Function at 0x65a250
Capabilities:
Get common file path
Get disk information
Get hostname
Get memory capacity
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x76c
push ebx
push esi
xor esi, esi
cmp ecx, esi
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
je 0x65aa66
cmp edx, 0x10
jl 0x65aa66
mov eax, dword [0x7ec2d8]
mov ebx, 1
cmp eax, ebx
jne 0x65a2ed
cmp dword [ebp + 8], ebx
jne 0x65a2c1
mov eax, dword [0x7ec2c4]
mov dword [ecx], eax
mov edx, dword [0x7ec2c8]
mov dword [ecx + 4], edx
mov eax, dword [0x7ec2cc]
mov dword [ecx + 8], eax
mov edx, dword [0x7ec2d0]
mov dword [ecx + 0xc], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x7ec2b0]
mov dword [ecx], eax
mov edx, dword [0x7ec2b4]
mov dword [ecx + 4], edx
mov eax, dword [0x7ec2b8]
mov dword [ecx + 8], eax
mov edx, dword [0x7ec2bc]
mov dword [ecx + 0xc], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, 0x22
lea edi, [esp + 0xd0]
rep stosd dword es:[edi], eax
mov ecx, 0x7d
lea edi, [esp + 0x3a8]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x2a0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x5a0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x198]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
stosw word es:[edi], ax
mov dword [esp + 0x5c], ecx
xor edx, edx
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], edx
mov dword [esp + 0x90], edx
mov byte [esp + 0x10], al
mov dword [esp + 0x94], edx
mov ecx, 0x10
lea edi, [esp + 0x158]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0xa8], eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x98], edx
mov dword [esp + 0xac], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xb0], eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0xa0], edx
mov dword [esp + 0xb4], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0xa4], edx
mov dword [esp + 0xb8], eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0xc0], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0x84], ecx
mov byte [esp + 0x38], dl
mov edx, 0x64
lea ecx, [esp + 0x710]
mov dword [esp + 0x158], 0x40
mov dword [esp + 0xcc], eax
mov dword [esp + 0x14], 0x11
call fcn.0065b400
mov edx, 0x64
lea ecx, [esp + 0x6a8]
call fcn.0065c550
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [ebp + 0xc]
and eax, 0xffff
cmp ecx, ebx
jne 0x65a48f
mov dword [esp + 0xe8], eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x54]
mov dx, word [esp + 0x5c]
mov ax, word [esp + 0x5e]
mov dword [esp + 0xec], ecx
mov word [esp + 0xf0], dx
mov edx, 0x28
lea ecx, [esp + 0xf8]
mov word [esp + 0xf2], ax
call fcn.00658da0
lea ecx, [esp + 0x710]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x65a520
lea edx, [esp + 0x6a8]
push edx
push edi
call ebx
cmp eax, esi
je 0x65a520
lea ecx, [esp + 0x158]
push ecx
call eax
test eax, eax
je 0x65a520
mov eax, dword [esp + 0x160]
mov edx, dword [esp + 0x164]
shrd eax, edx, 0x14
shr edx, 0x14
cmp eax, esi
jne 0x65a538
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x90]
shr eax, 0x14
cmp eax, 0x40
ja 0x65a547
mov eax, 0x40
jmp 0x65a64d
cmp eax, 0x60
ja 0x65a556
mov eax, 0x60
jmp 0x65a64d
cmp eax, 0x80
ja 0x65a567
mov eax, 0x80
jmp 0x65a64d
cmp eax, 0xc0
ja 0x65a578
mov eax, 0xc0
jmp 0x65a64d
cmp eax, 0x100
ja 0x65a589
mov eax, 0x100
jmp 0x65a64d
cmp eax, 0x180
ja 0x65a59a
mov eax, 0x180
jmp 0x65a64d
cmp eax, 0x200
ja 0x65a5ab
mov eax, 0x200
jmp 0x65a64d
cmp eax, 0x300
ja 0x65a5bc
mov eax, 0x300
jmp 0x65a64d
cmp eax, 0x400
ja 0x65a5cd
mov eax, 0x400
jmp 0x65a64d
cmp eax, 0x600
ja 0x65a5db
mov eax, 0x600
jmp 0x65a64d
cmp eax, 0x800
ja 0x65a5e9
mov eax, 0x800
jmp 0x65a64d
cmp eax, 0xc00
ja 0x65a5f7
mov eax, 0xc00
jmp 0x65a64d
cmp eax, 0x1000
ja 0x65a605
mov eax, 0x1000
jmp 0x65a64d
cmp eax, 0x1800
ja 0x65a613
mov eax, 0x1800
jmp 0x65a64d
cmp eax, 0x2000
ja 0x65a621
mov eax, 0x2000
jmp 0x65a64d
cmp eax, 0x3000
ja 0x65a62f
mov eax, 0x3000
jmp 0x65a64d
cmp eax, 0x4000
ja 0x65a63d
mov eax, 0x4000
jmp 0x65a64d
mov ecx, 0x6000
cmp ecx, eax
sbb eax, eax
and eax, 0x2000
add eax, ecx
cmp dword [ebp + 0xc], 1
jne 0x65a65a
mov dword [esp + 0xf4], eax
cmp edi, esi
je 0x65a67b
push str.GetSystemWindowsDirectoryA
push edi
call ebx
cmp eax, esi
je 0x65a67b
push 0x106
lea edx, [esp + 0x2a4]
push edx
call eax
jmp 0x65a68e
push 0x106
lea eax, [esp + 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x2a0]
call fcn.00659080
push 0x106
lea ecx, [esp + 0x5a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xd8]
lea ecx, [esp + 0x5a0]
call fcn.00659080
movsx edx, byte [esp + 0x5a0]
push edx
call fcn.00698d29
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add esp, 4
test eax, eax
je 0x65a6f5
cmp byte [esp + 0x5a1], 0x3a
jne 0x65a6f5
mov al, byte [esp + 0x5a0]
jmp 0x65a71b
movsx eax, byte [esp + 0x2a0]
push eax
call fcn.00698d29
add esp, 4
test eax, eax
je 0x65a771
cmp byte [esp + 0x2a1], 0x3a
jne 0x65a771
mov al, byte [esp + 0x2a0]
cmp al, 0x3f
je 0x65a771
movsx ecx, al
push ecx
call fcn.00698170
mov bl, al
add esp, 4
mov edx, 0x103
lea ecx, [esp + 0x19b]
mov byte [esp + 0x198], bl
mov byte [esp + 0x199], 0x3a
mov byte [esp + 0x19a], 0x5c
call fcn.0064ccb0
lea edx, [esp + 0xe0]
lea ecx, [esp + 0x198]
call fcn.00659080
test eax, eax
jne 0x65a771
cmp bl, 0x3f
jne 0x65a7e4
mov bl, 0x43
jmp 0x65a780
lea edx, [esp + 0x198]
push edx
mov byte [esp + 0x19c], bl
mov byte [esp + 0x19d], 0x3a
mov byte [esp + 0x19e], 0x5c
mov byte [esp + 0x19f], 0
call edi
cmp eax, 3
jne 0x65a7d6
mov edx, 0x103
lea ecx, [esp + 0x19b]
call fcn.0064ccb0
lea edx, [esp + 0xe0]
lea ecx, [esp + 0x198]
call fcn.00659080
test eax, eax
je 0x65a7dd
inc bl
cmp bl, 0x47
jle 0x65a780
cmp bl, 0x3f
jne 0x65a7e4
mov bl, 0x43
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x5c
mov byte [esp + 0x13], 0
call edi
cmp eax, 3
jne 0x65a839
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x28
lea edx, [esp + 0xac]
push edx
mov edx, 4
lea ecx, [esp + 0x24]
call fcn.00660110
call fcn.00656860
test eax, eax
lea ecx, [esp + 0x60]
mov edx, 0x28
je 0x65a852
call fcn.00658b30
jmp 0x65a857
call fcn.00657810
lea eax, [esp + 0x3a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [esp + 0x454], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov edx, 0x28
lea ecx, [esp + 0x45c]
mov dword [esp + 0x458], eax
call fcn.0065a0a0
mov edx, 0x28
lea ecx, [esp + 0x484]
call fcn.00659230
call fcn.00656860
cmp eax, 1
jne 0x65a8bd
mov edx, 0x28
lea ecx, [esp + 0x4ac]
call fcn.00659450
mov edx, 0x28
lea ecx, [esp + 0x4d4]
call fcn.00659540
call fcn.00656860
cmp eax, 1
jne 0x65a90b
mov edx, 0x28
lea ecx, [esp + 0x4fc]
call fcn.006597a0
mov edx, 0x28
lea ecx, [esp + 0x524]
call fcn.00659890
mov edx, 0x28
lea ecx, [esp + 0x54c]
call fcn.006599a0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x65a936
mov edx, dword [esp + 0x14]
push 0x28
lea eax, [esp + 0x578]
push eax
lea ecx, [esp + 0x30]
call fcn.00659110
cmp dword [ebp + 0xc], 1
jne 0x65a957
push 0x10
lea ecx, [esp + 0x14c]
push ecx
mov edx, 0x1f4
lea ecx, [esp + 0x3b0]
call fcn.0064cc40
mov ecx, 0xa
lea esi, [esp + 0xa8]
lea edi, [esp + 0x120]
push 0x12
rep movsd dword es:[edi], dword [esi]
push 0x7ec2b0
mov edx, 0x88
lea ecx, [esp + 0xd8]
call fcn.0064cc40
xor ecx, ecx
mov dword [esp + 0xe0], ecx
xor edx, edx
mov dword [esp + 0xd0], edx
xor eax, eax
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xd8], eax
mov dword [esp + 0xd4], edx
mov dword [esp + 0xdc], eax
mov ecx, 0xa
lea esi, [esp + 0x60]
lea edi, [esp + 0x120]
push 0x12
rep movsd dword es:[edi], dword [esi]
push 0x7ec2c4
mov edx, 0x88
lea ecx, [esp + 0xd8]
call fcn.0064cc40
xor edx, edx
mov ecx, 0x7ec2b0
call fcn.00657330
mov esi, 1
mov edx, esi
mov ecx, 0x7ec2c4
call fcn.00657330
cmp dword [ebp + 8], esi
mov eax, dword [esp + 0x18]
mov dword [0x7ec2d8], esi
jne 0x65aa38
mov edx, dword [0x7ec2c4]
mov dword [eax], edx
mov ecx, dword [0x7ec2c8]
mov dword [eax + 4], ecx
mov edx, dword [0x7ec2cc]
mov dword [eax + 8], edx
mov ecx, dword [0x7ec2d0]
mov dword [eax + 0xc], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [0x7ec2b0]
mov dword [eax], edx
mov ecx, dword [0x7ec2b4]
mov dword [eax + 4], ecx
mov edx, dword [0x7ec2b8]
mov dword [eax + 8], edx
mov ecx, dword [0x7ec2bc]
mov dword [eax + 0xc], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 8