Function at 0x4031b0
Capabilities:
Get common file path
Get hostname
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44448c
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x309c
call fcn.0041de70
mov eax, dword [0x453170]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x3080], 0
push 0x459940
movups xmmword [ebp - 0x3090], xmm0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x459940
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0x459940
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0x459940
push 0
push 0xfde9
call esi
push 0
push 0
push 0x455730
mov dword [0x45572c], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x455730
push 0
push 0xfde9
call esi
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0x455730
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x455730
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x450b90]
movaps xmm1, xmmword [0x450bb0]
mov dword [0x455938], edi
mov esi, dword [eax]
mov dword [ebp - 0x309c], esi
mov eax, dword [esi + 0x240]
test al, 1
jne 0x40331e
or eax, 1
mov dword [esi + 0x240], eax
mov dword [ebp - 4], 0
mov byte [esi + 0x17c], 1
movups xmmword [esi + 0x15c], xmm0
push 0x444a60
movups xmmword [esi + 0x16c], xmm1
call fcn.0041dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x17c], 0
lea eax, [eax + 0x15c]
mov dword [ebp - 0x3024], eax
je 0x403387
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov esi, dword [ebp - 0x301c]
mov edi, dword [ebp - 0x3020]
nop dword [eax]
mov ecx, edi
mov eax, 0xdff74797
and ecx, 7
mov edx, 0xe1d7bf93
shl ecx, 3
call fcn.00443dd0
mov ecx, dword [ebp - 0x3024]
xor byte [ecx + edi], al
add edi, 1
adc esi, 0
jne 0x40337d
cmp edi, 0x20
jb 0x403350
mov esi, dword [ebp - 0x309c]
mov byte [ecx + 0x20], 0
mov eax, dword [esi + 0x258]
mov dword [ebp - 0x3044], 1
mov dword [ebp - 0x3038], 0xb79426da
mov dword [ebp - 0x3034], 0xa6b2d1fa
mov dword [ebp - 0x3030], 0xdf932ee2
test al, 1
jne 0x403400
or eax, 1
mov dword [esi + 0x258], eax
mov dword [ebp - 4], 1
movq xmm0, qword [ebp - 0x3038]
mov eax, dword [ebp - 0x3030]
mov byte [esi + 0xb4], 1
movq qword [esi + 0xa8], xmm0
push 0x444a40
mov dword [esi + 0xb0], eax
call fcn.0041dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 0xb4], 0
lea edi, [esi + 0xa8]
je 0x40345f
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov eax, dword [ebp - 0x301c]
mov esi, dword [ebp - 0x3020]
mov dword [ebp - 0x3070], eax
nop dword [eax]
mov ecx, esi
mov eax, 0xdff74797
and ecx, 7
mov edx, 0xe1d7bf93
shl ecx, 3
call fcn.00443dd0
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x3070], 0
jne 0x40345b
cmp esi, 0xc
jb 0x403430
mov byte [edi + 0xc], 0
lea eax, [ebp - 0x3074]
mov dword [ebp - 0x30a0], 0
push eax
push 0x101
push 0
push dword [ebp - 0x3024]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4034f9
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x3078]
push eax
push 0
push 0
push 0
push edi
push dword [ebp - 0x3074]
call esi
test eax, eax
jne 0x4034ed
mov eax, dword [ebp - 0x3078]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x3078]
mov dword [ebp - 0x30a0], eax
push ecx
push eax
lea eax, [ebp - 0x3044]
push eax
push 0
push edi
push dword [ebp - 0x3074]
call esi
test eax, eax
je 0x4034ed
push dword [ebp - 0x30a0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x3074]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40350b
lea eax, [ebp - 0x2018]
mov dword [ebp - 0x3028], 0x1000
push 0x1000
push 0
push eax
call fcn.0041f670
add esp, 0xc
lea eax, [ebp - 0x3028]
push eax
lea eax, [ebp - 0x2018]
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
jmp 0x403553
jmp 0x403565
lea eax, [ebp - 0x3018]
mov dword [ebp - 0x3028], 0x1000
push 0x1000
push 0
push eax
call fcn.0041f670
add esp, 0xc
lea eax, [ebp - 0x3028]
push eax
lea eax, [ebp - 0x3018]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x4035ab
lea eax, [ebp - 0x1018]
push dword [ebp - 0x3028]
push 0
push eax
call fcn.0041f670
add esp, 0xc
lea eax, [ebp - 0x3090]
push eax
push 0x64
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
test eax, eax
jne 0x4035fa
push dword [ebp - 0x3088]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
lea eax, [ebp - 0x1018]
jle 0x403600
push dword [ebp - 0x3088]
jmp 0x403605
lea eax, [ebp - 0x1018]
push str.NONE
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x3070]
mov dword [ebp - 0x3048], 1
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x30a8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4036b4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x307c]
push eax
push 0
push 0
push 0
push str.ProductName
push dword [ebp - 0x3070]
call esi
test eax, eax
jne 0x4036a8
mov eax, dword [ebp - 0x307c]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
lea eax, [ebp - 0x307c]
push eax
push edi
lea eax, [ebp - 0x3048]
mov dword [ebp - 0x30a8], edi
push eax
push 0
push str.ProductName
push dword [ebp - 0x3070]
call esi
test eax, eax
je 0x4036a8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x3070]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x309c]
movaps xmm0, xmmword [0x450ba0]
mov dword [ebp - 0x3030], 0xc5a4055b
mov eax, dword [esi + 0x1dc]
test al, 1
jne 0x403713
or eax, 1
mov dword [esi + 0x1dc], eax
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x3030]
mov byte [esi + 0x294], 1
movups xmmword [esi + 0x280], xmm0
push 0x444760
mov dword [esi + 0x290], eax
call fcn.0041dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x294], 0
lea ecx, [eax + 0x280]
mov dword [ebp - 0x3098], ecx
je 0x403778
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov esi, dword [ebp - 0x301c]
mov edi, dword [ebp - 0x3020]
mov ecx, edi
mov eax, 0xc5cb6335
and ecx, 7
mov edx, 0x95db052f
shl ecx, 3
call fcn.00443dd0
mov ecx, dword [ebp - 0x3098]
xor byte [ecx + edi], al
add edi, 1
adc esi, 0
jne 0x40376e
cmp edi, 0x14
jb 0x403741
mov esi, dword [ebp - 0x309c]
mov byte [ecx + 0x14], 0
push ecx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40379a
lea ecx, [ebp - 0x306c]
push ecx
call eax
jmp 0x4037a7
lea eax, [ebp - 0x306c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x306c]
cmp ax, 9
je 0x4037d1
cmp ax, 6
je 0x4037d1
cmp ax, 7
je 0x4037d1
test ax, ax
jne 0x4037db
mov dword [0x455934], 0
jmp 0x4037db
mov dword [0x455934], 1
call fcn.00406960
mov dword [0x455518], eax
call fcn.00401750
call fcn.004068a0
mov ecx, dword [esi + 0xa4]
mov dword [0x455514], eax
mov word [ebp - 0x3024], 0xf390
test cl, 1
jne 0x403843
or ecx, 1
mov dword [esi + 0xa4], ecx
mov dword [ebp - 4], 3
mov ax, word [ebp - 0x3024]
mov word [esi + 0x252], 0x1ef
push 0x444a20
mov word [esi + 0x250], ax
call fcn.0041dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x253], 0
lea ecx, [eax + 0x250]
mov dword [ebp - 0x3098], ecx
je 0x4038a8
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov esi, dword [ebp - 0x301c]
mov edi, dword [ebp - 0x3020]
mov ecx, edi
mov eax, 0xfbef85f1
and ecx, 7
mov edx, 0xdda31969
shl ecx, 3
call fcn.00443dd0
mov ecx, dword [ebp - 0x3098]
xor byte [edi + ecx], al
add edi, 1
adc esi, 0
jne 0x40389e
cmp edi, 3
jb 0x403871
mov esi, dword [ebp - 0x309c]
mov byte [ecx + 3], 0
push dword [0x455514]
push ecx
push dword [0x455518]
call fcn.00406620
mov edi, 0x455940
mov byte [ebp - 0x3091], 0
mov dword [ebp - 0x30a4], edi
mov dword [ebp - 0x3098], 4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x4039ec
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, edi
mov edx, eax
call fcn.00401130
mov ecx, dword [esi + 0xe0]
mov dword [ebp - 0x3024], eax
mov dword [ebp - 0x3020], 0xfecc4033
test cl, 1
jne 0x40394b
or ecx, 1
mov dword [esi + 0xe0], ecx
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x3020]
mov word [esi + 0x26c], 0x155
push 0x444a00
mov dword [esi + 0x268], eax
call fcn.0041dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x26d], 0
lea ecx, [eax + 0x268]
mov dword [ebp - 0x30ac], ecx
je 0x4039bd
xorps xmm0, xmm0
movlpd qword [ebp - 0x3038], xmm0
mov edi, dword [ebp - 0x3034]
mov esi, dword [ebp - 0x3038]
nop dword [eax]
mov ecx, esi
mov eax, 0x9ba1215d
and ecx, 7
mov edx, 0x85990355
shl ecx, 3
call fcn.00443dd0
mov ecx, dword [ebp - 0x30ac]
xor byte [esi + ecx], al
add esi, 1
adc edi, 0
jne 0x4039ad
cmp esi, 5
jb 0x403980
mov esi, dword [ebp - 0x309c]
mov edi, dword [ebp - 0x30a4]
mov byte [ecx + 5], 0
push dword [ebp - 0x3024]
push ecx
push dword [0x455514]
call fcn.00406790
mov eax, dword [ebp - 0x3024]
test eax, eax
je 0x4039e2
push eax
call fcn.004210ac
add esp, 4
mov al, 1
mov byte [ebp - 0x3091], al
jmp 0x4039f2
mov al, byte [ebp - 0x3091]
add edi, 0x1000
sub dword [ebp - 0x3098], 1
mov dword [ebp - 0x30a4], edi
jne 0x4038d6
test al, al
jne 0x403acd
mov eax, dword [esi + 0x22c]
mov dword [ebp - 0x3020], 0x1aa3e88f
test al, 1
jne 0x403a60
or eax, 1
mov dword [esi + 0x22c], eax
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x3020]
mov word [esi + 0x218], 0x1a3
push 0x4449c0
mov dword [esi + 0x214], eax
call fcn.0041dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi + 0x21c]
mov dword [ebp - 0x3020], 0x3a80c6af
test al, 1
jne 0x403aa6
or eax, 1
mov dword [esi + 0x21c], eax
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x3020]
mov word [esi + 0x1f8], 0x1a3
push 0x4449e0
mov dword [esi + 0x1f4], eax
call fcn.0041dbad
add esp, 4
lea ecx, [esi + 0x214]
call fcn.004063f0
push eax
push ecx
lea ecx, [esi + 0x1f4]
call fcn.004063f0
add esp, 4
push eax
push dword [0x455514]
call fcn.00406790
mov esi, dword [ebp - 0x30a0]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov ecx, esi
call fcn.00401130
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x45593c], eax
lea eax, [ebp - 0x2018]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x2018]
mov edx, eax
call fcn.00401130
mov dword [0x459d54], eax
lea eax, [ebp - 0x3018]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x3018]
mov edx, eax
call fcn.00401130
mov dword [0x459d50], eax
lea eax, [ebp - 0x1018]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x1018]
mov edx, eax
call fcn.00401130
mov edi, dword [ebp - 0x30a8]
push edi
mov dword [0x455728], eax
call esi
add eax, eax
mov ecx, edi
mov edx, eax
call fcn.00401130
push dword [0x455518]
mov dword [0x459d5c], eax
call fcn.00406bc0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [0x455518]
mov esi, eax
call fcn.00406bc0
mov edx, esi
mov ecx, eax
call fcn.00401130
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [0x459b44], eax
mov eax, dword [0x459d58]
add eax, 0x2ac
push eax
call esi
mov ecx, dword [0x459d58]
mov edx, eax
add ecx, 0x2ac
call fcn.00401130
mov dword [0x459b40], eax
mov eax, dword [0x459d58]
add eax, 0x2ec
push eax
call esi
mov ecx, dword [0x459d58]
mov edx, eax
add ecx, 0x2ec
call fcn.00401130
mov esi, dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push 0x455930
push 0
push 0
push 0x4452f0
mov dword [0x455510], eax
call esi
push 0x455724
push 0
push 0
push 0x4452e0
call esi
push 0x455720
push 0
push 0
push 0x4452d0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call esi
push dword [ebp - 0x30a0]
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041d829
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret