Function at 0x4172ac
Capabilities:
Check os version
Create directory
Delete registry key
Get disk information
Persist via run registry key
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x4172b4
push ebx
push esi
push edi
mov edi, 0x41db1c
mov esi, 0x41db54
mov ebx, 0x41db9f
xor eax, eax
push ebp
push 0x4188c8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x41dba0], 0x66
jne 0x41734b
mov eax, esi
mov edx, 0x4188e0
call fcn.00403770
mov eax, dword [0x41c318]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x418920
mov edx, 0x418930
mov eax, 0x80000002
call fcn.00406928
mov edx, dword [ebp - 4]
mov eax, 0x41db28
call fcn.00403770
cmp byte [0x41db9d], 0
jne 0x41734b
mov eax, esi
mov edx, 0x418978
call fcn.00403770
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x41db28]
call fcn.004067c8
mov byte [ebx], al
mov eax, esi
mov edx, 0x4189d8
call fcn.00403770
mov edx, 0x418930
mov ecx, 0x418920
mov eax, 0x80000002
call fcn.00406df0
lea eax, [ebp - 8]
call fcn.0040666c
mov edx, dword [ebp - 8]
mov eax, 0x41db18
call fcn.00403770
lea eax, [ebp - 0xc]
call fcn.004066d8
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00403770
mov eax, esi
mov edx, 0x418a50
call fcn.00403770
mov eax, 0x41db20
mov ecx, 0x418ac4
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [0x41db28]
call fcn.00403894
test eax, eax
jne 0x4173ce
mov eax, 0x41db28
mov ecx, 0x418ad4
mov edx, dword [edi]
call fcn.004038e0
mov eax, 0x41c28c
mov ecx, dword [0x41c28c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, esi
mov edx, 0x418ae4
call fcn.00403770
mov eax, 0x41db10
mov ecx, 0x418b18
mov edx, dword [0x41c28c]
call fcn.004038e0
mov eax, esi
mov edx, 0x418b2c
call fcn.00403770
mov eax, 0x41db14
mov ecx, 0x418be0
mov edx, dword [0x41c28c]
call fcn.004038e0
xor eax, eax
mov dword [0x41dba4], eax
call fcn.0041a3a8
mov eax, esi
mov edx, 0x418bf4
call fcn.00403770
mov eax, esi
mov edx, 0x418c1c
call fcn.00403770
cmp byte [0x41db9d], 0
je 0x4176b0
mov eax, 0x418c6c
call fcn.00405b80
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00406848
lea eax, [ebp - 0x10]
mov ecx, 0x418c84
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x10]
call fcn.00405a34
lea eax, [ebp - 0x14]
mov ecx, 0x418c98
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x14]
call fcn.00405a34
mov eax, dword [0x41db10]
call fcn.00405a34
mov eax, esi
mov edx, 0x418cac
call fcn.00403770
mov ecx, 0x418ad4
mov edx, 0x418cf4
mov eax, 0x80000002
call fcn.00406df0
mov ecx, 0x418ad4
mov edx, 0x418d2c
mov eax, 0x80000002
call fcn.00406df0
mov ecx, 0x418ad4
mov edx, 0x418d6c
mov eax, 0x80000001
call fcn.00406df0
mov edx, 0x418cf4
mov ecx, 0x418db4
mov eax, 0x80000001
call fcn.00406df0
mov edx, 0x418d6c
mov ecx, 0x418dc4
mov eax, 0x80000002
call fcn.00406df0
lea eax, [ebp - 0x18]
mov ecx, 0x418dd4
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x18]
call fcn.00405a34
lea eax, [ebp - 0x1c]
mov ecx, 0x418de8
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x1c]
call fcn.00405a34
lea eax, [ebp - 0x20]
mov ecx, 0x418dfc
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.00405a34
lea eax, [ebp - 0x24]
mov ecx, 0x418e10
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.00405a34
lea eax, [ebp - 0x28]
mov ecx, 0x418e24
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x28]
call fcn.00405a34
lea eax, [ebp - 0x2c]
mov ecx, 0x418e38
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x2c]
call fcn.00405a34
lea eax, [ebp - 0x30]
mov ecx, 0x418e4c
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x30]
call fcn.00405a34
push 0x418e58
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x418e84
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x418ecc
call fcn.004153b0
mov eax, esi
mov edx, 0x418ed8
call fcn.00403770
mov eax, 0x418f18
call fcn.004153b0
mov eax, esi
mov edx, 0x418f24
call fcn.00403770
mov eax, 0x418fe4
call fcn.004153b0
mov eax, esi
mov edx, 0x418ff0
call fcn.00403770
mov eax, dword [0x41db14]
call fcn.00405a34
mov eax, esi
mov edx, 0x419094
call fcn.00403770
push 0x200040
push 0x41915c
push 0x419168
lea edx, [ebp - 0x38]
mov eax, 0x97
call fcn.00405338
push dword [ebp - 0x38]
push 0x419174
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x34]
call fcn.00403a94
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x418c6c
lea eax, [ebp - 0x3c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x3c]
call fcn.00403a94
push eax
push 0x41918c
push 0
mov eax, dword [0x41c32c]
mov eax, dword [eax]
call eax
call fcn.00405a8c
jmp 0x4188aa
push 0
mov eax, dword [0x41c28c]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x41db9c]
cmp byte [0x41db9c], 0
je 0x4176ea
call fcn.00405f60
mov eax, esi
mov edx, 0x419240
call fcn.00403770
mov eax, dword [0x41c318]
push eax
mov edx, 0x418930
mov ecx, 0x4192f8
mov eax, 0x80000002
call fcn.00406874
push eax
call fcn.00405590
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x4188aa
mov eax, esi
mov edx, 0x419304
call fcn.00403770
lea edx, [ebp - 0x40]
mov eax, dword [0x41db28]
call fcn.004055c0
mov edx, dword [ebp - 0x40]
mov eax, 0x41db2c
call fcn.00403770
call fcn.0040278c
lea edx, [ebp - 0x44]
mov eax, 0x4193b8
call fcn.00406098
mov edx, dword [ebp - 0x44]
mov eax, 0x41db58
call fcn.00403770
mov eax, 0x41db24
mov edx, 0x4193e8
call fcn.00403770
lea eax, [ebp - 0x4c]
mov ecx, dword [0x41db24]
mov edx, 0x419404
call fcn.004038e0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00406098
mov edx, dword [ebp - 0x48]
mov eax, 0x41db5c
call fcn.00403770
mov eax, esi
mov edx, 0x419418
call fcn.00403770
push 1
push 0x96
push 0x7a120
mov ecx, 0x418dd4
lea eax, [ebp - 0x50]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x41db28]
call fcn.00405784
mov byte [ebx], al
mov ecx, 0x418dd4
lea eax, [ebp - 0x54]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x54]
call fcn.004067c8
mov byte [ebx], al
mov eax, esi
mov edx, 0x4194d4
call fcn.00403770
mov eax, dword [0x41c318]
push eax
mov edx, 0x418930
mov ecx, 0x419558
mov eax, 0x80000002
call fcn.00406874
mov dword [0x41db94], eax
cmp dword [0x41db94], 0x97
jge 0x417916
cmp byte [ebx], 0
jne 0x417886
mov ecx, 0x418dd4
lea eax, [ebp - 0x58]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x58]
mov eax, dword [0x41db28]
call fcn.004039e0
je 0x417886
mov eax, 0x418dd4
call fcn.00405b80
push 1
push 0x96
push 0x7a120
mov ecx, 0x418dd4
lea eax, [ebp - 0x5c]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x5c]
mov cl, 1
mov eax, dword [0x41db28]
call fcn.00405784
mov byte [ebx], al
mov eax, esi
mov edx, 0x419568
call fcn.00403770
cmp byte [ebx], 0
je 0x417916
push 0x97
mov ecx, 0x419558
mov edx, 0x418930
mov eax, 0x80000002
call fcn.00406aec
mov byte [ebx], al
cmp dword [0x41db94], 0
jle 0x4178dc
lea edx, [ebp - 0x60]
mov eax, dword [0x41db94]
call fcn.00405338
mov ecx, dword [ebp - 0x60]
mov eax, 0x41db24
mov edx, 0x4195f4
call fcn.004038e0
jmp 0x4178e6
mov eax, 0x41db24
call fcn.0040371c
push 0x419604
lea edx, [ebp - 0x68]
mov eax, 0x97
call fcn.00405338
push dword [ebp - 0x68]
push dword [0x41db24]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x64]
call fcn.0041a4a8
mov eax, esi
mov edx, 0x419618
call fcn.00403770
call fcn.00407c44
push 1
push 0x96
push 0x7a120
mov ecx, 0x418de8
lea eax, [ebp - 0x6c]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x41db28]
call fcn.00405784
mov byte [ebx], al
mov ecx, 0x418de8
lea eax, [ebp - 0x70]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x70]
call fcn.004067c8
mov byte [ebx], al
mov eax, esi
mov edx, 0x419644
call fcn.00403770
push 1
push 0x96
push 0x7a120
mov ecx, 0x418dfc
lea eax, [ebp - 0x74]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [0x41db28]
call fcn.00405784
mov byte [ebx], al
mov ecx, 0x418dfc
lea eax, [ebp - 0x78]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x78]
call fcn.004067c8
mov byte [ebx], al
mov ecx, 0x418e38
lea eax, [ebp - 0x7c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x7c]
call fcn.00405818
test al, al
jne 0x417a5e
push 1
push 0
push 0x7a120
mov ecx, 0x418e38
lea eax, [ebp - 0x80]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x80]
push eax
mov ecx, 0x418e10
lea eax, [ebp - 0x84]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.00405784
mov byte [ebx], al
push 1
push 0
push 0x7a120
mov ecx, 0x418e4c
lea eax, [ebp - 0x88]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x418e24
lea eax, [ebp - 0x8c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.00405784
mov byte [ebx], al
mov ecx, 0x418e10
lea eax, [ebp - 0x90]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x90]
call fcn.00405818
test al, al
jne 0x417b0b
push 1
push 0
push 0x7a120
mov ecx, 0x418e10
lea eax, [ebp - 0x94]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x94]
push eax
mov ecx, 0x418e38
lea eax, [ebp - 0x98]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.00405784
mov byte [ebx], al
push 1
push 0
push 0x7a120
mov ecx, 0x418e24
lea eax, [ebp - 0x9c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, 0x418e4c
lea eax, [ebp - 0xa0]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
pop edx
call fcn.00405784
mov byte [ebx], al
mov eax, dword [0x41db28]
call fcn.004067c8
mov byte [ebx], al
mov eax, esi
mov edx, 0x4196e0
call fcn.00403770
mov ecx, 0x418e10
lea eax, [ebp - 0xa4]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xa4]
call fcn.004067c8
mov byte [ebx], al
mov ecx, 0x418e24
lea eax, [ebp - 0xa8]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xa8]
call fcn.004067c8
mov byte [ebx], al
mov ecx, 0x418e38
lea eax, [ebp - 0xac]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xac]
call fcn.004067c8
mov byte [ebx], al
mov ecx, 0x418e4c
lea eax, [ebp - 0xb0]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xb0]
call fcn.004067c8
mov byte [ebx], al
call fcn.00413288
mov eax, 0x418ecc
call fcn.00413c44
mov eax, esi
mov edx, 0x418cac
call fcn.00403770
mov eax, 0x418f18
call fcn.00413c44
mov eax, 0x418fe4
call fcn.00413c44
mov eax, esi
mov edx, 0x4196fc
call fcn.00403770
mov eax, 0x419724
call fcn.00413c44
mov eax, esi
mov edx, 0x419730
call fcn.00403770
push 0
push 0
push 0x41db98
mov ecx, 0x408678
xor edx, edx
xor eax, eax
call fcn.004036d8
push 0
push 0
push 0x41db98
mov ecx, 0x407634
xor edx, edx
xor eax, eax
call fcn.004036d8
mov ecx, 0x418dd4
mov eax, 0x41db24
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [0x41db24]
mov edx, dword [0x41db28]
call fcn.004039e0
je 0x417c8b
mov ecx, 0x418de8
lea eax, [ebp - 0xb4]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x41db28]
call fcn.004039e0
je 0x417c8b
mov ecx, 0x418dfc
lea eax, [ebp - 0xb8]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xb8]
mov edx, dword [0x41db28]
call fcn.004039e0
jne 0x417c97
mov eax, 0x41db24
call fcn.0040371c
jmp 0x417cac
mov eax, 0x41db24
mov ecx, dword [0x41db28]
mov edx, 0x41980c
call fcn.004038e0
mov al, byte [0x41dba0]
sub al, 0x64
je 0x417cbf
dec al
je 0x417cd6
dec al
je 0x417ced
jmp 0x417d02
mov eax, 0x41db24
mov ecx, dword [0x41db24]
mov edx, 0x419818
call fcn.004038e0
jmp 0x417d02
mov eax, 0x41db24
mov ecx, dword [0x41db24]
mov edx, 0x419824
call fcn.004038e0
jmp 0x417d02
mov eax, 0x41db24
mov ecx, dword [0x41db24]
mov edx, 0x419830
call fcn.004038e0
mov eax, dword [0x41db24]
call fcn.0041a4a8
mov ecx, 0x418930
mov eax, 0x41dbb8
mov edx, 0x80000002
call fcn.00406c48
test al, al
jne 0x417d4b
mov ecx, 0x418930
mov eax, 0x41dbb8
mov edx, 0x80000002
call fcn.00406c48
test al, al
jne 0x417d4b
mov eax, 0x419840
call fcn.0041a4a8
jmp 0x4188aa
mov eax, esi
mov edx, 0x419858
call fcn.00403770
push dword [edi]
push 0x41990c
push 0x41991c
mov eax, 0x41db44
mov edx, 3
call fcn.00403954
mov eax, dword [0x41db44]
call fcn.00405818
test al, al
jne 0x417dec
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0xbc]
mov ecx, 0x41992c
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xbc]
mov cl, 1
mov edx, dword [0x41db44]
call fcn.00405784
test al, al
je 0x417dd8
lea eax, [ebp - 0xc0]
mov ecx, dword [0x41db44]
mov edx, 0x419944
call fcn.004038e0
mov eax, dword [ebp - 0xc0]
call fcn.0041a4a8
jmp 0x417dec
mov eax, 0x419960
call fcn.0041a4a8
mov eax, 0x41db44
call fcn.0040371c
mov eax, dword [0x41db44]
call fcn.00403894
test eax, eax
jle 0x417fe0
mov eax, 0x41db4c
mov ecx, 0x419970
mov edx, dword [edi]
call fcn.004038e0
mov eax, 0x41db48
mov edx, 0x419984
call fcn.00403770
lea eax, [ebp - 0xc4]
mov ecx, 0x419998
mov edx, dword [0x41db4c]
call fcn.004038e0
mov eax, dword [ebp - 0xc4]
call fcn.00405818
test al, al
je 0x417e52
mov eax, 0x41db48
mov edx, 0x4199a8
call fcn.0040389c
lea eax, [ebp - 0xc8]
mov ecx, 0x4199b8
mov edx, dword [0x41db4c]
call fcn.004038e0
mov eax, dword [ebp - 0xc8]
call fcn.00405818
test al, al
je 0x417e86
mov eax, 0x41db48
mov edx, 0x4199c8
call fcn.0040389c
lea eax, [ebp - 0xcc]
mov ecx, 0x4199d8
mov edx, dword [0x41db4c]
call fcn.004038e0
mov eax, dword [ebp - 0xcc]
call fcn.00405818
test al, al
je 0x417eba
mov eax, 0x41db48
mov edx, 0x4199e8
call fcn.0040389c
lea eax, [ebp - 0xd0]
mov ecx, 0x4199f8
mov edx, dword [0x41db4c]
call fcn.004038e0
mov eax, dword [ebp - 0xd0]
call fcn.00405818
test al, al
je 0x417eee
mov eax, 0x41db48
mov edx, 0x419a08
call fcn.0040389c
lea eax, [ebp - 0xd4]
mov ecx, 0x419a18
