Function at 0x401340
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x100
call fcn.00401ea0
mov dword [esp + 0xfc], 0
mov dword [esp + 0xf8], 0x14
mov eax, dword [esp + 0xf8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sub.msvcrt.dll_calloc
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0xf4]
mov dword [eax], 0x52534d42
mov eax, dword [esp + 0xf4]
mov dword [eax + 4], 1
mov edx, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf8]
lea eax, [esp + 0xf8]
mov dword [esp], 0x4c
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call sub.ntdll.dll_NtQuerySystemInformation
sub esp, 0x10
mov dword [esp + 0xf0], eax
cmp dword [esp + 0xf0], 0xc0000023
jne 0x401453
mov ecx, dword [esp + 0xf4]
mov eax, dword [esp + 0xf8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
mov dword [esp + 0xf4], eax
mov ecx, dword [esp + 0xf8]
mov eax, dword [esp + 0xf4]
mov dword [eax + 0xc], ecx
mov edx, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf8]
lea eax, [esp + 0xf8]
mov dword [esp], 0x4c
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call sub.ntdll.dll_NtQuerySystemInformation
sub esp, 0x10
mov dword [esp + 0xf0], eax
cmp dword [esp + 0xf0], 0
jge 0x401499
mov eax, dword [esp + 0xf0]
lea ecx, str.NtQuerySystemInformation_failed:__lx_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0xf4]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0xfc], 1
jmp 0x401db9
mov eax, dword [esp + 0xf4]
add eax, 0x10
mov dword [esp + 0xec], eax
mov dword [esp + 0xe8], 8
mov eax, dword [esp + 0xe8]
cmp eax, dword [esp + 0xf8]
jae 0x40197d
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
mov al, byte [eax + ecx]
mov byte [esp + 0xe7], al
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
mov al, byte [eax + ecx + 1]
mov byte [esp + 0xe6], al
lea eax, [esp + 0xc8]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1e
call sub.msvcrt.dll_memset
movzx eax, byte [esp + 0xe7]
cmp eax, 1
jne 0x4015fd
movzx eax, byte [esp + 0xe6]
cmp eax, 0x19
jl 0x4015fd
movzx eax, byte [esp + 0xe7]
lea ecx, [0x408072]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov dword [esp + 0xc4], 0
cmp dword [esp + 0xc4], 0x10
jge 0x4015b4
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
add ecx, 8
add ecx, dword [esp + 0xc4]
movzx eax, byte [eax + ecx]
lea ecx, str._02x
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0xc4]
add eax, 1
mov dword [esp + 0xc4], eax
jmp 0x401562
lea eax, [0x40807c]
mov dword [esp], eax
call fcn.00401dd0
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
movzx eax, byte [eax + ecx + 7]
mov byte [esp + eax + 0xc8], 1
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
movzx eax, byte [eax + ecx + 0x19]
mov byte [esp + eax + 0xc8], 1
jmp 0x401834
movzx eax, byte [esp + 0xe7]
cmp eax, 2
jne 0x401691
movzx eax, byte [esp + 0xe6]
cmp eax, 8
jl 0x401691
movzx eax, byte [esp + 0xe7]
lea ecx, [0x408072]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov dword [esp + 0xc0], 0
cmp dword [esp + 0xc0], 4
jge 0x40168c
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
add ecx, 4
add ecx, dword [esp + 0xc0]
movzx eax, byte [eax + ecx]
mov byte [esp + eax + 0xc8], 1
mov eax, dword [esp + 0xc0]
add eax, 1
mov dword [esp + 0xc0], eax
jmp 0x401644
jmp 0x40182f
movzx eax, byte [esp + 0xe7]
cmp eax, 4
jne 0x401773
movzx eax, byte [esp + 0xe6]
cmp eax, 0x11
jl 0x401773
movzx eax, byte [esp + 0xe7]
lea ecx, [0x408072]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov dword [esp + 0xbc], 0
cmp dword [esp + 0xbc], 8
jge 0x40172a
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
add ecx, 8
add ecx, dword [esp + 0xbc]
movzx eax, byte [eax + ecx]
lea ecx, str._02x
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0xbc]
add eax, 1
mov dword [esp + 0xbc], eax
jmp 0x4016d8
lea eax, [0x40807c]
mov dword [esp], eax
call fcn.00401dd0
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
movzx eax, byte [eax + ecx + 7]
mov byte [esp + eax + 0xc8], 1
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
movzx eax, byte [eax + ecx + 0x10]
mov byte [esp + eax + 0xc8], 1
jmp 0x40182a
movzx eax, byte [esp + 0xe7]
cmp eax, 0x11
jne 0x401825
movzx eax, byte [esp + 0xe6]
cmp eax, 0x1b
jl 0x401825
movzx eax, byte [esp + 0xe7]
lea ecx, [0x408072]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
movzx eax, word [eax + ecx + 0xc]
lea ecx, [0x40807e]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
movzx eax, byte [eax + ecx + 0x17]
mov byte [esp + eax + 0xc8], 1
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
movzx eax, byte [eax + ecx + 0x18]
mov byte [esp + eax + 0xc8], 1
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
movzx eax, byte [eax + ecx + 0x1a]
mov byte [esp + eax + 0xc8], 1
jmp 0x40182a
jmp 0x40182f
jmp 0x401834
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb4], 0
mov eax, dword [esp + 0xe8]
movzx ecx, byte [esp + 0xe6]
add eax, ecx
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0xe8]
mov ecx, dword [esp + 0xf8]
sub ecx, 1
cmp eax, ecx
jae 0x401978
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
movzx eax, byte [eax + ecx]
cmp eax, 0
jne 0x401924
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
movzx eax, byte [eax + ecx + 1]
cmp eax, 0
jne 0x4018c8
mov eax, dword [esp + 0xe8]
add eax, 2
mov dword [esp + 0xe8], eax
jmp 0x401978
cmp dword [esp + 0xb4], 0
je 0x40191a
mov eax, dword [esp + 0xb8]
test byte [esp + eax + 0xc8], 1
je 0x40190f
mov ecx, dword [esp + 0xb8]
mov eax, dword [esp + 0xb4]
lea edx, str._d__s_n
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00401dd0
mov dword [esp + 0xb4], 0
jmp 0x40191f
jmp 0x40195d
cmp dword [esp + 0xb4], 0
jne 0x401958
mov eax, dword [esp + 0xec]
add eax, dword [esp + 0xe8]
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0xb8]
add eax, 1
mov dword [esp + 0xb8], eax
jmp 0x40195d
jmp 0x401962
mov eax, dword [esp + 0xe8]
add eax, 1
mov dword [esp + 0xe8], eax
jmp 0x401862
jmp 0x4014b5
mov eax, dword [esp + 0xf4]
mov dword [esp], eax
call sub.msvcrt.dll_free
lea ecx, [esp + 0x8e]
lea eax, str.__PhysicalDrive0
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x26
call sub.msvcrt.dll_memcpy
lea eax, [esp + 0x8e]
lea ecx, [esp + 0x84]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.ntdll.dll_RtlInitUnicodeString
sub esp, 8
mov dword [esp + 0x6c], 0x18
mov dword [esp + 0x70], 0
mov dword [esp + 0x78], 0x40
lea eax, [esp + 0x84]
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
lea edx, [esp + 0x68]
lea ecx, [esp + 0x6c]
lea eax, [esp + 0x60]
mov dword [esp], edx
mov dword [esp + 4], 0x80
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0x40
call sub.ntdll.dll_NtOpenFile
sub esp, 0x18
mov dword [esp + 0xf0], eax
cmp dword [esp + 0xf0], 0
jge 0x401a75
mov eax, dword [esp + 0xf0]
lea ecx, str.NtOpenFile_failed:__lx_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov dword [esp + 0xfc], 1
jmp 0x401db9
lea eax, [esp + 0x54]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call sub.msvcrt.dll_memset
mov esi, dword [esp + 0x68]
xor eax, eax
lea edx, [esp + 0x60]
lea ecx, [esp + 0x54]
lea eax, [esp + 0x4c]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0x2d1400
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 8
call sub.ntdll.dll_NtDeviceIoControlFile
sub esp, 0x28
mov dword [esp + 0xf0], eax
cmp dword [esp + 0xf0], 0
jge 0x401b38
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, str.NtDeviceIoControlFile1_1_failed:__lx_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
mov dword [esp + 0xfc], 1
jmp 0x401db9
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 0xec], eax
mov edi, dword [esp + 0x68]
mov ecx, dword [esp + 0xec]
mov eax, dword [esp + 0x50]
xor edx, edx
lea esi, [esp + 0x60]
lea edx, [esp + 0x54]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0x2d1400
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call sub.ntdll.dll_NtDeviceIoControlFile
sub esp, 0x28
mov dword [esp + 0xf0], eax
cmp dword [esp + 0xf0], 0
jge 0x401c02
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, str.NtDeviceIoControlFile1_2_failed:__lx_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0xec]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
mov dword [esp + 0xfc], 1
jmp 0x401db9
mov edx, dword [esp + 0x68]
xor eax, eax
lea ecx, [esp + 0x60]
lea eax, [esp + 0x30]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0x70000
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x18
call sub.ntdll.dll_NtDeviceIoControlFile
sub esp, 0x28
mov dword [esp + 0xf0], eax
cmp dword [esp + 0xf0], 0
jge 0x401ca8
mov eax, dword [esp + 0xf0]
lea ecx, str.NtDeviceIoControlFile_2_failed:__lx_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
mov dword [esp + 0xfc], 1
jmp 0x401db9
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
sub esp, 4
mov eax, dword [esp + 0xec]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp dword [eax + 0xc], 0
je 0x401cf0
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0x2c]
add eax, dword [ecx + 0xc]
lea ecx, str.Vendor:__s_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0x2c]
cmp dword [eax + 0x10], 0
je 0x401d1e
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0x2c]
add eax, dword [ecx + 0x10]
lea ecx, str.Product:__s_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0x2c]
cmp dword [eax + 0x18], 0
je 0x401d4c
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0x2c]
add eax, dword [ecx + 0x18]
lea ecx, str.SerialNumber:__s_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00401dd0
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
imul eax, ecx
mov ecx, dword [esp + 0x3c]
imul eax, ecx
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov edx, eax
imul edx, esi
mov dword [esp + 0x28], edx
mul ecx
mov ecx, eax
mov eax, dword [esp + 0x28]
add edx, eax
mov eax, esp
mov dword [eax + 8], edx
mov dword [eax + 4], ecx
mov dword [eax], str.Size:__lld_n
call fcn.00401dd0
mov eax, dword [esp + 0xec]
mov dword [esp], eax
call sub.msvcrt.dll_free
lea eax, str.Press_any_key..._n
mov dword [esp], eax
call fcn.00401dd0
call sub.msvcrt.dll_getchar
mov dword [esp + 0xfc], 0
mov eax, dword [esp + 0xfc]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret