Function at 0x41f544
Capabilities:
Check os version
Get hostname
Get memory capacity
Get system information on windows
Initialize winsock library
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5a4
mov eax, dword [0x448008]
xor eax, esp
mov dword [esp + 0x5a0], eax
and dword [esp + 0x24], 0
lea eax, [esp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
mov dword [esp + 0x18], edx
mov byte [esp + 0x16], cl
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x30], 2
jne 0x41fcd9
cmp dword [esp + 0x24], 5
jb 0x41fcd9
push 0x461828
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x41f5c7
push eax
push str.Failed_to_initialized_Sockets___d_
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x41fcee
call fcn.0041f459
cmp dword [0x4619b8], 0
mov bl, al
je 0x41fccd
cmp dword [0x4619bc], 0
je 0x41fccd
push 0x104
lea eax, [esp + 0x4a4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
push 0x26
push str.ProgramPath
mov edx, 0x449740
mov dword [esp + 0x28], eax
mov ecx, 0x481f58
call fcn.00425218
mov dh, byte [0x481f58]
lea esi, [esp + 0x290]
test dh, dh
je 0x41f643
mov edi, esi
mov eax, 0x481f58
sub eax, edi
mov cl, dh
mov edi, dword [esp + 0x18]
mov byte [esi], cl
inc esi
mov cl, byte [eax + esi]
test cl, cl
jne 0x41f639
mov dl, byte [0x449740]
mov byte [esi], 0
test dl, dl
je 0x41f663
mov ecx, 0x449740
sub ecx, esi
mov byte [esi], dl
inc esi
mov al, byte [ecx + esi]
mov dl, al
test al, al
jne 0x41f657
mov eax, str..exe
mov byte [esi], 0
mov cl, 0x2e
sub eax, esi
mov byte [esi], cl
inc esi
mov cl, byte [esi + eax]
test cl, cl
jne 0x41f66f
mov byte [esi], cl
lea eax, [esp + 0x290]
sub esi, eax
lea ecx, [esp + 0x188]
test dh, dh
je 0x41f6af
mov edx, 0x481f58
mov eax, ecx
sub edx, eax
lea eax, [esp + 0x28b]
cmp ecx, eax
jae 0x41f6af
mov al, byte [ecx + edx]
mov byte [ecx], al
inc ecx
cmp byte [ecx + edx], 0
jne 0x41f698
lea eax, [esp + 0x28b]
mov byte [ecx], 0
push eax
mov edx, 0x449740
call fcn.0040e8b2
mov ecx, eax
mov edx, str.Service.exe
sub edx, ecx
lea eax, [esp + 0x28b]
cmp ecx, eax
jae 0x41f6e4
mov al, byte [ecx + edx]
mov byte [ecx], al
inc ecx
cmp byte [ecx + edx], 0
jne 0x41f6cd
mov byte [ecx], 0
lea ecx, [esp + 0x188]
call fcn.00429d51
mov byte [esp + 0x13], al
test al, al
je 0x41f71b
test bl, bl
je 0x41f71b
xor cl, cl
call fcn.0041ef5c
call fcn.0042a328
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41fcd4
cmp esi, dword [esp + 0x1c]
jne 0x41f741
push 0x7fff
lea edx, [esp + 0x4a4]
lea ecx, [esp + 0x294]
call fcn.00428b6b
test eax, eax
jne 0x41f741
xor bh, bh
jmp 0x41f743
mov bh, 1
test bl, bl
je 0x41f766
cmp byte [esp + 0x12], 0
je 0x41f873
call fcn.0041f28a
mov bl, al
neg bl
sbb bl, bl
add bl, 1
jne 0x41fcd4
mov edi, dword [esp + 0x14]
test bh, bh
je 0x41f7e3
push edi
xor dl, dl
mov ecx, 0x481f58
call fcn.0042475c
pop ecx
lea edx, [esp + 0x290]
lea ecx, [esp + 0x4a0]
call fcn.0040f1a3
test al, al
jne 0x41f912
test bl, bl
je 0x41f7af
call fcn.0041f28a
mov bl, al
neg bl
sbb bl, bl
add bl, 1
jne 0x41fcd4
xor esi, esi
lea edx, [esp + 0x290]
lea ecx, [esp + 0x4a0]
call fcn.0040f1a3
test al, al
jne 0x41f912
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xc8
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xa
jl 0x41f7b1