mov edx, dword [0x41db4c]
call fcn.004038e0
mov eax, dword [ebp - 0xd4]
call fcn.00405818
test al, al
je 0x417f22
mov eax, 0x41db48
mov edx, 0x419a28
call fcn.0040389c
lea eax, [ebp - 0xd8]
mov ecx, 0x419a38
mov edx, dword [0x41db4c]
call fcn.004038e0
mov eax, dword [ebp - 0xd8]
call fcn.00405818
test al, al
je 0x417f56
mov eax, 0x41db48
mov edx, 0x419a48
call fcn.0040389c
lea eax, [ebp - 0xdc]
mov ecx, 0x419a58
mov edx, dword [0x41db4c]
call fcn.004038e0
mov eax, dword [ebp - 0xdc]
call fcn.00405818
test al, al
je 0x417f8a
mov eax, 0x41db48
mov edx, 0x419a68
call fcn.0040389c
mov eax, dword [0x41db48]
mov edx, 0x419a78
call fcn.004039e0
jne 0x417fa7
mov eax, 0x419aa8
call fcn.0041a4a8
jmp 0x417fc8
lea eax, [ebp - 0xe0]
mov ecx, dword [0x41db48]
mov edx, 0x419ab8
call fcn.004038e0
mov eax, dword [ebp - 0xe0]
call fcn.0041a4a8
push 0
mov ecx, 0x419ac8
mov edx, 0x419ad8
mov eax, 0x80000001
call fcn.00406aec
jmp 0x417fea
mov eax, 0x41db48
call fcn.0040371c
call fcn.00408614
mov eax, 0x41db24
mov edx, 0x419af8
call fcn.00403770
lea edx, [ebp - 0xe8]
mov eax, 0x419b3c
call fcn.00406098
mov ecx, dword [ebp - 0xe8]
lea eax, [ebp - 0xe4]
mov edx, dword [0x41db28]
call fcn.004038e0
mov eax, dword [ebp - 0xe4]
push eax
lea eax, [ebp - 0xf4]
mov ecx, 0x419b60
mov edx, dword [0x41db24]
call fcn.004038e0
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xf0]
call fcn.00406098
mov ecx, dword [ebp - 0xf0]
lea eax, [ebp - 0xec]
mov edx, 0x419b84
call fcn.004038e0
mov edx, dword [ebp - 0xec]
mov ecx, dword [0x41db28]
mov eax, 0x80000002
call fcn.004069fc
mov eax, dword [0x41c318]
push eax
mov edx, 0x418930
mov ecx, 0x419bb0
mov eax, 0x80000002
call fcn.00406874
mov dword [0x41db7c], eax
mov eax, dword [0x41c318]
push eax
mov edx, 0x418930
mov ecx, 0x419bc0
mov eax, 0x80000002
call fcn.00406874
mov dword [0x41db8c], eax
cmp dword [0x41db8c], 0x64
jge 0x418295
mov eax, dword [0x41c318]
push eax
push 0x400
lea eax, [ebp - 0xfc]
push eax
mov edx, 0x418930
mov ecx, 0x419bd0
mov eax, 0x80000002
call fcn.00406928
mov eax, dword [ebp - 0xfc]
lea edx, [ebp - 0xf8]
call fcn.004053bc
mov edx, dword [ebp - 0xf8]
mov eax, 0x41db3c
call fcn.00403770
mov eax, dword [0x41db3c]
call fcn.00403894
test eax, eax
je 0x41812c
mov eax, dword [0x41db3c]
mov al, byte [eax]
add al, 0x9f
sub al, 0x1a
jb 0x41813b
mov eax, 0x41db3c
mov edx, 0x419be0
call fcn.00403770
push 0x100002
mov eax, 0x41dcb4
mov ecx, 1
mov edx, dword [0x407614]
call fcn.00404220
add esp, 4
mov eax, dword [0x41db3c]
mov bl, byte [eax]
cmp bl, 0x63
jb 0x418271
lea eax, [ebp - 0x100]
mov edx, ebx
call fcn.0040383c
lea eax, [ebp - 0x100]
mov edx, 0x419bec
call fcn.0040389c
mov eax, dword [ebp - 0x100]
call fcn.00403a94
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x4181a7
sub eax, 1
jne 0x418260
xor eax, eax
mov dword [0x41db80], eax
lea eax, [ebp - 0x104]
mov edx, ebx
call fcn.0040383c
lea eax, [ebp - 0x104]
mov edx, 0x419bec
call fcn.0040389c
mov eax, dword [ebp - 0x104]
call fcn.0040e038
lea eax, [ebp - 0x10c]
mov edx, ebx
call fcn.0040383c
mov ecx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
mov edx, 0x419bf8
call fcn.004038e0
mov eax, dword [ebp - 0x108]
call fcn.0041a4a8
mov eax, esi
mov edx, 0x419c0c
call fcn.00403770
lea eax, [ebp - 0x110]
xor edx, edx
mov dl, bl
dec edx
call fcn.0040383c
mov eax, dword [ebp - 0x110]
push eax
mov ecx, 0x419bd0
mov edx, 0x418930
mov eax, 0x80000002
call fcn.004069fc
push 0
mov ecx, 0x419bb0
mov edx, 0x418930
mov eax, 0x80000002
call fcn.00406aec
cmp bl, 0x63
jne 0x418260
mov eax, 0x419c34
call fcn.0041a4a8
xor eax, eax
mov dword [0x41db7c], eax
dec ebx
cmp bl, 0x62
jne 0x418168
mov dword [0x41db8c], 0x64
mov eax, dword [0x41db8c]
push eax
mov ecx, 0x419bc0
mov edx, 0x418930
mov eax, 0x80000002
call fcn.00406aec
mov eax, esi
mov edx, 0x419c48
call fcn.00403770
cmp dword [0x41db8c], 0xc8
jge 0x418345
cmp byte [0x41dba0], 0x66
jne 0x4182c1
mov byte [0x41c280], 0
xor eax, eax
mov dword [0x41db84], eax
mov eax, dword [0x41c318]
push eax
mov edx, 0x418930
mov ecx, 0x419ca4
mov eax, 0x80000002
call fcn.00406874
mov dword [0x41db88], eax
push 0x100002
mov eax, 0x41dcb4
mov ecx, 1
mov edx, dword [0x407614]
call fcn.00404220
add esp, 4
xor eax, eax
call fcn.0040eb64
mov dword [0x41db8c], 0xc8
mov eax, dword [0x41db8c]
push eax
mov ecx, 0x419bc0
mov edx, 0x418930
mov eax, 0x80000002
call fcn.00406aec
mov eax, 0x419cb4
call fcn.0041a4a8
mov eax, esi
mov edx, 0x418ff0
call fcn.00403770
push 0
mov eax, 0x41dcb4
mov ecx, 1
mov edx, dword [0x407614]
call fcn.00404220
add esp, 4
mov eax, 0x41dbb8
call fcn.00406cbc
mov eax, dword [0x41db2c]
call fcn.00403894
test eax, eax
jne 0x4183af
lea edx, [ebp - 0x114]
mov eax, dword [0x41db28]
call fcn.004055c0
mov edx, dword [ebp - 0x114]
mov eax, 0x41db2c
call fcn.00403770
mov eax, dword [0x41db2c]
call fcn.00403894
test eax, eax
jne 0x4183af
call fcn.0040c048
jmp 0x4188aa
cmp byte [0x41dba0], 0x64
jne 0x4183c2
call fcn.0041a258
call fcn.004035b0
mov byte [0x41c280], 0
mov eax, dword [0x41c318]
push eax
mov edx, 0x418930
mov ecx, 0x419ccc
mov eax, 0x80000002
call fcn.00406874
dec eax
je 0x418492
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x41db10]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x41dba8], eax
mov eax, esi
mov edx, 0x4196e0
call fcn.00403770
push 2
push 0
push 0
mov eax, dword [0x41dba8]
push eax
call sub.kernel32.dll_SetFilePointer_1
call fcn.00408df8
push 0
push 0x41db98
mov eax, dword [0x41db6c]
call fcn.00403894
push eax
mov eax, 0x41db6c
call fcn.00403aec
push eax
mov eax, dword [0x41dba8]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, 0x41db6c
call fcn.0040371c
mov eax, dword [0x41dba8]
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, 0x419ccc
mov edx, 0x418930
mov eax, 0x80000002
call fcn.00406aec
mov eax, esi
mov edx, 0x419cdc
call fcn.00403770
push 0xea60
call sub.kernel32.dll_Sleep
mov eax, esi
mov edx, 0x419d8c
call fcn.00403770
lea edx, [ebp - 0x118]
mov al, 1
call fcn.004053f8
mov ecx, dword [ebp - 0x118]
mov eax, 0x41db38
mov edx, 0x419e28
call fcn.004038e0
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x4184dd
jmp dword [eax*4 + 0x4184e4]
lea edx, [ebp - 0x11c]
mov eax, 0x419e3c
call fcn.00406098
mov edx, dword [ebp - 0x11c]
mov eax, 0x41db34
call fcn.00403770
jmp 0x4185f1
lea edx, [ebp - 0x120]
mov eax, 0x419e54
call fcn.00406098
mov edx, dword [ebp - 0x120]
mov eax, 0x41db34
call fcn.00403770
jmp 0x4185f1
lea edx, [ebp - 0x124]
mov eax, 0x419e6c
call fcn.00406098
mov edx, dword [ebp - 0x124]
mov eax, 0x41db34
call fcn.00403770
jmp 0x4185f1
lea edx, [ebp - 0x128]
mov eax, 0x419e84
