Function at 0x40d19c
Capabilities:
Check os version
Create directory
Delete registry key
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0x40d1a4
push ebx
push esi
push edi
mov esi, 0x41ab34
mov edi, 0x41ab68
mov ebx, 0x41abab
xor eax, eax
push ebp
push 0x40e6ad
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x41abac], 0x66
jne 0x40d225
mov eax, edi
mov edx, 0x40e6c4
call fcn.0040325c
mov eax, dword [0x4192d4]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, dword [0x41ace8]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405e40
mov edx, dword [ebp - 4]
mov eax, 0x41ab40
call fcn.0040325c
cmp byte [0x41aba9], 0
jne 0x40d225
push 0x2710
call sub.kernel32.dll_Sleep
mov ecx, dword [0x41ace8]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00406264
lea eax, [ebp - 8]
call fcn.00405b84
mov edx, dword [ebp - 8]
mov eax, 0x41ab30
call fcn.0040325c
lea eax, [ebp - 0xc]
call fcn.00405bf0
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0040325c
mov eax, edi
mov edx, 0x40e718
call fcn.0040325c
mov eax, 0x41ab38
mov ecx, 0x40e788
mov edx, dword [esi]
call fcn.004033d8
mov eax, edi
mov edx, 0x40e798
call fcn.0040325c
mov eax, dword [0x41ab40]
call fcn.0040338c
test eax, eax
jne 0x40d2ab
mov eax, 0x41ab40
mov ecx, dword [0x41acd8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, 0x4191e8
mov ecx, dword [0x4191e8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, 0x41ab28
mov ecx, dword [0x41acd0]
mov edx, dword [0x4191e8]
call fcn.004033d8
mov eax, 0x41ab2c
mov ecx, dword [0x41acd4]
mov edx, dword [0x4191e8]
call fcn.004033d8
xor eax, eax
mov dword [0x41abb0], eax
call fcn.0040f73c
mov eax, edi
mov edx, 0x40e830
call fcn.0040325c
cmp byte [0x41aba9], 0
je 0x40d584
mov eax, dword [0x41ad94]
call fcn.00405130
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00405d60
lea eax, [ebp - 0x10]
mov ecx, dword [0x41ad50]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x10]
call fcn.00404fdc
lea eax, [ebp - 0x14]
mov ecx, dword [0x41ad54]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x14]
call fcn.00404fdc
mov eax, dword [0x41ab28]
call fcn.00404fdc
mov eax, edi
mov edx, 0x40e8ec
call fcn.0040325c
mov ecx, dword [0x41acd8]
mov edx, dword [0x41ad38]
mov eax, 0x80000002
call fcn.00406264
mov ecx, dword [0x41acd8]
mov edx, dword [0x41ad40]
mov eax, 0x80000002
call fcn.00406264
mov ecx, dword [0x41acd8]
mov edx, dword [0x41ad3c]
mov eax, 0x80000001
call fcn.00406264
mov ecx, dword [0x41acdc]
mov edx, dword [0x41ad38]
mov eax, 0x80000001
call fcn.00406264
mov ecx, dword [0x41ace0]
mov edx, dword [0x41ad3c]
mov eax, 0x80000002
call fcn.00406264
lea eax, [ebp - 0x18]
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x18]
call fcn.00404fdc
lea eax, [ebp - 0x1c]
mov ecx, dword [0x41acf0]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x1c]
call fcn.00404fdc
mov eax, edi
mov edx, 0x40e95c
call fcn.0040325c
lea eax, [ebp - 0x20]
mov ecx, dword [0x41acf4]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x20]
call fcn.00404fdc
lea eax, [ebp - 0x24]
mov ecx, dword [0x41acf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x24]
call fcn.00404fdc
lea eax, [ebp - 0x28]
mov ecx, dword [0x41acfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x28]
call fcn.00404fdc
lea eax, [ebp - 0x2c]
mov ecx, dword [0x41ad00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x2c]
call fcn.00404fdc
lea eax, [ebp - 0x30]
mov ecx, dword [0x41ad04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x30]
call fcn.00404fdc
mov eax, dword [0x41ad48]
call fcn.0040358c
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [0x41ad14]
call fcn.0040358c
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x40e9ac
call fcn.004137ec
mov eax, edi
mov edx, 0x40e9b8
call fcn.0040325c
mov eax, 0x40ea34
call fcn.004137ec
mov eax, 0x40ea40
call fcn.004137ec
mov eax, edi
mov edx, 0x40ea4c
call fcn.0040325c
mov eax, dword [0x41ab2c]
call fcn.00404fdc
mov eax, edi
mov edx, 0x40ea64
call fcn.0040325c
push 0x200040
push 0x40eaa0
push 0x40eaac
lea edx, [ebp - 0x38]
mov eax, 0x9f
call fcn.004048e0
push dword [ebp - 0x38]
push 0x40eab8
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040344c
mov eax, dword [ebp - 0x34]
call fcn.0040358c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
lea eax, [ebp - 0x3c]
mov ecx, dword [0x41ad94]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x3c]
call fcn.0040358c
push eax
push 0x40ead0
push 0
mov eax, dword [0x4192e8]
mov eax, dword [eax]
call eax
mov eax, dword [0x41ab40]
call fcn.00405034
jmp 0x40e66f
push 0
mov eax, dword [0x4191e8]
call fcn.0040358c
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x41aba8]
cmp byte [0x41aba8], 0
je 0x40d5be
call fcn.00405498
mov eax, dword [0x4192d4]
push eax
mov ecx, dword [0x41ad24]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405d8c
push eax
call fcn.00404b38
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x40e66f
lea edx, [ebp - 0x40]
mov eax, dword [0x41ab40]
call fcn.00404b68
mov edx, dword [ebp - 0x40]
mov eax, 0x41ab44
call fcn.0040325c
call fcn.00402720
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x44]
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x44]
mov cl, 1
mov eax, dword [0x41ab40]
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x48]
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x48]
call fcn.00405ce0
mov byte [ebx], al
mov eax, edi
mov edx, 0x40eae0
call fcn.0040325c
mov eax, dword [0x4192d4]
push eax
mov ecx, dword [0x41accc]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405d8c
mov dword [0x41aba0], eax
cmp dword [0x41aba0], 0x9f
jge 0x40d774
cmp byte [ebx], 0
jne 0x40d6ea
lea eax, [ebp - 0x4c]
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x41ab40]
call fcn.004034d8
je 0x40d6ea
mov eax, dword [0x41acec]
call fcn.00405130
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x50]
mov ecx, dword [0x41acec]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x41ab40]
call fcn.00404d2c
mov byte [ebx], al
cmp byte [ebx], 0
je 0x40d774
push 0x9f
mov ecx, dword [0x41accc]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00406004
mov byte [ebx], al
cmp dword [0x41aba0], 0
jle 0x40d73a
lea edx, [ebp - 0x54]
mov eax, dword [0x41aba0]
call fcn.004048e0
mov ecx, dword [ebp - 0x54]
mov eax, 0x41ab3c
mov edx, 0x40eb40
call fcn.004033d8
jmp 0x40d744
mov eax, 0x41ab3c
call fcn.00403208
push 0x40eb50
lea edx, [ebp - 0x5c]
mov eax, 0x9f
call fcn.004048e0
push dword [ebp - 0x5c]
push dword [0x41ab3c]
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.0040344c
mov eax, dword [ebp - 0x58]
call fcn.0040f91c
call fcn.0040c790
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x60]
mov ecx, dword [0x41acf0]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [0x41ab40]
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x64]
mov ecx, dword [0x41acf0]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x64]
call fcn.00405ce0
mov byte [ebx], al
mov eax, edi
mov edx, 0x40eb64
call fcn.0040325c
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x68]
mov ecx, dword [0x41acf4]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x68]
xor ecx, ecx
mov eax, dword [0x41ab40]
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x6c]
mov ecx, dword [0x41acf4]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x6c]
call fcn.00405ce0
mov byte [ebx], al
lea eax, [ebp - 0x70]
mov ecx, dword [0x41ad04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x70]
call fcn.00404dc0
test al, al
jne 0x40d8a3
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x74]
mov ecx, dword [0x41ad00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
mov ecx, dword [0x41acf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x78]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x7c]
mov ecx, dword [0x41ad04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
mov ecx, dword [0x41acfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x80]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x84]
mov ecx, dword [0x41acf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x84]
call fcn.00404dc0
test al, al
jne 0x40d955
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x88]
mov ecx, dword [0x41acf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x88]
push eax
lea eax, [ebp - 0x8c]
mov ecx, dword [0x41ad00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x90]
mov ecx, dword [0x41acfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x90]
push eax
lea eax, [ebp - 0x94]
mov ecx, dword [0x41ad04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x94]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
mov eax, dword [0x41ab40]
call fcn.00405ce0
mov byte [ebx], al
mov eax, edi
mov edx, 0x40eb9c
call fcn.0040325c
lea eax, [ebp - 0x98]
mov ecx, dword [0x41acf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x98]
call fcn.00405ce0
mov byte [ebx], al
lea eax, [ebp - 0x9c]
mov ecx, dword [0x41acfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x9c]
call fcn.00405ce0
mov byte [ebx], al
invalid
test dword [eax - 1], esp