Function at 0x10002db0
Capabilities:
Check for time delay via gettickcount
Get session user name
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 7
push 0xc0000000
push eax
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 0xa0], 0x406
mov dword [ebp - 0x9c], 0x413
mov dword [ebp - 0x98], 0x813
mov dword [ebp - 0x94], 0x409
mov dword [ebp - 0x90], 0x809
mov dword [ebp - 0x8c], 0xc09
mov dword [ebp - 0x88], 0x1009
mov dword [ebp - 0x84], 0x1409
mov dword [ebp - 0x80], 0x1809
mov dword [ebp - 0x7c], 0x40b
mov dword [ebp - 0x78], 0x40c
mov dword [ebp - 0x74], 0x80c0
mov dword [ebp - 0x70], 0xc0c
mov dword [ebp - 0x6c], 0x100c
mov dword [ebp - 0x68], 0x407
mov dword [ebp - 0x64], 0x807
mov dword [ebp - 0x60], 0xc07
mov dword [ebp - 0x5c], 0x40f
mov dword [ebp - 0x58], 0x410
mov dword [ebp - 0x54], 0x810
mov dword [ebp - 0x50], 0x414
mov dword [ebp - 0x4c], 0x814
mov dword [ebp - 0x48], 0x416
mov dword [ebp - 0x44], 0x816
mov dword [ebp - 0x40], 0x41d
mov dword [ebp - 0x3c], 0x40a
mov dword [ebp - 0x38], 0x80a
mov dword [ebp - 0x34], 0xc0a
mov dword [ebp - 0x30], 0x41f
mov dword [ebp - 0x2c], 0x415
mov dword [ebp - 0x28], 0x405
mov dword [ebp - 0x24], 0x41b
mov dword [ebp - 0x20], 0x40e
mov dword [ebp - 0x1c], 0x419
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10003501
push esi
push 0x104
lea ecx, [ebp - 0x1a4]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea edx, [ebp - 4]
push edx
push 0xa
push str.Process:
push edi
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x1a4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10002f27
push ebx
sub eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea edx, [ebp - 0x1a4]
push edx
push edi
mov dword [ebp - 4], ebx
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 4], ebx
call esi
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1a4]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push ebx
lea eax, [ebp - 4]
push eax
push 0xb
push str.Username:
push edi
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x1a4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10002f81
push ebx
sub eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea edx, [ebp - 0x1a4]
push edx
push edi
mov dword [ebp - 4], ebx
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 4], ebx
call esi
push 0x104
lea ecx, [ebp - 0x1a4]
push ecx
push str.PROCESSOR_IDENTIFIER
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
lea edx, [ebp - 4]
push edx
push 0xc
push str.Processor:
push edi
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x1a4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10002fe1
push ebx
sub eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea edx, [ebp - 0x1a4]
push edx
push edi
mov dword [ebp - 4], ebx
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 4], ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
push 0x104
movzx ecx, ax
lea edx, [ebp - 0x1a4]
push ebx
push edx
mov dword [ebp - 4], ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + eax*4 - 0xa0]
je 0x10003046
inc eax
cmp eax, 0x24
jl 0x10003032
jmp 0x10003062
mov dx, word [eax*4 + str.DAN_NLD_NLB_ENU_ENG_ENA_ENC_ENZ_ENI_FIN_FRA_FRB_FRC_FRS_DEU_DES_DEA_ISL_ITA_ITS_NOR_NON_PTB_PTG_SVE_ESP_ESM_ESN_TRK_PLK_CSY_SKY_HUN_RUS_GRE_ALL]
mov al, byte [eax*4 + 0x1001b992]
mov word [ebp - 0x1a4], dx
mov byte [ebp - 0x1a2], al
lea eax, [ebp - 0x1a4]
lea edx, [eax + 1]
jmp 0x10003070
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10003070
sub eax, edx
jne 0x10003085
mov dword [ebp - 0x1a4], 0x585858
push ebx
lea ecx, [ebp - 4]
push ecx
push 0xb
push str.Language:
push edi
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x1a4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100030a0
push ebx
lea edx, [ebp - 4]
push edx
sub eax, ecx
push eax
lea eax, [ebp - 0x1a4]
push eax
push edi
mov dword [ebp - 4], ebx
call esi
push ebx
lea ecx, [ebp - 4]
push ecx
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 4], ebx
call esi
push 0xc
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push str._dx_d__d
lea edx, [ebp - 0x1a4]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x18
push ebx
lea eax, [ebp - 4]
push eax
push 9
push str.Screen:
push edi
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x1a4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10003125
push ebx
sub eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea edx, [ebp - 0x1a4]
push edx
push edi
mov dword [ebp - 4], ebx
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 4], ebx
call esi
push 0x104
lea ecx, [ebp - 0x1a4]
push ecx
push str.dd:MMM:yyyy
push ebx
push ebx
push 0x409
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push ebx
lea edx, [ebp - 4]
push edx
push 7
push str.Date:
push edi
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x1a4]
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10003190
push ebx
sub eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea edx, [ebp - 0x1a4]
push edx
push edi
mov dword [ebp - 4], ebx
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 4], ebx
call esi
push 0x104
lea ecx, [ebp - 0x1a4]
push ecx
push str.HH:mm:ss
push ebx
push ebx
push 0x409
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push ebx
lea edx, [ebp - 4]
push edx
push 0xd
push str.Local_time:
push edi
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x1a4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100031f7
push ebx
sub eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea edx, [ebp - 0x1a4]
push edx
push edi
mov dword [ebp - 4], ebx
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 4], ebx
call esi
lea ecx, [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ecx, dword [ebp - 0x250]
mov eax, 0x88888889
imul ecx
add edx, ecx
mov eax, dword [ebp - 0x250]
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, ecx
shl edx, 4
sub edx, ecx
add edx, edx
add edx, edx
sub eax, edx
cdq
xor eax, edx
sub eax, edx
push eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
push eax
xor eax, eax
cmp dword [ebp - 0x250], ebx
lea ecx, [ebp - 0x1a4]
setg al
lea eax, [eax + eax + 0x2b]
push eax
push str._c_d:_02d
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x18
push ebx
lea edx, [ebp - 4]
push edx
push 6
push str.GMT:
push edi
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x1a4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100032b1
push ebx
sub eax, ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea edx, [ebp - 0x1a4]
push edx
push edi
mov dword [ebp - 4], ebx
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 4], ebx
call esi
push ebx
lea ecx, [ebp - 4]
push ecx
push 9
push str.Uptime:
push edi
mov dword [ebp - 4], ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov ecx, edx
shr ecx, 6
mov eax, 0xc22e4507
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
imul edx, edx, 0x15180
mov dword [ebp - 0xc], eax
mov eax, ecx
sub eax, edx
cdq
mov ecx, 0xe10
idiv ecx
mov dword [ebp - 4], eax
mov ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
mov ecx, dword [ebp - 4]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0xc]
push eax
push ecx
push edx
push str._dd__dh__dm
push 0x104
push 0x10023970
call dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, 0x10023970
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10003370
sub eax, ecx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov ecx, edx
shr ecx, 6
mov eax, 0xc22e4507
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
imul edx, edx, 0x15180
mov dword [ebp - 4], eax
mov eax, ecx
sub eax, edx
cdq
mov ecx, 0xe10
idiv ecx
mov dword [ebp - 0xc], eax
mov ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
mov ecx, dword [ebp - 0xc]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 4]
push eax
push ecx
push edx
push str._dd__dh__dm
push 0x104
push 0x10023970
call dword [sym.imp.MSVCRT.dll__snprintf]
mov ecx, dword [ebp - 8]
add esp, 0x18
push ebx
lea eax, [ebp - 0xc]
push eax
push ecx
push 0x10023970
push edi
mov dword [ebp - 0xc], ebx
call esi
push ebx
lea edx, [ebp - 8]
push edx
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 8], ebx
call esi
push 0x104
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push ebx
lea ecx, [ebp - 8]
push ecx
push 0x14
push str.Windows_directory:
push edi
mov dword [ebp - 8], ebx
call esi
lea eax, [ebp - 0x1a4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10003446
push ebx
lea edx, [ebp - 8]
push edx
sub eax, ecx
push eax
lea eax, [ebp - 0x1a4]
push eax
push edi
mov dword [ebp - 8], ebx
call esi
push ebx
lea ecx, [ebp - 8]
push ecx
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 8], ebx
call esi
push ebx
lea edx, [ebp - 8]
push edx
push 0x10
push str.Administrator:
push edi
mov dword [ebp - 8], ebx
call esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
mov eax, str.true
jne 0x1000349a
mov eax, str.false
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100034a0
sub eax, edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
mov eax, str.true
jne 0x100034c0
mov eax, str.false
mov edx, dword [ebp - 0xc]
push ebx
lea ecx, [ebp - 8]
push ecx
push edx
push eax
push edi
mov dword [ebp - 8], ebx
call esi
push ebx
lea eax, [ebp - 8]
push eax
push 2
push 0x1001b8f4
push edi
mov dword [ebp - 8], ebx
call esi
call fcn.10002c10
push edi
call fcn.10002640
push edi
call fcn.100028e0
push edi
call fcn.10002ab0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret