Function at 0x44f0f0
Capabilities:
Access the windows event log
Generate random numbers via winapi
Get memory capacity
Get networking parameters
Get system information on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
mov eax, dword [0x66ea60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
movzx eax, dx
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xec], ebx
push esi
push edi
cmp dx, ax
jge 0x44f3d9
cwde
xor esi, esi
mov edi, 1
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xf0], edi
call fcn.005b9fc5
cdq
idiv edi
add esi, dword [ebp - 0xf4]
sub dl, bl
xor byte [esi], dl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, al
je 0x44f160
xor byte [esi], al
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0xb0]
test al, al
je 0x44f179
xor byte [esi], al
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xe0], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x44f1a0
mov eax, dword [ebp - 0xdc]
test al, al
je 0x44f1a0
xor byte [esi], al
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov al, byte [ebp - 0x9c]
add al, byte [ebp - 0x98]
je 0x44f1bd
xor byte [esi], al
push 0x80
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.005b6630
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push closesocket
push str.C:WindowsSystem32config_system
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x44f233
push 0
lea eax, [ebp - 0xa0]
push eax
push 0x80
lea eax, [ebp - 0x88]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
test eax, eax
jne 0x44f21d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44f233
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x88]
xor al, byte [ebp - 0x87]
je 0x44f233
xor byte [esi], al
push str.System
push 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov ebx, eax
test ebx, ebx
je 0x44f2c6
push 0x400
call fcn.005b9fe6
mov edi, eax
add esp, 4
test edi, edi
je 0x44f2c6
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x90]
push eax
push 0x400
push edi
push 0
push 5
push ebx
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push edi
test eax, eax
je 0x44f2b7
mov al, byte [edi + 0x18]
mov byte [ebp - 0xe1], al
call fcn.005b9a9a
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov al, byte [ebp - 0xe1]
test al, al
je 0x44f2c6
xor byte [esi], al
jmp 0x44f2c6
call fcn.005b9a9a
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push 0x248
mov dword [ebp - 0x90], 0
call fcn.005b9fe6
add esp, 4
mov edi, eax
lea eax, [ebp - 0x90]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
test eax, eax
je 0x44f2f5
xor bl, bl
jmp 0x44f2fb
mov bl, byte [edi + 0x84]
push edi
call fcn.005b9a9a
add esp, 4
test bl, bl
je 0x44f30a
xor byte [esi], bl
call fcn.0044ed50
test al, al
je 0x44f315
xor byte [esi], al
mov ebx, dword [ebp - 0xf8]
push ebx
call fcn.005b9fe6
add esp, 4
mov edi, eax
lea eax, [ebp - 0x8c]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x44f346
xor edi, edi
jmp 0x44f383
push edi
push 4
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [ebp - 0x8c]
test eax, eax
jne 0x44f36b
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor edi, edi
jmp 0x44f383
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test edi, edi
je 0x44f383
mov eax, dword [ebp - 0xe8]
cdq
idiv ebx
mov al, byte [edx + edi]
xor byte [esi], al
push edi
call fcn.005b9a9a
mov ebx, dword [ebp - 0xec]
add esp, 4
mov esi, dword [ebp - 0xe8]
inc ebx
mov edi, dword [ebp - 0xf0]
inc esi
add edi, 2
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xf0], edi
cmp bx, word [ebp - 0xfc]
jl 0x44f142
mov eax, dword [ebp - 0xf4]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059e5bd
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059e5bd
mov esp, ebp
pop ebp
ret