Function at 0x40fda8
Capabilities:
Check os version
Get common file path
Get disk information
Get disk size
Get memory capacity
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xcc
push 0
push 0
dec ecx
jne 0x40fdb0
push ebx
push esi
push edi
mov edi, 0x41ab78
mov ebx, dword [0x4192d4]
xor eax, eax
push ebp
push 0x411297
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41ab68
mov edx, 0x4112b0
call fcn.0040325c
mov eax, edi
mov edx, 0x4112f0
call fcn.0040325c
mov dword [ebp - 0xdc], 0x94
lea eax, [ebp - 0xdc]
push eax
call sub.kernel32.dll_GetVersionExA
mov esi, dword [ebp - 0xcc]
cmp esi, 2
jne 0x40fe1e
lea eax, [ebp - 8]
mov edx, 0x4112fc
call fcn.004032a0
jmp 0x40fe42
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5b4]
call fcn.00404900
mov ecx, dword [ebp - 0x5b4]
lea eax, [ebp - 8]
mov edx, 0x411308
call fcn.004033d8
cmp byte [0x41aba8], 0
je 0x40fe5a
lea eax, [ebp - 4]
mov edx, 0x411318
call fcn.004032a0
jmp 0x40fe67
lea eax, [ebp - 4]
mov edx, 0x411328
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x411338
call fcn.0040325c
mov eax, dword [ebp - 0xd8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5b8]
call fcn.00404900
push dword [ebp - 0x5b8]
push 0x4113d8
mov eax, dword [ebp - 0xd4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5bc]
call fcn.00404900
push dword [ebp - 0x5bc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040344c
mov eax, dword [ebp - 0xc]
mov edx, 0x4113e4
call fcn.004034d8
jne 0x40feda
lea eax, [ebp - 4]
mov edx, 0x4113f0
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x411400
call fcn.0040325c
lea eax, [ebp - 0x18]
lea edx, [ebp - 0xc8]
mov ecx, 0x80
call fcn.00403374
mov eax, 0x41ab68
mov edx, 0x4114a4
call fcn.0040325c
lea eax, [ebp - 0x5c0]
mov ecx, 0x411554
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5c0]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x40ff43
lea eax, [ebp - 0x18]
mov edx, 0x411560
call fcn.004032a0
jmp 0x410060
lea eax, [ebp - 0x5c4]
mov ecx, 0x41156c
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5c4]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x40ff7b
lea eax, [ebp - 0x18]
mov edx, 0x411578
call fcn.004032a0
jmp 0x410060
lea eax, [ebp - 0x5c8]
mov ecx, 0x411584
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5c8]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x40ffb3
lea eax, [ebp - 0x18]
mov edx, 0x411590
call fcn.004032a0
jmp 0x410060
lea eax, [ebp - 0x5cc]
mov ecx, 0x41159c
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x40ffe8
lea eax, [ebp - 0x18]
mov edx, 0x4115a8
call fcn.004032a0
jmp 0x410060
lea eax, [ebp - 0x5d0]
mov ecx, 0x4115b4
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5d0]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x41001d
lea eax, [ebp - 0x18]
mov edx, 0x4115c0
call fcn.004032a0
jmp 0x410060
lea eax, [ebp - 0x5d4]
mov ecx, 0x4115cc
mov edx, dword [0x41ad90]
call fcn.004033d8
mov edx, dword [ebp - 0x5d4]
mov eax, dword [ebp - 0x18]
call fcn.004034d8
jne 0x410052
lea eax, [ebp - 0x18]
mov edx, 0x4115d8
call fcn.004032a0
jmp 0x410060
lea eax, [ebp - 0x18]
mov edx, dword [0x41ad90]
call fcn.004032a0
mov eax, dword [ebp - 0xd0]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5d8]
call fcn.00404900
mov ecx, dword [ebp - 0x5d8]
lea eax, [ebp - 0x10]
mov edx, 0x4115e4
call fcn.004033d8
push dword [ebp - 4]
push 0x4115f4
push dword [ebp - 0xc]
push 0x411600
push dword [ebp - 0x18]
push 0x411600
push dword [ebp - 0x10]
push 0x411600
lea eax, [ebp - 0x14]
mov edx, 8
call fcn.0040344c
push dword [edi]
push dword [ebp - 8]
push 0x4112f0
push dword [ebp - 4]
push 0x4115f4
push dword [ebp - 0xc]
push 0x4112f0
push dword [ebp - 0x10]
push 0x4112f0
push dword [ebp - 0x18]
push 0x4112f0
push 0x41160c
push dword [0x41ab34]
