Function at 0x473398
Capabilities:
Get common file path
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47366e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00406d80
xor eax, eax
push ebp
push 0x473631
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x80]
xor ecx, ecx
mov edx, 0x40
call fcn.00403b8c
lea eax, [ebp - 0xc]
mov edx, 0x104
call fcn.0040710c
push 0x104
mov eax, dword [ebp - 0xc]
call fcn.00406e0c
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.0040710c
lea eax, [ebp - 0xc]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040753c
cmp dword [ebp - 0xc], 0
jne 0x47345e
lea eax, [ebp - 0xc]
mov edx, 0x473688
call fcn.00406dd4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00406e0c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
jne 0x473488
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push 0x473690
push 0x4736bc
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040a5cc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4734b6
mov dword [ebp - 0x80], 0x40
lea eax, [ebp - 0x80]
push eax
call dword [ebp - 8]
jmp 0x4734f2
mov dword [ebp - 0x40], 0x20
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push 0
push 0x100000
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
add eax, 0x80000
adc edx, 0
call fcn.0040833c
push edx
push eax
lea ecx, [ebp - 0x88]
mov dl, 0x30
mov eax, 1
call fcn.0040e294
push dword [ebp - 0x88]
push 0x4736e4
push 0
push 0x100000
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
add eax, 0x80000
adc edx, 0
call fcn.0040833c
push edx
push eax
lea ecx, [ebp - 0x8c]
mov dl, 0x30
mov eax, 1
call fcn.0040e294
push dword [ebp - 0x8c]
push 0x4736f4
push 0
push 0x100000
mov eax, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
add eax, 0x80000
adc edx, 0
call fcn.0040833c
push edx
push eax
lea ecx, [ebp - 0x90]
mov dl, 0x30
mov eax, 1
call fcn.0040e294
push dword [ebp - 0x90]
push 0x4736e4
push 0
push 0x100000
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x64]
add eax, 0x80000
adc edx, 0
call fcn.0040833c
push edx
push eax
lea ecx, [ebp - 0x94]
mov dl, 0x30
mov eax, 1
call fcn.0040e294
push dword [ebp - 0x94]
push 0x47371c
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x98]
call fcn.0040ef08
push dword [ebp - 0x98]
push 0x4736e4
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x9c]
call fcn.0040ef08
push dword [ebp - 0x9c]
lea eax, [ebp - 0x84]
mov edx, 0xb
call fcn.00406148
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 4]
call fcn.00406fac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x473648
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473675
lea eax, [ebp - 0x9c]
mov edx, 7
call fcn.00405bbc
lea eax, [ebp - 0xc]
call fcn.00406d70
ret