call fcn.00406098
mov edx, dword [ebp - 0x128]
mov eax, 0x41db34
call fcn.00403770
jmp 0x4185f1
lea edx, [ebp - 0x12c]
mov eax, 0x419e9c
call fcn.00406098
mov edx, dword [ebp - 0x12c]
mov eax, 0x41db34
call fcn.00403770
jmp 0x4185f1
lea edx, [ebp - 0x130]
mov eax, 0x419eb8
call fcn.00406098
mov edx, dword [ebp - 0x130]
mov eax, 0x41db34
call fcn.00403770
jmp 0x4185f1
lea edx, [ebp - 0x134]
mov eax, 0x419ed0
call fcn.00406098
mov edx, dword [ebp - 0x134]
mov eax, 0x41db34
call fcn.00403770
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x418604
jmp dword [eax*4 + 0x41860b]
lea edx, [ebp - 0x138]
mov eax, 0x419ee8
call fcn.00406098
mov edx, dword [ebp - 0x138]
mov eax, 0x41db30
call fcn.00403770
jmp 0x418718
lea edx, [ebp - 0x13c]
mov eax, 0x419f04
call fcn.00406098
mov edx, dword [ebp - 0x13c]
mov eax, 0x41db30
call fcn.00403770
jmp 0x418718
lea edx, [ebp - 0x140]
mov eax, 0x419f20
call fcn.00406098
mov edx, dword [ebp - 0x140]
mov eax, 0x41db30
call fcn.00403770
jmp 0x418718
lea edx, [ebp - 0x144]
mov eax, 0x419f3c
call fcn.00406098
mov edx, dword [ebp - 0x144]
mov eax, 0x41db30
call fcn.00403770
jmp 0x418718
lea edx, [ebp - 0x148]
mov eax, 0x419f58
call fcn.00406098
mov edx, dword [ebp - 0x148]
mov eax, 0x41db30
call fcn.00403770
jmp 0x418718
lea edx, [ebp - 0x14c]
mov eax, 0x419f70
call fcn.00406098
mov edx, dword [ebp - 0x14c]
mov eax, 0x41db30
call fcn.00403770
jmp 0x418718
lea edx, [ebp - 0x150]
mov eax, 0x419f8c
call fcn.00406098
mov edx, dword [ebp - 0x150]
mov eax, 0x41db30
call fcn.00403770
mov ecx, 0x418c84
lea eax, [ebp - 0x154]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x154]
mov eax, dword [0x41db10]
call fcn.0041619c
test al, al
je 0x418764
mov ecx, 0x418c98
lea eax, [ebp - 0x158]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x158]
mov eax, dword [0x41db14]
call fcn.0041619c
test al, al
jne 0x41876e
call fcn.0041a258
jmp 0x4188aa
call fcn.00406234
mov ecx, 0x418c84
lea eax, [ebp - 0x15c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x15c]
call fcn.0040fd84
test al, al
je 0x4187c2
mov ecx, 0x418c98
lea eax, [ebp - 0x160]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x160]
call fcn.0040fd84
mov eax, esi
mov edx, 0x419418
call fcn.00403770
jmp 0x4188aa
call fcn.00406234
mov eax, esi
mov edx, 0x419fa8
call fcn.00403770
mov ecx, 0x418c84
lea eax, [ebp - 0x164]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x164]
call fcn.0040fd84
test al, al
je 0x418816
mov ecx, 0x418c98
lea eax, [ebp - 0x168]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x168]
call fcn.0040fd84
jmp 0x4188aa
call fcn.00406234
mov ecx, 0x418c84
lea eax, [ebp - 0x16c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x16c]
call fcn.0040fd84
test al, al
je 0x418867
mov eax, esi
mov edx, 0x41a018
call fcn.00403770
mov ecx, 0x418c98
lea eax, [ebp - 0x170]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x170]
call fcn.0040fd84
jmp 0x4188aa
mov eax, esi
mov edx, 0x41a0ac
call fcn.00403770
call fcn.00406234
call fcn.004113c4
test al, al
jne 0x4188aa
call fcn.00406234
call fcn.00411e84
test al, al
jne 0x4188aa
call fcn.004113c4
mov eax, 0x41a174
call fcn.0041a4a8
mov eax, esi
mov edx, 0x41a188
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4188cf
lea eax, [ebp - 0x170]
mov edx, 0x5c
call fcn.00403740
ret