Function at 0x440920
Capabilities:
Accept command line arguments
Create thread
Move file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e3d8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x78
mov eax, dword [0x4b4200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xorps xmm0, xmm0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x44], 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x150]
movaps xmm0, xmmword [0x4aa890]
push ecx
push dword [edi + 0x58]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c], 0xd
push dword [edi + 0x94]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x28], 0
push dword [edi + 0x4c]
push esi
call fcn.0041b400
sub esp, 0x10
mov dword [ebp - 4], 1
lea ecx, [edi + 0x6a0]
push esi
push str.Searching_for_a_newer_version_of_Clear_Disk_Info...
call fcn.0041d0e0
push 0
push 0xffffffffffffffba
lea ecx, [edi + 0x6a0]
call fcn.0041d6d0
sub esp, 8
mov ecx, eax
call fcn.0041d850
sub esp, 8
mov ecx, eax
call fcn.0041da40
sub esp, 0x10
xor edx, edx
mov ecx, str.https:__www.carifred.com_cleardiskinfo_checkversion.php
push 6
call fcn.0041eef0
mov esi, eax
mov dword [ebp - 0x24], esi
lea eax, [edi + 0x718]
test eax, eax
je 0x440a3c
push 0
push 0
push dword [eax + 0x230]
push 0x40e8a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x440a3c
cmp eax, 0xffffffff
je 0x440a3c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
movq qword [ebp - 0x6c], xmm0
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x64], 1
movq qword [ebp - 0x60], xmm0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x58], 1
mov byte [ebp - 4], 4
test esi, esi
je 0x440c30
nop
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x440ac1
mov eax, dword [esi + 0x1c]
cmp eax, 3
je 0x440adb
cmp eax, 4
je 0x440adb
push 0
mov ecx, edi
call fcn.0043f210
cmp byte [edi + 0xba], 0
jne 0x440adb
cmp byte [edi + 0xb8], 0
je 0x440a90
jmp 0x440adb
cmp eax, 7
je 0x440adb
mov dword [esi + 0x1c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x440afc
cmp eax, 7
je 0x440afc
mov dword [esi + 0x1c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
cmp dword [esi + 0x1c], 3
jne 0x440c30
xor eax, eax
nop dword [eax + eax]
inc eax
cmp byte [eax + 0x4a6370], 0
jne 0x440b10
mov dword [ebp - 0x4c], eax
mov ecx, 2
inc eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x48], eax
inc eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edx, dword [ebp - 0x48]
xor ecx, ecx
add esp, 4
mov dword [ebp - 0x6c], eax
mov word [eax + edx*2], cx
mov word [eax], cx
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x440b78
push edx
push eax
push ecx
push 0x4a6370
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x6c]
xor edx, edx
test eax, eax
setg byte [ebp - 0x64]
mov word [ecx + eax*2], dx
test byte [esi + 0x24], 4
jne 0x440b89
mov dword [ebp - 0x4c], 0
xor eax, eax
jmp 0x440bad
mov ecx, dword [esi + 0x40]
mov dword [ebp - 0x4c], ecx
test ecx, ecx
jne 0x440b97
xor eax, eax
jmp 0x440bad
xor eax, eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], eax
cmp byte [ecx], al
je 0x440bb0
mov dword [ebp - 0x4c], ecx
inc eax
cmp byte [ecx + eax], 0
jne 0x440ba6
mov dword [ebp - 0x50], eax
inc eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x48], eax
mov ecx, 2
inc eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edx, dword [ebp - 0x48]
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x60], ecx
add esp, 4
mov word [ecx + edx*2], ax
mov word [ecx], ax
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x440c0f
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x440c0f
push edx
push dword [ebp - 0x60]
push eax
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x60]
xor edx, edx
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x60]
mov byte [ebp - 0x64], 1
mov byte [ebp - 0x58], 1
call fcn.00407cb0
xor ecx, ecx
test eax, eax
setg cl
mov dword [ebp - 0x48], ecx
test eax, eax
jg 0x440c3e
lea ecx, [edi + 0x6a0]
call fcn.0041d630
mov ecx, dword [ebp - 0x48]
test ecx, ecx
jne 0x440c4a
lea edi, [ecx + 2]
jmp 0x4411f4
cmp ecx, 0xffffffff
jne 0x440c56
or edi, ecx
jmp 0x4411f4
mov eax, dword [edi + 0x9b4]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x440c69
cmp word [eax], 0
jne 0x440cd1
push 0x2002
mov dword [edi + 0x9b8], 0
call fcn.0046a3df
add esp, 4
mov dword [edi + 0x9b4], eax
push 0x2000
push 0
push eax
call fcn.0046ba40
mov eax, dword [edi + 0x9b4]
xor ecx, ecx
add esp, 0xc
mov word [eax + 0x2000], cx
mov eax, dword [edi + 0x9b4]
mov word [eax], cx
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x440cbe
push eax
call fcn.00469dd3
add esp, 4
push 0x1000
push dword [edi + 0x9b4]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [edi + 0x9b4], 0
xorps xmm0, xmm0
movq qword [ebp - 0x84], xmm0
mov dword [ebp - 0x7c], 0
jne 0x440d07
push 2
call fcn.0046a3df
add esp, 4
mov dword [edi + 0x9b4], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x9b8], ecx
mov ecx, dword [edi + 0x9b4]
xor eax, eax
mov byte [edi + 0x9bc], 1
mov dword [ebp - 0x48], ecx
test ecx, ecx
je 0x440d2a
cmp word [ecx], ax
je 0x440d2a
inc eax
cmp word [ecx + eax*2], 0
jne 0x440d22
xor ecx, ecx
nop dword [eax]
inc ecx
cmp word [ecx*2 + str..old], 0
jne 0x440d30
add eax, ecx
mov ecx, 2
mov dword [ebp - 0x4c], eax
inc eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov ecx, dword [ebp - 0x48]
add esp, 4
mov dword [ebp - 0x50], eax
mov edx, eax
test ecx, ecx
je 0x440d84
movzx ecx, word [ecx]
test cx, cx
je 0x440d84
mov esi, dword [ebp - 0x48]
sub esi, eax
mov word [edx], cx
add edx, 2
movzx eax, word [esi + edx]
mov ecx, eax
test ax, ax
jne 0x440d73
mov esi, str..old
mov ecx, 0x2e
sub esi, edx
mov word [edx], cx
lea edx, [edx + 2]
movzx eax, word [edx + esi]
mov ecx, eax
test ax, ax
jne 0x440d90
xor eax, eax
mov word [edx], ax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 7
or ecx, 0xffffffff
cmp dword [edi + 0x9b4], 0
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x48], ecx
mov byte [ebp - 0x7c], 1
jne 0x440dea
push 2
call fcn.0046a3df
add esp, 4
mov dword [edi + 0x9b4], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x9b8], ecx
push 1
push dword [ebp - 0x50]
mov byte [edi + 0x9bc], 1
push dword [edi + 0x9b4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x440fbb
mov ecx, 0xfffffffe
push str.Downloading_update...
mov dword [ebp - 0x48], ecx
lea ecx, [edi + 0x6a0]
push 0
call fcn.0041d6d0
cmp dword [edi + 0x9b4], 0
jne 0x440e48
push 2
call fcn.0046a3df
add esp, 4
mov dword [edi + 0x9b4], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x9b8], ecx
mov edx, dword [edi + 0x9b4]
sub esp, 0x10
mov ecx, str.https:__www.carifred.com_cleardiskinfo_ClearDiskInfo.exe
mov byte [edi + 0x9bc], 1
push 2
call fcn.0041eef0
mov dword [ebp - 0x4c], eax
test esi, esi
je 0x440ee7
mov dword [esi + 0x20], 3
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x440ea3
cmp eax, 0xffffffff
je 0x440ea3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x440ea3
call fcn.00407990
test al, al
jne 0x440e72
push 1
push 0xa
call dword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x440e72
mov eax, dword [esi + 4]
test eax, eax
je 0x440eb1
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esi]
test eax, eax
je 0x440ebe
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x440ece
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x440edc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.0041ee60
mov eax, dword [ebp - 0x4c]
mov esi, eax
mov dword [ebp - 0x24], esi
test eax, eax
je 0x440fbb
xor ecx, ecx
mov dword [ebp - 0x48], ecx
nop dword [eax]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x440f74
mov ecx, dword [eax + 0x1c]
cmp ecx, 3
je 0x440f8e
cmp ecx, 4
je 0x440f8e
push 0
mov ecx, edi
call fcn.0043f210
cmp byte [edi + 0xba], 0
mov eax, dword [ebp - 0x4c]
jne 0x440f8e
cmp byte [edi + 0xb8], 0
jne 0x440f8e
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x440f53
cmp ecx, 7
je 0x440f53
mov dword [eax + 0x1c], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x54], ecx
cmp ecx, dword [ebp - 0x48]
jbe 0x440f00
push 0
push ecx
lea ecx, [edi + 0x6a0]
call fcn.0041d6d0
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
jmp 0x440ef6
cmp ecx, 7
je 0x440f8e
mov dword [eax + 0x1c], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x440faf
cmp ecx, 7
je 0x440faf
mov dword [eax + 0x1c], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
xor ecx, ecx
cmp dword [eax + 0x1c], 3
sete cl
mov dword [ebp - 0x48], ecx
lea ecx, [edi + 0x6a0]
call fcn.0041d630
mov eax, dword [ebp - 0x48]
cmp eax, 1
jge 0x441017
cmp eax, 0xfffffffe
jne 0x441017
cmp dword [edi + 0x9b4], 0
jne 0x440ff7
push 2
call fcn.0046a3df
add esp, 4
mov dword [edi + 0x9b4], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x9b8], ecx
push 1
push dword [edi + 0x9b4]
mov byte [edi + 0x9bc], 1
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
or edi, 0xffffffff
jmp 0x4411e9
test eax, eax
jne 0x441022
xor edi, edi
jmp 0x4411e9
jns 0x44102c
or edi, 0xffffffff
jmp 0x4411e9
lea eax, [edi + 0x9b4]
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
push eax
movq qword [ebp - 0x20], xmm0
call fcn.004054f0
mov byte [ebp - 4], 0xa
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
mov dword [ebp - 0x70], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
xor ecx, ecx
test edi, edi
je 0x441078
cmp word [edi], cx
je 0x441078
inc ecx
cmp word [edi + ecx*2], 0
jne 0x441070
xor eax, eax
nop word [eax + eax]
inc eax
cmp word [eax*2 + str.__PostUpdate], 0
jne 0x441080
add eax, ecx
mov ecx, 2
mov dword [ebp - 0x4c], eax
inc eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x48], eax
mov edx, eax
test edi, edi
je 0x4410e1
movzx ecx, word [edi]
mov eax, ecx
mov dword [ebp - 0x54], eax
mov eax, edx
test cx, cx
je 0x4410e1
movzx ecx, cx
sub edi, eax
nop word [eax + eax]
mov word [edx], cx
add edx, 2
movzx eax, word [edx + edi]
mov ecx, eax
test ax, ax
jne 0x4410d0
mov edi, str.__PostUpdate
mov ecx, 0x20
sub edi, edx
nop dword [eax]
mov word [edx], cx
lea edx, [edx + 2]
movzx eax, word [edx + edi]
mov ecx, eax
test ax, ax
jne 0x4410f0
mov edi, dword [ebp - 0x48]
xor eax, eax
mov word [edx], ax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 1
push ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xb
call fcn.00406f30
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x49eae8
lea ecx, [ebp - 0x20]
call fcn.00406350
cmp eax, 2
jle 0x441172
mov ecx, dword [ebp - 0x20]
lea edx, [eax - 1]
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x44115e
test ecx, ecx
je 0x44115b
cmp word [ecx], ax
je 0x44115b
inc eax
cmp word [ecx + eax*2], 0
jne 0x441153
mov dword [ebp - 0x1c], eax
cmp eax, edx
setge byte [ebp - 0x18]
jl 0x441172
cmovl edx, eax
xor eax, eax
mov dword [ebp - 0x1c], edx
mov word [ecx + edx*2], ax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x44118e
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov word [eax], cx
push ecx
push 5
push eax
mov edx, edi
mov byte [ebp - 0x18], 1
xor ecx, ecx
mov byte [ebp - 0x70], 1
call fcn.00404770
mov edi, eax
test edi, edi
je 0x4411bc
cmp edi, 0xffffffff
je 0x4411bc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, dword [ebp - 0x50]
mov byte [ebp - 0x7c], 1
call fcn.00404130
push dword [ebp - 0x48]
mov edi, 1
call fcn.00469dd3
mov eax, dword [ebp - 0x20]
add esp, 4
test eax, eax
je 0x4411e9
push eax
call fcn.00469dd3
add esp, 4
push dword [ebp - 0x50]
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x441204
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x441214
push eax
call fcn.00469dd3
add esp, 4
mov byte [ebp - 4], 1
test esi, esi
je 0x441295
mov dword [esi + 0x20], 3
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x441254
cmp eax, 0xffffffff
je 0x441254
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x441254
call fcn.00407990
test al, al
jne 0x441223
push 1
push 0xa
call dword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x441223
mov eax, dword [esi + 4]
test eax, eax
je 0x441262
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esi]
test eax, eax
je 0x44126f
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x44127f
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44128d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.0041ee60
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x44]
test ecx, ecx
je 0x4412be
test esi, esi
je 0x4412cb
push dword [ebp - 0x2c]
lea eax, [ebp - 0x44]
push dword [ebp - 0x3c]
push eax
call fcn.0040f6b0
call fcn.00407990
test esi, esi
je 0x4412cb
push esi
call fcn.00469dd3
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00469dc5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4