Function at 0x403b70
Capabilities:
Check os version
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push ebx
mov ebx, 0x100
push ebx
lea eax, [ebp - 0x19c]
push 0
push eax
mov dword [ebp - 4], ebx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x19c]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x403bb0
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push edi
mov edi, dword [ebp + 8]
mov byte [ebp + eax - 0x19c], 0
lea eax, [ebp - 0x19c]
mov byte [edi], 0
mov ecx, eax
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403bd0
push esi
sub eax, ecx
mov esi, ecx
dec edi
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403be0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x29c]
push 0
push ecx
mov dword [ebp - 8], ebx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x403cad
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp + 8]
mov byte [ebp + ecx - 0x29c], 0
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403c35
mov dx, word [0x4052bc]
lea eax, [ebp - 0x29c]
mov word [edi], dx
mov ecx, eax
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403c50
sub eax, ecx
mov esi, ecx
lea edi, [ebx - 1]
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403c60
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x94
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x9c]
push 0
lea esi, [ebx + 0x40]
push eax
mov byte [esi], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x9c]
push ecx
mov dword [ebp - 0x9c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x403cb6
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x8c]
dec eax
je 0x403d91
dec eax
jne 0x403df3
mov eax, dword [ebp - 0x98]
cmp eax, 5
jne 0x403d66
mov eax, dword [ebp - 0x94]
cmp eax, 2
jne 0x403d0b
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403ce5
mov edx, dword [str.Windows2003]
mov dword [esi], edx
mov eax, dword [0x4052c4]
mov dword [esi + 4], eax
mov ecx, dword [0x4052c8]
mov dword [esi + 8], ecx
jmp 0x403df3
cmp eax, 1
jne 0x403d35
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403d11
mov edx, dword [str.WindowsXP]
mov dword [esi], edx
mov eax, dword [0x4052d0]
mov dword [esi + 4], eax
mov cx, word [0x4052d4]
jmp 0x403def
test eax, eax
jne 0x403df3
dec esi
mov edi, edi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403d40
mov edx, dword [str.Windows2000]
mov dword [esi], edx
mov eax, dword [0x4052dc]
mov dword [esi + 4], eax
mov ecx, dword [0x4052e0]
mov dword [esi + 8], ecx
jmp 0x403df3
cmp eax, 4
ja 0x403df3
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403d70
mov edx, dword [str.WindowsNT]
mov dword [esi], edx
mov eax, dword [0x4052e8]
mov dword [esi + 4], eax
mov cx, word [0x4052ec]
jmp 0x403def
cmp dword [ebp - 0x98], 4
jne 0x403df3
mov eax, dword [ebp - 0x94]
test eax, eax
jne 0x403dc6
dec esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403da5
mov edx, dword [str.Windows95]
mov dword [esi], edx
mov eax, dword [0x4052f4]
mov dword [esi + 4], eax
mov cx, word [0x4052f8]
jmp 0x403def
cmp eax, 0xa
jne 0x403df3
dec esi
lea esp, [esp]
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403dd0
mov edx, dword [str.Windows98]
mov dword [esi], edx
mov eax, dword [0x405300]
mov dword [esi + 4], eax
mov cx, word [0x405304]
mov word [esi + 8], cx
mov byte [ebx + 0x4c], 0
mov edx, dword [str.060211]
mov dword [ebx + 0x4c], edx
mov eax, dword [0x40530c]
mov dword [ebx + 0x50], eax
mov cl, byte [0x405310]
pop esi
pop edi
mov byte [ebx + 0x54], cl
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret