Function at 0x4102b0
Capabilities:
Check os version
Get common file path
Get disk information
Get disk size
Get memory capacity
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xcc
push 0
push 0
dec ecx
jne 0x4102b8
push ebx
push esi
push edi
mov edi, 0x41ab78
mov ebx, dword [0x4192d4]
xor eax, eax
push ebp
push 0x4117c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41ab68
mov edx, 0x4117d8
call fcn.0040325c
mov eax, edi
mov edx, 0x41183c
call fcn.0040325c
mov dword [ebp - 0xdc], 0x94
mov eax, 0x41ab68
mov edx, 0x411848
call fcn.0040325c
lea eax, [ebp - 0xdc]
push eax
call sub.kernel32.dll_GetVersionExA
mov esi, dword [ebp - 0xcc]
cmp esi, 2
jne 0x410335
lea eax, [ebp - 8]
mov edx, 0x4118bc
call fcn.004032a0
jmp 0x410359
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5b4]
call fcn.00404900
mov ecx, dword [ebp - 0x5b4]
lea eax, [ebp - 8]
mov edx, 0x4118c8
call fcn.004033d8
cmp byte [0x41aba8], 0
je 0x410371
lea eax, [ebp - 4]
mov edx, 0x4118d8
call fcn.004032a0
jmp 0x41037e
lea eax, [ebp - 4]
mov edx, 0x4118e8
call fcn.004032a0
mov eax, dword [ebp - 0xd8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5b8]
call fcn.00404900
push dword [ebp - 0x5b8]
push 0x4118f8
mov eax, dword [ebp - 0xd4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5bc]
call fcn.00404900
push dword [ebp - 0x5bc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040344c
mov eax, dword [ebp - 0xc]
mov edx, 0x411904
call fcn.004034d8
jne 0x4103e2
lea eax, [ebp - 4]
mov edx, 0x411910
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x411920
call fcn.0040325c
lea eax, [ebp - 0x18]
lea edx, [ebp - 0xc8]
mov ecx, 0x80
call fcn.00403374
mov eax, 0x41ab68
mov edx, 0x41199c
call fcn.0040325c
lea eax, [ebp - 0x5c0]
mov ecx, 0x4119dc
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5c0]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x41044b
lea eax, [ebp - 0x18]
mov edx, 0x4119e8
call fcn.004032a0
jmp 0x410568
lea eax, [ebp - 0x5c4]
mov ecx, 0x4119f4
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5c4]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x410483
lea eax, [ebp - 0x18]
mov edx, 0x411a00
call fcn.004032a0
jmp 0x410568
lea eax, [ebp - 0x5c8]
mov ecx, 0x411a0c
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5c8]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x4104bb
lea eax, [ebp - 0x18]
mov edx, 0x411a18
call fcn.004032a0
jmp 0x410568
lea eax, [ebp - 0x5cc]
mov ecx, 0x411a24
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x4104f0
lea eax, [ebp - 0x18]
mov edx, 0x411a30
call fcn.004032a0
jmp 0x410568
lea eax, [ebp - 0x5d0]
mov ecx, 0x411a3c
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5d0]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x410525
lea eax, [ebp - 0x18]
mov edx, 0x411a48
call fcn.004032a0
jmp 0x410568
lea eax, [ebp - 0x5d4]
mov ecx, 0x411a54
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5d4]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x41055a
lea eax, [ebp - 0x18]
mov edx, 0x411a60
call fcn.004032a0
jmp 0x410568
lea eax, [ebp - 0x18]
mov edx, dword [0x41ad90]
call fcn.004032a0
mov eax, dword [ebp - 0xd0]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5d8]
call fcn.00404900
mov ecx, dword [ebp - 0x5d8]
lea eax, [ebp - 0x10]
mov edx, 0x411a6c
call fcn.004033d8
mov eax, 0x41ab68
mov edx, 0x411a7c
call fcn.0040325c
push dword [ebp - 4]
push 0x411a94
push dword [ebp - 0xc]
push 0x411aa0
push dword [ebp - 0x18]
push 0x411aa0
push dword [ebp - 0x10]
push 0x411aa0
lea eax, [ebp - 0x14]
mov edx, 8
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x411aac
call fcn.0040325c
push dword [edi]
push dword [ebp - 8]
push 0x41183c
push dword [ebp - 4]
push 0x411a94
push dword [ebp - 0xc]
push 0x41183c
push dword [ebp - 0x10]
push 0x41183c
push dword [ebp - 0x18]
push 0x41183c
push 0x411b50
push dword [0x41ab34]
push 0x41183c
mov eax, edi
mov edx, 0xe
call fcn.0040344c
push 0xfa
lea eax, [ebp - 0x56f]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x41ab68
mov edx, 0x411b64
call fcn.0040325c
push dword [edi]
push 0x411bc0
lea eax, [ebp - 0x5dc]
lea edx, [ebp - 0x56f]
mov ecx, 0xfb
call fcn.00403374
push dword [ebp - 0x5dc]
push 0x41183c
mov eax, edi
mov edx, 4
call fcn.0040344c
push ebx
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x411bd4
mov edx, 0x411be8
mov eax, 0x80000001
call fcn.00405e40
push dword [edi]
push 0x411c0c
push dword [ebp - 4]
push 0x41183c
mov eax, edi
mov edx, 4
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x411c20
call fcn.0040325c
push dword [ebp - 0x14]
push dword [ebp - 4]
push 0x411aa0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040344c
push dword [edi]
push 0x411cb8
push dword [0x41ab30]
push 0x41183c
mov eax, edi
mov edx, 4
call fcn.0040344c
push dword [ebp - 0x14]
push 0x411ccc
push dword [0x41ab30]
push 0x411aa0
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040344c
mov dword [ebp - 0x44], 0x32
mov eax, 0x41ab68
mov edx, 0x411cd8
call fcn.0040325c
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x56f]
push eax
call sub.advapi32.dll_GetUserNameA
push dword [edi]
push 0x411d44
lea eax, [ebp - 0x5e0]
lea edx, [ebp - 0x56f]
mov ecx, 0xfb
call fcn.00403374
push dword [ebp - 0x5e0]
push 0x41183c
mov eax, edi
mov edx, 4
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x411d54
call fcn.0040325c
push dword [ebp - 0x14]
push 0x411dac
lea eax, [ebp - 0x5e4]
lea edx, [ebp - 0x56f]
mov ecx, 0xfb
call fcn.00403374
push dword [ebp - 0x5e4]
push 0x411aa0
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x411dbc
call fcn.0040325c
lea eax, [ebp - 4]
mov edx, 0x411e70
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x411e94
call fcn.0040325c
lea eax, [ebp - 8]
mov ecx, 0x411f34
mov edx, dword [ebp - 4]
call fcn.004033d8
push ebx
mov ecx, 0x411f50
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.00405d8c
lea edx, [ebp - 0xc]
call fcn.004048e0
mov eax, dword [ebp - 0xc]
call fcn.0040338c
cmp eax, 3
jge 0x410830
push 0
push 0x100000
call fcn.00405530
call fcn.00403aa0
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00404900
push dword [ebp - 0x14]
push 0x411f60
push dword [ebp - 0xc]
push 0x411aa0
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040344c
push dword [edi]
push 0x411f70
push 0x411f7c
push dword [ebp - 0xc]
push 0x411f8c
push 0x41183c
push 0x411f9c
push ebx
push 0x400
lea eax, [ebp - 0x5e8]
push eax
mov ecx, 0x411fb0
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5e8]
push 0x41183c
push 0x411fcc
push ebx
push 0x400
lea eax, [ebp - 0x5ec]
push eax
mov ecx, 0x411fe4
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5ec]
push 0x41183c
push 0x411ff8
push ebx
push 0x400
lea eax, [ebp - 0x5f0]
push eax
mov ecx, 0x412010
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5f0]
push 0x41183c
push 0x41202c
push ebx
push 0x400
lea eax, [ebp - 0x5f4]
push eax
mov ecx, 0x412044
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5f4]
push 0x41183c
push 0x412060
push ebx
push 0x400
lea eax, [ebp - 0x5f8]
push eax
mov ecx, 0x412074
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5f8]
push 0x41183c
push 0x41208c
push ebx
push 0x400
lea eax, [ebp - 0x5fc]
push eax
mov ecx, 0x4120a8
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5fc]
push 0x41183c
push 0x4120c4
push ebx
push 0x400
lea eax, [ebp - 0x600]
push eax
mov ecx, 0x4120e0
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x600]
push 0x41183c
mov eax, edi
mov edx, 0x1b
call fcn.0040344c
lea eax, [ebp - 4]
mov edx, 0x4120f8
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x412108
call fcn.0040325c
xor esi, esi
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.004048e0
push ebx
push 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x604]
mov ecx, dword [ebp - 0x10]
mov edx, 0x412190
call fcn.004033d8
mov ecx, dword [ebp - 0x604]
mov edx, 0x4121a8
mov eax, 0x80000002
call fcn.00405e40
mov eax, dword [ebp - 0xc]
call fcn.0040338c
test eax, eax
jle 0x410a3a
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x41183c
mov eax, edi
mov edx, 4
call fcn.0040344c
push ebx
push 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x608]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4121d0
call fcn.004033d8
mov ecx, dword [ebp - 0x608]
mov edx, 0x4121ec
mov eax, 0x80000002
call fcn.00405e40
mov eax, dword [ebp - 0xc]
call fcn.0040338c
test eax, eax
jle 0x410a91
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x41183c
mov eax, edi
mov edx, 4
call fcn.0040344c
inc esi
cmp esi, 7
jne 0x4109d9
push ebx
mov ecx, dword [0x41ad30]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405d8c
lea edx, [ebp - 0x10]
call fcn.004048e0
push dword [0x41ad30]
push 0x412218
push dword [ebp - 0x10]
push 0x41183c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040344c
mov dword [ebp - 0x5b0], 0x20
lea eax, [ebp - 0x5b0]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, 0x41ab68
mov edx, 0x412224
call fcn.0040325c
mov eax, dword [ebp - 0x5a8]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 4]
call fcn.00404900
push dword [ebp - 0x14]
push 0x4122e0
push dword [ebp - 4]
push 0x411aa0
push dword [0x41ab34]
push 0x411aa0
lea eax, [ebp - 0x14]
mov edx, 6
call fcn.0040344c
push dword [edi]
push 0x411f70
push 0x4122f0
push 0x41183c
push 0x412300
push dword [ebp - 4]
push 0x412310
push 0x41183c
push 0x41231c
mov eax, dword [ebp - 0x5ac]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x60c]
call fcn.00404900
push dword [ebp - 0x60c]
push 0x412330
push 0x41183c
push 0x41233c
mov eax, dword [ebp - 0x5a4]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x610]
call fcn.00404900
push dword [ebp - 0x610]
push 0x412310
push 0x41183c
push 0x411f70
push 0x412350
push 0x41183c
push 0x412368
mov eax, dword [ebp - 0x5a0]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x614]
call fcn.00404900
push dword [ebp - 0x614]
push 0x412310
push 0x41183c
push 0x41233c
mov eax, dword [ebp - 0x59c]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x618]
call fcn.00404900
push dword [ebp - 0x618]
push 0x412310
push 0x41183c
push 0x412380
mov eax, dword [ebp - 0x598]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x61c]
call fcn.00404900
push dword [ebp - 0x61c]
push 0x412310
push 0x41183c
push 0x41239c
mov eax, dword [ebp - 0x594]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x620]
call fcn.00404900
push dword [ebp - 0x620]
push 0x412310
push 0x41183c
push 0x41183c
push dword [0x41ad8c]
push dword [0x41ab44]
push 0x41183c
push dword [ebp - 0x10]
mov eax, edi
mov edx, 0x28
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x4123bc
call fcn.0040325c
lea eax, [ebp - 0x26c]
push eax
push 0x101
mov eax, dword [0x41929c]
mov eax, dword [eax]
call eax
push 0xff
lea eax, [ebp - 0x56f]
push eax
mov eax, dword [0x4192bc]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x56f]
push eax
mov eax, dword [0x4192f4]
mov eax, dword [eax]
call eax
mov ebx, eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
mov eax, dword [0x419290]
mov eax, dword [eax]
call eax
mov edx, eax
lea eax, [ebp - 4]
call fcn.00403338
push dword [edi]
push 0x41240c
push dword [ebp - 4]
mov eax, edi
mov edx, 3
call fcn.0040344c
push dword [ebp - 0x14]
push 0x412420
push dword [ebp - 4]
push 0x411aa0
push 0x41242c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040344c
mov eax, dword [0x4192ec]
mov eax, dword [eax]
call eax
mov eax, 0x41ab68
mov edx, 0x41243c
call fcn.0040325c
push dword [edi]
push 0x41183c
push 0x41183c
push 0x41248c
push 0x41183c
mov eax, edi
mov edx, 5
call fcn.0040344c
mov bl, 0x42
mov eax, 0x41ab68
mov edx, 0x4124b0
call fcn.0040325c
lea eax, [ebp - 0x624]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x624]
lea eax, [ebp - 0x628]
call fcn.004027dc
mov edx, 0x4124f4
lea eax, [ebp - 0x628]
mov cl, 2
call fcn.004027ac
lea edx, [ebp - 0x628]
lea eax, [ebp - 0x62c]
call fcn.004027dc
mov edx, 0x4124f8
lea eax, [ebp - 0x62c]
mov cl, 3
call fcn.004027ac
lea edx, [ebp - 0x62c]
lea eax, [ebp - 0x1c]
call fcn.00403368
mov eax, dword [ebp - 0x1c]
call fcn.0040358c
mov esi, eax
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x410e01.0
jmp dword [eax*4 + 0x410e08]
mov eax, 0x41ab68
mov edx, 0x412504
call fcn.0040325c
lea eax, [ebp - 4]
mov edx, 0x412564
call fcn.004032a0
lea eax, [ebp - 8]
mov edx, 0x412574
call fcn.004032a0
jmp 0x410f37
lea eax, [ebp - 4]
mov edx, 0x412580
call fcn.004032a0
lea eax, [ebp - 8]
mov edx, 0x412598
call fcn.004032a0
jmp 0x410f37
lea eax, [ebp - 4]
mov edx, 0x4125a4
call fcn.004032a0
lea eax, [ebp - 8]
mov edx, 0x4125b8
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x4125c8
call fcn.0040325c
jmp 0x410f37
lea eax, [ebp - 4]
mov edx, 0x4126a0
call fcn.004032a0
lea eax, [ebp - 8]
mov edx, 0x4126b0
call fcn.004032a0
push dword [edi]
push 0x41183c
push 0x411f70
push dword [ebp - 0x1c]
push dword [ebp - 4]
push 0x41183c
mov eax, edi
mov edx, 6
call fcn.0040344c
lea eax, [ebp - 4]
call fcn.00403208
mov eax, 0x41ab68
mov edx, 0x4126bc
call fcn.0040325c
jmp 0x410f37
lea eax, [ebp - 4]
mov edx, 0x41276c
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x412780
call fcn.0040325c
lea eax, [ebp - 8]
mov edx, 0x412824
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x412834
call fcn.0040325c
jmp 0x410f37
lea eax, [ebp - 4]
call fcn.00403208
mov eax, 0x41ab68
mov edx, 0x4128fc
call fcn.0040325c
mov eax, dword [ebp - 4]
call fcn.0040338c
dec eax
jl 0x41117f
mov eax, 0x41ab68
mov edx, 0x4129ac
call fcn.0040325c
push dword [ebp - 0x14]
lea eax, [ebp - 0x630]
mov edx, ebx
call fcn.00403328
push dword [ebp - 0x630]
push 0x412218
push dword [ebp - 8]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040344c
push dword [edi]
push 0x411f70
push dword [ebp - 0x1c]
push 0x41183c
push 0x412a6c
push dword [ebp - 4]
push 0x41183c
mov eax, edi
mov edx, 7
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x412a7c
call fcn.0040325c
push 0x64
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x104
lea eax, [ebp - 0x370]
push eax
push esi
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4110b5
push dword [edi]
push 0x412b38
lea eax, [ebp - 0x634]
lea edx, [ebp - 0x370]
mov ecx, 0x104
call fcn.00403374
invalid