Function at 0x40d848
Capabilities:
Check os version
Create directory
Delete registry key
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0x40d850
push ebx
push esi
push edi
mov esi, 0x41ab34
mov edi, 0x41ab68
mov ebx, 0x41abab
xor eax, eax
push ebp
push 0x40ed7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x40ed94
call fcn.0040325c
cmp byte [0x41abac], 0x66
jne 0x40d8dd
mov eax, edi
mov edx, 0x40edf0
call fcn.0040325c
mov eax, dword [0x4192d4]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, dword [0x41ace8]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405e40
mov edx, dword [ebp - 4]
mov eax, 0x41ab40
call fcn.0040325c
cmp byte [0x41aba9], 0
jne 0x40d8dd
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, edi
mov edx, 0x40ee7c
call fcn.0040325c
mov ecx, dword [0x41ace8]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00406264
lea eax, [ebp - 8]
call fcn.00405b84
mov edx, dword [ebp - 8]
mov eax, 0x41ab30
call fcn.0040325c
lea eax, [ebp - 0xc]
call fcn.00405bf0
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0040325c
mov eax, 0x41ab38
mov ecx, 0x40eed0
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [0x41ab40]
call fcn.0040338c
test eax, eax
jne 0x40d957
mov eax, 0x41ab40
mov ecx, dword [0x41acd8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, 0x4191e8
mov ecx, dword [0x4191e8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, 0x41ab28
mov ecx, dword [0x41acd0]
mov edx, dword [0x4191e8]
call fcn.004033d8
mov eax, 0x41ab2c
mov ecx, dword [0x41acd4]
mov edx, dword [0x4191e8]
call fcn.004033d8
xor eax, eax
mov dword [0x41abb0], eax
call fcn.0040fed0
mov eax, edi
mov edx, 0x40eee0
call fcn.0040325c
mov eax, edi
mov edx, 0x40ef44
call fcn.0040325c
cmp byte [0x41aba9], 0
je 0x40dc24
mov eax, dword [0x41ad94]
call fcn.00405130
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00405d60
lea eax, [ebp - 0x10]
mov ecx, dword [0x41ad50]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x10]
call fcn.00404fdc
lea eax, [ebp - 0x14]
mov ecx, dword [0x41ad54]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x14]
call fcn.00404fdc
mov eax, dword [0x41ab28]
call fcn.00404fdc
mov ecx, dword [0x41acd8]
mov edx, dword [0x41ad38]
mov eax, 0x80000002
call fcn.00406264
mov ecx, dword [0x41acd8]
mov edx, dword [0x41ad40]
mov eax, 0x80000002
call fcn.00406264
mov ecx, dword [0x41acd8]
mov edx, dword [0x41ad3c]
mov eax, 0x80000001
call fcn.00406264
mov ecx, dword [0x41acdc]
mov edx, dword [0x41ad38]
mov eax, 0x80000001
call fcn.00406264
mov ecx, dword [0x41ace0]
mov edx, dword [0x41ad3c]
mov eax, 0x80000002
call fcn.00406264
lea eax, [ebp - 0x18]
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x18]
call fcn.00404fdc
lea eax, [ebp - 0x1c]
mov ecx, dword [0x41acf0]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x1c]
call fcn.00404fdc
lea eax, [ebp - 0x20]
mov ecx, dword [0x41acf4]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x20]
call fcn.00404fdc
lea eax, [ebp - 0x24]
mov ecx, dword [0x41acf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x24]
call fcn.00404fdc
lea eax, [ebp - 0x28]
mov ecx, dword [0x41acfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x28]
call fcn.00404fdc
lea eax, [ebp - 0x2c]
mov ecx, dword [0x41ad00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x2c]
call fcn.00404fdc
lea eax, [ebp - 0x30]
mov ecx, dword [0x41ad04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x30]
call fcn.00404fdc
mov eax, dword [0x41ad48]
call fcn.0040358c
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [0x41ad14]
call fcn.0040358c
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x40efb4
call fcn.0041436c
mov eax, edi
mov edx, 0x40efc0
call fcn.0040325c
mov eax, 0x40f030
call fcn.0041436c
mov eax, edi
mov edx, 0x40f03c
call fcn.0040325c
mov eax, 0x40f0bc
call fcn.0041436c
mov eax, dword [0x41ab2c]
call fcn.00404fdc
push 0x200040
push 0x40f0c0
push 0x40f0cc
lea edx, [ebp - 0x38]
mov eax, 0x9f
call fcn.004048e0
push dword [ebp - 0x38]
push 0x40f0d8
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040344c
