Function at 0x40fcd8
Capabilities:
Check os version
Create directory
Delete registry key
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x40fce0
xor eax, eax
push ebp
push 0x41137a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x41eb98], 0x66
jne 0x40fd61
mov eax, 0x41eb54
mov edx, 0x411390
call fcn.00403780
mov eax, dword [0x41d320]
push eax
push 0x400
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x41ecd4]
mov edx, dword [0x41ed00]
mov eax, 0x80000002
call fcn.00406c7c
mov edx, dword [ebp - 8]
mov eax, 0x41eb2c
call fcn.00403780
cmp byte [0x41eb95], 0
jne 0x40fd61
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x41eb2c]
call fcn.00406ad4
mov byte [0x41eb97], al
mov eax, 0x41eb54
mov edx, 0x411420
call fcn.00403780
mov ecx, dword [0x41ecd4]
mov edx, dword [0x41ed00]
mov eax, 0x80000002
call fcn.0040715c
lea eax, [ebp - 0xc]
call fcn.0040694c
mov edx, dword [ebp - 0xc]
mov eax, 0x41eb1c
call fcn.00403780
lea eax, [ebp - 0x10]
call fcn.004069b8
mov edx, dword [ebp - 0x10]
mov eax, 0x41eb20
call fcn.00403780
mov eax, 0x41eb54
mov edx, 0x411484
call fcn.00403780
mov eax, 0x41eb24
mov ecx, 0x411554
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, 0x41eb54
mov edx, 0x411564
call fcn.00403780
mov eax, dword [0x41eb2c]
call fcn.004038a4
test eax, eax
jne 0x40fe07
mov eax, 0x41eb2c
mov ecx, dword [0x41ecc4]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, 0x41d28c
mov ecx, dword [0x41d28c]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, 0x41eb14
mov ecx, dword [0x41ecbc]
mov edx, dword [0x41d28c]
call fcn.004038f0
mov eax, 0x41eb18
mov ecx, dword [0x41ecc0]
mov edx, dword [0x41d28c]
call fcn.004038f0
xor eax, eax
mov dword [0x41eb9c], eax
call fcn.00412690
mov eax, 0x41eb54
mov edx, 0x4115bc
call fcn.00403780
cmp byte [0x41eb95], 0
je 0x410128
mov eax, dword [0x41ed80]
call fcn.00405b30
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00406b68
push 0
mov eax, dword [0x41d28c]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x41eb94]
cmp byte [0x41eb94], 0
je 0x410162
call fcn.00406044
mov eax, 0x41eb54
mov edx, 0x4118d4
call fcn.00403780
mov eax, dword [0x41d320]
push eax
mov ecx, dword [0x41ed10]
mov edx, dword [0x41ed00]
mov eax, 0x80000002
call fcn.00406bb4
push eax
call fcn.00405430
pop edx
sub eax, edx
jno 0x41019d
call fcn.00402f1c
cmp eax, 0x1e
jl 0x41135c
lea edx, [ebp - 0x44]
mov eax, dword [0x41eb2c]
call fcn.0040548c
mov edx, dword [ebp - 0x44]
mov eax, 0x41eb30
call fcn.00403780
call fcn.0040278c
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x48]
mov ecx, dword [0x41ecd8]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov edx, dword [ebp - 0x48]
mov cl, 1
mov eax, dword [0x41eb2c]
call fcn.004056b8
mov byte [0x41eb97], al
lea eax, [ebp - 0x4c]
mov ecx, dword [0x41ecd8]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x4c]
call fcn.00406ad4
mov byte [0x41eb97], al
mov eax, 0x41eb54
mov edx, 0x411918
call fcn.00403780
mov eax, dword [0x41d320]
push eax
mov ecx, dword [0x41ecb8]
mov edx, dword [0x41ed00]
mov eax, 0x80000002
call fcn.00406bb4
mov dword [0x41eb8c], eax
cmp dword [0x41eb8c], 0x9e
jge 0x410364
cmp byte [0x41eb97], 0
jne 0x4102c4
lea eax, [ebp - 0x50]
mov ecx, dword [0x41ecd8]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov edx, dword [ebp - 0x50]
mov eax, dword [0x41eb2c]
call fcn.004039f0
je 0x4102c4
mov eax, dword [0x41ecd8]
call fcn.00405b30
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x54]
mov ecx, dword [0x41ecd8]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov edx, dword [ebp - 0x54]
mov cl, 1
mov eax, dword [0x41eb2c]
call fcn.004056b8
mov byte [0x41eb97], al
mov eax, 0x41eb54
mov edx, 0x4119c0
call fcn.00403780
cmp byte [0x41eb97], 0
je 0x410364
push 0x9e
mov ecx, dword [0x41ecb8]
mov edx, dword [0x41ed00]
mov eax, 0x80000002
call fcn.00406e90
mov byte [0x41eb97], al
cmp dword [0x41eb8c], 0
jle 0x41032a
lea edx, [ebp - 0x58]
mov eax, dword [0x41eb8c]
call fcn.00405148
mov ecx, dword [ebp - 0x58]
mov eax, 0x41eb28
mov edx, 0x411a70
call fcn.004038f0
jmp 0x410334
mov eax, 0x41eb28
call fcn.0040372c
push 0x411a80
lea edx, [ebp - 0x60]
mov eax, 0x9e
call fcn.00405148
push dword [ebp - 0x60]
push dword [0x41eb28]
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.00403964
mov eax, dword [ebp - 0x5c]
call fcn.00412764
call fcn.0040f1a8
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x64]
mov ecx, dword [0x41ecdc]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov edx, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [0x41eb2c]
call fcn.004056b8
mov byte [0x41eb97], al
lea eax, [ebp - 0x68]
mov ecx, dword [0x41ecdc]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x68]
call fcn.00406ad4
mov byte [0x41eb97], al
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x6c]
mov ecx, dword [0x41ece0]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x41eb2c]
call fcn.004056b8
mov byte [0x41eb97], al
lea eax, [ebp - 0x70]
mov ecx, dword [0x41ece0]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x70]
call fcn.00406ad4
mov byte [0x41eb97], al
lea eax, [ebp - 0x74]
mov ecx, dword [0x41ecec]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x74]
call fcn.00405764
test al, al
jne 0x4104c7
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x78]
mov ecx, dword [0x41ecec]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
mov ecx, dword [0x41ece4]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
pop edx
call fcn.004056b8
mov byte [0x41eb97], al
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x80]
mov ecx, dword [0x41ecf0]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x80]
push eax
lea eax, [ebp - 0x84]
mov ecx, dword [0x41ece8]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.004056b8
mov byte [0x41eb97], al
lea eax, [ebp - 0x88]
mov ecx, dword [0x41ece4]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x88]
call fcn.00405764
test al, al
jne 0x410593
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x8c]
mov ecx, dword [0x41ece4]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x8c]
push eax
lea eax, [ebp - 0x90]
mov ecx, dword [0x41ecec]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x90]
xor ecx, ecx
pop edx
call fcn.004056b8
mov byte [0x41eb97], al
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x94]
mov ecx, dword [0x41ece8]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x94]
push eax
lea eax, [ebp - 0x98]
mov ecx, dword [0x41ecf0]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.004056b8
mov byte [0x41eb97], al
mov eax, dword [0x41eb2c]
call fcn.00406ad4
mov byte [0x41eb97], al
mov eax, 0x41eb54
mov edx, 0x411a94
call fcn.00403780
lea eax, [ebp - 0x9c]
mov ecx, dword [0x41ece4]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0x9c]
call fcn.00406ad4
mov byte [0x41eb97], al
lea eax, [ebp - 0xa0]
mov ecx, dword [0x41ece8]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0xa0]
call fcn.00406ad4
mov byte [0x41eb97], al
lea eax, [ebp - 0xa4]
mov ecx, dword [0x41ecec]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0xa4]
call fcn.00406ad4
mov byte [0x41eb97], al
lea eax, [ebp - 0xa8]
mov ecx, dword [0x41ecf0]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0xa8]
call fcn.00406ad4
mov byte [0x41eb97], al
mov eax, 0x4116c4
call fcn.00417e74
mov eax, 0x4117ac
call fcn.00417e74
mov eax, 0x4117f4
call fcn.00417e74
mov eax, 0x41eb54
mov edx, 0x411ab4
call fcn.00403780
mov eax, 0x411b20
call fcn.00417e74
mov eax, 0x41eb54
mov edx, 0x411b2c
call fcn.00403780
push 0
push 0
push 0x41eb90
mov ecx, 0x407f9c
xor edx, edx
xor eax, eax
call fcn.004036e8
mov eax, 0x41eb54
mov edx, 0x411b70
call fcn.00403780
push 0
push 0
push 0x41eb90
mov ecx, 0x407a20
xor edx, edx
xor eax, eax
call fcn.004036e8
mov eax, 0x41eb28
mov ecx, dword [0x41ecd8]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [0x41eb28]
mov edx, dword [0x41eb2c]
call fcn.004039f0
je 0x41074c
lea eax, [ebp - 0xac]
mov ecx, dword [0x41ecdc]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0xac]
mov edx, dword [0x41eb2c]
call fcn.004039f0
je 0x41074c
lea eax, [ebp - 0xb0]
mov ecx, dword [0x41ece0]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0xb0]
mov edx, dword [0x41eb2c]
call fcn.004039f0
jne 0x410758
mov eax, 0x41eb28
call fcn.0040372c
jmp 0x41076d
mov eax, 0x41eb28
mov ecx, dword [0x41eb2c]
mov edx, 0x411bfc
call fcn.004038f0
mov al, byte [0x41eb98]
sub al, 0x64
je 0x410780
dec al
je 0x410797
dec al
je 0x4107ae
jmp 0x4107c3
mov eax, 0x41eb28
mov ecx, dword [0x41eb28]
mov edx, 0x411c08
call fcn.004038f0
jmp 0x4107c3
mov eax, 0x41eb28
mov ecx, dword [0x41eb28]
mov edx, 0x411c14
call fcn.004038f0
jmp 0x4107c3
mov eax, 0x41eb28
mov ecx, dword [0x41eb28]
mov edx, 0x411c20
call fcn.004038f0
mov eax, dword [0x41eb28]
call fcn.00412764
mov eax, 0x41ebb0
mov ecx, dword [0x41ed00]
mov edx, 0x80000002
call fcn.00406f5c
test al, al
jne 0x41080e
mov eax, 0x41ebb0
mov ecx, dword [0x41ed00]
mov edx, 0x80000002
call fcn.00406f5c
test al, al
jne 0x41080e
mov eax, 0x411c30
call fcn.00412764
jmp 0x41135c
push dword [0x41eb20]
push 0x411c48
push 0x411c58
mov eax, 0x41eb44
mov edx, 3
call fcn.00403964
mov eax, dword [0x41eb44]
call fcn.00405764
test al, al
jne 0x4108ac
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0xb4]
mov ecx, dword [0x41ecf4]
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, dword [ebp - 0xb4]
mov cl, 1
mov edx, dword [0x41eb44]
call fcn.004056b8
test al, al
je 0x410898
lea eax, [ebp - 0xb8]
mov ecx, dword [0x41eb44]
mov edx, 0x411c68
call fcn.004038f0
mov eax, dword [ebp - 0xb8]
call fcn.00412764
jmp 0x4108ac
mov eax, 0x411c84
call fcn.00412764
mov eax, 0x41eb44
call fcn.0040372c
mov eax, dword [0x41eb44]
call fcn.004038a4
test eax, eax
jle 0x410aa4
mov eax, 0x41eb4c
mov ecx, 0x411c94
mov edx, dword [0x41eb20]
call fcn.004038f0
mov eax, 0x41eb48
mov edx, 0x411ca8
call fcn.00403780
lea eax, [ebp - 0xbc]
mov ecx, 0x411cbc
mov edx, dword [0x41eb4c]
call fcn.004038f0
mov eax, dword [ebp - 0xbc]
call fcn.00405764
test al, al
je 0x410916
mov eax, 0x41eb48
mov edx, 0x411ccc
call fcn.004038ac
lea eax, [ebp - 0xc0]
mov ecx, 0x411cdc
mov edx, dword [0x41eb4c]
call fcn.004038f0
mov eax, dword [ebp - 0xc0]
call fcn.00405764
test al, al
je 0x41094a
mov eax, 0x41eb48
call fcn.0040372c