test bl, bl
je 0x41f7f4
call fcn.0041f28a
test al, al
je 0x41fcd4
call fcn.004125b5
call fcn.0041ef35
push 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
neg eax
sbb eax, eax
inc eax
mov dword [0x482164], eax
call fcn.00413815
push 1
push 0x23
mov esi, 0x482060
mov edx, 0x449740
push str.WorkingPath
mov ecx, esi
call fcn.00425218
push edi
xor dl, dl
mov ecx, esi
call fcn.0042475c
pop ecx
test eax, eax
jne 0x41f96a
mov dl, byte [0x482060]
lea ecx, [esp + 0x398]
test dl, dl
je 0x41f868
mov eax, ecx
sub esi, eax
mov byte [ecx], dl
inc ecx
mov al, byte [ecx + esi]
mov dl, al
test al, al
jne 0x41f857
mov esi, 0x482060
mov byte [ecx], 0
dec ecx
xor eax, eax
jmp 0x41f93f
test bh, bh
jne 0x41f89a
mov dword [esp + 0xbc], 0x3000091
mov dword [esp + 0xc0], 0x1348c5b
mov dword [esp + 0xc4], 0x19258
jmp 0x41f8c8
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x294]
call fcn.00429763
pop ecx
test eax, eax
je 0x41f766
cmp dword [esp + 0xbc], 0x3000091
jb 0x41f766
mov eax, str.Same_or_more_recent_version_already_running_
mov cl, 0x53
sub eax, edi
mov byte [edi], cl
inc edi
mov cl, byte [edi + eax]
test cl, cl
jne 0x41f8d1
lea eax, [esp + 0xbc]
xor ebx, ebx
push eax
mov edx, str._nRunning
mov byte [edi], bl
mov ecx, edi
call fcn.0041f4b2
pop ecx
push ebx
mov edx, str._nStarting
mov ecx, eax
call fcn.0041f4b2
pop ecx
xor cl, cl
mov byte [eax], bl
call fcn.0041ef5c
push 3
jmp 0x41fcf0
xor cl, cl
call fcn.0041ef5c
push 0
push 0
xor edx, edx
lea ecx, [esp + 0x298]
call fcn.004209de
pop ecx
pop ecx
jmp 0x41fcd4
cmp byte [ecx - 1], 0x5c
jne 0x41f93e
inc eax
cmp eax, 2
je 0x41f94a
dec ecx
lea edx, [esp + 0x398]
cmp ecx, edx
ja 0x41f932
xor edx, edx
mov byte [ecx], 0
push 0
inc edx
lea ecx, [esp + 0x39c]
call fcn.0040eead
pop ecx
push edi
xor dl, dl
mov ecx, esi
call fcn.0042475c
pop ecx
push 0x45e800
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov cl, 1
call fcn.0040fa7b
push 1
push 0x26
push str.ProgramPath
mov edx, str.NxCoreInstall
lea ecx, [esp + 0x194]
call fcn.00425218
push edi
xor dl, dl
lea ecx, [esp + 0x18c]
call fcn.0042475c
pop ecx
lea ecx, [esp + 0x188]
call fcn.004104c3
push edi
xor dl, dl
lea ecx, [esp + 0x18c]
call fcn.0042475c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x4617c4
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x4617e8
mov dword [0x4617e8], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push ecx
mov edx, 0x1348c5b
lea ecx, [esp + 0x16c]
call fcn.00401275
pop ecx
xor edx, edx
lea ecx, [esp + 0x148]
call fcn.00401401
lea eax, [esp + 0x148]
push eax
lea eax, [esp + 0x16c]
push eax
push str.NxCore_Access_built_on__s_at__s
xor eax, eax
push eax
push 0x104
push eax
push eax
call fcn.00420600
add esp, 0x1c
push 8
pop edi
test bh, bh
je 0x41fa56
lea eax, [esp + 0x4a0]
xor ebx, ebx
push eax
push str.Module__s
push 1
push edi
push ebx
push ebx
call fcn.00420600
add esp, 0x18
jmp 0x41fa58
xor ebx, ebx
cmp byte [esp + 0x13], 0
je 0x41fa71
push str.Started_by_Service
push 1
push edi
push ebx
push ebx
call fcn.00420600
add esp, 0x14
push 0x481f58
push str.Program_Dir__s
push ebx
push edi
push ebx
push ebx
call fcn.00420600
push esi
push str.Working_Dir__s
push ebx
push edi
push ebx
push ebx
call fcn.00420600
mov ecx, dword [esp + 0x54]
xor eax, eax
shld eax, ecx, 0x10
push str.Windows
shl ecx, 0x10
or eax, ebx
or ecx, dword [esp + 0x5c]
shld eax, ecx, 0x10
push ebx
shl ecx, 0x10
or eax, ebx
or ecx, dword [esp + 0x64]
shld eax, ecx, 0x10
push 0xc
shl ecx, 0x10
or eax, ebx
or ecx, dword [esp + 0x6c]
push eax
push ecx
call fcn.00420600
add esp, 0x44
mov ecx, str.SHELL32.DLL
call fcn.0041f31d
mov ecx, str.KERNEL32.DLL
mov dword [0x44ad30], eax
mov dword [0x44ad34], edx
call fcn.0041f31d
mov ecx, str.GDI32.DLL
call fcn.0041f31d
mov ecx, str.USER32.DLL
call fcn.0041f31d
mov ecx, str.MSVCRT.DLL
call fcn.0041f31d
mov ecx, str.ADVAPI32.DLL
call fcn.0041f31d
mov ecx, str.SHLWAPI.DLL
call fcn.0041f31d
mov ecx, str.COMCTL32.DLL
call fcn.0041f31d
mov ecx, str.WINMM.DLL
call fcn.0041f31d
mov ecx, str.WS2_32.DLL
call fcn.0041f31d
mov ecx, str.RICHED20.DLL
call fcn.0041f31d
movzx eax, word [0x4617e6]
push eax
movzx eax, word [0x4617e4]
push eax
movzx eax, word [0x4617c4]
push eax
push dword [0x4617d8]
push str.CPU__d_Arch__d_Lev__d_Rev__04x
push ebx
push edi
push ebx
push ebx
call fcn.00420600
mov ecx, dword [0x461800]
add esp, 0x24
mov eax, dword [0x461804]
mov edx, 0xffffff40
shrd ecx, eax, 0x14
add ecx, 0x3f
and ecx, edx
push ebx
push ecx
mov ecx, dword [0x4617f0]
mov eax, dword [0x4617f4]
shrd ecx, eax, 0x14
push ebx
add ecx, 0x3f
and ecx, edx
push ecx
push str.RAM__lluM_Page__lluM
push ebx
push edi
push ebx
push ebx
call fcn.00420600
add esp, 0x24
mov eax, 0x4617a1
push 0x1f
pop esi
push esi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp byte [0x4617a1], 0
mov edx, 0x4617a1
mov ecx, edx
je 0x41fbe9
mov eax, esi
dec esi
test eax, eax
js 0x41fbe9
inc ecx
cmp byte [ecx], 0
jne 0x41fbdc
push edx
sub cl, dl
push 0x46182c
mov byte [0x4617a0], cl
mov cx, word [0x46182a]
movzx eax, cl
push eax
movzx eax, ch
push eax
push str.WinSock__d._d___s__on___s_
push ebx
push edi
push ebx
push ebx
call fcn.00420600
add esp, 0x24
lea ecx, [esp + 0xc8]
push 0x20
pop edx
call fcn.0041bd73
mov edi, eax
mov ecx, ebx
test edi, edi
jle 0x41fc5d
lea esi, [ecx + 1]
xor edx, edx
mov ecx, dword [esp + ecx*4 + 0xc8]
push ebx
call fcn.004285e1
push eax
push esi
push str.Network__d:__s
push ebx
push 0x200
push ebx
push ebx
call fcn.00420600
mov ecx, esi
add esp, 0x1c
cmp ecx, edi
jl 0x41fc2e
mov ecx, dword [0x44e7c8]
xor edx, edx
push ebx
call fcn.004285e1
push eax
push str.Server_1:__s
push ebx
push 8
push ebx
push ebx
call fcn.00420600
mov ecx, dword [0x44e7d0]
add esp, 0x18
xor edx, edx
push ebx
call fcn.004285e1
push eax
push str.Server_2:__s
push ebx
push 8
push ebx
push ebx
call fcn.00420600
push dword [0x482164]
cmp dword [0x48205c], 1
mov ecx, 0x444ea0
mov eax, 0x444e9c
cmovne eax, ecx
push eax
push str.Using__s_res_timer___d_
push ebx
push 8
push ebx
push ebx
call fcn.00420600
add esp, 0x34
xor eax, eax
jmp 0x41fcf1
xor cl, cl
call fcn.0041ef5c
xor eax, eax
inc eax
jmp 0x41fcf1
mov eax, str.NxCore_Access_requires_Windows_2000_or_later
mov cl, 0x4e
sub eax, edi
mov byte [edi], cl
inc edi
mov cl, byte [eax + edi]
test cl, cl
jne 0x41fce2
mov byte [edi], cl
push 2
pop eax
mov ecx, dword [esp + 0x5ac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042a623
mov esp, ebp
pop ebp
ret