Function at 0x1021f15
Capabilities:
Get cpu information
Get hostname
Get memory capacity
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x1a4
mov eax, dword [0x1067a40]
push ebx
push esi
mov esi, dword [ebp + 0x7c]
push edi
mov dword [ebp + 0x70], eax
xor eax, eax
mov ecx, 0xd8
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xe4]
push eax
xor ebx, ebx
lea edi, [esi + 0xc]
push edi
mov word [esi], 2
mov word [esi + 2], 1
mov word [esi + 4], 0xece
mov word [esi + 6], bx
mov word [esi + 8], bx
mov dword [ebp - 0xe4], 0x20
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x1021f80
push 0x20
push 0x10034b4
push edi
call fcn.01021459
lea ecx, [ebp - 0xe4]
lea eax, [esi + 0x2c]
push ecx
mov edi, 0x104
push eax
mov dword [ebp - 0xe4], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1021fc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
mov eax, 0x1005ca8
je 0x1021fb7
mov eax, 0x10034b4
push edi
push eax
lea eax, [esi + 0x2c]
push eax
call fcn.01021459
push 0x27
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1021ffa
push 0x27
pop ecx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x264], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x268], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x26c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x270], eax
mov ax, word [ebp + 0x68]
mov word [esi + 0x274], ax
mov ax, word [ebp + 0x6a]
mov word [esi + 0x276], ax
mov ax, word [ebp + 0x6c]
mov word [esi + 0x278], ax
movzx ax, byte [ebp + 0x6e]
mov word [esi + 0x27a], ax
mov edi, 0x80
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [esi + 0x27c]
push eax
mov byte [ebp + 0x67], bl
call fcn.01021459
lea eax, [ebp - 0xe0]
push eax
push 1
push ebx
push 0x1005c78
push 0x80000002
mov dword [ebp - 0xe0], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1022161
lea ecx, [ebp - 0xdc]
push ecx
lea eax, [esi + 0x160]
push eax
lea eax, [ebp + 0x7c]
push eax
push ebx
push 0x1005c6c
push dword [ebp - 0xe0]
mov dword [ebp - 0xdc], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp + 0x7c], ebx
call edi
test eax, eax
jne 0x10220cd
cmp dword [ebp + 0x7c], 1
jne 0x10220cd
mov byte [esi + 0x1df], bl
jmp 0x10220d3
mov byte [esi + 0x160], bl
lea ecx, [ebp - 0xdc]
push ecx
lea eax, [esi + 0x1e0]
push eax
lea eax, [ebp + 0x7c]
push eax
push ebx
push 0x1005c58
push dword [ebp - 0xe0]
mov dword [ebp - 0xdc], 0x80
mov dword [ebp + 0x7c], ebx
call edi
test eax, eax
jne 0x1022112
cmp dword [ebp + 0x7c], 1
jne 0x1022112
mov byte [esi + 0x25f], bl
jmp 0x1022118
mov byte [esi + 0x1e0], bl
lea ecx, [ebp - 0xdc]
push ecx
lea eax, [esi + 0x260]
push eax
lea eax, [ebp + 0x7c]
push eax
push ebx
push 0x1005c50
push dword [ebp - 0xe0]
mov dword [ebp - 0xdc], 4
mov dword [ebp + 0x7c], ebx
call edi
test eax, eax
jne 0x102214f
cmp dword [ebp + 0x7c], 4
je 0x1022155
mov dword [esi + 0x260], ebx
push dword [ebp - 0xe0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x108]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x108]
mov dword [esi + 0x130], eax
mov eax, dword [ebp - 0x104]
mov dword [esi + 0x134], eax
mov eax, dword [ebp - 0x100]
cdq
mov dword [esi + 0x138], eax
mov eax, dword [ebp - 0xfc]
mov dword [esi + 0x13c], edx
cdq
mov dword [esi + 0x140], eax
mov eax, dword [ebp - 0xf8]
mov dword [esi + 0x148], eax
mov eax, dword [ebp - 0xf4]
mov dword [esi + 0x150], eax
mov eax, dword [ebp - 0xf0]
mov dword [esi + 0x154], eax
mov eax, dword [ebp - 0xec]
mov dword [esi + 0x158], eax
mov ax, word [ebp - 0xe8]
mov word [esi + 0x15c], ax
mov ax, word [ebp - 0xe6]
mov dword [esi + 0x144], edx
mov dword [esi + 0x14c], ebx
mov word [esi + 0x15e], ax
cmp byte [0x10691d9], bl
je 0x1022218
or byte [esi + 0xa], 1
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x128]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x124]
mov dword [esi + 0x2fc], eax
mov eax, dword [ebp - 0x120]
mov dword [esi + 0x300], eax
mov eax, dword [ebp - 0x11c]
mov dword [esi + 0x308], eax
mov eax, dword [ebp - 0x118]
mov dword [esi + 0x310], eax
mov eax, dword [ebp - 0x114]
mov dword [esi + 0x318], eax
mov eax, dword [ebp - 0x110]
mov dword [esi + 0x320], eax
mov eax, dword [ebp - 0x10c]
push 0x2b
mov dword [esi + 0x328], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0xd8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd8]
push eax
mov dword [esi + 0x304], ebx
mov dword [esi + 0x30c], ebx
mov dword [esi + 0x314], ebx
mov dword [esi + 0x31c], ebx
mov dword [esi + 0x324], ebx
mov dword [esi + 0x32c], ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 2
push 0x20
jne 0x10222ea
lea eax, [ebp - 0x80]
push eax
lea eax, [esi + 0x330]
push eax
call fcn.0103801d
mov ecx, dword [ebp - 0x30]
jmp 0x1022303
lea eax, [ebp - 0xd4]
push eax
lea eax, [esi + 0x330]
push eax
call fcn.0103801d
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0xd8]
add ecx, eax
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
mov dword [esi + 0x350], ecx
mov byte [esi + 0x34f], bl
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [esi + 0x354]
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, dword [ebp + 0x70]
pop edi
mov word [esi + 0x35c], ax
pop esi
pop ebx
call fcn.01032376
add ebp, 0x74
leave
ret 4