Function at 0x401939
Capabilities:
Contain obfuscated stackstrings
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x474194]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x2c4], eax
mov al, byte [0x46c12a]
push 0x63
mov byte [ebp - 0x7c], al
xor edi, edi
lea eax, [ebp - 0x7b]
push edi
push eax
call fcn.00456240
add esp, 0xc
push str.kernel32.dll
mov dword [ebp - 0x2bc], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, edi
je 0x401c1a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetComputerNameA
push ebx
call esi
push str.GetVolumeInformationA
push ebx
mov dword [ebp - 0x2c0], eax
call esi
mov esi, eax
cmp dword [ebp - 0x2c0], edi
je 0x4019cd
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x7c]
push eax
mov dword [ebp - 0x2c8], 0x64
call dword [ebp - 0x2c0]
cmp esi, edi
je 0x4019e5
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2bc]
push eax
push edi
push edi
push 0x46b76c
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov bl, byte [0x46c12a]
push 0x63
lea eax, [ebp - 0x1a7]
push edi
push eax
mov dword [ebp - 0x2b4], 1
mov byte [ebp - 0x1a8], bl
call fcn.00456240
push 0x103
lea eax, [ebp - 0x2ab]
push edi
push eax
mov dword [ebp - 0x2b8], 0x64
mov byte [ebp - 0x2ac], bl
call fcn.00456240
push str.stemBIOS
push str.RIPTIONSy
push str.HARDWAREDESC
push str._s_s_s
lea eax, [ebp - 0x2ac]
push 0x104
push eax
call fcn.00450396
add esp, 0x30
call esi
call esi
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x2ac]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call esi
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
mov dword [ebp - 0x18], 0x65736142
mov dword [ebp - 0x14], 0x72616f42
mov dword [ebp - 0x10], 0x6f725064
mov dword [ebp - 0xc], 0x74637564
mov byte [ebp - 8], 0
lea edi, [ebp - 7]
stosb byte es:[edi], al
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x2b4]
push eax
xor edi, edi
push edi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x2b0]
call esi
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, byte [0x46c12a]
push 0x63
lea eax, [ebp - 0x143]
push edi
push eax
mov byte [ebp - 0x144], bl
call fcn.00456240
push 0x63
lea eax, [ebp - 0xdf]
push edi
push eax
mov byte [ebp - 0xe0], bl
call fcn.00456240
add esp, 0x18
lea eax, [ebp - 0x2b0]
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x64
pop ebx
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x2b4]
push eax
push 0
push str.Identifier
push dword [ebp - 0x2b0]
inc edi
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2b4], edi
call esi
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x2b4]
push eax
push 0
push str.ProcessorNameString
push dword [ebp - 0x2b0]
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2b4], edi
call esi
push dword [ebp - 0x2bc]
mov ebx, dword [ebp - 0x2c4]
push 0x46b7f0
push ebx
call fcn.00450312
mov edi, 0x46b7f4
push edi
mov esi, 0x200
push esi
push ebx
call fcn.004503b4
lea eax, [ebp - 0x7c]
push eax
push esi
push ebx
call fcn.004503b4
push edi
push esi
push ebx
call fcn.004503b4
lea eax, [ebp - 0x1a8]
push eax
push esi
push ebx
call fcn.004503b4
push edi
push esi
push ebx
call fcn.004503b4
add esp, 0x48
lea eax, [ebp - 0x144]
push eax
push esi
push ebx
call fcn.004503b4
add esp, 0xc
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push esi
push ebx
call fcn.004503b4
lea eax, [ebp - 0xe0]
push eax
push esi
push ebx
call fcn.004503b4
add esp, 0x18
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004500ac
leave
ret