Function at 0x402e70
Capabilities:
Get hostname
Get keyboard layout
Get session user name

Disassembly:
sub esp, 0x118
push ebx
push esi
push edi
call fcn.00402870
call fcn.004027a0
mov ecx, dword [0x406898]
mov edx, dword [0x406894]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov dword [0x40692c], eax
movzx eax, word [0x406920]
push eax
mov eax, dword [0x406890]
push ecx
mov ecx, dword [0x40688c]
push edx
push eax
push ecx
push str.SI:_Major.Minor_d._d__Build_d__Plat_d__SuiteM_x_
push 0x406648
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
call fcn.00401730
push 0x40689c
push str.SI:_CSDV_s_
push 0x406648
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
add esp, 0x38
call fcn.00401730
mov eax, dword [0x40692c]
cmp eax, 0x1389
jg 0x402f93
je 0x402f89
cmp eax, 0x1ea
jg 0x402f54
je 0x402f4a
mov ecx, eax
sub ecx, 0x140
je 0x402f40
sub ecx, 0x50
je 0x402f36
sub ecx, 0xa
jne 0x402fe3
push str.OS:_Windows98_n_r
jmp 0x403017
push str.OS:_Windows95_n_r
jmp 0x403017
push str.OS:_Windows_NT3.51_n_r
jmp 0x403017
push str.OS:_WindowsME_n_r
jmp 0x403017
mov ecx, eax
sub ecx, 0xfa0
je 0x402f7f
sub ecx, 0x64
je 0x402f75
sub ecx, 0x384
jne 0x402fe3
push str.OS:_Windows_2000_n_r
jmp 0x403017
push str.OS:_Windows_NT4.0_Server_n_r
jmp 0x403017
push str.OS:_Windows_NT4.0_n_r
jmp 0x403017
push str.OS:_Windows_XP_n_r
jmp 0x403017
cmp eax, 0x13ed
jg 0x402fcc
je 0x402fc5
mov ecx, eax
sub ecx, 0x138a
je 0x402fbe
sub ecx, 0xa
je 0x402fb7
sub ecx, 0x58
jne 0x402fe3
push str.OS:_Windows_2000_Server_n_r
jmp 0x403017
push str.OS:_Windows_2003_R2_____n_r
jmp 0x403017
push str.OS:_Windows_2003_R2______n_r
jmp 0x403017
push str.OS:_Windows_XP_Server_____n_r
jmp 0x403017
mov ecx, eax
sub ecx, 0x13ee
je 0x403012
sub ecx, 0xa
je 0x40300b
sub ecx, 0x378
je 0x403004
push eax
push str.__d__n_r
push 0x406848
call esi
push 0x406848
push 0x406a40
call sub.MSVCRT.dll_strcpy
add esp, 0x14
jmp 0x403024
push str.OS:_Windows_Vista_n_r
jmp 0x403017
push str.OS:_Windows_Server_2003_R2_n_r
jmp 0x403017
push str.OS:_Windows_Server_2003_n_r
push 0x406a40
call sub.MSVCRT.dll_strcpy
add esp, 8
call fcn.00401730
call fcn.00402de0
test eax, eax
jne 0x403039
push str._OS:_32_bits_
jmp 0x40303e
push str._OS:_64_bits_
push 0x406a40
call sub.MSVCRT.dll_strcpy
add esp, 8
call fcn.00401730
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push edx
push eax
push str.AffinityMaskProc_Sys_x__x
push 0x406648
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
add esp, 0x18
call fcn.00401730
call dword [sym.imp.KERNEL32.dll_GetTickCount]
fld qword [0x405090]
lea ecx, [esp + 0xc]
fstp qword [esp + 0x1c]
push ecx
mov edi, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x403133
mov ecx, dword [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x2c]
push 0x405088
push edx
call esi
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.MSVCRT.dll_atof]
fstp qword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
lea eax, [esp + 0x40]
push 0x405088
push eax
call esi
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.MSVCRT.dll_atof]
mov eax, dword [esp + 0x3c]
fmul qword [0x405080]
add esp, 0x28
fdiv qword [esp + 0x1c]
jmp 0x403137
fld qword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
push edx
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
sub esp, 8
fstp qword [esp]
push edi
push str.TickCount_u__f__PerfCount_Freq_I64u__I64u
push 0x406648
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
call fcn.00401730
push str.locale__ALL_CTYPE
push 0x406648
call esi
mov edi, dword [sym.imp.MSVCRT.dll_setlocale]
push 0x404c79
push ebx
call edi
add esp, 0x3c
cmp eax, ebx
jne 0x403194
mov eax, 0x404c79
push eax
push 0x406648
call sub.MSVCRT.dll_strlen
add eax, 0x406648
add esp, 4
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x405034
push 0x406648
call sub.MSVCRT.dll_strlen
add eax, 0x406648
add esp, 4
push eax
call sub.MSVCRT.dll_strcat
push ebx
push ebx
call edi
add esp, 0x10
cmp eax, ebx
jne 0x4031dd
mov eax, 0x404c79
push eax
push 0x406648
call sub.MSVCRT.dll_strlen
add eax, 0x406648
add esp, 4
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x405034
push 0x406648
call sub.MSVCRT.dll_strlen
add eax, 0x406648
add esp, 4
push eax
call sub.MSVCRT.dll_strcat
push ebx
push 2
call edi
add esp, 0x10
cmp eax, ebx
jne 0x403227
mov eax, 0x404c79
push eax
push 0x406648
call sub.MSVCRT.dll_strlen
add eax, 0x406648
add esp, 4
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x405030
push 0x406648
call sub.MSVCRT.dll_strlen
add eax, 0x406648
add esp, 4
push eax
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
add esp, 0x10
call fcn.00401730
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push str.kLANG_Ix_
push 0x406648
call esi
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push eax
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
push str.__ACP_d__d
push 0x406648
call sub.MSVCRT.dll_strlen
add eax, 0x406648
add esp, 4
push eax
call esi
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push eax
push str.__LCID_x__x
push 0x406648
call sub.MSVCRT.dll_strlen
add eax, 0x406648
add esp, 4
push eax
call esi
push 0x406648
push 0x406a40
call sub.MSVCRT.dll_strcpy
call fcn.00401730
push str.User
push 0x406648
call sub.MSVCRT.dll_strcpy
push 0x406648
call sub.MSVCRT.dll_strlen
mov edx, 0x1fe
sub edx, eax
add esp, 0x24
lea eax, [esp + 0xc]
push eax
push 0x406648
mov dword [esp + 0x14], edx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 0x406648
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x403363
cmp dword [esp + 0xc], ebx
jle 0x403363
push 0x405030
push 0x406648
call sub.MSVCRT.dll_strcat
push eax
push 0x406a40
call sub.MSVCRT.dll_strcpy
add esp, 0x10
call fcn.00401730
push str.Computer
push 0x406648
call sub.MSVCRT.dll_strcpy
push 0x406648
call sub.MSVCRT.dll_strlen
add esp, 0xc
lea edx, [esp + 0xc]
mov ecx, 0x1fe
push edx
sub ecx, eax
push 0x406648
mov dword [esp + 0x14], ecx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 0x406648
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x4033d4
cmp dword [esp + 0xc], ebx
jle 0x4033d4
push 0x405030
push 0x406648
call sub.MSVCRT.dll_strcat
push eax
push 0x406a40
call sub.MSVCRT.dll_strcpy
add esp, 0x10
call fcn.00401730
call fcn.00402bf0
pop edi
pop esi
pop ebx
add esp, 0x118
ret