Function at 0x4073f0
Capabilities:
Get hostname
Get memory capacity
Get session user name
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x417e0b
mov eax, dword fs:[0]
push eax
sub esp, 0xac0
mov eax, dword [0x41c690]
xor eax, esp
mov dword [esp + 0xabc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41c690]
xor eax, esp
push eax
lea eax, [esp + 0xad4]
mov dword fs:[0], eax
mov esi, dword [esp + 0xae4]
mov edi, dword [esp + 0xae8]
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], al
push 0x400
push eax
mov dword [esp + 0xae4], eax
lea eax, [esp + 0x6d8]
push eax
call fcn.00409190
add esp, 0xc
push 0x400
lea ecx, [esp + 0x6d4]
push ecx
push edi
mov ecx, esi
call fcn.00404940
mov dword [esp + 0x28], eax
test eax, eax
jle 0x407f1f
lea edx, [esp + 0x2d0]
push 0x1ff
push edx
call fcn.004072b0
fstp st(0)
mov ecx, dword [0x41c04c]
lea esi, [ecx + 0x1c9]
add esp, 8
test esi, esi
je 0x4074e8
push 0
push 0
push 0x1f
push esi
push 0xffffffffffffffff
lea eax, [esp + 0x2e4]
push eax
push 0
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [esi + 0x1f], 0
mov ecx, dword [0x41c04c]
cmp dword [esp + 0x28], 0
mov dword [esp + 0x14], 0
jle 0x407eda
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocalTime]
or ebp, 0xffffffff
jmp 0x407516
mov ecx, dword [0x41c04c]
movsx eax, byte [esp + edi + 0x6d0]
add eax, 0xffffffdd
xor esi, esi
cmp eax, 0x52
ja case.0x407533.36
movzx edx, byte [eax + 0x407f90]
jmp dword [edx*4 + 0x407f54]
mov byte [esp + 0x1d0], 0x40
mov byte [esp + 0x1d1], 0
jmp 0x407e9a
add ecx, 0x1e9
push 0x1c0
push ecx
call fcn.00404040
mov esi, dword [0x41c04c]
add esp, 8
add esi, 0x1e9
jmp case.0x407533.36
movzx eax, byte [esp + edi + 0x6d1]
push eax
call fcn.00404240
mov ecx, dword [0x41c04c]
mov byte [ecx + 0x1e9], al
mov edx, dword [0x41c04c]
mov byte [edx + 0x1ea], 0
mov esi, dword [0x41c04c]
add esp, 4
add esi, 0x1e9
jmp case.0x407533.36
cmp byte [ecx + 0x38], 0
lea esi, [ecx + 0x38]
jne 0x4075d8
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x4075d2
mov byte [esi], al
mov ecx, dword [0x41c04c]
lea esi, [ecx + 0x38]
jmp case.0x407533.36
cmp byte [ecx + 0x28], 0
lea esi, [ecx + 0x28]
jne 0x407609
lea ecx, [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x407603
mov byte [esi], al
mov ecx, dword [0x41c04c]
lea esi, [ecx + 0x28]
jmp case.0x407533.36
cmp byte [ecx + 0x139], 0
lea eax, [ecx + 0x139]
jne 0x407631
push 0x10
push eax
call fcn.00403ca0
mov ecx, dword [0x41c04c]
add esp, 8
lea esi, [ecx + 0x139]
jmp case.0x407533.36
lea esi, [ecx + 0x1c9]
jmp case.0x407533.36
cmp byte [ecx + 0x149], 0
lea eax, [ecx + 0x149]
jne 0x40766a
push 0x80
push eax
call fcn.00403d50
mov ecx, dword [0x41c04c]
add esp, 8
lea esi, [ecx + 0x149]
jmp case.0x407533.36
lea edx, [esp + 0x2d0]
push 0x200
push edx
call fcn.00406760
add esp, 8
push 0
push 0
push 0xff
lea eax, [esp + 0x1dc]
push eax
push ebp
lea ecx, [esp + 0x2e4]
push ecx
push 0
push 0
mov byte [esp + 0x1f0], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [esp + 0x2cf], 0
jmp 0x407e9a
lea edx, [esp + 0xf8]
push edx
call ebx
movzx eax, word [esp + 0xf8]
movzx ecx, word [esp + 0xfa]
movzx edx, word [esp + 0xfe]
push eax
push ecx
push edx
push str._02lu_02lu_lu
lea eax, [esp + 0x1e0]
push 0xff
push eax
call fcn.0040a1bb
add esp, 0x18
jmp 0x407e9a
lea ecx, [esp + 0xe8]
push ecx
call ebx
movzx edx, word [esp + 0xf4]
movzx eax, word [esp + 0xf2]
movzx ecx, word [esp + 0xf0]
push edx
push eax
push ecx
push str._02lu_02lu_02lu
lea edx, [esp + 0x1e0]
push 0xff
push edx
call fcn.0040a1bb
add esp, 0x18
jmp 0x407e9a
lea eax, [esp + 0x58]
push eax
call ebx
movzx ecx, word [esp + 0x58]
movzx edx, word [esp + 0x5a]
movzx eax, word [esp + 0x5e]
push ecx
movzx ecx, word [esp + 0x68]
push edx
movzx edx, word [esp + 0x6a]
push eax
movzx eax, word [esp + 0x6c]
push ecx
push edx
push eax
push str._02lu_02lu_02lu_02lu_02lu_lu
lea ecx, [esp + 0x1ec]
push 0xff
push ecx
call fcn.0040a1bb
add esp, 0x24
jmp 0x407e9a
mov edx, dword [0x418938]
mov eax, dword [0x41893c]
movsx cx, byte [esp + edi + 0x6d1]
mov dword [esp + 0x1c8], edx
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0x1d0], eax