mov eax, dword [ebp - 0x34]
call fcn.0040358c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
lea eax, [ebp - 0x3c]
mov ecx, dword [0x41ad94]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x3c]
call fcn.0040358c
push eax
push 0x40f0f0
push 0
mov eax, dword [0x4192e8]
mov eax, dword [eax]
call eax
mov eax, dword [0x41ab40]
call fcn.00405034
jmp 0x40ed3f
push 0
mov eax, dword [0x4191e8]
call fcn.0040358c
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x41aba8]
cmp byte [0x41aba8], 0
je 0x40dc5e
call fcn.00405498
mov eax, edi
mov edx, 0x40f174
call fcn.0040325c
mov eax, dword [0x4192d4]
push eax
mov ecx, dword [0x41ad24]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405d8c
push eax
call fcn.00404b38
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x40ed3f
mov eax, edi
mov edx, 0x40f03c
call fcn.0040325c
lea edx, [ebp - 0x40]
mov eax, dword [0x41ab40]
call fcn.00404b68
mov edx, dword [ebp - 0x40]
mov eax, 0x41ab44
call fcn.0040325c
call fcn.00402720
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x44]
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x44]
mov cl, 1
mov eax, dword [0x41ab40]
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x48]
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x48]
call fcn.00405ce0
mov byte [ebx], al
mov eax, edi
mov edx, 0x40f18c
call fcn.0040325c
mov eax, dword [0x4192d4]
push eax
mov ecx, dword [0x41accc]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405d8c
mov dword [0x41aba0], eax
cmp dword [0x41aba0], 0x9f
jge 0x40de2c
cmp byte [ebx], 0
jne 0x40dda2
lea eax, [ebp - 0x4c]
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x41ab40]
call fcn.004034d8
je 0x40dda2
mov eax, dword [0x41acec]
call fcn.00405130
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x50]
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x41ab40]
call fcn.00404d2c
mov byte [ebx], al
cmp byte [ebx], 0
je 0x40de2c
push 0x9f
mov ecx, dword [0x41accc]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00406004
mov byte [ebx], al
cmp dword [0x41aba0], 0
jle 0x40ddf2
lea edx, [ebp - 0x54]
mov eax, dword [0x41aba0]
call fcn.004048e0
mov ecx, dword [ebp - 0x54]
mov eax, 0x41ab3c
mov edx, 0x40f1b0
call fcn.004033d8
jmp 0x40ddfc
mov eax, 0x41ab3c
call fcn.00403208
push 0x40f1c0
lea edx, [ebp - 0x5c]
mov eax, 0x9f
call fcn.004048e0
push dword [ebp - 0x5c]
push dword [0x41ab3c]
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.0040344c
mov eax, dword [ebp - 0x58]
call fcn.0040ffd8
mov eax, edi
mov edx, 0x40f1d4
call fcn.0040325c
call fcn.0040cc2c
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x60]
mov ecx, dword [0x41acf0]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [0x41ab40]
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x64]
mov ecx, dword [0x41acf0]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x64]
call fcn.00405ce0
mov byte [ebx], al
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x68]
mov ecx, dword [0x41acf4]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x68]
xor ecx, ecx
mov eax, dword [0x41ab40]
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x6c]
mov ecx, dword [0x41acf4]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x6c]
call fcn.00405ce0
mov byte [ebx], al
lea eax, [ebp - 0x70]
mov ecx, dword [0x41ad04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x70]
call fcn.00404dc0
test al, al
jne 0x40df5b
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x74]
mov ecx, dword [0x41ad00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
mov ecx, dword [0x41acf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x78]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x7c]
mov ecx, dword [0x41ad04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
mov ecx, dword [0x41acfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x80]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x84]
mov ecx, dword [0x41acf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x84]
call fcn.00404dc0
test al, al
jne 0x40e00d
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x88]
