Function at 0x10001ed4
Capabilities:
Contain obfuscated stackstrings
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x2c8
mov eax, dword [0x1000f060]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push ebx
push edi
xor ebx, ebx
push 0x63
mov dword [ebp - 0x250], eax
lea eax, [ebp - 7]
push ebx
push eax
mov byte [ebp - 8], bl
call fcn.10007ef0
add esp, 0xc
push str.kernel32.dll
mov dword [ebp - 0x248], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100021c2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetComputerNameA
push edi
call esi
push str.GetVolumeInformationA
push edi
mov dword [ebp - 0x24c], eax
call esi
mov esi, eax
cmp dword [ebp - 0x24c], ebx
je 0x10001f65
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x254], 0x64
call dword [ebp - 0x24c]
cmp esi, ebx
je 0x10001f7d
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x248]
push eax
push ebx
push ebx
push 0x1000dd84
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push 0x63
lea eax, [ebp - 0x133]
push ebx
push eax
mov dword [ebp - 0x240], 1
mov byte [ebp - 0x134], bl
call fcn.10007ef0
push 0x103
lea eax, [ebp - 0x237]
push ebx
push eax
mov dword [ebp - 0x244], 0x64
mov byte [ebp - 0x238], bl
call fcn.10007ef0
push str.stemBIOS
push str.RIPTIONSy
push str.HARDWAREDESC
push 0x1000dce8
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.10003147
add esp, 0x30
call esi
call esi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x238]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call esi
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
mov byte [ebp + 0x5c], 0x42
mov byte [ebp + 0x5d], 0x61
mov byte [ebp + 0x5e], 0x73
mov byte [ebp + 0x5f], 0x65
mov byte [ebp + 0x60], 0x42
mov byte [ebp + 0x61], 0x6f
mov byte [ebp + 0x62], 0x61
mov byte [ebp + 0x63], 0x72
mov byte [ebp + 0x64], 0x64
mov byte [ebp + 0x65], 0x50
mov byte [ebp + 0x66], 0x72
mov byte [ebp + 0x67], 0x6f
mov byte [ebp + 0x68], 0x64
mov byte [ebp + 0x69], 0x75
mov byte [ebp + 0x6a], 0x63
mov byte [ebp + 0x6b], 0x74
mov byte [ebp + 0x6c], bl
lea edi, [ebp + 0x6d]
stosb byte es:[edi], al
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp + 0x5c]
push eax
push dword [ebp - 0x23c]
call esi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x63
lea eax, [ebp - 0xcf]
push ebx
push eax
mov byte [ebp - 0xd0], bl
call fcn.10007ef0
push 0x63
mov byte [ebp - 0x6c], bl
push ebx
lea eax, [ebp - 0x6b]
push eax
call fcn.10007ef0
add esp, 0x18
lea eax, [ebp - 0x23c]
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x64
pop edi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x240]
push eax
push ebx
push str.Identifier
push dword [ebp - 0x23c]
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x240], 1
call esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x240]
push eax
push ebx
push str.ProcessorNameString
push dword [ebp - 0x23c]
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x240], 1
call esi
push dword [ebp - 0x248]
mov ebx, dword [ebp - 0x250]
push 0x1000de00
mov esi, 0x200
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov edi, 0x1000de04
push edi
push esi
push ebx
call fcn.10003165
lea eax, [ebp - 8]
push eax
push esi
push ebx
call fcn.10003165
push edi
push esi
push ebx
call fcn.10003165
lea eax, [ebp - 0x134]
push eax
push esi
push ebx
call fcn.10003165
add esp, 0x40
push edi
push esi
push ebx
call fcn.10003165
lea eax, [ebp - 0xd0]
push eax
push esi
push ebx
call fcn.10003165
add esp, 0x18
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push esi
push ebx
call fcn.10003165
lea eax, [ebp - 0x6c]
push eax
push esi
push ebx
call fcn.10003165
add esp, 0x18
pop esi
mov ecx, dword [ebp + 0x70]
pop edi
xor ecx, ebp
pop ebx
call fcn.10003014
add ebp, 0x74
leave
ret