Function at 0x415540
Capabilities:
Get common file path
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
xor eax, eax
mov word [ebp - 0xac], ax
mov ebx, dword [ebp - 0x70]
add ebx, 0x5f488
mov esi, dword [ebp - 0x6c]
adc esi, 0
sub ebx, 0x77a4f
sbb esi, 0
mov ecx, dword [ebp - 0x10c]
xor edx, edx
sub ebx, ecx
sbb esi, edx
push 0
push 0
call sub.KERNEL32.dll_Module32NextW
xor ecx, ecx
add ebx, eax
adc esi, ecx
sub ebx, 0x736cd
sbb esi, 0
movzx eax, byte [ebp - 0x81]
and eax, 0x3e2
cdq
or ebx, eax
or esi, edx
movzx edx, byte [ebp - 0x81]
sub edx, dword [ebp - 0x10c]
xor eax, eax
or ebx, edx
or esi, eax
mov byte [ebp - 0x81], bl
cmp dword [ebp - 0x10c], 0
je 0x4155f0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, dword [ebp - 0x10c]
jne 0x41560f
movzx ecx, byte [ebp - 0x81]
movzx edx, byte [ebp - 0x81]
cmp ecx, edx
jne 0x41560f
xor eax, eax
je 0x41560f
mov ecx, dword [ebp - 0x10c]
xor edx, edx
add ecx, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
add ecx, 0xa9a5
adc edx, 0
mov dword [ebp - 0x10c], ecx
jmp 0x415622
mov eax, 0x56f2e
sub eax, dword [ebp - 0x10c]
xor ecx, ecx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
xor edx, edx
jne 0x41565f
cmp dword [ebp - 0x10c], 0
jbe 0x4156cb
cmp dword [ebp - 0x70], 0xa00b
jne 0x4156cb
cmp dword [ebp - 0x6c], 0
jne 0x4156cb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
movzx ecx, word [ebp - 0xac]
cmp eax, ecx
jb 0x4156cb
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea esi, [eax + edx + 0x42d1f]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebx, [esi + eax + 0x6670e]
and ebx, 0x2daf5
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea eax, [edx + ecx + 0x662c3]
and ebx, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
and ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
movzx ecx, word [ebp - 0xac]
add eax, ecx
and eax, dword [ebp - 0x10c]
or ebx, eax
mov byte [ebp - 0x81], bl
jmp 0x41573b
mov esi, 0x94ed1
sub esi, dword [ebp - 0x10c]
movzx edx, byte [ebp - 0x81]
add esi, edx
sub esi, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
add esi, eax
movzx edi, byte [ebp - 0x81]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
add edi, eax
and esi, edi
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
or esi, eax
mov ebx, esi
xor esi, esi
push 0
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor ecx, ecx
sub eax, dword [ebp - 0x70]
sbb ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x10c]
xor edi, edi
add eax, edx
adc ecx, edi
or ebx, eax
or esi, ecx
mov byte [ebp - 0x81], bl
mov dword [ebp - 0x10c], 0
jmp 0x415758
mov eax, dword [ebp - 0x10c]
add eax, 0x9b0
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x9b0
jae 0x415796
mov esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
sub esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
lea ecx, [esi + eax + 0x294b1]
mov eax, 0x55c55
sar eax, cl
cdq
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
jmp 0x415747
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
movzx edx, ax
movzx eax, word [ebp - 0xac]
lea esi, [edx + eax + 0x29234]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExA]
lea ecx, [esi + eax - 0x37c26]
mov edx, dword [ebp - 0x10c]
add edx, 0x25554
and ecx, edx
mov dword [ebp - 0x10c], ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0x7cdfb]
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
or edx, eax
mov dword [ebp - 0x10c], edx
mov ecx, dword [ebp - 0x10c]
add ecx, 0x1abf2
mov word [ebp - 0xac], cx
mov edx, dword [ebp - 0x10c]
add edx, 0x7b30b
sub edx, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
and edx, eax
mov word [ebp - 0xac], dx
movzx esi, byte [ebp - 0x81]
add esi, 0x36ea2
movzx edi, word [ebp - 0xac]
sub edi, 0x3a8e2
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
sub edi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
mov ecx, eax
shl edi, cl
and esi, edi
mov dword [ebp - 0x10c], esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
mov esi, eax
add esi, 0x631f4
sub esi, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
add esi, ecx
movzx edx, word [ebp - 0xac]
mov eax, 0x4f7eb
sub eax, edx
sub eax, dword [ebp - 0x10c]
and esi, eax
mov edi, 0x5dd0a
sub edi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
sub edi, eax
sub edi, 0x26f23
or esi, edi
mov dword [ebp - 0x10c], esi
movzx esi, word [ebp - 0xac]
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
add eax, dword [ebp - 0x10c]
and esi, eax
mov dword [ebp - 0x10c], esi
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10