Function at 0x402f91
Capabilities:
Check os version
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov dword [ebp - 8], 0x1d
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax - 0x170]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
and eax, 0x3a4
movzx ecx, word [ebp - 8]
xor eax, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, 0x251
sub ecx, eax
mov al, byte [ebp - 8]
xor ecx, eax
mov byte [ebp - 1], cl
mov eax, dword [ebp - 0xc]
or al, 0xdb
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0x39
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, dword [sym.imp.KERNEL32.dll_CompareFileTime]
ja 0x402ffb
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x22
push eax
call esi
jmp 0x4031e7
cmp byte [ebp - 1], 0x16
jae 0x403010
mov eax, dword [ebp - 8]
and ax, 0x113
mov dword [ebp - 8], eax
jmp 0x4031e7
cmp byte [ebp - 1], 0x14
jae 0x40302d
movzx eax, byte [ebp - 1]
xor edx, edx
mov ecx, 0x2c8
div ecx
movzx ecx, word [ebp - 8]
xor edx, edx
div ecx
jmp 0x403066
cmp byte [ebp - 1], 0xcd
jne 0x4031e7
cmp word [ebp - 8], 0xfeca
jne 0x403184
cmp byte [ebp - 1], 0xcd
jne 0x40311a
cmp byte [ebp - 1], 0x5e
jae 0x40306e
movzx ecx, byte [ebp - 1]
mov eax, 0x282
xor edx, edx
div ecx
add edx, 0x2a1
mov dword [ebp - 0xc], edx
jmp 0x4031e7
cmp byte [ebp - 1], 5
jae 0x403086
mov eax, dword [ebp - 0xc]
push 0x36
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x10], edx
jmp 0x4031e7
cmp byte [ebp - 1], 0xcd
jne 0x4030d3
mov eax, dword [ebp - 8]
and eax, 0x584
sub eax, 0x440
push eax
push 0x1000
movzx eax, word [ebp - 8]
xor eax, 0x3e1
add eax, 0x2c823
push eax
movzx ecx, byte [ebp - 1]
push 0x59
xor edx, edx
pop eax
div ecx
mov eax, dword [ebp - 0xc]
xor edx, eax
sub edx, 0xfc82
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x18], eax
jmp 0x4031e7
cmp byte [ebp - 1], 0x5b
jne 0x4030fb
movzx eax, byte [ebp - 1]
or ax, 0x24b
push eax
movzx eax, byte [ebp - 1]
movzx ecx, word [ebp - 8]
xor edx, edx
div ecx
and eax, 0x81
push eax
call edi
jmp 0x4031e7
cmp byte [ebp - 1], 0xa
jb 0x403439
cmp byte [ebp - 1], 0x22
ja 0x4031e7
movzx eax, word [ebp - 8]
add eax, 0x323
jmp 0x403148
cmp byte [ebp - 1], 0x63
je 0x4032fd
cmp byte [ebp - 1], 0x20
jae 0x40313a
movzx eax, word [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x4031e7
cmp byte [ebp - 1], 5
jne 0x403150
mov eax, dword [ebp - 8]
and eax, 0x1fa
mov dword [ebp - 0x10], eax
jmp 0x4031e7
cmp byte [ebp - 1], 0x25
je 0x4032fd
cmp byte [ebp - 1], 2
ja 0x4031e7
movzx ecx, byte [ebp - 1]
mov eax, 0x172
xor edx, edx
div ecx
xor edx, edx
mov ecx, eax
mov eax, 0x1e4
div dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x10], ecx
jmp 0x4031e7
cmp word [ebp - 8], 0x5a
jae 0x40319b
movzx ecx, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
xor edx, edx
div ecx
sub eax, 0x3d
jmp 0x403148
cmp word [ebp - 8], 0x4d
jne 0x4031b0
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x30f
mov byte [ebp - 1], al
jmp 0x4031e7
cmp word [ebp - 8], 0x12
jae 0x4031c3
mov eax, dword [ebp - 0xc]
or ax, 0x3d5
jmp 0x403008
cmp word [ebp - 8], 0x2a
jae 0x4031dc
movzx eax, word [ebp - 8]
xor edx, edx
mov ecx, 0x276
div ecx
mov byte [ebp - 1], dl
jmp 0x4031e7
cmp word [ebp - 8], 0x3e
jb 0x4033a7
mov eax, dword [ebp - 8]
mov ecx, 0x30e
sub ecx, eax
mov dword [ebp - 8], ecx
cmp word [ebp - 8], 0xa
jae 0x40320a
movzx eax, word [ebp - 8]
imul eax, eax, 0x313
mov dword [ebp - 0x10], eax
jmp 0x40324b
cmp word [ebp - 8], 9
je 0x403439
cmp word [ebp - 8], 0x444
jne 0x403227
mov eax, 0x44649b
mov dword [ebp - 0x14], eax
jmp 0x40324b
cmp word [ebp - 8], 0x48
ja 0x40323b
movzx eax, word [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x40324b
cmp word [ebp - 8], 6
jae 0x40324b
mov eax, dword [ebp - 0xc]
or ah, 1
mov dword [ebp - 0xc], eax
cmp word [ebp - 8], 0x24
jne 0x40326a
movzx eax, byte [ebp - 1]
xor edx, edx
mov ecx, 0x2c6
div ecx
sub edx, 0x168
jmp 0x403356
cmp word [ebp - 8], 0x444
jne 0x403381
mov eax, 0xfcdb
cmp dword [ebp - 0xc], eax
jne 0x403391
cmp dword [ebp - 0xc], 0x29
ja 0x40329f
movzx eax, byte [ebp - 1]
xor eax, 0x280
or ax, 0x139
push eax
call esi
jmp 0x403391
cmp dword [ebp - 0xc], 0x4e
jae 0x4032be
mov cl, byte [ebp - 8]
mov eax, 0x2fd
or ecx, eax
mov edx, dword [ebp - 0xc]
or edx, eax
and ecx, edx
mov byte [ebp - 1], cl
jmp 0x403391
cmp dword [ebp - 0xc], 0x31
jae 0x4032ee
movzx eax, word [ebp - 8]
push eax
movzx eax, byte [ebp - 1]
push eax
movzx eax, byte [ebp - 1]
push eax
push dword [ebp - 0xc]
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 0xc]
xor eax, 0xeb
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
jmp 0x403391
cmp dword [ebp - 0xc], eax
jne 0x403391
cmp dword [ebp - 0xc], 0x5c
jae 0x403305
mov al, byte [ebp - 0xc]
jmp 0x40343c
cmp dword [ebp - 0xc], 0x28
je 0x4033a7
cmp dword [ebp - 0xc], 0x2f
ja 0x403327
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
or eax, ecx
or ax, 0x2a3
mov dword [ebp - 8], eax
jmp 0x403391
cmp dword [ebp - 0xc], 0x5f
jae 0x40333a
mov eax, dword [ebp - 0xc]
xor eax, 0x360
mov dword [ebp - 0x10], eax
jmp 0x403391
cmp dword [ebp - 0xc], 9
jne 0x40335b
movzx ecx, byte [ebp - 1]
mov eax, 0x209
xor edx, edx
div ecx
xor edx, edx
mov ecx, 0x2e1
div ecx
mov byte [ebp - 1], dl
jmp 0x403391
cmp dword [ebp - 0xc], eax
jne 0x403391
movzx ecx, byte [ebp - 1]
mov eax, 0x369
xor edx, edx
div ecx
mov eax, dword [ebp - 0xc]
sub edx, eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx + 0x10ccb]
mov dword [ebp - 0x14], eax
jmp 0x403391
cmp word [ebp - 8], 2
jne 0x403391
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x6d
mov dword [ebp - 0xc], eax
movzx ecx, byte [ebp - 1]
mov eax, 0x16d
xor edx, edx
div ecx
mov dword [ebp - 0x10], edx
cmp byte [ebp - 1], 0xa
jae 0x4033af
mov al, byte [ebp - 1]
jmp 0x40343c
cmp byte [ebp - 1], 0x5e
ja 0x4033d6
movzx eax, byte [ebp - 1]
push eax
movzx ecx, word [ebp - 8]
mov eax, 0x8d
xor edx, edx
div ecx
movzx ecx, word [ebp - 8]
mov eax, edx
xor edx, edx
div ecx
push eax
call edi
jmp 0x4033e8
cmp byte [ebp - 1], 0x4f
je 0x403439
cmp byte [ebp - 1], 0xcd
jne 0x4033e8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
movzx ecx, word [ebp - 8]
mov eax, 0x203
xor edx, edx
div ecx
mov eax, dword [ebp - 8]
xor edx, eax
mov dword [ebp - 8], edx
cmp dword [ebp - 0x10], 0xa0
jne 0x403410
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x403439
cmp dword [ebp - 0x10], 0x47
ja 0x403421
mov eax, dword [ebp - 0xc]
and eax, 0x52
mov dword [ebp - 0xc], eax
jmp 0x403439
cmp dword [ebp - 0x10], 0x1d
jne 0x403439
movzx eax, word [ebp - 8]
lea eax, [eax + eax*2]
shl eax, 6
add eax, 0x350
mov dword [ebp - 0x10], eax
mov al, byte [ebp - 8]
pop edi
pop esi
leave
ret