Function at 0x431958
Capabilities:
Contain obfuscated stackstrings
Get disk size
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov dword [ebp - 0xcc], 0
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov dword [ebp - 0x98], 0x94
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
je 0x431ec7
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x2d0], edx
cmp dword [ebp - 0x2d0], 1
je 0x4319be
cmp dword [ebp - 0x2d0], 2
je 0x431b54
jmp 0x431ec7
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc8], 0
jmp 0x4319e5
mov ecx, dword [ebp - 0xc8]
add ecx, 1
mov dword [ebp - 0xc8], ecx
cmp dword [ebp - 0xc8], 4
jge 0x431a09
mov edx, dword [ebp - 0xc8]
mov al, byte [ebp - 0xcc]
add al, byte [ebp + edx - 0xc4]
mov byte [ebp - 0xcc], al
jmp 0x4319d6
mov dword [ebp - 0xdc], 0xc0000
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc8], 0
jmp 0x431a38
mov ecx, dword [ebp - 0xc8]
add ecx, 1
mov dword [ebp - 0xc8], ecx
cmp dword [ebp - 0xc8], 0x10
jge 0x431a66
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp - 0xc4]
add eax, dword [edx]
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xdc]
add ecx, 4
mov dword [ebp - 0xdc], ecx
jmp 0x431a29
mov dword [ebp - 0xc8], 0
jmp 0x431a81
mov edx, dword [ebp - 0xc8]
add edx, 1
mov dword [ebp - 0xc8], edx
cmp dword [ebp - 0xc8], 4
jge 0x431aa5
mov eax, dword [ebp - 0xc8]
mov cl, byte [ebp - 0xcb]
add cl, byte [ebp + eax - 0xc4]
mov byte [ebp - 0xcb], cl
jmp 0x431a72
mov dword [ebp - 0xdc], 0xfe000
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc8], 0
jmp 0x431ad4
mov edx, dword [ebp - 0xc8]
add edx, 1
mov dword [ebp - 0xc8], edx
cmp dword [ebp - 0xc8], 0x10
jge 0x431b02
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xc4]
add ecx, dword [eax]
mov dword [ebp - 0xc4], ecx
mov edx, dword [ebp - 0xdc]
add edx, 4
mov dword [ebp - 0xdc], edx
jmp 0x431ac5
mov dword [ebp - 0xc8], 0
jmp 0x431b1d
mov eax, dword [ebp - 0xc8]
add eax, 1
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x431b41
mov ecx, dword [ebp - 0xc8]
mov dl, byte [ebp - 0xca]
add dl, byte [ebp + ecx - 0xc4]
mov byte [ebp - 0xca], dl
jmp 0x431b0e
mov byte [ebp - 0xcb], 0x27
mov byte [ebp - 0xca], 0xda
jmp 0x431ec7
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0xa0]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc8], 0
jmp 0x431b8d
mov ecx, dword [ebp - 0xc8]
add ecx, 1
mov dword [ebp - 0xc8], ecx
cmp dword [ebp - 0xc8], 4
jge 0x431bb1
mov edx, dword [ebp - 0xc8]
mov al, byte [ebp - 0xcc]
add al, byte [ebp + edx - 0xc4]
mov byte [ebp - 0xcc], al
jmp 0x431b7e
mov ecx, dword [ebp - 0x9c]
and ecx, 0xffff
mov edx, dword [ebp - 0x9a]
and edx, 0xffff
add ecx, edx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xc8], 0
jmp 0x431bec
mov eax, dword [ebp - 0xc8]
add eax, 1
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x431c10
mov ecx, dword [ebp - 0xc8]
mov dl, byte [ebp - 0xcc]
add dl, byte [ebp + ecx - 0xc4]
mov byte [ebp - 0xcc], dl
jmp 0x431bdd
mov byte [ebp - 0xf8], 0x48
mov byte [ebp - 0xf7], 0x41
mov byte [ebp - 0xf6], 0x52
mov byte [ebp - 0xf5], 0x44
mov byte [ebp - 0xf4], 0x57
mov byte [ebp - 0xf3], 0x41
mov byte [ebp - 0xf2], 0x52
mov byte [ebp - 0xf1], 0x45
mov byte [ebp - 0xf0], 0x5c
mov byte [ebp - 0xef], 0x44
mov byte [ebp - 0xee], 0x45
mov byte [ebp - 0xed], 0x53
mov byte [ebp - 0xec], 0x43
mov byte [ebp - 0xeb], 0x52
mov byte [ebp - 0xea], 0x49
mov byte [ebp - 0xe9], 0x50
mov byte [ebp - 0xe8], 0x54
mov byte [ebp - 0xe7], 0x49
mov byte [ebp - 0xe6], 0x4f
mov byte [ebp - 0xe5], 0x4e
mov byte [ebp - 0xe4], 0x5c
mov byte [ebp - 0xe3], 0x53
mov byte [ebp - 0xe2], 0x79
mov byte [ebp - 0xe1], 0x73
mov byte [ebp - 0xe0], 0x74
mov byte [ebp - 0xdf], 0x65
mov byte [ebp - 0xde], 0x6d
mov byte [ebp - 0xdd], 0
lea eax, [ebp - 0xfc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0xf8]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x431eb9
mov byte [ebp - 0x104], 0x42
mov byte [ebp - 0x103], 0x69
mov byte [ebp - 0x102], 0x6f
mov byte [ebp - 0x101], 0x73
mov byte [ebp - 0x100], 0
mov byte [ebp - 0x17c], 0x56
mov byte [ebp - 0x17b], 0x69
mov byte [ebp - 0x17a], 0x64
mov byte [ebp - 0x179], 0x65
mov byte [ebp - 0x178], 0x6f
mov byte [ebp - 0x177], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0x108], 0
jmp 0x431d6e
mov edx, dword [ebp - 0xc8]
add edx, 1
mov dword [ebp - 0xc8], edx
cmp dword [ebp - 0x108], 0
jne 0x431eac
mov dword [ebp - 0x170], 0x4f
mov byte [ebp - 0x1d4], 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x1d4]
push ecx
mov edx, dword [ebp - 0xc8]
push edx
mov eax, dword [ebp - 0xfc]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegEnumValueA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x431ea7
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x1d4]
push edx
call fcn.006ef560
add esp, 8
test eax, eax
jne 0x431de8
jmp 0x431d5f
mov dword [ebp - 0x170], 0x64
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x16c]
push ecx
lea edx, [ebp - 0x174]
push edx
push 0
lea eax, [ebp - 0x1d4]
push eax
mov ecx, dword [ebp - 0xfc]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x431ea7
lea edx, [ebp - 0x17c]
push edx
lea eax, [ebp - 0x1d4]
push eax
call fcn.006ef560
add esp, 8
test eax, eax
je 0x431e4b
mov dword [ebp - 0x184], 1
jmp 0x431e55
mov dword [ebp - 0x184], 2
mov dword [ebp - 0x180], 0
jmp 0x431e70
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x180]
cmp edx, dword [ebp - 0x170]
jae 0x431ea7
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp - 0x180]
mov dl, byte [ebp + eax - 0xcc]
add dl, byte [ebp + ecx - 0x16c]
mov eax, dword [ebp - 0x184]
mov byte [ebp + eax - 0xcc], dl
jmp 0x431e61
jmp 0x431d5f
mov ecx, dword [ebp - 0xfc]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov byte [ebp - 0xcb], 0x27
mov byte [ebp - 0xca], 0xda
mov byte [ebp - 0x204], 0x48
mov byte [ebp - 0x203], 0x41
mov byte [ebp - 0x202], 0x52
mov byte [ebp - 0x201], 0x44
mov byte [ebp - 0x200], 0x57
mov byte [ebp - 0x1ff], 0x41
mov byte [ebp - 0x1fe], 0x52
mov byte [ebp - 0x1fd], 0x45
mov byte [ebp - 0x1fc], 0x5c
mov byte [ebp - 0x1fb], 0x44
mov byte [ebp - 0x1fa], 0x45
mov byte [ebp - 0x1f9], 0x53
mov byte [ebp - 0x1f8], 0x43
mov byte [ebp - 0x1f7], 0x52
mov byte [ebp - 0x1f6], 0x49
mov byte [ebp - 0x1f5], 0x50
mov byte [ebp - 0x1f4], 0x54
mov byte [ebp - 0x1f3], 0x49
mov byte [ebp - 0x1f2], 0x4f
mov byte [ebp - 0x1f1], 0x4e
mov byte [ebp - 0x1f0], 0x5c
mov byte [ebp - 0x1ef], 0x53
mov byte [ebp - 0x1ee], 0x79
mov byte [ebp - 0x1ed], 0x73
mov byte [ebp - 0x1ec], 0x74
mov byte [ebp - 0x1eb], 0x65
mov byte [ebp - 0x1ea], 0x6d
mov byte [ebp - 0x1e9], 0x5c
mov byte [ebp - 0x1e8], 0x43
mov byte [ebp - 0x1e7], 0x65
mov byte [ebp - 0x1e6], 0x6e
mov byte [ebp - 0x1e5], 0x74
mov byte [ebp - 0x1e4], 0x72
mov byte [ebp - 0x1e3], 0x61
mov byte [ebp - 0x1e2], 0x6c
mov byte [ebp - 0x1e1], 0x50
mov byte [ebp - 0x1e0], 0x72
mov byte [ebp - 0x1df], 0x6f
mov byte [ebp - 0x1de], 0x63
mov byte [ebp - 0x1dd], 0x65
mov byte [ebp - 0x1dc], 0x73
mov byte [ebp - 0x1db], 0x73
mov byte [ebp - 0x1da], 0x6f
mov byte [ebp - 0x1d9], 0x72
mov byte [ebp - 0x1d8], 0x5c
mov byte [ebp - 0x1d7], 0x30
mov byte [ebp - 0x1d6], 0
lea edx, [ebp - 0x208]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x204]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x432143
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0x20c], 0
jmp 0x43205d
mov ecx, dword [ebp - 0xc8]
add ecx, 1
mov dword [ebp - 0xc8], ecx
cmp dword [ebp - 0x20c], 0
jne 0x432136
mov dword [ebp - 0x274], 0x4f
mov byte [ebp - 0x2cc], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x274]
push edx
lea eax, [ebp - 0x2cc]
push eax
mov ecx, dword [ebp - 0xc8]
push ecx
mov edx, dword [ebp - 0x208]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegEnumValueA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x432131
mov dword [ebp - 0x274], 0x64
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x278]
push edx
push 0
lea eax, [ebp - 0x2cc]
push eax
mov ecx, dword [ebp - 0x208]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x432131
mov dword [ebp - 0x27c], 0
jmp 0x432108
mov edx, dword [ebp - 0x27c]
add edx, 1
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x27c]
cmp eax, dword [ebp - 0x274]
jae 0x432131
mov ecx, dword [ebp - 0x27c]
mov dl, byte [ebp - 0xcc]
add dl, byte [ebp + ecx - 0x270]
mov byte [ebp - 0xcc], dl
jmp 0x4320f9
jmp 0x43204e
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0xd4]
push ecx
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0xd8]
push ecx
push 0x780540
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x4321cd
mov edx, dword [ebp - 0xd8]
imul edx, dword [ebp - 0xc0]
add edx, dword [ebp - 0xd4]
mov dword [ebp - 0xc4], edx
mov dword [ebp - 0xc8], 0
jmp 0x4321a9
mov eax, dword [ebp - 0xc8]
add eax, 1
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x4321cd
mov ecx, dword [ebp - 0xc8]
mov dl, byte [ebp - 0xc9]
add dl, byte [ebp + ecx - 0xc4]
mov byte [ebp - 0xc9], dl
jmp 0x43219a
mov eax, dword [ebp - 0xcc]
mov esp, ebp
pop ebp
ret