Function at 0x4050ab
Capabilities:
Get hostname
Get memory capacity
Get session user name
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x364
mov eax, dword [0x5e2ec0]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
push esi
push edi
push 0xff
xor esi, esi
lea eax, [esp + 0x6d]
push esi
push eax
mov byte [esp + 0x74], 0
call fcn.0055bfc0
add esp, 0xc
xor eax, eax
push 0x1fe
mov word [esp + 0x16c], ax
lea eax, [esp + 0x16e]
push esi
push eax
call fcn.0055bfc0
add esp, 0xc
push esi
push 0x80
push 1
push esi
push esi
push 0x40000000
mov ebx, 0x100
push str.about.log
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x40536c
lea esi, [esp + 0x68]
call fcn.00404d0e
push dword [esp + 0xc]
mov edi, esi
mov ecx, 0x5d41c0
call fcn.004036cd
pop ecx
push ebx
mov eax, esi
push 0
push eax
call fcn.0055bfc0
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
add esp, 0xc
push 1
call esi
push eax
push 0
call esi
push eax
mov eax, edi
push str.RESOLUTION:__dx_d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [esp + 0x1c]
lea esi, [esp + 0x78]
call fcn.00403769
push ebx
xor esi, esi
lea eax, [esp + 0x7c]
push esi
push eax
call fcn.0055bfc0
add esp, 0x1c
push ebx
lea eax, [esp + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
lea eax, [esp + 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [esp + 0x16c]
push eax
lea eax, [esp + 0x70]
push eax
call fcn.0055a952
add esp, 0xc
push edi
lea edi, [esp + 0x6c]
mov ecx, str.LOCALE
call fcn.004036cd
pop ecx
push ebx
mov eax, edi
push esi
push eax
call fcn.0055bfc0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push dword [esp + 0xc]
mov ecx, str.USER
call fcn.004036cd
pop ecx
lea eax, [esp + 0x10]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push ebx
mov eax, edi
push esi
push eax
call fcn.0055bfc0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 1
push esi
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405254
push esi
mov eax, edi
push esi
push eax
push str.ProcessorNameString
lea edi, [esp + 0x28]
call fcn.00403aa5
add esp, 0x10
push dword [esp + 0xc]
lea edi, [esp + 0x6c]
mov ecx, 0x5d422c
call fcn.004036cd
pop ecx
push ebx
mov eax, edi
push esi
push eax
call fcn.0055bfc0
add esp, 0xc
mov esi, edi
call fcn.00404cc3
push dword [esp + 0xc]
mov ecx, 0x5d4230
call fcn.004036cd
pop ecx
push ebx
mov eax, edi
push 0
push eax
call fcn.0055bfc0
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
shrd eax, ecx, 0x14
push eax
mov eax, edi
push str.RAM:__lu_MB_r_n
push eax
shr ecx, 0x14
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [esp + 0x18]
add esp, 0xc
call fcn.00403769
push ebx
xor ebx, ebx
mov eax, esi
push ebx
push eax
call fcn.0055bfc0
add esp, 0xc
push edi
call fcn.00404dc1
mov dword [esp], 0x2800
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
je 0x405362
lea esi, [esp + 0x1c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00403b11
push str._tSOFTRWARE:_r_n
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [esp + 0x20], ebx
jbe 0x405341
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x1c]
push dword [eax + ebx*4]
push edi
call esi
push 0x5d3ad4
push edi
call esi
inc ebx
cmp ebx, dword [esp + 0x20]
jb 0x405328
push 0
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x36c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0055a67a
mov esp, ebp
pop ebp
ret