Function at 0x131b0
Capabilities:
Get common file path
Get hostname
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5448c
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x309c
call fcn.0002de70
mov eax, dword [0x63170]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x3080], 0
push 0x69940
movups xmmword [ebp - 0x3090], xmm0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x69940
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0x69940
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0x69940
push 0
push 0xfde9
call esi
push 0
push 0
push 0x65730
mov dword [0x6572c], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x65730
push 0
push 0xfde9
call esi
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0x65730
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x65730
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x60b90]
movaps xmm1, xmmword [0x60bb0]
mov dword [0x65938], edi
mov esi, dword [eax]
mov dword [ebp - 0x309c], esi
mov eax, dword [esi + 0x240]
test al, 1
jne 0x1331e
or eax, 1
mov dword [esi + 0x240], eax
mov dword [ebp - 4], 0
mov byte [esi + 0x17c], 1
movups xmmword [esi + 0x15c], xmm0
push 0x54a60
movups xmmword [esi + 0x16c], xmm1
call fcn.0002dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x17c], 0
lea eax, [eax + 0x15c]
mov dword [ebp - 0x3024], eax
je 0x13387
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov esi, dword [ebp - 0x301c]
mov edi, dword [ebp - 0x3020]
nop dword [eax]
mov ecx, edi
mov eax, 0xdff74797
and ecx, 7
mov edx, 0xe1d7bf93
shl ecx, 3
call fcn.00053dd0
mov ecx, dword [ebp - 0x3024]
xor byte [ecx + edi], al
add edi, 1
adc esi, 0
jne 0x1337d
cmp edi, 0x20
jb 0x13350
mov esi, dword [ebp - 0x309c]
mov byte [ecx + 0x20], 0
mov eax, dword [esi + 0x258]
mov dword [ebp - 0x3044], 1
mov dword [ebp - 0x3038], 0xb79426da
mov dword [ebp - 0x3034], 0xa6b2d1fa
mov dword [ebp - 0x3030], 0xdf932ee2
test al, 1
jne 0x13400
or eax, 1
mov dword [esi + 0x258], eax
mov dword [ebp - 4], 1
movq xmm0, qword [ebp - 0x3038]
mov eax, dword [ebp - 0x3030]
mov byte [esi + 0xb4], 1
movq qword [esi + 0xa8], xmm0
push 0x54a40
mov dword [esi + 0xb0], eax
call fcn.0002dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 0xb4], 0
lea edi, [esi + 0xa8]
je 0x1345f
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov eax, dword [ebp - 0x301c]
mov esi, dword [ebp - 0x3020]
mov dword [ebp - 0x3070], eax
nop dword [eax]
mov ecx, esi
mov eax, 0xdff74797
and ecx, 7
mov edx, 0xe1d7bf93
shl ecx, 3
call fcn.00053dd0
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x3070], 0
jne 0x1345b
cmp esi, 0xc
jb 0x13430
mov byte [edi + 0xc], 0
lea eax, [ebp - 0x3074]
mov dword [ebp - 0x30a0], 0
push eax
push 0x101
push 0
push dword [ebp - 0x3024]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x134f9
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x3078]
push eax
push 0
push 0
push 0
push edi
push dword [ebp - 0x3074]
call esi
test eax, eax
jne 0x134ed
mov eax, dword [ebp - 0x3078]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x3078]
mov dword [ebp - 0x30a0], eax
push ecx
push eax
lea eax, [ebp - 0x3044]
push eax
push 0
push edi
push dword [ebp - 0x3074]
call esi
test eax, eax
je 0x134ed
push dword [ebp - 0x30a0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x3074]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1350b
lea eax, [ebp - 0x2018]
mov dword [ebp - 0x3028], 0x1000
push 0x1000
push 0
push eax
call fcn.0002f670
add esp, 0xc
lea eax, [ebp - 0x3028]
push eax
lea eax, [ebp - 0x2018]
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
jmp 0x13553
jmp 0x13565
lea eax, [ebp - 0x3018]
mov dword [ebp - 0x3028], 0x1000
push 0x1000
push 0
push eax
call fcn.0002f670
add esp, 0xc
lea eax, [ebp - 0x3028]
push eax
lea eax, [ebp - 0x3018]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x135ab
lea eax, [ebp - 0x1018]
push dword [ebp - 0x3028]
push 0
push eax
call fcn.0002f670
add esp, 0xc
lea eax, [ebp - 0x3090]
push eax
push 0x64
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
test eax, eax
jne 0x135fa
push dword [ebp - 0x3088]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
lea eax, [ebp - 0x1018]
jle 0x13600
push dword [ebp - 0x3088]
jmp 0x13605
lea eax, [ebp - 0x1018]
push str.NONE
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x3070]
mov dword [ebp - 0x3048], 1
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
mov dword [ebp - 0x30a8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x136b4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x307c]
push eax
push 0
push 0
push 0
push str.ProductName
push dword [ebp - 0x3070]
call esi
test eax, eax
jne 0x136a8
mov eax, dword [ebp - 0x307c]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
lea eax, [ebp - 0x307c]
push eax
push edi
lea eax, [ebp - 0x3048]
mov dword [ebp - 0x30a8], edi
push eax
push 0
push str.ProductName
push dword [ebp - 0x3070]
call esi
test eax, eax
je 0x136a8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x3070]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x309c]
movaps xmm0, xmmword [0x60ba0]
mov dword [ebp - 0x3030], 0xc5a4055b
mov eax, dword [esi + 0x1dc]
test al, 1
jne 0x13713
or eax, 1
mov dword [esi + 0x1dc], eax
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x3030]
mov byte [esi + 0x294], 1
movups xmmword [esi + 0x280], xmm0
push 0x54760
mov dword [esi + 0x290], eax
call fcn.0002dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x294], 0
lea ecx, [eax + 0x280]
mov dword [ebp - 0x3098], ecx
je 0x13778
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov esi, dword [ebp - 0x301c]
mov edi, dword [ebp - 0x3020]
mov ecx, edi
mov eax, 0xc5cb6335
and ecx, 7
mov edx, 0x95db052f
shl ecx, 3
call fcn.00053dd0
mov ecx, dword [ebp - 0x3098]
xor byte [ecx + edi], al
add edi, 1
adc esi, 0
jne 0x1376e
cmp edi, 0x14
jb 0x13741
mov esi, dword [ebp - 0x309c]
mov byte [ecx + 0x14], 0
push ecx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1379a
lea ecx, [ebp - 0x306c]
push ecx
call eax
jmp 0x137a7
lea eax, [ebp - 0x306c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x306c]
cmp ax, 9
je 0x137d1
cmp ax, 6
je 0x137d1
cmp ax, 7
je 0x137d1
test ax, ax
jne 0x137db
mov dword [0x65934], 0
jmp 0x137db
mov dword [0x65934], 1
call fcn.00016960
mov dword [0x65518], eax
call fcn.00011750
call fcn.000168a0
mov ecx, dword [esi + 0xa4]
mov dword [0x65514], eax
mov word [ebp - 0x3024], 0xf390
test cl, 1
jne 0x13843
or ecx, 1
mov dword [esi + 0xa4], ecx
mov dword [ebp - 4], 3
mov ax, word [ebp - 0x3024]
mov word [esi + 0x252], 0x1ef
push 0x54a20
mov word [esi + 0x250], ax
call fcn.0002dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x253], 0
lea ecx, [eax + 0x250]
mov dword [ebp - 0x3098], ecx
je 0x138a8
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov esi, dword [ebp - 0x301c]
mov edi, dword [ebp - 0x3020]
mov ecx, edi
mov eax, 0xfbef85f1
and ecx, 7
mov edx, 0xdda31969
shl ecx, 3
call fcn.00053dd0
mov ecx, dword [ebp - 0x3098]
xor byte [edi + ecx], al
add edi, 1
adc esi, 0
jne 0x1389e
cmp edi, 3
jb 0x13871
mov esi, dword [ebp - 0x309c]
mov byte [ecx + 3], 0
push dword [0x65514]
push ecx
push dword [0x65518]
call fcn.00016620
mov edi, 0x65940
mov byte [ebp - 0x3091], 0
mov dword [ebp - 0x30a4], edi
mov dword [ebp - 0x3098], 4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x139ec
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, edi
mov edx, eax
call fcn.00011130
mov ecx, dword [esi + 0xe0]
mov dword [ebp - 0x3024], eax
mov dword [ebp - 0x3020], 0xfecc4033
test cl, 1
jne 0x1394b
or ecx, 1
mov dword [esi + 0xe0], ecx
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x3020]
mov word [esi + 0x26c], 0x155
push 0x54a00
mov dword [esi + 0x268], eax
call fcn.0002dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x26d], 0
lea ecx, [eax + 0x268]
mov dword [ebp - 0x30ac], ecx
je 0x139bd
xorps xmm0, xmm0
movlpd qword [ebp - 0x3038], xmm0
mov edi, dword [ebp - 0x3034]
mov esi, dword [ebp - 0x3038]
nop dword [eax]
mov ecx, esi
mov eax, 0x9ba1215d
and ecx, 7
mov edx, 0x85990355
shl ecx, 3
call fcn.00053dd0
mov ecx, dword [ebp - 0x30ac]
xor byte [esi + ecx], al
add esi, 1
adc edi, 0
jne 0x139ad
cmp esi, 5
jb 0x13980
mov esi, dword [ebp - 0x309c]
mov edi, dword [ebp - 0x30a4]
mov byte [ecx + 5], 0
push dword [ebp - 0x3024]
push ecx
push dword [0x65514]
call fcn.00016790
mov eax, dword [ebp - 0x3024]
test eax, eax
je 0x139e2
push eax
call fcn.000310ac
add esp, 4
mov al, 1
mov byte [ebp - 0x3091], al
jmp 0x139f2
mov al, byte [ebp - 0x3091]
add edi, 0x1000
sub dword [ebp - 0x3098], 1
mov dword [ebp - 0x30a4], edi
jne 0x138d6
test al, al
jne 0x13acd
mov eax, dword [esi + 0x22c]
mov dword [ebp - 0x3020], 0x1aa3e88f
test al, 1
jne 0x13a60
or eax, 1
mov dword [esi + 0x22c], eax
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x3020]
mov word [esi + 0x218], 0x1a3
push 0x549c0
mov dword [esi + 0x214], eax
call fcn.0002dbad
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi + 0x21c]
mov dword [ebp - 0x3020], 0x3a80c6af
test al, 1
jne 0x13aa6
or eax, 1
mov dword [esi + 0x21c], eax
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x3020]
mov word [esi + 0x1f8], 0x1a3
push 0x549e0
mov dword [esi + 0x1f4], eax
call fcn.0002dbad
add esp, 4
lea ecx, [esi + 0x214]
call fcn.000163f0
push eax
push ecx
lea ecx, [esi + 0x1f4]
call fcn.000163f0
add esp, 4
push eax
push dword [0x65514]
call fcn.00016790
mov esi, dword [ebp - 0x30a0]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov ecx, esi
call fcn.00011130
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x6593c], eax
lea eax, [ebp - 0x2018]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x2018]
mov edx, eax
call fcn.00011130
mov dword [0x69d54], eax
lea eax, [ebp - 0x3018]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x3018]
mov edx, eax
call fcn.00011130
mov dword [0x69d50], eax
lea eax, [ebp - 0x1018]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x1018]
mov edx, eax
call fcn.00011130
mov edi, dword [ebp - 0x30a8]
push edi
mov dword [0x65728], eax
call esi
add eax, eax
mov ecx, edi
mov edx, eax
call fcn.00011130
push dword [0x65518]
mov dword [0x69d5c], eax
call fcn.00016bc0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [0x65518]
mov esi, eax
call fcn.00016bc0
mov edx, esi
mov ecx, eax
call fcn.00011130
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [0x69b44], eax
mov eax, dword [0x69d58]
add eax, 0x2ac
push eax
call esi
mov ecx, dword [0x69d58]
mov edx, eax
add ecx, 0x2ac
call fcn.00011130
mov dword [0x69b40], eax
mov eax, dword [0x69d58]
add eax, 0x2ec
push eax
call esi
mov ecx, dword [0x69d58]
mov edx, eax
add ecx, 0x2ec
call fcn.00011130
mov esi, dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push 0x65930
push 0
push 0
push 0x552f0
mov dword [0x65510], eax
call esi
push 0x65724
push 0
push 0
push 0x552e0
call esi
push 0x65720
push 0
push 0
push 0x552d0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call esi
push dword [ebp - 0x30a0]
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0002d829
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret