Function at 0x658df0
Capabilities:
Get common file path
Get disk information
Get hostname
Get memory capacity
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x76c
push ebx
push esi
xor esi, esi
cmp ecx, esi
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
je 0x659606
cmp edx, 0x10
jl 0x659606
mov eax, dword [0x7eb2b8]
mov ebx, 1
cmp eax, ebx
jne 0x658e8d
cmp dword [ebp + 8], ebx
jne 0x658e61
mov eax, dword [0x7eb2a4]
mov dword [ecx], eax
mov edx, dword [0x7eb2a8]
mov dword [ecx + 4], edx
mov eax, dword [0x7eb2ac]
mov dword [ecx + 8], eax
mov edx, dword [0x7eb2b0]
mov dword [ecx + 0xc], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x7eb290]
mov dword [ecx], eax
mov edx, dword [0x7eb294]
mov dword [ecx + 4], edx
mov eax, dword [0x7eb298]
mov dword [ecx + 8], eax
mov edx, dword [0x7eb29c]
mov dword [ecx + 0xc], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, 0x22
lea edi, [esp + 0xd0]
rep stosd dword es:[edi], eax
mov ecx, 0x7d
lea edi, [esp + 0x3a8]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x2a0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x5a0]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x198]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
stosw word es:[edi], ax
mov dword [esp + 0x5c], ecx
xor edx, edx
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], edx
mov dword [esp + 0x90], edx
mov byte [esp + 0x10], al
mov dword [esp + 0x94], edx
mov ecx, 0x10
lea edi, [esp + 0x158]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0xa8], eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x98], edx
mov dword [esp + 0xac], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x9c], edx
mov dword [esp + 0xb0], eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0xa0], edx
mov dword [esp + 0xb4], eax
mov dword [esp + 0x70], ecx
mov dword [esp + 0xa4], edx
mov dword [esp + 0xb8], eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0xc0], eax
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0x84], ecx
mov byte [esp + 0x38], dl
mov edx, 0x64
lea ecx, [esp + 0x710]
mov dword [esp + 0x158], 0x40
mov dword [esp + 0xcc], eax
mov dword [esp + 0x14], 0x11
call fcn.00659fa0
mov edx, 0x64
lea ecx, [esp + 0x6a8]
call fcn.0065b0f0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [ebp + 0xc]
and eax, 0xffff
cmp ecx, ebx
jne 0x65902f
mov dword [esp + 0xe8], eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x54]
mov dx, word [esp + 0x5c]
mov ax, word [esp + 0x5e]
mov dword [esp + 0xec], ecx
mov word [esp + 0xf0], dx
mov edx, 0x28
lea ecx, [esp + 0xf8]
mov word [esp + 0xf2], ax
call fcn.00657940
lea ecx, [esp + 0x710]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x6590c0
lea edx, [esp + 0x6a8]
push edx
push edi
call ebx
cmp eax, esi
je 0x6590c0
lea ecx, [esp + 0x158]
push ecx
call eax
test eax, eax
je 0x6590c0
mov eax, dword [esp + 0x160]
mov edx, dword [esp + 0x164]
shrd eax, edx, 0x14
shr edx, 0x14
cmp eax, esi
jne 0x6590d8
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x90]
shr eax, 0x14
cmp eax, 0x40
ja 0x6590e7
mov eax, 0x40
jmp 0x6591ed
cmp eax, 0x60
ja 0x6590f6
mov eax, 0x60
jmp 0x6591ed
cmp eax, 0x80
ja 0x659107
mov eax, 0x80
jmp 0x6591ed
cmp eax, 0xc0
ja 0x659118
mov eax, 0xc0
jmp 0x6591ed
cmp eax, 0x100
ja 0x659129
mov eax, 0x100
jmp 0x6591ed
cmp eax, 0x180
ja 0x65913a
mov eax, 0x180
jmp 0x6591ed
cmp eax, 0x200
ja 0x65914b
mov eax, 0x200
jmp 0x6591ed
cmp eax, 0x300
ja 0x65915c
mov eax, 0x300
jmp 0x6591ed
cmp eax, 0x400
ja 0x65916d
mov eax, 0x400
jmp 0x6591ed
cmp eax, 0x600
ja 0x65917b
mov eax, 0x600
jmp 0x6591ed
cmp eax, 0x800
ja 0x659189
mov eax, 0x800
jmp 0x6591ed
cmp eax, 0xc00
ja 0x659197
mov eax, 0xc00
jmp 0x6591ed
cmp eax, 0x1000
ja 0x6591a5
mov eax, 0x1000
jmp 0x6591ed
cmp eax, 0x1800
ja 0x6591b3
mov eax, 0x1800
jmp 0x6591ed
cmp eax, 0x2000
ja 0x6591c1
mov eax, 0x2000
jmp 0x6591ed
cmp eax, 0x3000
ja 0x6591cf
mov eax, 0x3000
jmp 0x6591ed
cmp eax, 0x4000
ja 0x6591dd
mov eax, 0x4000
jmp 0x6591ed
mov ecx, 0x6000
cmp ecx, eax
sbb eax, eax
and eax, 0x2000
add eax, ecx
cmp dword [ebp + 0xc], 1
jne 0x6591fa
mov dword [esp + 0xf4], eax
cmp edi, esi
je 0x65921b
push str.GetSystemWindowsDirectoryA
push edi
call ebx
cmp eax, esi
je 0x65921b
push 0x106
lea edx, [esp + 0x2a4]
push edx
call eax
jmp 0x65922e
push 0x106
lea eax, [esp + 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0xd0]
lea ecx, [esp + 0x2a0]
call fcn.00657c20
push 0x106
lea ecx, [esp + 0x5a4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xd8]
lea ecx, [esp + 0x5a0]
call fcn.00657c20
movsx edx, byte [esp + 0x5a0]
push edx
call fcn.006978c9
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add esp, 4
test eax, eax
je 0x659295
cmp byte [esp + 0x5a1], 0x3a
jne 0x659295
mov al, byte [esp + 0x5a0]
jmp 0x6592bb
movsx eax, byte [esp + 0x2a0]
push eax
call fcn.006978c9
add esp, 4
test eax, eax
je 0x659311
cmp byte [esp + 0x2a1], 0x3a
jne 0x659311
mov al, byte [esp + 0x2a0]
cmp al, 0x3f
je 0x659311
movsx ecx, al
push ecx
call fcn.00696d10
mov bl, al
add esp, 4
mov edx, 0x103
lea ecx, [esp + 0x19b]
mov byte [esp + 0x198], bl
mov byte [esp + 0x199], 0x3a
mov byte [esp + 0x19a], 0x5c
call fcn.0064b850
lea edx, [esp + 0xe0]
lea ecx, [esp + 0x198]
call fcn.00657c20
test eax, eax
jne 0x659311
cmp bl, 0x3f
jne 0x659384
mov bl, 0x43
jmp 0x659320
lea edx, [esp + 0x198]
push edx
mov byte [esp + 0x19c], bl
mov byte [esp + 0x19d], 0x3a
mov byte [esp + 0x19e], 0x5c
mov byte [esp + 0x19f], 0
call edi
cmp eax, 3
jne 0x659376
mov edx, 0x103
lea ecx, [esp + 0x19b]
call fcn.0064b850
lea edx, [esp + 0xe0]
lea ecx, [esp + 0x198]
call fcn.00657c20
test eax, eax
je 0x65937d
inc bl
cmp bl, 0x47
jle 0x659320
cmp bl, 0x3f
jne 0x659384
mov bl, 0x43
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x5c
mov byte [esp + 0x13], 0
call edi
cmp eax, 3
jne 0x6593d9
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x28
lea edx, [esp + 0xac]
push edx
mov edx, 4
lea ecx, [esp + 0x24]
call fcn.0065ecb0
call fcn.00655400
test eax, eax
lea ecx, [esp + 0x60]
mov edx, 0x28
je 0x6593f2
call fcn.006576d0
jmp 0x6593f7
call fcn.006563b0
lea eax, [esp + 0x3a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [esp + 0x454], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov edx, 0x28
lea ecx, [esp + 0x45c]
mov dword [esp + 0x458], eax
call fcn.00658c40
mov edx, 0x28
lea ecx, [esp + 0x484]
call fcn.00657dd0
call fcn.00655400
cmp eax, 1
jne 0x65945d
mov edx, 0x28
lea ecx, [esp + 0x4ac]
call fcn.00657ff0
mov edx, 0x28
lea ecx, [esp + 0x4d4]
call fcn.006580e0
call fcn.00655400
cmp eax, 1
jne 0x6594ab
mov edx, 0x28
lea ecx, [esp + 0x4fc]
call fcn.00658340
mov edx, 0x28
lea ecx, [esp + 0x524]
call fcn.00658430
mov edx, 0x28
lea ecx, [esp + 0x54c]
call fcn.00658540
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x6594d6
mov edx, dword [esp + 0x14]
push 0x28
lea eax, [esp + 0x578]
push eax
lea ecx, [esp + 0x30]
call fcn.00657cb0
cmp dword [ebp + 0xc], 1
jne 0x6594f7
push 0x10
lea ecx, [esp + 0x14c]
push ecx
mov edx, 0x1f4
lea ecx, [esp + 0x3b0]
call fcn.0064b7e0
mov ecx, 0xa
lea esi, [esp + 0xa8]
lea edi, [esp + 0x120]
push 0x12
rep movsd dword es:[edi], dword [esi]
push 0x7eb290
mov edx, 0x88
lea ecx, [esp + 0xd8]
call fcn.0064b7e0
xor ecx, ecx
mov dword [esp + 0xe0], ecx
xor edx, edx
mov dword [esp + 0xd0], edx
xor eax, eax
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xd8], eax
mov dword [esp + 0xd4], edx
mov dword [esp + 0xdc], eax
mov ecx, 0xa
lea esi, [esp + 0x60]
lea edi, [esp + 0x120]
push 0x12
rep movsd dword es:[edi], dword [esi]
push 0x7eb2a4
mov edx, 0x88
lea ecx, [esp + 0xd8]
call fcn.0064b7e0
xor edx, edx
mov ecx, 0x7eb290
call fcn.00655ed0
mov esi, 1
mov edx, esi
mov ecx, 0x7eb2a4
call fcn.00655ed0
cmp dword [ebp + 8], esi
mov eax, dword [esp + 0x18]
mov dword [0x7eb2b8], esi
jne 0x6595d8
mov edx, dword [0x7eb2a4]
mov dword [eax], edx
mov ecx, dword [0x7eb2a8]
mov dword [eax + 4], ecx
mov edx, dword [0x7eb2ac]
mov dword [eax + 8], edx
mov ecx, dword [0x7eb2b0]
mov dword [eax + 0xc], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [0x7eb290]
mov dword [eax], edx
mov ecx, dword [0x7eb294]
mov dword [eax + 4], ecx
mov edx, dword [0x7eb298]
mov dword [eax + 8], edx
mov ecx, dword [0x7eb29c]
mov dword [eax + 0xc], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 0x325
pop ebx
mov esp, ebp
pop ebp
ret 8