Function at 0x407114
Capabilities:
Get common file path
Get cpu information
Get disk information
Get disk size
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [esi], 0
je 0x406dce
push 4
push 0x3000
push 0x202
push 0
call edi
lea ecx, [ebp - 0x18]
mov dword [esi + 8], eax
push ecx
push eax
mov dword [ebp - 0x18], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [esi + 0xc], 0
je 0x406df6
push 4
push 0x3000
push 0x20
push 0
mov dword [ebp - 0x18], 0x1e
call edi
lea ecx, [ebp - 0x18]
mov dword [esi + 0x14], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp dword [esi + 0x18], 0
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
je 0x406e56
push 4
push 0x3000
push 0x80
push 0
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x406e56
push ecx
push 0x80
push eax
push str.Domain
push str.SYSTEMCurrentControlSet_servicesTcpipParameters
push 0x80000002
call fcn.00406d10
test eax, eax
je 0x406e49
mov eax, dword [esi + 0x20]
cmp word [eax], 0
jne 0x406e56
push str.WORKGROUP
push eax
jmp 0x406e51
push str.undefined
push dword [esi + 0x20]
call ebx
add esp, 8
cmp dword [esi + 0x30], 0
je 0x406ef5
push 4
push 0x3000
push 0x80
push 0
call edi
mov dword [ebp - 0x14], eax
mov dword [esi + 0x38], eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.Control_PanelInternational
push 0x80000001
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406ede
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x40
push eax
push dword [ebp - 0x14]
push 0
push 0
push str.LocaleName
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406ec9
mov dword [ebp - 8], 1
jmp 0x406ecf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x406ef5
push 0x8000
push 0
push dword [esi + 0x38]
mov dword [esi + 0x30], 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [esi + 0x3c], 0
je 0x407024
push 4
push 0x3000
push 0x8a
push 0
call edi
push 4
push 0x3000
mov dword [ebp - 0xc], eax
add eax, 0xe
push 4
push 0
mov dword [ebp - 0x18], eax
call edi
mov dword [esi + 0x44], eax
mov edi, 1
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
jmp 0x406f40
push edi
push 0x4104f4
push dword [ebp - 0xc]
call ebx
add esp, 0xc
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
inc edi
push eax
push 0x20019
push 0
push str.Keyboard_LayoutPreload
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406fe3
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x80
push eax
push dword [ebp - 0x18]
push 0
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406fa0
mov dword [ebp - 0x14], 1
jmp 0x406fa6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
je 0x406fe3
push str.00000419
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x406fea
push 0x410540
push dword [esi + 0x44]
call ebx
add esp, 8
mov ecx, 1
xor eax, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
jmp 0x406ff0
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x406fed
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp edi, 9
je 0x406ffd
test eax, eax
jne 0x406f40
test ecx, ecx
jne 0x40700e
push 0x410544
push dword [esi + 0x44]
call ebx
add esp, 8
push 0x8000
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [esi + 0x48], 0
je 0x4070d6
push 4
push 0x3000
push 0x82
push 0
call edi
mov dword [ebp - 0x10], eax
mov dword [esi + 0x50], eax
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4070ac
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x80
push eax
push dword [ebp - 0x10]
push 0
push 0
push 0x410548
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407097
mov dword [ebp - 0x14], 1
jmp 0x40709d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jne 0x4070d6
push ecx
push 0x80
push dword [esi + 0x50]
push 0x410548
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersion
push 0x80000002
call fcn.00406d10
push str.error
push dword [esi + 0x50]
call ebx
add esp, 8
cmp dword [esi + 0x54], 0
je 0x407134
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 4
push 0x3000
push 0x40
push 0
call edi
movzx ecx, word [ebp - 0x48]
mov dword [esi + 0x5c], eax
cmp ecx, 9
ja case.0x407106.1
movzx ecx, byte [ecx + 0x407510]
jmp dword [ecx*4 + 0x4074fc]
push 0x410640
jmp 0x40712e
push 0x410648
jmp 0x40712e
push str.Itanium
jmp 0x40712e
push 0x410660
jmp 0x40712e
push str.Unknown
push eax
call ebx
add esp, 8
cmp dword [esi + 0x24], 0
je 0x407155
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [esi + 0x2c]
push eax
call fcn.00407520
test eax, eax
jne 0x407155
mov dword [esi + 0x24], eax
cmp dword [esi + 0x60], 0
je 0x4072e9
push 4
push 0x3000
push 0x400
push 0
call edi
push 4
push 0x3000
push 0xe0c
push 0
mov dword [esi + 0x68], eax
call edi
push 0x100
push eax
mov dword [ebp - 0xc], eax
lea ecx, [eax + 0x60c]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [ebp - 0xc]
xor eax, eax
push 0x100
mov word [ecx + 6], ax
lea edx, [ecx + 0x600]
lea eax, [ecx + 0x400]
mov dword [ebp - 0x10], edx
push eax
lea eax, [ecx + 0x604]
push eax
lea eax, [ecx + 0x608]
push eax
push edx
push 0x100
lea eax, [ecx + 0x200]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40726d
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
push ecx
push 0
push 0
push str.ProcessorNameString
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40722e
mov dword [ebp - 0x14], 1
jmp 0x407234
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
je 0x40726d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 4]
push ecx
push 0x80
lea eax, [ecx + eax*2]
push eax
push str.Identifier
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call fcn.00406d10
mov eax, dword [ebp - 0x10]
push dword [eax]
push 0x4104f4
push dword [esi + 0x68]
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push dword [ebp - 4]
push dword [esi + 0x68]
call ebx
push str.RtlComputeCrc32
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4072c7
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [esi + 0x68]
push 0x29a
call dword [ebp - 0x1c]
mov dword [esi + 0x6c], eax
jmp 0x4072ce
mov dword [esi + 0x6c], 0
mov eax, dword [ebp - 0x10]
push 0x8000
push 0
mov eax, dword [eax]
mov dword [esi + 0x70], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4072ef
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [esi + 0x74], 0
je 0x4074a0
push 4
push 0x3000
push 0x400
push 0
mov dword [ebp - 0x40], str.UNKNOWN
mov dword [ebp - 0x3c], str.NO_ROOT_DIR
mov dword [ebp - 0x38], str.REMOVABLE
mov dword [ebp - 0x34], str.FIXED
mov dword [ebp - 0x30], str.REMOTE
mov dword [ebp - 0x2c], str.CDROM
mov dword [ebp - 0x28], str.RAMDISK
call edi
mov dword [esi + 0x7c], eax
lea ecx, [ebp - 0x80]
mov eax, 0x41
mov word [ecx], ax
lea ecx, [ecx + 2]
inc eax
cmp ax, 0x5a
jbe 0x407345
mov eax, dword [0x40e304]
mov dword [ebp - 0x24], eax
mov eax, dword [0x40e308]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x407370
mov ax, word [ebp + eax*2 - 0x80]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov edi, eax
cmp edi, 2
jbe 0x40747b
cmp edi, 5
je 0x40747b
xor eax, eax
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x7c]
call ebx
push dword [ebp + edi*4 - 0x40]
mov eax, 0x5c
push dword [esi + 0x7c]
mov word [ebp - 0x20], ax
call ebx
push 0x4107b0
push dword [esi + 0x7c]
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x407471
mov edi, dword [ebp - 0x1c]
imul edi, dword [ebp - 0x14]
push 0
push edi
push 0
push dword [ebp - 0x10]
call fcn.00408470
push 0
push edi
push 0
push dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ebx, edx
call fcn.00408470
mov edi, dword [ebp - 8]
mov ecx, edi
push dword [esi + 0x7c]
sub ecx, eax
mov eax, ebx
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi + 0x7c]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push edi
lea eax, [ecx + eax*2]
push 0x4107b4
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x10
push dword [esi + 0x7c]
call edi
push dword [ebp - 8]
mov ecx, dword [esi + 0x7c]
push dword [ebp - 4]
push str._I64u
lea eax, [ecx + eax*2]
push eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0x10
push 0x4107d0
push dword [esi + 0x7c]
call ebx
jmp 0x407481
push 0x4107d4
push dword [esi + 0x7c]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x1b
jb 0x407370
push dword [esi + 0x7c]
call edi
mov ecx, dword [esi + 0x7c]
xor edx, edx
mov word [ecx + eax*2 - 2], dx
cmp dword [esi + 0x80], 0
je 0x4074ee
push 4
push 0x3000
push 0x81
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x84], eax
test eax, eax
je 0x4074e4
push ecx
push eax
call fcn.004068f0
test eax, eax
jne 0x4074ee
push 0x8000
push eax
push dword [esi + 0x84]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0x80], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret