Function at 0x406860
Capabilities:
Get disk information
Get disk size
Get hostname
Get memory capacity

Disassembly:
sub esp, 0xcbc
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x34], ecx
mov byte [esp + 0x13c], 0x8b
call fcn.004065e0
mov ebp, dword [0x42e208]
push eax
lea eax, [esp + 0x141]
push eax
call ebp
add esp, 8
lea ecx, [esp + 0x10]
xor ebx, ebx
push ecx
push 1
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call dword [0x42e0e4]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x30]
lea eax, [esp + 0x38]
push edx
push eax
push ebx
push ebx
push str.MHz
push ecx
mov dword [esp + 0x48], 4
call dword [0x42e0b0]
mov edx, dword [esp + 0x10]
push edx
call dword [0x42e0ec]
mov ecx, 0xc
mov esi, 0x428d84
lea edi, [esp + 0x464]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x35
lea edi, [esp + 0x494]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x464]
push eax
push 0xf003f
push ebx
push ecx
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [0x42e0e4]
test eax, eax
jne 0x406971
lea edx, [esp + 0x14]
lea eax, [esp + 0xbc]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push str.ProcessorNameString
push edx
mov dword [esp + 0x2c], 0x80
call dword [0x42e0b0]
mov eax, dword [esp + 0x10]
push eax
call dword [0x42e0ec]
lea ecx, [esp + 0xbc]
lea edx, [esp + 0x17d]
push ecx
push 0x428d6c
push edx
call ebp
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, 0x31b5d43b
mul esi
mov ecx, edx
mov eax, esi
xor edx, edx
mov esi, 0x5265c00
div esi
mov edi, 0x36ee80
shr ecx, 0x18
mov esi, edx
xor edx, edx
mov eax, esi
div edi
mov eax, 0x45e7b273
mul edx
shr edx, 0xe
mov eax, 0x95217cb1
push edx
mul esi
shr edx, 0x15
push edx
push ecx
lea eax, [esp + 0x1c9]
push 0x428d58
push eax
call ebp
add esp, 0x14
lea ecx, [esp + 0x1c]
lea edx, [esp + 0xbc]
mov dword [esp + 0x1c], 0x80
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0xbc]
push eax
push ecx
call dword [0x42e09c]
lea edx, [esp + 0xbc]
lea eax, [esp + 0x21d]
push edx
push 0x428d6c
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x568]
push ecx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov al, byte [esp + 0x568]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, al
lea esi, [esp + 0x568]
je 0x406b13
lea edx, [esp + 0x668]
xor eax, eax
push 0x104
push edx
push eax
push eax
push eax
mov ecx, 0x41
lea edi, [esp + 0x67c]
push eax
push eax
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x410
lea eax, [esp + 0x770]
push 0x160
push eax
push 0x80
push esi
call dword [0x42e15c]
lea ecx, [esp + 0x87c]
push ecx
call ebx
lea edx, [esp + 0x668]
push edx
call ebx
mov al, byte [esi]
cmp al, 0x41
je 0x406b03
cmp al, 0x42
je 0x406b03
lea eax, [esp + 0x28]
push 0
lea ecx, [esp + 0x24]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x406b03
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ecx, 0x1e
call fcn.00419010
mov edx, dword [esp + 0x18]
mov ecx, 0x1e
add edx, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x24]
call fcn.00419010
add dword [esp + 0x14], eax
push esi
call ebx
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x406a55
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x23d]
push edx
push 0x428d4c
push eax
call ebp
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x289]
push ecx
push 0x428d40
push edx
call ebp
lea edi, [esp + 0x295]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x23d]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x7c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov dword [esp + 0x80], 0x40
call esi
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x88]
mov ecx, 0x14
call fcn.00419010
push edx
push eax
lea ecx, [esp + 0x2c5]
push 0x428d34
push ecx
call ebp
add esp, 0x10
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x3c]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x40], 0x40
call esi
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov ecx, 0x14
call fcn.00419010
add eax, 1
adc edx, 0
push edx
push eax
lea eax, [esp + 0x305]
push 0x428d28
push eax
call ebp
lea edi, [esp + 0x30d]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2cd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
push str.SYSTEMCurrentControlSetControlTerminal_ServerWds_rdpwdTds_tcp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x100
lea edi, [esp + 0x8e0]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x374]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x8e0]
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x360]
push 0
push ecx
call ebx
push eax
lea edx, [esp + 0x368]
push 0
push edx
push 4
lea eax, [esp + 0x8e0]
push str.PortNumber
push eax
push 0x80000002
call fcn.0040a710
lea ecx, [esp + 0x380]
lea edx, [esp + 0x35d]
push ecx
push edx
call ebp
add esp, 0x28
push 0x4281ac
call fcn.004066c0
push eax
call fcn.00418ae0
add esp, 8
test eax, eax
jne 0x406ccb
lea eax, [esp + 0x1dd]
push 0x428ccc
push eax
call ebp
add esp, 8
jmp 0x406d0e
push 0x428cc8
call fcn.004066c0
push eax
call fcn.00418ae0
add esp, 8
test eax, eax
je 0x406cf6
lea ecx, [esp + 0x1dd]
push 0x428cbc
push ecx
call ebp
add esp, 8
jmp 0x406d0e
call fcn.004066c0
push eax
lea edx, [esp + 0x1e1]
push 0x428d6c
push edx
call ebp
add esp, 0xc
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x13c]
push 0x222
push eax
call fcn.0040a640
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcbc
ret