Function at 0x401dd8
Capabilities:
Get hostname
Get session user name
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a4
push ebx
push esi
push edi
push 9
pop ecx
mov esi, 0x4061c4
lea edi, [ebp - 0x7c]
push 0x12
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
mov esi, 0x4061ec
lea edi, [ebp - 0x194]
lea eax, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor ebx, ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0x64
mov dword [ebp - 0x2c], 1
movsb byte es:[edi], byte [esi]
call fcn.00401675
lea eax, [ebp - 0x194]
push eax
call fcn.00401675
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push eax
push 0xf003f
lea eax, [ebp - 0x7c]
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401e55
cmp dword [0x406b80], ebx
jne 0x401e5c
xor eax, eax
jmp 0x4020b3
push 0x20
lea eax, [ebp - 8]
pop esi
push eax
lea eax, [ebp - 0xc0]
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [ebp - 8]
mov dword [ebp - 8], esi
mov byte [ebp + eax - 0xc0], bl
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xe4]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0xe4], bl
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xc0]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x148]
push eax
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x214]
push 0x406238
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
push 0xf003f
lea eax, [ebp - 0x214]
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x1f4
push eax
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x406240
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40206e
lea eax, [ebp - 0x54]
push 0x406244
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0xc0]
mov dword [ebp - 4], 0xba0da71d
push eax
xor esi, esi
mov dword [ebp - 0xc], ebx
call sub.MSVCRT.dll_strlen
add esp, 0xc
test eax, eax
jbe 0x401fb9
cmp esi, 0x10
jne 0x401f65
xor esi, esi
lea edi, [ebp + esi - 0x54]
push 4
lea eax, [ebp - 0x10]
push edi
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 0xc]
push 4
movsx eax, byte [ebp + eax - 0xc0]
imul eax, dword [ebp - 4]
xor dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push edi
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 4]
add esi, 4
imul eax, eax, 0xbc8f
inc dword [ebp - 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc0]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x1c
cmp dword [ebp - 0xc], eax
jb 0x401f5e
lea eax, [ebp - 0x54]
push 4
push eax
lea eax, [ebp - 4]
push eax
call sub.MSVCRT.dll_memcpy
or dword [ebp - 4], 1
add esp, 0xc
xor esi, esi
mov al, byte [ebp + esi - 0x4a0]
mov cl, byte [ebp + esi - 0x49f]
add al, 0xf
sub cl, 0x21
shl al, 4
or al, cl
mov ecx, esi
sub al, byte [ebp - 4]
shr ecx, 1
mov byte [ebp + ecx - 0x2b0], al
mov eax, dword [ebp - 4]
imul eax, eax, 0x10ff5
inc esi
mov dword [ebp - 4], eax
inc esi
cmp esi, 0x135
jb 0x401fd1
lea eax, [ebp - 0x54]
mov dword [ebp - 0x38], 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
lea eax, [ebp - 0x38]
push ebx
push eax
lea eax, [ebp - 0x40]
push ebx
push eax
mov dword [ebp - 0x40], 0x9a
call dword [0x406b80]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
push 1
add ecx, eax
push ebx
push ecx
call sub.MSVCRT.dll_memset
push dword [ebp - 0x24]
lea eax, [ebp - 0x148]
push eax
push 0x406b8c
push 0x406258
call fcn.00403f7c
add esp, 0x1c
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x14]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
lea eax, [ebp - 0x148]
push eax
mov dword [ebp - 0x1c], 0x64
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x401ec9
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret