Function at 0x401000
Capabilities:
Get disk information
Get hostname
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
push 0x3f
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x80], al
lea eax, [ebp - 0x7f]
push ebx
push eax
mov dword [ebp - 0x30], ebx
call sub.msvcrt.dll_memset
push 0x7e
lea edx, [ebp - 0xfe]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x100], cx
call sub.msvcrt.dll_memset
mov eax, dword [0x427ae0]
add esp, 0x18
or eax, dword [0x427ae4]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
jne 0x401406
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edi, dword [0x427ae0]
mov eax, dword [0x427ae8]
mov esi, dword [sym.imp.msvcrt.dll_realloc]
lea edx, [edi + 0xc]
push edx
push eax
call esi
movzx ecx, word [ebp - 0x30]
mov word [eax + edi], cx
mov byte [eax + edi + 2], bl
add edi, 2
lea edx, [edi + 0xe]
push edx
push eax
mov dword [0x427ae0], edi
mov dword [0x427ae8], eax
call esi
mov ecx, dword [ebp - 0x1c]
mov dword [eax + edi], ecx
mov byte [eax + edi + 4], bl
add edi, 4
lea edx, [edi + 0xc]
push edx
push eax
mov dword [0x427ae0], edi
mov dword [0x427ae8], eax
call esi
movzx ecx, word [ebp - 0x10]
mov word [eax + edi], cx
mov byte [eax + edi + 2], bl
add edi, 2
lea edx, [edi + 0xc]
push edx
push eax
mov dword [0x427ae0], edi
mov dword [0x427ae8], eax
call esi
movzx ecx, word [ebp - 0xe]
add esp, 0x20
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0xc]
push edx
mov word [eax + edi], cx
push ebx
mov byte [eax + edi + 2], bl
push ebx
add edi, 2
push 0x40a6b0
mov dword [0x427ae0], edi
mov dword [0x427ae8], eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edi, dword [0x427ae0]
mov ecx, dword [0x427ae8]
lea eax, [edi + 0xe]
push eax
push ecx
call esi
mov edx, dword [ebp - 0xc]
mov dword [eax + edi], edx
mov byte [eax + edi + 4], bl
add edi, 4
mov dword [0x427ae0], edi
mov dword [0x427ae8], eax
push str.InstallDate
mov eax, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov edi, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402fb0
mov ebx, dword [0x427ae0]
mov ecx, dword [0x427ae8]
mov edi, eax
lea eax, [ebx + 0xe]
push eax
xor edi, 0x18273645
push ecx
call esi
lea edx, [ebp - 0x38]
push edx
mov dword [eax + ebx], edi
mov byte [eax + ebx + 4], 0
push 0
mov dword [0x427ae8], eax
push str.DigitalProductId
add ebx, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov eax, 0x100
mov ecx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov dword [0x427ae0], ebx
call fcn.00402e50
mov edi, eax
xor eax, eax
mov ecx, edi
and ecx, eax
add esp, 0x24
cmp ecx, 0xffffffff
je 0x401232
mov edx, edi
or edx, eax
je 0x401232
mov eax, dword [ebp - 0x38]
mov ecx, dword [0x427ae0]
mov dword [ebp - 8], ecx
test eax, eax
je 0x401218
test edi, edi
je 0x401218
lea ebx, [edi + ecx]
mov ecx, dword [0x427ae8]
lea eax, [ebx + 0xa]
push eax
push ecx
call esi
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x38]
mov esi, eax
push edi
lea eax, [esi + edx]
push ecx
push eax
mov dword [ebp - 8], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x38]
mov byte [edx + edi], 0
add esp, 0x14
mov dword [0x427ae0], ebx
jmp 0x40121e
mov esi, dword [0x427ae8]
mov dword [0x427ae8], esi
test eax, eax
je 0x401232
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov eax, dword [0x427ae0]
mov ecx, dword [0x427ae8]
push eax
push ecx
push 0x427b00
mov dword [0x427b10], 0
call fcn.004017c0
add esp, 0xc
test eax, eax
je 0x40126c
push 0x427b10
push 0x427b00
call fcn.00403050
add esp, 8
mov edx, dword [0x427ae0]
mov eax, dword [0x427ae8]
push edx
push eax
push 0x427b00
mov dword [0x427b14], 0
call fcn.004017c0
add esp, 0xc
test eax, eax
je 0x4012a1
push 0x427b00
call fcn.004030b0
add esp, 4
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x80]
mov esi, 0x40
push edx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x100]
push ecx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x80]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4012d1
sub eax, edx
mov edx, eax
mov eax, dword [0x427b10]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4012e4
mov edi, dword [sym.imp.msvcrt.dll_calloc]
sub eax, esi
lea edx, [eax + edx + 0x32]
push 1
push edx
call edi
mov ebx, eax
lea eax, [ebp - 0x100]
add esp, 8
mov dword [0x427ad8], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401310
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, dword [0x427b14]
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401330
sub eax, esi
sar eax, 1
lea eax, [eax + edx + 0x32]
push 2
push eax
call edi
mov ecx, dword [0x427b10]
push ecx
lea edx, [ebp - 0x80]
push edx
push 0x40a750
push ebx
mov dword [0x427adc], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x427b14]
mov edx, dword [0x427adc]
push eax
lea ecx, [ebp - 0x100]
push ecx
push 0x40a758
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov cx, word [0x427b04]
mov dx, word [0x427b06]
xor eax, eax
add esp, 0x28
mov dword [0x427af4], eax
mov dword [0x427af0], eax
mov dword [0x427af8], eax
mov dword [0x427afc], eax
mov eax, dword [0x427b00]
push 0x40
mov dword [0x427af0], eax
mov eax, dword [0x427b08]
mov word [0x427af4], cx
mov ecx, dword [0x427b0c]
push 0x427b58
push 0x427af0
mov word [0x427af6], dx
mov dword [0x427af8], eax
mov dword [0x427afc], ecx
call dword [sym.imp.ole32.dll_StringFromGUID2]
push 0
push 0
push 0x40
push 0x427b18
push 0xffffffffffffffff
push 0x427b58
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret