Function at 0x659de0
Capabilities:
Get common file path
Get disk information
Get hostname
Get memory capacity
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x76c
push ebx
push esi
xor esi, esi
cmp ecx, esi
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
je 0x65a5f6
cmp edx, 0x10
jl 0x65a5f6
mov eax, dword [0x7ec2d8]
mov ebx, 1
cmp eax, ebx
jne 0x659e7d
cmp dword [ebp + 8], ebx
jne 0x659e51
mov eax, dword [0x7ec2c4]
mov dword [ecx], eax
mov edx, dword [0x7ec2c8]
mov dword [ecx + 4], edx
mov eax, dword [0x7ec2cc]
mov dword [ecx + 8], eax
mov edx, dword [0x7ec2d0]
mov dword [ecx + 0xc], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x7ec2b0]
mov dword [ecx], eax
mov edx, dword [0x7ec2b4]
mov dword [ecx + 4], edx
mov eax, dword [0x7ec2b8]
mov dword [ecx + 8], eax
mov edx, dword [0x7ec2bc]
mov dword [ecx + 0xc], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, 0x22
lea edi, [esp + 0xd0]
rep stosd dword es:[edi], eax
mov ecx, 0x7d
lea edi, [esp + 0x3a8]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x2a0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x5a0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x198]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
stosw word es:[edi], ax
mov dword [esp + 0x5c], ecx
xor edx, edx
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], edx
mov dword [esp + 0x90], edx
mov byte [esp + 0x10], al
mov dword [esp + 0x94], edx
mov ecx, 0x10
lea edi, [esp + 0x158]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0xa8], eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x98], edx
mov dword [esp + 0xac], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xb0], eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0xa0], edx
mov dword [esp + 0xb4], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0xa4], edx
mov dword [esp + 0xb8], eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0xc0], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0x84], ecx
mov byte [esp + 0x38], dl
mov edx, 0x64
lea ecx, [esp + 0x710]
mov dword [esp + 0x158], 0x40
mov dword [esp + 0xcc], eax
mov dword [esp + 0x14], 0x11
call fcn.0065af90
mov edx, 0x64
lea ecx, [esp + 0x6a8]
call fcn.0065c0e0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [ebp + 0xc]
and eax, 0xffff
cmp ecx, ebx
jne 0x65a01f
mov dword [esp + 0xe8], eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x54]
mov dx, word [esp + 0x5c]
mov ax, word [esp + 0x5e]
mov dword [esp + 0xec], ecx
mov word [esp + 0xf0], dx
mov edx, 0x28
lea ecx, [esp + 0xf8]
mov word [esp + 0xf2], ax
call fcn.00658930
lea ecx, [esp + 0x710]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x65a0b0
lea edx, [esp + 0x6a8]
push edx
push edi
call ebx
cmp eax, esi
je 0x65a0b0
lea ecx, [esp + 0x158]
push ecx
call eax
test eax, eax
je 0x65a0b0
mov eax, dword [esp + 0x160]
mov edx, dword [esp + 0x164]
shrd eax, edx, 0x14
shr edx, 0x14
cmp eax, esi
jne 0x65a0c8
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x90]
shr eax, 0x14
cmp eax, 0x40
ja 0x65a0d7
mov eax, 0x40
jmp 0x65a1dd
cmp eax, 0x60
ja 0x65a0e6
mov eax, 0x60
jmp 0x65a1dd
cmp eax, 0x80
ja 0x65a0f7
mov eax, 0x80
jmp 0x65a1dd
cmp eax, 0xc0
ja 0x65a108
mov eax, 0xc0
jmp 0x65a1dd
cmp eax, 0x100
ja 0x65a119
mov eax, 0x100
jmp 0x65a1dd
cmp eax, 0x180
ja 0x65a12a
mov eax, 0x180
jmp 0x65a1dd
cmp eax, 0x200
ja 0x65a13b
mov eax, 0x200
jmp 0x65a1dd
cmp eax, 0x300
ja 0x65a14c
mov eax, 0x300
jmp 0x65a1dd
cmp eax, 0x400
ja 0x65a15d
mov eax, 0x400
jmp 0x65a1dd
cmp eax, 0x600
ja 0x65a16b
mov eax, 0x600
jmp 0x65a1dd
cmp eax, 0x800
ja 0x65a179
mov eax, 0x800
jmp 0x65a1dd
cmp eax, 0xc00
ja 0x65a187
mov eax, 0xc00
jmp 0x65a1dd
cmp eax, 0x1000
ja 0x65a195
mov eax, 0x1000
jmp 0x65a1dd
cmp eax, 0x1800
ja 0x65a1a3
mov eax, 0x1800
jmp 0x65a1dd
cmp eax, 0x2000
ja 0x65a1b1
mov eax, 0x2000
jmp 0x65a1dd
cmp eax, 0x3000
ja 0x65a1bf
mov eax, 0x3000
jmp 0x65a1dd
cmp eax, 0x4000
ja 0x65a1cd
mov eax, 0x4000
jmp 0x65a1dd
mov ecx, 0x6000
cmp ecx, eax
sbb eax, eax
and eax, 0x2000
add eax, ecx
cmp dword [ebp + 0xc], 1
jne 0x65a1ea
mov dword [esp + 0xf4], eax
cmp edi, esi
je 0x65a20b
push str.GetSystemWindowsDirectoryA
push edi
call ebx
cmp eax, esi
je 0x65a20b
push 0x106
lea edx, [esp + 0x2a4]
push edx
call eax
jmp 0x65a21e
push 0x106
lea eax, [esp + 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x2a0]
call fcn.00658c10
push 0x106
lea ecx, [esp + 0x5a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xd8]
lea ecx, [esp + 0x5a0]
call fcn.00658c10
movsx edx, byte [esp + 0x5a0]
push edx
call fcn.006988b9
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add esp, 4
test eax, eax
je 0x65a285
cmp byte [esp + 0x5a1], 0x3a
jne 0x65a285
mov al, byte [esp + 0x5a0]
jmp 0x65a2ab
movsx eax, byte [esp + 0x2a0]
push eax
call fcn.006988b9
add esp, 4
test eax, eax
je 0x65a301
cmp byte [esp + 0x2a1], 0x3a
jne 0x65a301
mov al, byte [esp + 0x2a0]
cmp al, 0x3f
je 0x65a301
movsx ecx, al
push ecx
call fcn.00697d00
mov bl, al
add esp, 4
mov edx, 0x103
lea ecx, [esp + 0x19b]
mov byte [esp + 0x198], bl
mov byte [esp + 0x199], 0x3a
mov byte [esp + 0x19a], 0x5c
call fcn.0064c840
lea edx, [esp + 0xe0]
lea ecx, [esp + 0x198]
call fcn.00658c10
test eax, eax
jne 0x65a301
cmp bl, 0x3f
jne 0x65a374
mov bl, 0x43
jmp 0x65a310
lea edx, [esp + 0x198]
push edx
mov byte [esp + 0x19c], bl
mov byte [esp + 0x19d], 0x3a
mov byte [esp + 0x19e], 0x5c
mov byte [esp + 0x19f], 0
call edi
cmp eax, 3
jne 0x65a366
mov edx, 0x103
lea ecx, [esp + 0x19b]
call fcn.0064c840
lea edx, [esp + 0xe0]
lea ecx, [esp + 0x198]
call fcn.00658c10
test eax, eax
je 0x65a36d
inc bl
cmp bl, 0x47
jle 0x65a310
cmp bl, 0x3f
jne 0x65a374
mov bl, 0x43
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x5c
mov byte [esp + 0x13], 0
call edi
cmp eax, 3
jne 0x65a3c9
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x28
lea edx, [esp + 0xac]
push edx
mov edx, 4
lea ecx, [esp + 0x24]
call fcn.0065fca0
call fcn.006563f0
test eax, eax
lea ecx, [esp + 0x60]
mov edx, 0x28
je 0x65a3e2
call fcn.006586c0
jmp 0x65a3e7
call fcn.006573a0
lea eax, [esp + 0x3a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [esp + 0x454], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov edx, 0x28
lea ecx, [esp + 0x45c]
mov dword [esp + 0x458], eax
call fcn.00659c30
mov edx, 0x28
lea ecx, [esp + 0x484]
call fcn.00658dc0
call fcn.006563f0
cmp eax, 1
jne 0x65a44d
mov edx, 0x28
lea ecx, [esp + 0x4ac]
call fcn.00658fe0
mov edx, 0x28
lea ecx, [esp + 0x4d4]
call fcn.006590d0
call fcn.006563f0
cmp eax, 1
jne 0x65a49b
mov edx, 0x28
lea ecx, [esp + 0x4fc]
call fcn.00659330
mov edx, 0x28
lea ecx, [esp + 0x524]
call fcn.00659420
mov edx, 0x28
lea ecx, [esp + 0x54c]
call fcn.00659530
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x65a4c6
mov edx, dword [esp + 0x14]
push 0x28
lea eax, [esp + 0x578]
push eax
lea ecx, [esp + 0x30]
call fcn.00658ca0
cmp dword [ebp + 0xc], 1
jne 0x65a4e7
push 0x10
lea ecx, [esp + 0x14c]
push ecx
mov edx, 0x1f4
lea ecx, [esp + 0x3b0]
call fcn.0064c7d0
mov ecx, 0xa
lea esi, [esp + 0xa8]
lea edi, [esp + 0x120]
push 0x12
rep movsd dword es:[edi], dword [esi]
push 0x7ec2b0
mov edx, 0x88
lea ecx, [esp + 0xd8]
call fcn.0064c7d0
xor ecx, ecx
mov dword [esp + 0xe0], ecx
xor edx, edx
mov dword [esp + 0xd0], edx
xor eax, eax
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xd8], eax
mov dword [esp + 0xd4], edx
mov dword [esp + 0xdc], eax
mov ecx, 0xa
lea esi, [esp + 0x60]
lea edi, [esp + 0x120]
push 0x12
rep movsd dword es:[edi], dword [esi]
push 0x7ec2c4
mov edx, 0x88
lea ecx, [esp + 0xd8]
call fcn.0064c7d0
xor edx, edx
mov ecx, 0x7ec2b0
call fcn.00656ec0
mov esi, 1
mov edx, esi
mov ecx, 0x7ec2c4
call fcn.00656ec0
cmp dword [ebp + 8], esi
mov eax, dword [esp + 0x18]
mov dword [0x7ec2d8], esi
jne 0x65a5c8
mov edx, dword [0x7ec2c4]
mov dword [eax], edx
mov ecx, dword [0x7ec2c8]
mov dword [eax + 4], ecx
mov edx, dword [0x7ec2cc]
mov dword [eax + 8], edx
mov ecx, dword [0x7ec2d0]
mov dword [eax + 0xc], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [0x7ec2b0]
mov dword [eax], edx
mov ecx, dword [0x7ec2b4]
mov dword [eax + 4], ecx
mov edx, dword [0x7ec2b8]
mov dword [eax + 8], edx
mov ecx, dword [0x7ec2bc]
mov dword [eax + 0xc], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 8