Function at 0x4054f0
Capabilities:
Access the windows event log
Get cpu information
Get disk information
Get disk size
Get file size
Get hostname
Get memory capacity
Get session user name
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578503
mov eax, dword fs:[0]
push eax
mov eax, 0xa690
call fcn.0054d370
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, 0x5e9970
xor ebx, ebx
mov dword [ebp - 0xa69c], eax
push str.User_Name
mov ecx, edi
mov dword [0x5eb8b0], ebx
call fcn.004071a5
mov esi, eax
mov dword [ebp - 0xa674], 0x100
push 0x202
push dword [esi]
call fcn.00560abc
pop ecx
pop ecx
lea ecx, [ebp - 0xa674]
mov dword [esi], eax
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.Host_Name
mov ecx, edi
call fcn.004071a5
mov esi, eax
mov edi, 0xc8
xor eax, eax
mov dword [ebp - 0xa674], edi
mov word [ebp - 0x5f0], ax
lea eax, [ebp - 0xa674]
push eax
lea eax, [ebp - 0x5f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x5f0]
push edi
push eax
call fcn.0056063b
pop ecx
pop ecx
lea eax, [ebp - 0x5f0]
mov ecx, esi
push eax
call fcn.004072d9
mov esi, 0x5e9970
push str.OS_Version
mov ecx, esi
call fcn.004071a5
mov edx, dword [0x5ebafc]
mov ecx, eax
mov eax, dword [0x5ebb00]
push 9
pop edi
cmp edx, 5
jne 0x405621
cmp eax, 1
jne 0x4055f6
push str.Windows_XP
jmp 0x4056c9
cmp eax, 2
jne 0x405619
cmp byte [0x5ebc12], 1
jne 0x405612
mov eax, str.Windows_XP_x64
cmp word [0x5ebc1c], di
je 0x405671
mov eax, str.Windows_2003
jmp 0x405671
push eax
push 5
jmp 0x4056d5
cmp edx, 6
jne 0x405674
test eax, eax
jne 0x405636
mov eax, str.Windows_Vista
mov edx, str.Windows_2008
jmp 0x405667
cmp eax, 1
jne 0x405647
mov eax, str.Windows_7
mov edx, str.Windows_2008_R2
jmp 0x405667
cmp eax, 2
jne 0x405658
mov eax, str.Windows_8
mov edx, str.Windows_2012
jmp 0x405667
cmp eax, 3
jne 0x4056d3
mov eax, str.Windows_8.1
mov edx, str.Windows_2012_R2
cmp byte [0x5ebc12], 1
cmovne eax, edx
push eax
jmp 0x4056c9
cmp edx, 0xa
jne 0x4056d3
mov eax, dword [0x5ebc14]
cmp eax, 0x55f0
jb 0x40568c
push str.Windows_11
jmp 0x4056c9
cmp byte [0x5ebc12], 1
jne 0x40569c
push str.Windows_10
jmp 0x4056c9
cmp dword [0x5ebc40], 0x711
jae 0x4056af
push str.Windows_Server_2016
jmp 0x4056c9
cmp eax, 0x4563
jne 0x4056bd
push str.Windows_Server_2019
jmp 0x4056c9
cmp eax, 0x4f7c
jb 0x4056e3
push str.Windows_Server_2022
push ecx
call fcn.00407286
pop ecx
pop ecx
jmp 0x4056e3
push eax
push edx
push str.Windows_NT__d._d
push ecx
call fcn.00407286
add esp, 0x10
push str.Service_Pack
mov ecx, esi
call fcn.004071a5
mov edi, eax
cmp word [0x5ebb0c], bx
je 0x405710
push 0x58a49c
mov esi, 0x5ebb0c
push esi
call fcn.005602ba
pop ecx
pop ecx
test eax, eax
jne 0x405715
mov esi, 0x58a4a0
push esi
mov ecx, edi
call fcn.004072d9
mov edi, 0x5e9970
push str.Machine_Domain
mov ecx, edi
call fcn.004071a5
mov esi, eax
lea eax, [ebp - 0x25f0]
push 0x1000
push eax
call fcn.00419049
pop ecx
pop ecx
push 0x64
pop ecx
test al, al
jne 0x405799
lea eax, [ebp - 0xa664]
push eax
push ecx
push ebx
call sub.NETAPI32.dll_NetWkstaGetInfo
test eax, eax
jne 0x405780
mov eax, dword [ebp - 0xa664]
push dword [eax + 8]
push 0x58a4e0
push esi
call fcn.00407286
add esp, 0xc
push dword [ebp - 0xa664]
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x405799
push str._none_
lea eax, [ebp - 0x25f0]
push 0x1000
push eax
call fcn.00552893
add esp, 0xc
lea eax, [ebp - 0x25f0]
mov ecx, esi
push eax
call fcn.004072d9
push str.Logon_Domain
mov ecx, edi
call fcn.004071a5
push str.Logon_Server
mov ecx, edi
mov esi, eax
call fcn.004071a5
lea eax, [ebp - 0xa698]
push eax
push 1
push ebx
call sub.NETAPI32.dll_NetWkstaUserGetInfo
mov ecx, esi
test eax, eax
jne 0x4057ef
mov eax, dword [ebp - 0xa698]
push dword [eax + 4]
call fcn.004072d9
mov eax, dword [ebp - 0xa698]
mov eax, dword [eax + 0xc]
jmp 0x4057fe
push str._none_
call fcn.004072d9
mov eax, str._none_
push eax
lea ecx, [esi + 8]
call fcn.004072d9
push str.System_Type
mov ecx, 0x5e9970
call fcn.004071a5
mov esi, eax
xor eax, eax
mov word [ebp - 0x25f0], ax
lea eax, [ebp - 0xa688]
push eax
push 1
push ebx
push str.SYSTEMCurrentControlSetControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4059ac
lea eax, [ebp - 0xa674]
mov dword [ebp - 0xa674], 0x2000
push eax
lea eax, [ebp - 0x25f0]
push eax
xor eax, eax
push eax
push eax
push str.ProductType
push dword [ebp - 0xa688]
call ebx
mov edi, str.WinNT
test eax, eax
jne 0x4058df
lea eax, [ebp - 0x25f0]
push str.LanmanNT
push eax
call fcn.00552def
pop ecx
pop ecx
test eax, eax
jne 0x405899
push str.Domain_Controller
jmp 0x4058d8
lea eax, [ebp - 0x25f0]
push str.ServerNT
push eax
call fcn.00552def
pop ecx
pop ecx
test eax, eax
jne 0x4058b7
push str.Server
jmp 0x4058d8
lea eax, [ebp - 0x25f0]
push edi
push eax
call fcn.00552def
pop ecx
pop ecx
test eax, eax
jne 0x4058d1
push str.Workstation
jmp 0x4058d8
lea eax, [ebp - 0x25f0]
push eax
mov ecx, esi
call fcn.004072d9
lea eax, [ebp - 0x25f0]
push edi
push eax
call fcn.00552def
pop ecx
pop ecx
test eax, eax
je 0x405942
lea eax, [ebp - 0xa668]
mov edi, str.Stand_alone
push eax
push 0x65
xor eax, eax
push eax
call sub.NETAPI32.dll_NetServerGetInfo
test eax, eax
jne 0x405933
mov ecx, dword [ebp - 0xa668]
mov edx, dword [ecx + 0x10]
test dword [eax*8 + 0x58a230], edx
jne 0x405926
inc eax
cmp eax, 2
jb 0x405915
jmp 0x40592d
mov edi, dword [eax*8 + 0x58a234]
push ecx
call sub.NETAPI32.dll_NetApiBufferFree
push edi
push str.___s
push esi
call fcn.0040434c
add esp, 0xc
lea eax, [ebp - 0xa674]
mov dword [ebp - 0xa674], 0x208
push eax
lea eax, [ebp - 0x460]
push eax
xor eax, eax
push eax
push eax
push str.ProductSuite
push dword [ebp - 0xa688]
call ebx
test eax, eax
jne 0x40599e
lea edi, [ebp - 0x460]
cmp word [ebp - 0x460], ax
je 0x40599e
xor ebx, ebx
push edi
push str.___s
push esi
call fcn.0040434c
push ebx
push edi
call fcn.0054efda
add esp, 0x14
lea edi, [eax + 2]
cmp word [edi], bx
jne 0x405980
push dword [ebp - 0xa688]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4059b8
push str.Workstation
mov ecx, esi
call fcn.004072d9
lea eax, [ebp - 0xa5f4]
push eax
call fcn.00416513
mov ebx, eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0xa680], ebx
pop ecx
cmp dword [ebp - 0xa5f4], eax
jbe 0x405a17
lea esi, [ebx + 0x1ec0]
push str._none_
lea eax, [esi - 0x208]
push 0x104
push eax
call fcn.00552893
push str._none_
push 0x6a4
push esi
call fcn.00552893
add esp, 0x18
add esi, 0x2c08
inc edi
cmp edi, dword [ebp - 0xa5f4]
jb 0x4059df
lea eax, [ebp - 0xa688]
push eax
push 0x20019
xor eax, eax
push eax
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405d27
xor ecx, ecx
mov dword [ebp - 0xa678], 0x104
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0xa678]
mov esi, ecx
push eax
lea eax, [ebp - 0x258]
mov dword [ebp - 0xa664], esi
push eax
push ecx
push dword [ebp - 0xa688]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x405d1b
mov edi, 0xd48
xor ebx, ebx
lea eax, [ebp - 0xa66c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0xa688]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405cdd
lea eax, [ebp - 0xa678]
mov dword [ebp - 0xa678], 4
push eax
lea eax, [ebp - 0xa690]
push eax
push ebx
push ebx
push str.EnableDHCP
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405cd1
cmp dword [ebp - 0xa690], 0
lea eax, [ebp - 0xa678]
push eax
lea eax, [ebp - 0x3338]
mov dword [ebp - 0xa678], edi
push eax
push ebx
mov ecx, str.IPAddress
mov eax, str.DhcpIPAddress
push ebx
cmove eax, ecx
push eax
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405cd1
mov eax, dword [ebp - 0xa678]
mov ecx, 0x6a2
shr eax, 1
mov dword [ebp - 0xa678], eax
cmp eax, ecx
jb 0x405b40
mov dword [ebp - 0xa678], ecx
mov ecx, 0xd44
mov eax, ecx
jmp 0x405b4c
add eax, eax
mov ecx, eax
cmp ecx, edi
jae 0x406fd6
xor edx, edx
add eax, 2
mov word [ebp + ecx - 0x3338], dx
cmp eax, edi
jae 0x406fd6
xor ecx, ecx
lea esi, [ebp - 0x3338]
mov word [ebp + eax - 0x3338], cx
cmp word [ebp - 0x3338], cx
je 0x405ccb
push esi
call fcn.00552a19
cmp dword [ebp - 0xa5f4], 0
pop ecx
mov dword [ebp - 0xa668], eax
jbe 0x405caf
mov edi, dword [ebp - 0xa680]
push eax
lea eax, [edi + 0x20]
push esi
push eax
call fcn.005602fa
add esp, 0xc
test eax, eax
jne 0x405bc6
mov eax, dword [ebp - 0xa668]
movzx eax, word [edi + eax*2 + 0x20]
push eax
call fcn.0055fcb0
pop ecx
test eax, eax
je 0x405be1
inc ebx
add edi, 0x2c08
cmp ebx, dword [ebp - 0xa5f4]
jae 0x405caf
mov eax, dword [ebp - 0xa668]
jmp 0x405b9e
xor ebx, ebx
cmp dword [ebp - 0xa690], ebx
je 0x405c16
lea eax, [ebp - 0xa678]
mov dword [ebp - 0xa678], 0x208
push eax
lea eax, [edi + 0x1cb8]
push eax
push ebx
push ebx
push str.DhcpServer
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
mov dword [ebp - 0xa678], 0x2000
mov word [ebp - 0x25f0], ax
lea eax, [ebp - 0xa678]
push eax
lea eax, [ebp - 0x25f0]
push eax
push ebx
push ebx
push str.NameServer
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [ebp - 0x25f0], 0
jne 0x405c92
cmp dword [ebp - 0xa690], 0
je 0x405cb1
lea eax, [ebp - 0xa678]
mov dword [ebp - 0xa678], 0x2000
push eax
lea eax, [ebp - 0x25f0]
push eax
push ebx
push ebx
push str.DhcpNameServer
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [ebp - 0x25f0], 0
je 0x405cb1
lea eax, [ebp - 0x25f0]
push eax
lea eax, [edi + 0x1ec0]
push 0x6a4
push eax
call fcn.00552893
add esp, 0xc
jmp 0x405cb1
xor ebx, ebx
push ebx
push esi
call fcn.0054efda
pop ecx
pop ecx
lea esi, [eax + 2]
cmp word [esi], bx
jne 0x405b7e
mov edi, 0xd48
mov esi, dword [ebp - 0xa664]
push dword [ebp - 0xa66c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xa678]
mov dword [ebp - 0xa678], 0x104
push eax
lea eax, [ebp - 0x258]
inc esi
push eax
push esi
push dword [ebp - 0xa688]
mov dword [ebp - 0xa664], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x405a80
mov ebx, dword [ebp - 0xa680]
push dword [ebp - 0xa688]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Network_Card
mov ecx, 0x5e9970
call fcn.004071a5
mov edi, eax
mov eax, 0x58840c
push eax
mov ecx, edi
call fcn.004072d9
xor eax, eax
mov esi, eax
cmp dword [ebp - 0xa5f4], eax
jbe 0x405d95
invalid