lea eax, [esp + 0x30]
push eax
mov word [esp + 0x1d0], cx
lea ecx, [esp + 0x1d0]
push 0
push ecx
call fcn.00404e00
add esp, 0x10
test eax, eax
je 0x40797a
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
mov edx, ebp
or edx, ebx
je 0x40787c
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push 0
push 0x64
push eax
push ecx
call fcn.00409670
push ebx
push ebp
push edx
push eax
call fcn.00409460
mov ecx, 0x64
sub ecx, eax
cmp ecx, 0x64
jbe 0x407822
mov ecx, 0x64
push 0x100
lea edx, [esp + 0x1d4]
push edx
push ecx
call fcn.00401080
mov eax, 0x41c038
add esp, 0xc
mov esi, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407840
lea edi, [esp + 0x1d0]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x407851
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [esp + 0x1d0]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x407871
sub esi, ecx
jmp 0x40787e
xor esi, esi
mov eax, dword [esp + 0x14]
movsx eax, byte [esp + eax + 0x6d2]
add eax, 0xffffffab
cmp eax, 0x20
ja case.0x40789d.86
movzx ecx, byte [eax + 0x407ff8]
jmp dword [ecx*4 + 0x407fe4]
mov edx, 0xff
sub edx, esi
push edx
lea eax, [esp + esi + 0x1d4]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.004068b0
add esp, 0xc
jmp 0x407e8d
sub ebp, dword [esp + 0x2c]
lea eax, [esp + 0xb8]
sbb ebx, dword [esp + 0x30]
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xbc], ebx
jmp 0x407e5a
sub ebp, dword [esp + 0x2c]
mov ecx, 0xff
sbb ebx, dword [esp + 0x30]
sub ecx, esi
push ecx
lea edx, [esp + esi + 0x1d4]
push edx
lea eax, [esp + 0xc8]
push eax
mov dword [esp + 0xcc], ebp
mov dword [esp + 0xd0], ebx
call fcn.004068b0
add esp, 0xc
jmp 0x407e8d
fild qword [esp + 0x2c]
mov ecx, 0xff
sub ecx, esi
push ecx
fmul qword [0x418468]
lea edx, [esp + esi + 0x1d4]
fild qword [esp + 0x4c]
push edx
jmp 0x407e44
push 0x200
lea eax, [esp + 0x2d4]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.00406410
mov edx, 0x100
sub edx, esi
push edx
lea eax, [esp + esi + 0x1e0]
push eax
lea ecx, [esp + 0x2e4]
push ecx
jmp 0x407e85
mov edx, dword [str._not_ready]
mov eax, dword [0x418930]
mov cx, word [0x418934]
mov dword [esp + 0x1d0], edx
mov dl, byte [0x418936]
mov dword [esp + 0x1d4], eax
mov word [esp + 0x1d8], cx
mov byte [esp + 0x1da], dl
jmp 0x407e8d
mov al, byte [esp + edi + 0x6d1]
mov byte [esp + 0x1d0], 0
cmp al, 0x50
je 0x407be0
cmp al, 0x53
je 0x407ae5
cmp al, 0x56
jne 0x407ce4
push 0x40
lea eax, [esp + 0x10c]
push 0
push eax
call fcn.00409190
mov eax, dword [0x41dd0c]
add esp, 0xc
mov dword [esp + 0x108], 0x40
test eax, eax
jne 0x407a29
mov eax, dword [0x41dd00]
test eax, eax
je 0x407a21
push str.GlobalMemoryStatusEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41dd0c], eax
test eax, eax
jne 0x407a29
mov dword [0x41dd0c], ebp
jmp 0x407a3c
cmp eax, ebp
je 0x407a3c
lea ecx, [esp + 0x108]
push ecx
call eax
cmp eax, 1
jge 0x407ab4
xor eax, eax
lea edx, [esp + 0xc8]
mov dword [esp + 0xc8], eax
push edx
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0xcc], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esi, dword [esp + 0xe0]
mov eax, dword [esp + 0xe4]
xor edi, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
jmp 0x407cec
mov esi, dword [esp + 0x130]
mov edi, dword [esp + 0x134]
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x13c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jmp 0x407cec
push 0x40
lea eax, [esp + 0x18c]
push 0
push eax
call fcn.00409190
mov eax, dword [0x41dd0c]
add esp, 0xc
mov dword [esp + 0x188], 0x40
test eax, eax
jne 0x407b33
mov eax, dword [0x41dd00]
test eax, eax
je 0x407b2b
push str.GlobalMemoryStatusEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41dd0c], eax
test eax, eax
jne 0x407b33
mov dword [0x41dd0c], ebp
jmp 0x407b46
cmp eax, ebp
je 0x407b46
lea ecx, [esp + 0x188]
push ecx
call eax
cmp eax, 1
jge 0x407baf
xor eax, eax
lea edx, [esp + 0x70]
mov dword [esp + 0x70], eax
push edx
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x74], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esi, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
xor edi, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
jmp 0x407cec
mov esi, dword [esp + 0x1a0]
mov edi, dword [esp + 0x1a4]
mov ecx, dword [esp + 0x1a8]
mov edx, dword [esp + 0x1ac]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jmp 0x407cec
push 0x40
lea eax, [esp + 0x14c]
push 0
push eax
call fcn.00409190
mov eax, dword [0x41dd0c]
add esp, 0xc
mov dword [esp + 0x148], 0x40
test eax, eax
jne 0x407c2e
mov eax, dword [0x41dd00]
test eax, eax
je 0x407c26
push str.GlobalMemoryStatusEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41dd0c], eax
test eax, eax
jne 0x407c2e
mov dword [0x41dd0c], ebp
jmp 0x407c41
cmp eax, ebp
je 0x407c41
lea ecx, [esp + 0x148]
push ecx
call eax
cmp eax, 1
jge 0x407cb6
xor eax, eax
lea edx, [esp + 0x98]
mov dword [esp + 0x98], eax
push edx
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0x9c], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esi, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
xor edi, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
jmp 0x407cec
mov esi, dword [esp + 0x150]
mov edi, dword [esp + 0x154]
mov ecx, dword [esp + 0x158]
mov edx, dword [esp + 0x15c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jmp 0x407cec
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov eax, esi
or eax, edi
je 0x407d7e
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
push 0x64
push ecx
push edx
call fcn.00409670
push edi
push esi
push edx
push eax
call fcn.00409460
mov ecx, 0x64
sub ecx, eax
cmp ecx, 0x64
jbe 0x407d23
mov ecx, 0x64
push 0x100
lea eax, [esp + 0x1d4]
push eax
push ecx
call fcn.00401080
mov eax, 0x41c038
add esp, 0xc
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x407d40
lea edi, [esp + 0x1d0]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x407d53
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [esp + 0x1d0]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x407d73
sub esi, ecx
jmp 0x407d80
xor esi, esi
mov ecx, dword [esp + 0x14]
movsx eax, byte [esp + ecx + 0x6d2]
add eax, 0xffffffab
cmp eax, 0x20
ja case.0x407d9f.86
movzx edx, byte [eax + 0x408030]
jmp dword [edx*4 + 0x40801c]
mov eax, 0xff
sub eax, esi
push eax
lea ecx, [esp + esi + 0x1d4]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004068b0
add esp, 0xc
jmp 0x407e8d
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
sbb ecx, dword [esp + 0x1c]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ecx
lea eax, [esp + 0x90]
jmp 0x407e5a
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
sbb edx, dword [esp + 0x1c]
mov eax, 0xff
sub eax, esi
mov dword [esp + 0x68], ecx
push eax
lea ecx, [esp + esi + 0x1d4]
mov dword [esp + 0x70], edx
push ecx
lea edx, [esp + 0x70]
push edx
call fcn.004068b0
add esp, 0xc
jmp 0x407e8d
fild qword [esp + 0x18]
mov eax, 0xff
sub eax, esi
push eax
fmul qword [0x418468]
lea ecx, [esp + esi + 0x1d4]
fild qword [esp + 0x24]
push ecx
fdivp st(1)
sub esp, 8
fstp qword [esp]
call fcn.00406310
add esp, 0x10
jmp 0x407e8d
lea eax, [esp + 0x18]
push 0x200
lea edx, [esp + 0x2d4]
push edx
push eax
call fcn.00406410
mov ecx, 0x100
sub ecx, esi
push ecx
lea edx, [esp + esi + 0x1e0]
push edx
lea eax, [esp + 0x2e4]
push eax
call fcn.00401360
add esp, 0x18
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edi, dword [esp + 0x14]
or ebp, 0xffffffff
lea esi, [esp + 0x1d0]
push 3
lea eax, [esp + edi + 0x6d4]
push eax
lea ecx, [esp + 0x3c]
call fcn.004037e0
lea ecx, [esp + 0x34]
test esi, esi
je 0x407ebf
push esi
jmp 0x407ec4
push 0x418928
call fcn.004038a0
add edi, 3
cmp edi, dword [esp + 0x28]
mov dword [esp + 0x14], edi
jl 0x407510
cmp dword [esp + 0x38], 0
je 0x407f1f
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
push 4
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ecx
push edi
mov ecx, esi
call fcn.00404ac0
mov dword [esp + 0x28], eax
cmp eax, 4
jne 0x407f1f
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
push eax
push ecx
push edi
mov ecx, esi
call fcn.00404ac0
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x34]
call fcn.00403760
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xad4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xabc]
xor ecx, esp
call fcn.00408f97
add esp, 0xacc
ret