Function at 0x404ae0
Capabilities:
Check os version
Get cpu information
Get disk information
Get disk size
Get hostname
Get memory capacity
Get session user name
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5ac
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1bc]
mov ebp, 0x100
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
lea ecx, [esp + 0x1bc]
push eax
push ecx
mov dword [esp + 0x38], ebp
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x404b27
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x5ac
ret
mov ebx, dword [esp + 0x5c0]
mov edi, 0x41a4d4
or ecx, 0xffffffff
xor eax, eax
mov byte [ebx], 0
mov edx, dword [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + edx + 0x1bc], 0
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x2c], ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1bc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x3bc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3bc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x404bc7
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x5ac
ret
mov edx, dword [esp + 0x2c]
or ecx, 0xffffffff
mov edi, 0x41a4c8
xor eax, eax
mov byte [esp + edx + 0x3bc], 0
lea edx, [ebx + 0x20]
mov byte [edx], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3bc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea ebp, [ebx + 0x40]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41a4bc
or ecx, 0xffffffff
mov byte [ebp], al
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x25
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x68], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x404c8a
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x5ac
ret
mov eax, dword [esp + 0x78]
dec eax
je 0x404e78
dec eax
jne 0x404f33
cmp dword [esp + 0x6c], 4
ja 0x404ccd
mov edi, str.Microsoft_Windows_NT
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x6c], 5
jne 0x404d06
mov eax, dword [esp + 0x70]
test eax, eax
jne 0x404d06
mov edi, str.Microsoft_Windows_2000
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x16c]
push ecx
push edx
push 0
push 0
push str.ProductType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x16c]
push edx
push str.WINNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404d8a
mov edi, str.Professional_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x16c]
push eax
push str.LANMANNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404dc9
mov edi, str.Server_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x16c]
push eax
push str.SERVERNT
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404e08
mov edi, str.Advanced_Server_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x6c]
cmp eax, 4
ja 0x404e48
mov ecx, dword [esp + 0x74]
lea edx, [esp + 0x7c]
and ecx, 0xffff
push ecx
mov ecx, dword [esp + 0x74]
push edx
push ecx
push eax
lea edx, [esp + 0x2cc]
push str.version__d._d__s__Build__d__n
push edx
call fcn.00406523
add esp, 0x18
lea edi, [esp + 0x2bc]
jmp 0x404f0e
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x7c]
and eax, 0xffff
lea edx, [esp + 0x2bc]
push eax
push ecx
push str._s__Build__d__n
push edx
call fcn.00406523
add esp, 0x10
lea edi, [esp + 0x2bc]
jmp 0x404f0e
cmp dword [esp + 0x6c], 4
jne 0x404f33
mov eax, dword [esp + 0x70]
test eax, eax
jne 0x404ec6
mov edi, str.Microsoft_Windows_95
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x7d]
mov ecx, edx
and ecx, 3
cmp al, 0x43
rep movsb byte es:[edi], byte [esi]
je 0x404ebf
cmp al, 0x42
jne 0x404f33
mov edi, str.OSR2
jmp 0x404f0e
cmp eax, 0xa
jne 0x404f04
mov edi, str.Microsoft_Windows_98
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x7d]
mov ecx, edx
and ecx, 3
cmp al, 0x41
rep movsb byte es:[edi], byte [esi]
jne 0x404f33
mov edi, 0x41a394
jmp 0x404f0e
cmp eax, 0x5a
jne 0x404f33
mov edi, str.Microsoft_Windows_Millennium_Edition
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ebp, ebp
mov byte [ebx + 0x2c0], 0
xor esi, esi
xor edi, edi
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
test eax, eax
mov dword [esp + 0x20], eax
jne 0x404f5f
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x5ac
ret
xor ecx, ecx
mov dword [esp + 0x1c], ecx
jmp 0x404f6b
mov eax, dword [esp + 0x20]
shr eax, cl
test eax, eax
je 0x404fe7
test al, 1
je 0x404fdd
lea eax, [esp + 0x34]
add cl, 0x41
push eax
mov byte [esp + 0x38], cl
mov byte [esp + 0x39], 0x3a
mov byte [esp + 0x3a], 0x5c
mov byte [esp + 0x3b], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x404fd9
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x44]
push ecx
lea eax, [esp + 0x64]
push edx
lea ecx, [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x404f52
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
add esi, edx
mov edx, dword [esp + 0x50]
adc edi, eax
mov eax, dword [esp + 0x14]
add ebp, ecx
adc eax, edx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, 0x1a
mov dword [esp + 0x1c], ecx
jl 0x404f67
mov eax, dword [esp + 0x14]
push 0
push 0x40000000
push eax
push ebp
call fcn.00406fe0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
fild qword [esp + 0x10]
push 0
push 0x40000000
push edi
push esi
fstp qword [esp + 0x20]
call fcn.00406fe0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
fild qword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0x25
fstp qword [esp + 0x24]
fld qword [esp + 0x14]
fdiv qword [esp + 0x24]
mov eax, dword [esp + 0x28]
sub esp, 8
fmul qword [0x416440]
fstp qword [esp]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
lea eax, [ebx + 0x2c0]
push 0x41a330
push eax
call fcn.00406523
lea ebp, [ebx + 0x140]
mov edi, str.CPU:
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
mov byte [ebp], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x18], 0x50
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x28]
mov ecx, edx
push eax
push 1
and ecx, 3
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push closesocket
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x11c]
push ecx
push edx
push 0
push 0
push str.VendorIdentifier
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
lea edi, [esp + 0x11c]
mov byte [esp + ecx + 0x11c], 0
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x18], 0x50
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41a2e0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x28]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x14
lea edi, [esp + 0x11c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x11c]
push eax
push ecx
push 0
push 0
push str.Identifier
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x18]
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
mov dword [esp + 0x18], 8
mov byte [esp + eax + 0x11c], 0
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x28]
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x40]
push eax
push ecx
push 0
push 0
push str.MHz
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x40]
push eax
push str.__dMHZ
lea ecx, [esp + 0x5c]
push ecx
call fcn.00406523
lea edi, [esp + 0x60]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x28]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xfc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x108]
mov ecx, dword [esp + 0x104]
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
push 0x41a2c0
fild qword [esp + 0x14]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
fild qword [esp + 0x14]
sub esp, 8
lea edx, [esp + 0x4c8]
shr eax, 0x14
fdivp st(1)
shr ecx, 0x14
fmul qword [0x416440]
fstp qword [esp]
push eax
push ecx
push 0x41a28c
push edx
call fcn.00406523
lea edi, [esp + 0x4d8]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x1c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 0x240]
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [edx], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5ac
ret