mov ecx, dword [0x41acf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x88]
push eax
lea eax, [ebp - 0x8c]
mov ecx, dword [0x41ad00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x90]
mov ecx, dword [0x41acfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x90]
push eax
lea eax, [ebp - 0x94]
mov ecx, dword [0x41ad04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x94]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
mov eax, dword [0x41ab40]
call fcn.00405ce0
mov byte [ebx], al
mov eax, edi
mov edx, 0x40f204
call fcn.0040325c
lea eax, [ebp - 0x98]
mov ecx, dword [0x41acf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x98]
call fcn.00405ce0
mov byte [ebx], al
lea eax, [ebp - 0x9c]
mov ecx, dword [0x41acfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x9c]
call fcn.00405ce0
mov byte [ebx], al
mov eax, edi
mov edx, 0x40f248
call fcn.0040325c
lea eax, [ebp - 0xa0]
mov ecx, dword [0x41ad00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0xa0]
call fcn.00405ce0
mov byte [ebx], al
lea eax, [ebp - 0xa4]
mov ecx, dword [0x41ad04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0xa4]
call fcn.00405ce0
mov byte [ebx], al
mov eax, 0x40efb4
call fcn.00415320
mov eax, edi
mov edx, 0x40f174
call fcn.0040325c
mov eax, 0x40f030
call fcn.00415320
mov eax, 0x40f0bc
call fcn.00415320
mov eax, 0x40f2dc
call fcn.00415320
mov eax, edi
mov edx, 0x40efc0
call fcn.0040325c
push 0
push 0
push 0x41aba4
mov ecx, 0x407084
xor edx, edx
xor eax, eax
call fcn.004031c4
push 0
push 0
push 0x41aba4
mov ecx, 0x406b70
xor edx, edx
xor eax, eax
call fcn.004031c4
mov eax, 0x41ab3c
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [0x41ab3c]
mov edx, dword [0x41ab40]
call fcn.004034d8
je 0x40e18f
lea eax, [ebp - 0xa8]
mov ecx, dword [0x41acf0]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0xa8]
mov edx, dword [0x41ab40]
call fcn.004034d8
je 0x40e18f
lea eax, [ebp - 0xac]
mov ecx, dword [0x41acf4]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0xac]
mov edx, dword [0x41ab40]
call fcn.004034d8
jne 0x40e19b
mov eax, 0x41ab3c
call fcn.00403208
jmp 0x40e1b0
mov eax, 0x41ab3c
mov ecx, dword [0x41ab40]
mov edx, 0x40f2e8
call fcn.004033d8
mov al, byte [0x41abac]
sub al, 0x64
je 0x40e1c3
dec al
je 0x40e1da
dec al
je 0x40e1f1
jmp 0x40e206
mov eax, 0x41ab3c
mov ecx, dword [0x41ab3c]
mov edx, 0x40f2f4
call fcn.004033d8
jmp 0x40e206
mov eax, 0x41ab3c
mov ecx, dword [0x41ab3c]
mov edx, 0x40f300
call fcn.004033d8
jmp 0x40e206
mov eax, 0x41ab3c
mov ecx, dword [0x41ab3c]
mov edx, 0x40f30c
call fcn.004033d8
mov eax, dword [0x41ab3c]
call fcn.0040ffd8
mov eax, 0x41abc4
mov ecx, dword [0x41ad14]
mov edx, 0x80000002
call fcn.004060bc
test al, al
jne 0x40e251
mov eax, 0x41abc4
mov ecx, dword [0x41ad14]
mov edx, 0x80000002
call fcn.004060bc
test al, al
jne 0x40e251
mov eax, 0x40f31c
call fcn.0040ffd8
jmp 0x40ed3f
mov eax, edi
mov edx, 0x40f32c
call fcn.0040325c
push dword [esi]
push 0x40f360
push 0x40f370
mov eax, 0x41ab58
mov edx, 3
call fcn.0040344c
mov eax, dword [0x41ab58]
call fcn.00404dc0
test al, al
jne 0x40e2f3
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0xb0]
mov ecx, dword [0x41ad08]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0xb0]
mov cl, 1
mov edx, dword [0x41ab58]
call fcn.00404d2c
test al, al
je 0x40e2df
lea eax, [ebp - 0xb4]
mov ecx, dword [0x41ab58]
mov edx, 0x40f380
call fcn.004033d8
mov eax, dword [ebp - 0xb4]
call fcn.0040ffd8
jmp 0x40e2f3
mov eax, 0x40f39c
call fcn.0040ffd8
mov eax, 0x41ab58
call fcn.00403208
mov eax, dword [0x41ab58]
call fcn.0040338c
test eax, eax
jle 0x40e4e7
mov eax, 0x41ab60
mov ecx, 0x40f3ac
mov edx, dword [esi]
call fcn.004033d8
mov eax, 0x41ab5c
mov edx, 0x40f3c0
call fcn.0040325c
lea eax, [ebp - 0xb8]
mov ecx, 0x40f3d4
mov edx, dword [0x41ab60]
call fcn.004033d8
mov eax, dword [ebp - 0xb8]
call fcn.00404dc0
test al, al
je 0x40e359
mov eax, 0x41ab5c
mov edx, 0x40f3e4
call fcn.00403394
lea eax, [ebp - 0xbc]
mov ecx, 0x40f3f4
mov edx, dword [0x41ab60]
call fcn.004033d8
mov eax, dword [ebp - 0xbc]
call fcn.00404dc0
test al, al
je 0x40e38d
mov eax, 0x41ab5c
invalid