Function at 0x403b60
Capabilities:
Contain obfuscated stackstrings
Get memory capacity
Get system information on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x220
mov al, 0x6c
push ebx
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], al
mov al, 0x65
mov cl, 0x41
push ebp
mov byte [esp + 0x25], al
mov byte [esp + 0x29], al
mov byte [esp + 0x2c], al
push esi
mov byte [esp + 0x18], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 0x34], cl
lea eax, [esp + 0x28]
push edi
lea ecx, [esp + 0x1c]
xor dl, dl
push eax
push ecx
mov byte [esp + 0x25], 0x44
mov byte [esp + 0x26], 0x56
mov byte [esp + 0x28], 0x50
mov byte [esp + 0x29], 0x49
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x2e
mov byte [esp + 0x2d], 0x64
mov byte [esp + 0x30], dl
mov byte [esp + 0x34], 0x52
mov byte [esp + 0x36], 0x67
mov byte [esp + 0x37], 0x4f
mov byte [esp + 0x38], 0x70
mov byte [esp + 0x3a], 0x6e
mov byte [esp + 0x3b], 0x4b
mov byte [esp + 0x3d], 0x79
mov byte [esp + 0x3e], 0x45
mov byte [esp + 0x3f], 0x78
mov byte [esp + 0x41], dl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
mov edi, str.dows_NTCurrentVersion
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.SOFTWAREMicrosoftWin
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
mov edi, str.SOFTWAREMicrosoftWin
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.dows_NTCurrentVersion
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [esp + 0x12c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
mov byte [esp + 0x10], 0x50
mov byte [esp + 0x11], 0x72
mov byte [esp + 0x12], 0x6f
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x14], 0x75
mov byte [esp + 0x15], 0x63
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x4e
mov byte [esp + 0x18], 0x61
mov byte [esp + 0x19], 0x6d
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], al
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x3c]
mov edx, ecx
mov esi, edi
mov edi, ebx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0xf003f
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x138]
push ecx
push closesocket
call ebp
test eax, eax
jne 0x403d33
lea edx, [esp + 0x40]
lea eax, [esp + 0x48]
push edx
lea ecx, [esp + 0x48]
push eax
mov eax, dword [esp + 0x44]
push ecx
lea edx, [esp + 0x1c]
push 0
push edx
push eax
mov dword [esp + 0x58], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea edx, [esp + 0x48]
push str.2000
push edx
call esi
add esp, 8
test eax, eax
je 0x403d56
mov edi, str.Win_2000
jmp 0x403f0b
lea ecx, [esp + 0x48]
push 0x4079ac
push ecx
call esi
add esp, 8
test eax, eax
je 0x403d92
mov edi, str.Win_XP
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x234]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403f2a
lea eax, [esp + 0x48]
push str.2003
push eax
call esi
add esp, 8
test eax, eax
je 0x403dce
mov edi, str.Win_2003
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x234]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403f2a
lea eax, [esp + 0x48]
push str.Vista
push eax
call esi
add esp, 8
test eax, eax
je 0x403e0a
mov edi, str.Win_Vista
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x234]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403f2a
lea eax, [esp + 0x48]
push str.2008
push eax
call esi
add esp, 8
test eax, eax
je 0x403e46
mov edi, str.Win_2008
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x234]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403f2a
lea eax, [esp + 0x48]
push 0x407964
push eax
call esi
add esp, 8
test eax, eax
je 0x403e94
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
push 0
call esi
push 0
call esi
mov edi, str.Win_7
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x234]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403f2a
lea eax, [esp + 0x48]
push 0x407958
push eax
call esi
add esp, 8
test eax, eax
je 0x403ecd
mov edi, str.Win_8
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x234]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403f2a
lea eax, [esp + 0x48]
push 0x40794c
push eax
call esi
add esp, 8
test eax, eax
je 0x403f06
mov edi, str.Win_10
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x234]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x403f2a
mov edi, str.Win_NT
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0x234]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [esp + 0xdc]
lea eax, [esp + 0xec]
and edx, 0xffff
push eax
mov dword [ebx + 0x2c], edx
mov dword [esp + 0xf0], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret