Function at 0x47f257
Capabilities:
Get disk information
Get file size
Query environment variable

Disassembly:
push ebp
sub esp, 0xa30
lea ebp, [esp - 4]
mov eax, dword [0x665ebc]
xor eax, ebp
mov dword [ebp + 0xa30], eax
push 0x50
mov eax, 0x5e2122
call fcn.0059ca24
mov edi, dword [ebp + 0xa3c]
mov esi, ecx
lea ecx, [ebp]
mov dword [ebp - 0x10], esi
call fcn.00427139
and dword [ebp - 4], 0
lea ebx, [esi + 4]
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.004b06fc
test eax, eax
je 0x47f2d9
xor esi, esi
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0042719c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xa30]
xor ecx, ebp
call fcn.0059ca15
add ebp, 0xa34
leave
ret 8
mov ecx, esi
call fcn.0047f116
push edi
lea ecx, [ebp]
call fcn.00498be1
cmp dword [ebp + 0xa40], 0
jne 0x47f305
lea ecx, [ebp]
call fcn.004992e9
test eax, eax
je 0x47f305
push 0x605250
jmp 0x47f30a
push 0x60524c
push edi
mov ecx, ebx
call fcn.004b0baa
test eax, eax
jne 0x47f342
mov eax, dword [0x66e888]
test eax, eax
je 0x47f324
mov esi, dword [eax + 0x20]
jmp 0x47f326
xor esi, esi
push 0x74
mov ecx, 0x66ea90
call fcn.0047ddbd
push eax
push esi
call fcn.00428e29
pop ecx
pop ecx
xor esi, esi
jmp 0x47f2a6
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [esi + 0x158]
push eax
call ebx
xor edi, edi
cmp dword [ebp + 0xa40], edi
jne 0x47f374
mov ecx, dword [ebp - 0x14]
push 2
push edi
call fcn.004b070d
mov ecx, dword [ebp - 0x14]
push 0x605248
call fcn.004b07a6
push 0x3ff
lea eax, [ebp + 0x631]
push edi
push eax
mov byte [ebp + 0x630], 0
call fcn.0059cb30
add esp, 0xc
push edi
lea ecx, [ebp - 0x44]
call fcn.004bfd48
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push edi
lea ecx, [ebp - 0x44]
call fcn.004bfff5
test eax, eax
je 0x47f3ca
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x44]
call fcn.004bfe6d
mov ecx, esi
call fcn.0047f0a7
movzx eax, word [ebp - 0x24]
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, word [ebp - 0x28]
push eax
movzx eax, word [ebp - 0x2a]
push eax
movzx eax, word [ebp - 0x2e]
push eax
movzx eax, word [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x20]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x18]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push 0x6037c8
lea eax, [ebp + 0x630]
push str._s__v_u._u._u._u___04u__02u__02u___02u:_02u:_02u_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x14]
add esp, 0x34
lea eax, [ebp + 0x630]
push eax
call fcn.004b07a6
mov ecx, esi
call fcn.0047f0a7
lea ecx, [ebp + 0x438]
call fcn.004759dd
push 0x631718
lea eax, [ebp + 0x630]
push eax
call ebx
lea ecx, [ebp + 0x438]
call fcn.0047ef5a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x47f46d
push str.Win_95
jmp 0x47f577
lea ecx, [ebp + 0x438]
call fcn.0047ef44
test eax, eax
je 0x47f486
push str.Win_95_OSR2
jmp 0x47f577
lea ecx, [ebp + 0x438]
call fcn.0047ef70
test eax, eax
je 0x47f49f
push str.Win_98
jmp 0x47f577
lea ecx, [ebp + 0x438]
call fcn.0047ef2d
test eax, eax
je 0x47f4b8
push str.Win_ME
jmp 0x47f577
xor esi, esi
cmp dword [ebp + 0x448], esi
jne 0x47f4cc
push str.Win_32s
jmp 0x47f577
cmp dword [ebp + 0x448], 2
jne 0x47f500
cmp dword [ebp + 0x43c], 4
ja 0x47f4e8
push str.Win_NT
jmp 0x47f577
cmp dword [ebp + 0x43c], 5
jne 0x47f500
cmp dword [ebp + 0x440], esi
jne 0x47f500
push str.Win_2K
jmp 0x47f577
lea ecx, [ebp + 0x438]
call fcn.0047eeb8
test eax, eax
je 0x47f516
push str.Win_XP
jmp 0x47f577
lea ecx, [ebp + 0x438]
call fcn.0047eecf
test eax, eax
je 0x47f52c
push str.Win_2K3
jmp 0x47f577
cmp dword [ebp + 0x448], 2
jne 0x47f54d
cmp dword [ebp + 0x43c], 6
jne 0x47f54d
cmp dword [ebp + 0x440], esi
jne 0x47f54d
push str.Win_Vista
jmp 0x47f577
lea ecx, [ebp + 0x438]
call fcn.0047eefd
test eax, eax
je 0x47f563
push str.Window_7
jmp 0x47f577
lea ecx, [ebp + 0x438]
call fcn.0047ef14
test eax, eax
je 0x47f580
push str.Window_8
lea eax, [ebp + 0x630]
push eax
call edi
movzx eax, word [ebp + 0x444]
lea ecx, [ebp + 0x44c]
push ecx
push eax
push dword [ebp + 0x440]
lea eax, [ebp + 0x630]
push dword [ebp + 0x43c]
push str._v_u._u._u__s_n
push eax
call fcn.0059bf90
pop ecx
lea eax, [ebp + eax + 0x630]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x14]
add esp, 0x18
lea eax, [ebp + 0x630]
push eax
call fcn.004b07a6
push 0x605190
lea eax, [ebp + 0x630]
push eax
call ebx
mov dword [ebp - 0x14], 0x41
mov esi, 0x66ea90
mov ebx, 0x5f5778
mov al, byte [ebp - 0x14]
mov byte [ebp + 0x630], al
lea eax, [ebp + 0x630]
push eax
lea ecx, [ebp]
call fcn.00498be1
lea ecx, [ebp]
call fcn.0049a09c
push dword [ebp - 0x14]
mov ecx, esi
push 0x75
mov dword [ebp - 0x1c], eax
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x75c]
push str._s__C:__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x1c]
add esp, 0x10
dec eax
je 0x47f6d9
dec eax
je 0x47f6d5
dec eax
je 0x47f661
dec eax
je 0x47f65d
dec eax
je 0x47f659
dec eax
jne 0x47f708
push 0x7b
jmp 0x47f6db
push 0x7a
jmp 0x47f6db
push 0x79
jmp 0x47f6db
and dword [ebp - 0x18], 0
lea ecx, [ebp]
mov byte [ebp + 0x530], 0
mov byte [ebp + 0x4cc], 0
call fcn.00498de5
push 0x64
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x4cc]
push eax
xor eax, eax
push eax
push eax
push eax
push 0x100
lea eax, [ebp + 0x530]
push eax
lea eax, [ebp + 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push dword [ebp - 0x18]
lea eax, [ebp + 0x4cc]
push eax
push dword [ebp - 0x14]
lea eax, [ebp + 0x530]
push eax
push 0x78
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x75c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x47f6ec
push 0x77
jmp 0x47f6db
push 0x76
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x75c]
push eax
call edi
push ebx
lea eax, [ebp + 0x75c]
push eax
call edi
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x75c]
push eax
add ecx, 4
call fcn.004b07a6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x5a
jle 0x47f5ec
lea ecx, [ebp]
call fcn.00498edf
lea eax, [ebp]
push eax
push 0x7c
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x630]
push str._s____s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea eax, [ebp + 0x630]
push eax
add ecx, 4
call fcn.004b07a6
lea ecx, [ebp]
call fcn.00498ef2
lea eax, [ebp]
push eax
push 0x7d
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x630]
push str._s____s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea eax, [ebp + 0x630]
push eax
add ecx, 4
call fcn.004b07a6
lea ecx, [ebp]
call fcn.0049a0df
lea eax, [ebp]
push eax
push 0x7e
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x630]
push str._s____s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea eax, [ebp + 0x630]
push eax
add ecx, 4
call fcn.004b07a6
cmp dword [ebp + 0x448], 2
jne 0x47f834
push 0x100
lea eax, [ebp + 0x530]
push eax
push str._USERPROFILE_
mov byte [ebp + 0x530], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp + 0x530], 0
je 0x47f834
lea eax, [ebp + 0x530]
push eax
push 0x7f
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x630]
push str._s____s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea eax, [ebp + 0x630]
push eax
add ecx, 4
call fcn.004b07a6
lea ecx, [ebp]
call fcn.00498ebf
lea eax, [ebp]
push eax
push 0x80
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x630]
push str._s____s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea eax, [ebp + 0x630]
push eax
add ecx, 4
call fcn.004b07a6
lea ecx, [ebp]
call fcn.00498eaa
lea eax, [ebp + 0x530]
push eax
push 0
lea ecx, [ebp]
mov byte [ebp + 0x530], 0
call fcn.00498d2a
lea eax, [ebp + 0x530]
push eax
push 0x81
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x630]
push str._s____s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea eax, [ebp + 0x630]
push eax
add ecx, 4
call fcn.004b07a6
lea ecx, [ebp]
call fcn.00498eaa
xor ecx, ecx
push ecx
mov eax, 0x80
push eax
push 3
push ecx
push ecx
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x47f93e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push 0x82
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x630]
push str._s____lu_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea eax, [ebp + 0x630]
push eax
add ecx, 4
call fcn.004b07a6
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x5c]
call fcn.0048f7c7
push 0x55d
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5f5834
lea eax, [ebp + 0x630]
push eax
call edi
lea ecx, [ebp - 0x5c]
call fcn.0048ed38
neg eax
sbb eax, eax
add eax, 0x367
push eax
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x630]
push eax
call edi
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x630]
push eax
add ecx, 4
call fcn.004b07a6
mov ecx, dword [ebp - 0x10]
push ebx
add ecx, 4
call fcn.004b07a6
push str.Windows_x64__
lea eax, [ebp + 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
call fcn.00428ab4
neg eax
sbb eax, eax
pop ecx
add eax, 0x367
push eax
mov ecx, esi
call fcn.0047ddbd
push eax
lea eax, [ebp + 0x630]
push eax
call edi
mov edi, dword [ebp - 0x10]
lea eax, [ebp + 0x630]
add edi, 4
push eax
mov ecx, edi
call fcn.004b07a6
push ebx
mov ecx, edi
call fcn.004b07a6
push ebx
mov ecx, edi
call fcn.004b07a6
push 0x83
mov ecx, esi
call fcn.0047ddbd
mov ecx, dword [ebp - 0x10]
push eax
call fcn.0047efc3
mov ecx, edi
call fcn.004b06ee
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.0048ea4e
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.004bfff0
jmp 0x47f2a3