Function at 0x403670
Capabilities:
Get geographical location
Get hostname
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
push ebx
push esi
push edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [ebp + 8]
push 0x40
push esi
push 2
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0xc]
lea ecx, [esi + 0x40]
push eax
push ecx
mov dword [ebp - 0xc], 0x40
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x2dc]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push edx
call ebx
lea eax, [ebp - 8]
lea ecx, [ebp - 0x2dc]
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
call dword [0x409df0]
test eax, eax
jne 0x403737
mov dword [ebp + 8], 0xc8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp + 8]
lea eax, [ebp - 0xd4]
push edx
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
push str.ProductName
push edx
call dword [0x409df4]
mov eax, dword [ebp - 8]
push eax
call dword [0x409df8]
mov edi, dword [0x409e1c]
lea ecx, [ebp - 0xd4]
push str.2000
push ecx
call edi
test eax, eax
je 0x403779
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [esi + 0xc0]
push str.Windows_2000
mov dword [0x40957c], 1
push edx
jmp 0x40387c
lea eax, [ebp - 0xd4]
push 0x409640
push eax
call edi
test eax, eax
je 0x4037ae
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [0x40957c], 0
push str.Windows_XP
jmp 0x403875
lea edx, [ebp - 0xd4]
push str.2003
push edx
call edi
test eax, eax
je 0x4037ea
mov dword [0x40957c], 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [esi + 0xc0]
push str.Windows_2003
push eax
jmp 0x40387c
lea ecx, [ebp - 0xd4]
push str.Vista
push ecx
call edi
test eax, eax
je 0x403823
mov dword [0x40957c], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [esi + 0xc0]
push str.Windows_Vista
push edx
jmp 0x40387c
lea eax, [ebp - 0xd4]
push str.2008
push eax
call edi
test eax, eax
je 0x403846
mov dword [0x40957c], 1
push str.Windows_2008
jmp 0x403875
lea edx, [ebp - 0xd4]
push 0x4095e8
push edx
call edi
test eax, eax
mov dword [0x40957c], 0
je 0x403870
lea eax, [esi + 0xc0]
push str.Windows_7
push eax
jmp 0x40387c
push str.Windows_NT
lea ecx, [esi + 0xc0]
push ecx
call ebx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1d7]
mov byte [ebp - 0x1d8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x1d8]
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push edx
call ebx
lea eax, [ebp - 4]
lea ecx, [ebp - 0x1d8]
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
call dword [0x409df0]
test eax, eax
jne 0x403919
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [ebp + 8]
lea eax, [ebp - 0x10]
push edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
push str.MHz
push edx
mov dword [ebp - 0x14], 4
mov dword [ebp + 8], 0xc8
call dword [0x409df4]
mov eax, dword [ebp - 4]
push eax
call dword [0x409df8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp - 0x10]
mov edi, dword [0x409e38]
push ecx
lea edx, [esi + 0x120]
push str._u_MHz
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
mov ecx, 0x14
call fcn.00403c30
add eax, 1
lea ecx, [esi + 0x100]
adc edx, 0
push edx
push eax
push str._u_MB
push ecx
call edi
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [esi + 0x140]
push str.v1.1
push edx
call ebx
mov eax, dword [0x40a3e8]
test eax, eax
jne 0x4039bd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x40a3e8], eax
mov dword [esi + 0x160], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret