77
or cl, al
push str.GlobalMemoryStatusEx
push str.KERNEL32.dll
mov byte [0x42aa54], cl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebx
mov dword [0x42a83c], eax
lea ecx, [esp + 0x40]
push ecx
call dword [0x42a83c]
mov ecx, 0x14
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
call fcn.00416430
xor edi, edi
xor esi, esi
mov dword [esp + 0x198], eax
mov dword [esp + 0x14], edi
xor ebx, ebx
mov dl, bl
lea eax, [esp + 0x18]
add dl, 0x42
push eax
mov byte [esp + 0x1c], dl
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x409c07
lea ecx, [esp + 0x28]
push 0
push ecx
lea edx, [esp + 0x20]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x409c07
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
add edi, eax
adc edx, ecx
mov ecx, 0x14
mov eax, edi
mov dword [esp + 0x14], edx
call fcn.00416430
mov esi, eax
inc ebx
cmp ebx, 0x1a
jl 0x409ba5
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0
fild qword [esp + 0x10]
call fcn.00415ed4
mov dword [esp + 0x19c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, 0x31b5d43b
imul esi
sar edx, 0x18
mov eax, edx
lea ecx, [esp + 0x368]
shr eax, 0x1f
add edx, eax
push edx
push 0x424ee0
push ecx
call ebp
mov eax, esi
mov ecx, 0x5265c00
cdq
idiv ecx
mov eax, 0x4a90be59
lea ecx, [esp + 0x43c]
mov esi, edx
imul esi
sar edx, 0x14
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
push 0x424ee0
push ecx
call ebp
mov eax, esi
mov ecx, 0x36ee80
cdq
idiv ecx
mov eax, 0x45e7b273
lea ecx, [esp + 0x3e4]
imul edx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
push 0x424ee0
push ecx
call ebp
lea edx, [esp + 0x3f0]
lea eax, [esp + 0x454]
push edx
lea ecx, [esp + 0x390]
push eax
push ecx
lea edx, [esp + 0x1d0]
push 0x424eb4
push edx
call ebp
add esp, 0x38
call fcn.004099c0
lea ecx, [esp + 0xa4]
mov byte [esp + 0x192], al
mov eax, dword [esp + 0x5a0]
push 0x228
push ecx
mov ecx, dword [esp + 0x5a4]
mov dword [esp + 0x19c], eax
call fcn.00402720
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x584
ret 0xc