Function at 0x4027b0
Capabilities:
Contain obfuscated stackstrings
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x598
push ebx
push esi
push edi
mov dword [ebp - 0x3c], 0x51dd
mov dword [ebp - 0x564], 0xcf98cfb
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x2d0], 0x218f08a0
call fcn.00402730
mov dword [ebp - 0x10], 0x8a6
mov dword [ebp - 0xc], 0
jmp 0x402802
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edi, 0x40a66c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
cmp dword [ebp - 0xc], ecx
jae 0x402849
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx + 0x40a66c]
cmp eax, 0x5c
jne 0x402847
mov dword [ebp - 0x570], 0xa05
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x40a66d], 0
mov dword [ebp - 0x574], 0xffffffbb
jmp 0x402849
jmp 0x4027f9
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x29c], 0xc2d4260
mov eax, dword [0x40bd60]
cdq
mov ecx, 0x1ff8
idiv ecx
mov eax, dword [0x40aa90]
imul eax, edx
mov dword [0x40bd60], eax
mov edi, 0x40aa94
mov edx, 0x40aa48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x2e8], 0x91c6
mov edi, 0x40aa94
mov edx, 0x40aa48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x40bd60]
cdq
mov ecx, 0x21b0
idiv ecx
mov dword [0x40aa90], eax
mov edi, 0x40aa94
mov edx, 0x40aa48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x568], 0x6c2d615
mov dword [ebp - 0x560], 0x2a9c1b0
mov edi, 0x40aa94
mov edx, 0x40aa48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 8], 2
mov edi, 0x40aa94
mov edx, 0x40aa48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x56c], 0
push 0
push 0x40e6d8
lea eax, [ebp - 0x56c]
push eax
push 0x40e6c8
call fcn.00402580
add esp, 0x10
mov dword [ebp - 0x55c], 1
mov dword [ebp - 0x300], 0x42c12c7
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 5
mov byte [ebp - 0x2fc], 0x61
mov byte [ebp - 0x2fb], 0x62
mov byte [ebp - 0x2fa], 0x63
mov byte [ebp - 0x2f9], 0x64
mov byte [ebp - 0x2f8], 0x65
xor ecx, ecx
mov byte [ebp - 0x2f7], cl
lea edx, [ebp - 0x34]
mov dword [ebp - 0x2e4], edx
mov dword [ebp - 0x2e0], 0
jmp 0x402a5f
mov eax, dword [ebp - 0x2e0]
add eax, 1
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 5
jge 0x402a79
mov ecx, dword [ebp - 0x2e4]
add ecx, 4
mov dword [ebp - 0x2e4], ecx
jmp 0x402a50
mov eax, dword [0x40bd60]
cdq
mov ecx, 0x145b
idiv ecx
mov eax, dword [0x40aa90]
imul eax, edx
mov dword [0x40bd60], eax
mov dword [ebp - 0x2dc], 0xf5f
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x2e0], 0
jmp 0x402ac4
mov edx, dword [ebp - 0x2e0]
add edx, 1
mov dword [ebp - 0x2e0], edx
cmp dword [ebp - 0x2e0], 5
jge 0x402ade
mov eax, dword [ebp - 0x2e4]
add eax, 1
mov dword [ebp - 0x2e4], eax
jmp 0x402ab5
mov dword [ebp - 0x2c8], 0
jmp 0x402af9
mov ecx, dword [ebp - 0x2c8]
add ecx, 1
mov dword [ebp - 0x2c8], ecx
cmp dword [ebp - 0x2c8], 0x96
jge 0x402b28
mov dword [ebp - 0x57c], 0x1d7a3f0
mov edx, dword [ebp - 0x2c8]
mov byte [edx + 0x40ab34], 0x51
mov dword [ebp - 0x578], 2
jmp 0x402aea
mov dword [ebp - 0x18], 0x1009998
push 0x100
call fcn.00402d5b
add esp, 4
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2f0], 0x449c
push 0x100
call fcn.00402d5b
add esp, 4
mov dword [ebp - 0x598], eax
mov ecx, dword [ebp - 0x598]
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x40], 0x9beb3b2
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0
jmp 0x402b94
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x100
jge 0x402bd2
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
mov cl, byte [ebp - 0x14]
mov byte [eax], cl
mov dword [ebp - 0x580], 0x15052638
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0x258
div ecx
mov eax, dword [ebp - 0x2f4]
add eax, dword [ebp - 0x14]
mov cl, byte [ebp + edx - 0x298]
mov byte [eax], cl
jmp 0x402b8b
mov dword [ebp - 0x2ec], 0
mov byte [0x40e5ac], 0xe8
mov dword [ebp - 0x14], 0
jmp 0x402bf5
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x100
jge 0x402ca1
mov dword [ebp - 0x58c], 0x7ed6
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x2ec]
add edx, ecx
mov eax, dword [ebp - 0x2f4]
add eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x402c3d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x2ec], edx
cmp dword [0x40ab44], 0x48f7
jne 0x402c56
mov byte [0x40e618], 0x49
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov al, byte [edx]
mov byte [ebp - 0x2d8], al
mov dword [ebp - 0x584], 0xffffc9b5
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x2ec]
mov al, byte [edx]
mov byte [ecx], al
mov dword [ebp - 0x588], 2
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x2ec]
mov dl, byte [ebp - 0x2d8]
mov byte [ecx], dl
jmp 0x402bec
mov eax, dword [0x40bd60]
cdq
mov ecx, 0x238a
idiv ecx
mov dword [0x40aa90], eax
mov dword [ebp - 0x2ec], 0
mov edx, dword [ebp - 0x2ec]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x38], 0x170cd178
mov dword [ebp - 0x2d4], 0
jmp 0x402ce8
mov eax, dword [ebp - 0x2d4]
add eax, 1
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 4
jae 0x402d41
mov eax, dword [0x40bd60]
cdq
mov ecx, 0x312d
idiv ecx
mov dword [0x40aa90], eax
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov al, byte [edx]
mov byte [ebp - 0x2d8], al
mov dword [ebp - 0x590], 0x8d6745b
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x2ec]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x2ec]
mov dl, byte [ebp - 0x2d8]
mov byte [ecx], dl
jmp 0x402cd9
mov dword [ebp - 0x2c4], 0x190b58b
call fcn.00401e30
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10