push 0x4112f0
mov eax, edi
mov edx, 0xe
call fcn.0040344c
push 0xfa
lea eax, [ebp - 0x56f]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x41ab68
mov edx, 0x411620
call fcn.0040325c
push dword [edi]
push 0x411638
lea eax, [ebp - 0x5dc]
lea edx, [ebp - 0x56f]
mov ecx, 0xfb
call fcn.00403374
push dword [ebp - 0x5dc]
push 0x4112f0
mov eax, edi
mov edx, 4
call fcn.0040344c
push ebx
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x41164c
mov edx, 0x411660
mov eax, 0x80000001
call fcn.00405e40
push dword [edi]
push 0x411684
push dword [ebp - 4]
push 0x4112f0
mov eax, edi
mov edx, 4
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x411698
call fcn.0040325c
push dword [ebp - 0x14]
push dword [ebp - 4]
push 0x411600
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040344c
push dword [edi]
push 0x4116d0
push dword [0x41ab30]
push 0x4112f0
mov eax, edi
mov edx, 4
call fcn.0040344c
push dword [ebp - 0x14]
push 0x4116e4
push dword [0x41ab30]
push 0x411600
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040344c
mov dword [ebp - 0x44], 0x32
mov eax, 0x41ab68
mov edx, 0x4112b0
call fcn.0040325c
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x56f]
push eax
call sub.advapi32.dll_GetUserNameA
push dword [edi]
push 0x4116f0
lea eax, [ebp - 0x5e0]
lea edx, [ebp - 0x56f]
mov ecx, 0xfb
call fcn.00403374
push dword [ebp - 0x5e0]
push 0x4112f0
mov eax, edi
mov edx, 4
call fcn.0040344c
mov eax, 0x41ab68
mov edx, fcn.00411700
call fcn.0040325c
push dword [ebp - 0x14]
push 0x411774
lea eax, [ebp - 0x5e4]
lea edx, [ebp - 0x56f]
mov ecx, 0xfb
call fcn.00403374
push dword [ebp - 0x5e4]
push 0x411600
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040344c
lea eax, [ebp - 4]
mov edx, 0x411784
call fcn.004032a0
lea eax, [ebp - 8]
mov ecx, 0x4117a8
mov edx, dword [ebp - 4]
call fcn.004033d8
push ebx
mov ecx, 0x4117c4
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.00405d8c
lea edx, [ebp - 0xc]
call fcn.004048e0
mov eax, dword [ebp - 0xc]
call fcn.0040338c
cmp eax, 3
jge 0x4102ec
push 0
push 0x100000
call fcn.00405530
call fcn.00403aa0
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00404900
mov eax, 0x41ab68
mov edx, 0x4117d4
call fcn.0040325c
push dword [ebp - 0x14]
push 0x411834
push dword [ebp - 0xc]
push 0x411600
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040344c
push dword [edi]
push 0x411844
push 0x411850
push dword [ebp - 0xc]
push 0x411860
push 0x4112f0
push 0x411870
push ebx
push 0x400
lea eax, [ebp - 0x5e8]
push eax
mov ecx, 0x411884
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5e8]
push 0x4112f0
push 0x4118a0
push ebx
push 0x400
lea eax, [ebp - 0x5ec]
push eax
mov ecx, 0x4118b8
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5ec]
push 0x4112f0
push 0x4118cc
push ebx
push 0x400
lea eax, [ebp - 0x5f0]
push eax
mov ecx, 0x4118e4
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5f0]
push 0x4112f0
push 0x411900
push ebx
push 0x400
lea eax, [ebp - 0x5f4]
push eax
mov ecx, 0x411918
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5f4]
push 0x4112f0
push 0x411934
push ebx
push 0x400
lea eax, [ebp - 0x5f8]
push eax
mov ecx, 0x411948
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5f8]
push 0x4112f0
push 0x411960
push ebx
push 0x400
lea eax, [ebp - 0x5fc]
push eax
mov ecx, 0x41197c
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x5fc]
push 0x4112f0
push 0x411998
push ebx
push 0x400
lea eax, [ebp - 0x600]
push eax
mov ecx, 0x4119b4
mov edx, dword [ebp - 4]
mov eax, 0x80000002
call fcn.00405e40
push dword [ebp - 0x600]
push 0x4112f0
mov eax, edi
mov edx, 0x1b
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x4119cc
call fcn.0040325c
lea eax, [ebp - 4]
mov edx, 0x411a54
call fcn.004032a0
xor esi, esi
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.004048e0
push ebx
push 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x604]
mov ecx, dword [ebp - 0x10]
mov edx, 0x411a64
call fcn.004033d8
mov ecx, dword [ebp - 0x604]
mov edx, 0x411a7c
mov eax, 0x80000002
call fcn.00405e40
mov eax, dword [ebp - 0xc]
call fcn.0040338c
test eax, eax
jle 0x410505
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x4112f0
mov eax, edi
mov edx, 4
call fcn.0040344c
push ebx
push 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x608]
mov ecx, dword [ebp - 0x10]
mov edx, 0x411aa4
call fcn.004033d8
mov ecx, dword [ebp - 0x608]
mov edx, 0x411ac0
mov eax, 0x80000002
call fcn.00405e40
mov eax, dword [ebp - 0xc]
call fcn.0040338c
test eax, eax
jle 0x41055c
push dword [edi]
push dword [ebp - 4]
push dword [ebp - 0xc]
push 0x4112f0
mov eax, edi
mov edx, 4
call fcn.0040344c
inc esi
cmp esi, 7
jne 0x4104a4
mov eax, 0x41ab68
mov edx, 0x411aec
call fcn.0040325c
push ebx
mov ecx, dword [0x41ad30]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405d8c
lea edx, [ebp - 0x10]
call fcn.004048e0
mov eax, 0x41ab68
mov edx, 0x411bbc
call fcn.0040325c
push dword [0x41ad30]
push 0x411c20
push dword [ebp - 0x10]
push 0x4112f0
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040344c
mov dword [ebp - 0x5b0], 0x20
lea eax, [ebp - 0x5b0]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, 0x41ab68
mov edx, 0x411c2c
call fcn.0040325c
mov eax, dword [ebp - 0x5a8]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 4]
call fcn.00404900
push dword [ebp - 0x14]
push 0x411ca8
push dword [ebp - 4]
push 0x411600
push dword [0x41ab34]
push 0x411600
lea eax, [ebp - 0x14]
mov edx, 6
call fcn.0040344c
push dword [edi]
push 0x411844
push 0x411cb8
push 0x4112f0
push 0x411cc8
push dword [ebp - 4]
push 0x411cd8
push 0x4112f0
push 0x411ce4
mov eax, dword [ebp - 0x5ac]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x60c]
call fcn.00404900
push dword [ebp - 0x60c]
push 0x411cf8
push 0x4112f0
push 0x411d04
mov eax, dword [ebp - 0x5a4]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x610]
call fcn.00404900
push dword [ebp - 0x610]
push 0x411cd8
push 0x4112f0
push 0x411844
push 0x411d18
push 0x4112f0
push 0x411d30
mov eax, dword [ebp - 0x5a0]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x614]
call fcn.00404900
push dword [ebp - 0x614]
push 0x411cd8
push 0x4112f0
push 0x411d04
mov eax, dword [ebp - 0x59c]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x618]
call fcn.00404900
push dword [ebp - 0x618]
push 0x411cd8
push 0x4112f0
push 0x411d48
mov eax, dword [ebp - 0x598]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x61c]
call fcn.00404900
push dword [ebp - 0x61c]
push 0x411cd8
push 0x4112f0
push 0x411d64
mov eax, dword [ebp - 0x594]
shr eax, 0x14
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x620]
call fcn.00404900
push dword [ebp - 0x620]
push 0x411cd8
push 0x4112f0
push 0x4112f0
push dword [0x41ad8c]
push dword [0x41ab44]
push 0x4112f0
push dword [ebp - 0x10]
mov eax, edi
mov edx, 0x28
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x411d84
call fcn.0040325c
lea eax, [ebp - 0x26c]
test dword [ebp + edi*8 + 0x6850ffff], edx
add dword [ecx], eax
add byte [eax], al
mov eax, dword [0x41929c]
mov eax, dword [eax]
call eax
mov eax, 0x41ab68
mov edx, 0x411e24
call fcn.0040325c
push 0xff
lea eax, [ebp - 0x56f]
push eax
mov eax, dword [0x4192bc]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x56f]
push eax
mov eax, dword [0x4192f4]
mov eax, dword [eax]
call eax
mov ebx, eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
mov eax, dword [0x419290]
mov eax, dword [eax]
call eax
mov edx, eax
lea eax, [ebp - 4]
call fcn.00403338
push dword [edi]
push 0x411eb0
push dword [ebp - 4]
mov eax, edi
mov edx, 3
call fcn.0040344c
push dword [ebp - 0x14]
push 0x411ec4
push dword [ebp - 4]
push 0x411600
push 0x411ed0
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040344c
mov eax, dword [0x4192ec]
mov eax, dword [eax]
call eax
mov eax, 0x41ab68
mov edx, 0x411bbc
call fcn.0040325c
push dword [edi]
push 0x4112f0
push 0x4112f0
push 0x411ee0
push 0x4112f0
mov eax, edi
mov edx, 5
call fcn.0040344c
mov bl, 0x42
lea eax, [ebp - 0x624]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x624]
lea eax, [ebp - 0x628]
call fcn.004027dc
mov edx, 0x411efc
lea eax, [ebp - 0x628]
mov cl, 2
call fcn.004027ac
lea edx, [ebp - 0x628]
lea eax, [ebp - 0x62c]
call fcn.004027dc
mov edx, 0x411f00
lea eax, [ebp - 0x62c]
mov cl, 3
call fcn.004027ac
lea edx, [ebp - 0x62c]
lea eax, [ebp - 0x1c]
call fcn.00403368
mov eax, dword [ebp - 0x1c]
call fcn.0040358c
mov esi, eax
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4108ea.0
jmp dword [eax*4 + 0x4108f1]
lea eax, [ebp - 4]
mov edx, 0x411f0c
call fcn.004032a0
lea eax, [ebp - 8]
mov edx, 0x411f1c
call fcn.004032a0
jmp 0x4109f0
lea eax, [ebp - 4]
mov edx, 0x411f28
call fcn.004032a0
lea eax, [ebp - 8]
mov edx, 0x411f40
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x411f4c
call fcn.0040325c
jmp 0x4109f0
lea eax, [ebp - 4]
mov edx, 0x412018
call fcn.004032a0
lea eax, [ebp - 8]
mov edx, 0x41202c
call fcn.004032a0
jmp 0x4109f0
lea eax, [ebp - 4]
mov edx, 0x41203c
call fcn.004032a0
lea eax, [ebp - 8]
mov edx, 0x41204c
call fcn.004032a0
mov eax, 0x41ab68
mov edx, 0x412058
call fcn.0040325c
push dword [edi]
push 0x4112f0
push 0x411844
push dword [ebp - 0x1c]
push dword [ebp - 4]
push 0x4112f0
mov eax, edi
mov edx, 6
call fcn.0040344c
lea eax, [ebp - 4]
call fcn.00403208
jmp 0x4109f0
lea eax, [ebp - 4]
mov edx, 0x4120b4
call fcn.004032a0
lea eax, [ebp - 8]
mov edx, 0x4120c8
call fcn.004032a0
jmp 0x4109f0
lea eax, [ebp - 4]
call fcn.00403208
mov eax, dword [ebp - 4]
call fcn.0040338c
dec eax
jl 0x410c38
mov eax, 0x41ab68
mov edx, 0x4120d8
call fcn.0040325c
push dword [ebp - 0x14]
lea eax, [ebp - 0x630]
mov edx, ebx
call fcn.00403328
push dword [ebp - 0x630]
push 0x411c20
push dword [ebp - 8]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040344c
push dword [edi]
push 0x411844
push dword [ebp - 0x1c]
push 0x4112f0
push 0x412114
push dword [ebp - 4]
push 0x4112f0
mov eax, edi
mov edx, 7
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x412124
call fcn.0040325c
push 0x64
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x104
lea eax, [ebp - 0x370]
push eax
push esi
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x410b5f
push dword [edi]
push 0x4121d8
lea eax, [ebp - 0x634]
lea edx, [ebp - 0x370]
mov ecx, 0x104
call fcn.00403374
push dword [ebp - 0x634]
push 0x4112f0
push 0x4121e8
lea eax, [ebp - 0x638]
lea edx, [ebp - 0x474]
mov ecx, 0x104
call fcn.00403374
push dword [ebp - 0x638]
push 0x4112f0
push 0x412200
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x63c]
call fcn.00404900
push dword [ebp - 0x63c]
push 0x4112f0
push 0x41221c
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x640]
call fcn.00404900
push dword [ebp - 0x640]
push 0x4112f0
push 0x412240
mov eax, dword [ebp - 0x28]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x644]
call fcn.00404900
push dword [ebp - 0x644]
push 0x4112f0
mov eax, edi
mov edx, 0x10
call fcn.0040344c
mov eax, 0x41ab68
mov edx, 0x412250
call fcn.0040325c
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
call sub.kernel32.dll_GetDiskFreeSpaceExA
test eax, eax
je 0x410c38
push dword [edi]
push 0x4122cc
push 0
push 0x100000
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
call fcn.00403aa0
push edx
push eax
lea eax, [ebp - 0x648]
call fcn.00404900
push dword [ebp - 0x648]
push 0x411cd8
push 0x4112f0
push 0x4122dc