Function at 0x403030
Capabilities:
Get common file path
Get hostname
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x444b1c
push eax
mov dword fs:[0], esp
mov eax, 0x30a4
push ebx
call fcn.0041e560
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
push edi
mov ecx, 0x45a998
movups xmmword [ebp - 0x8c], xmm0
call fcn.00401530
mov ecx, 0x456788
mov dword [0x456784], eax
call fcn.00401530
mov esi, dword fs:[0x2c]
mov dword [0x456990], eax
mov dword [ebp - 0x4c], 0xb5968a5e
mov dword [ebp - 0x48], 0xc0b4c9e4
mov esi, dword [esi]
mov dword [ebp - 0x44], 0xdd918266
mov dword [ebp - 0x28], esi
mov eax, dword [esi + 0x20c]
lea edx, [esi + 0x1dc]
mov dword [ebp - 0x1c], edx
test al, 1
jne 0x40311f
or eax, 1
mov dword [esi + 0x20c], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov byte [edx + 0xc], 1
nop
mov al, byte [ebp + ecx - 0x4c]
mov byte [edx + ecx], al
add ecx, 1
adc edi, 0
test edi, edi
jne 0x403106
cmp ecx, 0xc
jb 0x4030f0
push 0x4453d0
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
jmp 0x403122
mov dword [ebp - 0x1c], edx
cmp byte [edx + 0xc], 0
je 0x403169
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov ecx, edi
mov eax, 0xddf5eb13
and ecx, 7
mov edx, 0x87d1a78d
shl ecx, 3
call fcn.00444580
mov edx, dword [ebp - 0x1c]
xor byte [edx + edi], al
add edi, 1
adc esi, 0
test esi, esi
jne 0x403162
cmp edi, 0xc
jb 0x403136
mov esi, dword [ebp - 0x28]
mov byte [edx + 0xc], 0
movaps xmm0, xmmword [0x451d50]
mov eax, dword [esi + 0x250]
movups xmmword [ebp - 0x60], xmm0
movaps xmm0, xmmword [0x451d30]
movups xmmword [ebp - 0x50], xmm0
test al, 1
jne 0x4031de
or eax, 1
mov dword [esi + 0x250], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov byte [esi + 0x298], 1
nop
mov al, byte [ebp + ecx - 0x60]
mov byte [esi + ecx + 0x278], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4031ca
cmp ecx, 0x20
jb 0x4031b0
push 0x445410
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 0x298], 0
lea ecx, [esi + 0x278]
mov dword [ebp - 0x24], ecx
je 0x403230
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
nop
mov ecx, esi
mov eax, 0xddf5eb13
and ecx, 7
mov edx, 0x87d1a78d
shl ecx, 3
call fcn.00444580
mov ecx, dword [ebp - 0x24]
xor byte [ecx + esi], al
add esi, 1
adc edi, 0
test edi, edi
jne 0x40322c
cmp esi, 0x20
jb 0x403200
mov byte [ecx + 0x20], 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x74], 1
push eax
push 0x101
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4032ae
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x64]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push 0
push 0
push 0
push esi
push dword [ebp - 0x3c]
call edi
test eax, eax
jne 0x4032a5
mov eax, dword [ebp - 0x64]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x34], eax
push ecx
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push esi
push dword [ebp - 0x3c]
call edi
test eax, eax
je 0x4032a5
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4032c0
lea eax, [ebp - 0x20b0]
mov dword [ebp - 0x2c], 0x1000
push 0x1000
push 0
push eax
call fcn.0041fce0
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20b0]
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
jmp 0x403302
jmp 0x403314
lea eax, [ebp - 0x30b0]
mov dword [ebp - 0x2c], 0x1000
push 0x1000
push 0
push eax
call fcn.0041fce0
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30b0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x403354
lea eax, [ebp - 0x10b0]
push dword [ebp - 0x2c]
push 0
push eax
call fcn.0041fce0
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
push 0x64
lea eax, [ebp - 0x20b0]
push eax
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
test eax, eax
jne 0x4033a0
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
lea eax, [ebp - 0x10b0]
jle 0x4033a6
push dword [ebp - 0x84]
jmp 0x4033ab
lea eax, [ebp - 0x10b0]
push str.NONE
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x78], 1
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403439
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push str.ProductName
push dword [ebp - 0x40]
call esi
test eax, eax
jne 0x403430
mov eax, dword [ebp - 0x68]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
lea eax, [ebp - 0x68]
push eax
push edi
lea eax, [ebp - 0x78]
mov dword [ebp - 0x30], edi
push eax
push 0
push str.ProductName
push dword [ebp - 0x40]
call esi
test eax, eax
je 0x403430
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x28]
movaps xmm0, xmmword [0x451d40]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0xafd4856b
mov eax, dword [esi + 0xc4]
test al, 1
jne 0x4034ae
or eax, 1
mov dword [esi + 0xc4], eax
mov dword [ebp - 4], 2
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov byte [esi + 0x1c8], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x54]
mov byte [esi + ecx + 0x1b4], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x40349a
cmp ecx, 0x14
jb 0x403480
push 0x444f10
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 0x1c8], 0
lea edi, [esi + 0x1b4]
mov dword [ebp - 0x1c], edi
je 0x403505
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
nop
mov ecx, edi
mov eax, 0xafbbe305
and ecx, 7
mov edx, 0xedc1e78f
shl ecx, 3
call fcn.00444580
mov ecx, dword [ebp - 0x1c]
xor byte [ecx + edi], al
add edi, 1
adc esi, 0
test esi, esi
jne 0x4034fc
cmp edi, 0x14
jb 0x4034d0
mov esi, dword [ebp - 0x28]
mov edi, ecx
mov byte [ecx + 0x14], 0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403527
lea ecx, [ebp - 0xb0]
push ecx
call eax
jmp 0x403534
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0xb0]
cmp ax, 9
je 0x40355e
cmp ax, 6
je 0x40355e
cmp ax, 7
je 0x40355e
test ax, ax
jne 0x403568
mov dword [0x45698c], 0
jmp 0x403568
mov dword [0x45698c], 1
call fcn.00405cb0
mov dword [0x456570], eax
call fcn.004019a0
call fcn.00405bf0
mov ecx, dword [esi + 0x1f0]
mov dword [ebp - 0x38], eax
mov dword [0x45656c], eax
mov word [ebp - 0x1c], 0xdd66
mov byte [ebp - 0x1a], 0x15
test cl, 1
jne 0x4035ee
or ecx, 1
mov dword [esi + 0x1f0], ecx
mov dword [ebp - 4], 3
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov byte [esi + 0xbb], 1
nop
mov al, byte [ebp + ecx - 0x1c]
mov byte [esi + ecx + 0xb8], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4035da
cmp ecx, 3
jb 0x4035c0
push 0x445390
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 0xbb], 0
lea ecx, [esi + 0xb8]
mov dword [ebp - 0x24], ecx
je 0x403643
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
nop
mov ecx, edi
mov eax, 0xf115ab07
and ecx, 7
mov edx, 0xcb7bff79
shl ecx, 3
call fcn.00444580
mov ecx, dword [ebp - 0x24]
xor byte [ecx + edi], al
add edi, 1
adc esi, 0
test esi, esi
jne 0x40363c
cmp edi, 3
jb 0x403610
mov esi, dword [ebp - 0x28]
mov byte [ecx + 3], 0
push dword [ebp - 0x38]
push ecx
push dword [0x456570]
call fcn.00405970
mov edi, 0x456998
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x24], 4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x40377c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, edi
mov edx, eax
call fcn.00401160
mov ecx, dword [esi + 0xac]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x3c8ef051
mov byte [ebp - 0x14], 0x21
test cl, 1
jne 0x4036fe
or ecx, 1
mov dword [esi + 0xac], ecx
mov dword [ebp - 4], 4
xorps xmm0, xmm0
movlpd qword [ebp - 0x70], xmm0
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x70]
mov byte [esi + 0x275], 1
nop dword [eax]
nop dword [eax + eax]
mov cl, byte [ebp + eax - 0x18]
mov byte [eax + esi + 0x270], cl
add eax, 1
adc edx, 0
test edx, edx
jne 0x4036ea
cmp eax, 5
jb 0x4036d0
push 0x445350
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 0x275], 0
lea ecx, [esi + 0x270]
mov dword [ebp - 0x6c], ecx
je 0x403756
xorps xmm0, xmm0
movlpd qword [ebp - 0x48], xmm0
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
nop
mov ecx, esi
mov eax, 0x59e3913f
and ecx, 7
mov edx, 0xe58d7b21
shl ecx, 3
call fcn.00444580
mov ecx, dword [ebp - 0x6c]
xor byte [esi + ecx], al
add esi, 1
adc edi, 0
test edi, edi
jne 0x40374c
cmp esi, 5
jb 0x403720
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x38]
mov byte [ecx + 5], 0
push dword [ebp - 0x1c]
push ecx
push dword [0x45656c]
call fcn.00405ae0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x403775
push eax
call fcn.004218dc
add esp, 4
mov al, 1
mov byte [ebp - 0x1d], al
jmp 0x40377f
mov al, byte [ebp - 0x1d]
add edi, 0x1000
sub dword [ebp - 0x24], 1
mov dword [ebp - 0x38], edi
jne 0x403665
test al, al
jne 0x4038ae
mov eax, dword [esi + 0x10c]
mov dword [ebp - 0x18], 0x1c85f425
mov byte [ebp - 0x14], 0x6d
test al, 1
jne 0x40380e
or eax, 1
mov dword [esi + 0x10c], eax
mov dword [ebp - 4], 5
xorps xmm0, xmm0
movlpd qword [ebp - 0x48], xmm0
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
mov byte [esi + 0x2c1], 1
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x18]
mov byte [ecx + esi + 0x2bc], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4037fa
cmp ecx, 5
jb 0x4037e0
push 0x4452d0
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x2bc]
call fcn.00405880
mov edi, eax
mov dword [ebp - 0x18], 0x3ca6da05
mov eax, dword fs:[0x2c]
mov byte [ebp - 0x14], 0x6d
mov esi, dword [eax]
mov ecx, dword [esi + 0x24c]
test cl, 1
jne 0x403894
or ecx, 1
mov dword [esi + 0x24c], ecx
mov dword [ebp - 4], 6
xorps xmm0, xmm0
movlpd qword [ebp - 0x48], xmm0
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
mov byte [esi + 0x135], 1
nop
mov al, byte [ebp + ecx - 0x18]
mov byte [ecx + esi + 0x130], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x40387a
cmp ecx, 5
jb 0x403860
push 0x445310
call fcn.0041e08d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
add ecx, 0x130
call fcn.00405880
push edi
push eax
push dword [0x45656c]
call fcn.00405ae0
mov esi, dword [ebp - 0x34]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
mov edx, eax
mov ecx, esi
call fcn.00401160
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x456994], eax
lea eax, [ebp - 0x20b0]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x20b0]
mov edx, eax
call fcn.00401160
mov dword [0x45cda8], eax
lea eax, [ebp - 0x30b0]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x30b0]
mov edx, eax
call fcn.00401160
mov dword [0x45ada4], eax
lea eax, [ebp - 0x10b0]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x10b0]
mov edx, eax
call fcn.00401160
push dword [ebp - 0x30]
mov dword [0x456780], eax
call esi
mov ecx, dword [ebp - 0x30]
add eax, eax
mov edx, eax
call fcn.00401160
push dword [0x456570]
mov dword [0x45cdb0], eax
call fcn.00405f10
push eax
call edi
push dword [0x456570]
mov esi, eax
call fcn.00405f10
mov edx, esi
mov ecx, eax
call fcn.00401160
mov dword [0x45ab9c], eax
mov eax, dword [0x45cdac]
add eax, 0x2ac
push eax
call edi
mov ecx, dword [0x45cdac]
mov edx, eax
add ecx, 0x2ac
call fcn.00401160
mov dword [0x45ab98], eax
mov eax, dword [0x45cdac]
add eax, 0x2ec
push eax
call edi
mov ecx, dword [0x45cdac]
mov edx, eax
add ecx, 0x2ec
call fcn.00401160
mov esi, dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push 0x456988
push 0
push 0
push 0x4462e0
mov dword [0x456568], eax
call esi
push 0x45677c
push 0
push 0
push 0x4462d0
call esi
push 0x456778
push 0
push 0
push 0x4462c0
call esi
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push dword [ebp - 0x34]
call esi
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret