Function at 0x4036b0
Capabilities:
Get common file path
Get hostname
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444e2c
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x309c
call fcn.0041e4f0
mov eax, dword [0x455170]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x3080], 0
push 0x45b930
movups xmmword [ebp - 0x3090], xmm0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x45b930
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0x45b930
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0x45b930
push 0
push 0xfde9
call esi
push 0
push 0
push 0x457720
mov dword [0x45771c], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x457720
push 0
push 0xfde9
call esi
mov esi, eax
lea ecx, [esi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0x457720
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x457720
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword fs:[0x2c]
movaps xmm0, xmmword [0x451be0]
movaps xmm1, xmmword [0x451c00]
mov dword [0x457928], edi
mov esi, dword [eax]
mov dword [ebp - 0x309c], esi
mov eax, dword [esi + 0x2bc]
test al, 1
jne 0x40381e
or eax, 1
mov dword [esi + 0x2bc], eax
mov dword [ebp - 4], 0
mov byte [esi + 0x10c], 1
movups xmmword [esi + 0xec], xmm0
push 0x445460
movups xmmword [esi + 0xfc], xmm1
call fcn.0041e22d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x10c], 0
lea eax, [eax + 0xec]
mov dword [ebp - 0x3024], eax
je 0x403887
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov esi, dword [ebp - 0x301c]
mov edi, dword [ebp - 0x3020]
nop dword [eax]
mov ecx, edi
mov eax, 0x1dc94bd5
and ecx, 7
mov edx, 0x7b2f4767
shl ecx, 3
call fcn.004446d0
mov ecx, dword [ebp - 0x3024]
xor byte [ecx + edi], al
add edi, 1
adc esi, 0
jne 0x40387d
cmp edi, 0x20
jb 0x403850
mov esi, dword [ebp - 0x309c]
mov byte [ecx + 0x20], 0
mov eax, dword [esi + 0x37c]
mov dword [ebp - 0x3044], 1
mov dword [ebp - 0x3038], 0x75aa2a98
mov dword [ebp - 0x3034], 0x3c4a290e
mov dword [ebp - 0x3030], 0x1dad22a0
test al, 1
jne 0x403900
or eax, 1
mov dword [esi + 0x37c], eax
mov dword [ebp - 4], 1
movq xmm0, qword [ebp - 0x3038]
mov eax, dword [ebp - 0x3030]
mov byte [esi + 0x2d0], 1
movq qword [esi + 0x2c4], xmm0
push 0x445440
mov dword [esi + 0x2cc], eax
call fcn.0041e22d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 0x2d0], 0
lea edi, [esi + 0x2c4]
je 0x40395f
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov eax, dword [ebp - 0x301c]
mov esi, dword [ebp - 0x3020]
mov dword [ebp - 0x3070], eax
nop dword [eax]
mov ecx, esi
mov eax, 0x1dc94bd5
and ecx, 7
mov edx, 0x7b2f4767
shl ecx, 3
call fcn.004446d0
xor byte [edi + esi], al
add esi, 1
adc dword [ebp - 0x3070], 0
jne 0x40395b
cmp esi, 0xc
jb 0x403930
mov byte [edi + 0xc], 0
lea eax, [ebp - 0x3074]
mov dword [ebp - 0x30a0], 0
push eax
push 0x101
push 0
push dword [ebp - 0x3024]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4039f9
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x3078]
push eax
push 0
push 0
push 0
push edi
push dword [ebp - 0x3074]
call esi
test eax, eax
jne 0x4039ed
mov eax, dword [ebp - 0x3078]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x3078]
mov dword [ebp - 0x30a0], eax
push ecx
push eax
lea eax, [ebp - 0x3044]
push eax
push 0
push edi
push dword [ebp - 0x3074]
call esi
test eax, eax
je 0x4039ed
push dword [ebp - 0x30a0]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x3074]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x403a0b
lea eax, [ebp - 0x2018]
mov dword [ebp - 0x3028], 0x1000
push 0x1000
push 0
push eax
call fcn.0041fcf0
add esp, 0xc
lea eax, [ebp - 0x3028]
push eax
lea eax, [ebp - 0x2018]
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
jmp 0x403a53
jmp 0x403a65
lea eax, [ebp - 0x3018]
mov dword [ebp - 0x3028], 0x1000
push 0x1000
push 0
push eax
call fcn.0041fcf0
add esp, 0xc
lea eax, [ebp - 0x3028]
push eax
lea eax, [ebp - 0x3018]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x403aab
lea eax, [ebp - 0x1018]
push dword [ebp - 0x3028]
push 0
push eax
call fcn.0041fcf0
add esp, 0xc
lea eax, [ebp - 0x3090]
push eax
push 0x64
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.NETAPI32.dll_NetWkstaGetInfo]
test eax, eax
jne 0x403afa
push dword [ebp - 0x3088]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
lea eax, [ebp - 0x1018]
jle 0x403b00
push dword [ebp - 0x3088]
jmp 0x403b05
lea eax, [ebp - 0x1018]
push str.NONE
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x3070]
mov dword [ebp - 0x3048], 1
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x30a8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403bb4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x307c]
push eax
push 0
push 0
push 0
push str.ProductName
push dword [ebp - 0x3070]
call esi
test eax, eax
jne 0x403ba8
mov eax, dword [ebp - 0x307c]
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
lea eax, [ebp - 0x307c]
push eax
push edi
lea eax, [ebp - 0x3048]
mov dword [ebp - 0x30a8], edi
push eax
push 0
push str.ProductName
push dword [ebp - 0x3070]
call esi
test eax, eax
je 0x403ba8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x3070]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x309c]
movaps xmm0, xmmword [0x451c20]
mov dword [ebp - 0x3030], 0xc5a4055b
mov eax, dword [esi + 0x1e0]
test al, 1
jne 0x403c13
or eax, 1
mov dword [esi + 0x1e0], eax
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x3030]
mov byte [esi + 0x298], 1
movups xmmword [esi + 0x284], xmm0
push 0x445100
mov dword [esi + 0x294], eax
call fcn.0041e22d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x298], 0
lea ecx, [eax + 0x284]
mov dword [ebp - 0x3098], ecx
je 0x403c78
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov esi, dword [ebp - 0x301c]
mov edi, dword [ebp - 0x3020]
mov ecx, edi
mov eax, 0xc5cb6335
and ecx, 7
mov edx, 0x95db052f
shl ecx, 3
call fcn.004446d0
mov ecx, dword [ebp - 0x3098]
xor byte [ecx + edi], al
add edi, 1
adc esi, 0
jne 0x403c6e
cmp edi, 0x14
jb 0x403c41
mov esi, dword [ebp - 0x309c]
mov byte [ecx + 0x14], 0
push ecx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403c9a
lea ecx, [ebp - 0x306c]
push ecx
call eax
jmp 0x403ca7
lea eax, [ebp - 0x306c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x306c]
cmp ax, 9
je 0x403cd1
cmp ax, 6
je 0x403cd1
cmp ax, 7
je 0x403cd1
test ax, ax
jne 0x403cdb
mov dword [0x457924], 0
jmp 0x403cdb
mov dword [0x457924], 1
call fcn.00407050
mov dword [0x457508], eax
call fcn.00401750
call fcn.00406f90
mov ecx, dword [esi + 0x32c]
mov dword [0x457504], eax
mov word [ebp - 0x3024], 0xb3f8
test cl, 1
jne 0x403d43
or ecx, 1
mov dword [esi + 0x32c], ecx
mov dword [ebp - 4], 3
mov ax, word [ebp - 0x3024]
mov word [esi + 0xd6], 0x121
push 0x445420
mov word [esi + 0xd4], ax
call fcn.0041e22d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0xd7], 0
lea ecx, [eax + 0xd4]
mov dword [ebp - 0x3098], ecx
je 0x403da8
xorps xmm0, xmm0
movlpd qword [ebp - 0x3020], xmm0
mov esi, dword [ebp - 0x301c]
mov edi, dword [ebp - 0x3020]
mov ecx, edi
mov eax, 0xc121c599
and ecx, 7
mov edx, 0xa7113981
shl ecx, 3
call fcn.004446d0
mov ecx, dword [ebp - 0x3098]
xor byte [edi + ecx], al
add edi, 1
adc esi, 0
jne 0x403d9e
cmp edi, 3
jb 0x403d71
mov esi, dword [ebp - 0x309c]
mov byte [ecx + 3], 0
push dword [0x457504]
push ecx
push dword [0x457508]
call fcn.00406d10
mov edi, 0x457930
mov byte [ebp - 0x3091], 0
mov dword [ebp - 0x30a4], edi
mov dword [ebp - 0x3098], 4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x403eec
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov ecx, edi
mov edx, eax
call fcn.00401130
mov ecx, dword [esi + 0x260]
mov dword [ebp - 0x3024], eax
mov dword [ebp - 0x3020], 0x76a65075
test cl, 1
jne 0x403e4b
or ecx, 1
mov dword [esi + 0x260], ecx
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x3020]
mov word [esi + 0x248], 0x1b1
push 0x445400
mov dword [esi + 0x244], eax
call fcn.0041e22d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x249], 0
lea ecx, [eax + 0x244]
mov dword [ebp - 0x30ac], ecx
je 0x403ebd
xorps xmm0, xmm0
movlpd qword [ebp - 0x3038], xmm0
mov edi, dword [ebp - 0x3034]
mov esi, dword [ebp - 0x3038]
nop dword [eax]
mov ecx, esi
mov eax, 0x13cb311b
and ecx, 7
mov edx, 0x77d119b1
shl ecx, 3
call fcn.004446d0
mov ecx, dword [ebp - 0x30ac]
xor byte [esi + ecx], al
add esi, 1
adc edi, 0
jne 0x403ead
cmp esi, 5
jb 0x403e80
mov esi, dword [ebp - 0x309c]
mov edi, dword [ebp - 0x30a4]
mov byte [ecx + 5], 0
push dword [ebp - 0x3024]
push ecx
push dword [0x457504]
call fcn.00406e80
mov eax, dword [ebp - 0x3024]
test eax, eax
je 0x403ee2
push eax
call fcn.004219fc
add esp, 4
mov al, 1
mov byte [ebp - 0x3091], al
jmp 0x403ef2
mov al, byte [ebp - 0x3091]
add edi, 0x1000
sub dword [ebp - 0x3098], 1
mov dword [ebp - 0x30a4], edi
jne 0x403dd6
test al, al
jne 0x403fcd
mov eax, dword [esi + 0x188]
mov dword [ebp - 0x3020], 0x8a69be75
test al, 1
jne 0x403f60
or eax, 1
mov dword [esi + 0x188], eax
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x3020]
mov word [esi + 0x1b4], 0x15d
push 0x4453c0
mov dword [esi + 0x1b0], eax
call fcn.0041e22d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi + 0x2b4]
mov dword [ebp - 0x3020], 0xaa4a9055
test al, 1
jne 0x403fa6
or eax, 1
mov dword [esi + 0x2b4], eax
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x3020]
mov word [esi + 0x1c4], 0x15d
push 0x4453e0
mov dword [esi + 0x1c0], eax
call fcn.0041e22d
add esp, 4
lea ecx, [esi + 0x1b0]
call fcn.00406a60
push eax
push ecx
lea ecx, [esi + 0x1c0]
call fcn.00406a60
add esp, 4
push eax
push dword [0x457504]
call fcn.00406e80
mov esi, dword [ebp - 0x30a0]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov ecx, esi
call fcn.00401130
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x45792c], eax
lea eax, [ebp - 0x2018]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x2018]
mov edx, eax
call fcn.00401130
mov dword [0x45bd44], eax
lea eax, [ebp - 0x3018]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x3018]
mov edx, eax
call fcn.00401130
mov dword [0x45bd40], eax
lea eax, [ebp - 0x1018]
push eax
call esi
add eax, eax
lea ecx, [ebp - 0x1018]
mov edx, eax
call fcn.00401130
mov edi, dword [ebp - 0x30a8]
push edi
mov dword [0x457718], eax
call esi
add eax, eax
mov ecx, edi
mov edx, eax
call fcn.00401130
push dword [0x457508]
mov dword [0x45bd4c], eax
call fcn.004072b0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [0x457508]
mov esi, eax
call fcn.004072b0
mov edx, esi
mov ecx, eax
call fcn.00401130
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [0x45bb34], eax
mov eax, dword [0x45bd48]
add eax, 0x2ac
push eax
call esi
mov ecx, dword [0x45bd48]
mov edx, eax
add ecx, 0x2ac
call fcn.00401130
mov dword [0x45bb30], eax
mov eax, dword [0x45bd48]
add eax, 0x2ec
push eax
call esi
mov ecx, dword [0x45bd48]
mov edx, eax
add ecx, 0x2ec
call fcn.00401130
mov esi, dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push 0x457920
push 0
push 0
push 0x446310
mov dword [0x457500], eax
call esi
push 0x457714
push 0
push 0
push 0x446300
call esi
push 0x457710
push 0
push 0
push 0x4462f0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call esi
push dword [ebp - 0x30a0]
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041dea9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret