Function at 0x402b16
Capabilities:
Create thread
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 4], 0
push 0x40
call fcn.0048253b
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x3c], 0
mov dword [0x51684f], 0x14
mov eax, 0x4a4356
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00403f5d
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x402bcc
push ebx
call fcn.00482541
add esp, 4
push 0x4a436e
push dword [ebp - 0x44]
mov ecx, 2
call fcn.00402aba
add esp, 8
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x402bf4
push ebx
call fcn.00482541
add esp, 4
mov dword [ebp - 0x4c], esp
push dword [ebp - 0x48]
push 0
call dword [0x516973]
nop
nop
nop
nop
cmp dword [ebp - 0x4c], esp
je 0x402c1b
push 6
call fcn.0048254d
add esp, 4
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x402c2e
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x50]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x402c6f
mov dword [ebp - 0x40], esp
push 1
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
cmp dword [ebp - 0x40], esp
je 0x402c65
push 6
call fcn.0048254d
add esp, 4
mov eax, 0
jmp 0x403f0b
mov eax, 0x4a43cb
push eax
mov ebx, eax
call fcn.004019e2
pop eax
sub ebx, eax
push ecx
push ebx
push eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.0048253b
add esp, 4
pop esi
mov edi, eax
pop ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
test ecx, ecx
je 0x402ccc
push eax
lodsd eax, dword [esi]
push esi
push edi
push ecx
test eax, eax
je 0x402cc0
push eax
mov ebx, eax
call fcn.00401ec6
inc eax
push eax
call fcn.0048253b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop ecx
pop edi
pop esi
stosd dword es:[edi], eax
dec ecx
jne 0x402ca3
pop eax
push eax
mov ebx, dword [0x516853]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x402cee
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x402cea
imul eax, dword [ebx]
jmp 0x402cdf
mov ecx, eax
test ecx, ecx
je 0x402d0d
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x402d06
push ebx
push eax
call fcn.00482541
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x402cf4
call fcn.00482541
add esp, 4
pop eax
mov dword [0x516853], eax
mov ebx, dword [0x516857]
mov dword [ebp - 0x40], ebx
mov ebx, dword [ebp - 0x40]
mov dword [ebx], 0x94
mov dword [ebp - 0x40], esp
mov eax, dword [0x516857]
push eax
push 0x214
call fcn.0048253b
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x80
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
pop ebx
add ebx, 4
call dword [0x516977]
nop
nop
nop
nop
cmp dword [ebp - 0x40], esp
je 0x402db1
push 6
call fcn.0048254d
add esp, 4
push eax
mov ebx, dword [ebp - 0x44]
push ebx
mov edi, dword [ebp - 0x48]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.00482541
add esp, 4
pop eax
call fcn.00404120
mov dword [0x51685b], eax
push OleUIBusyA
push 0
push 0x4a42ea
push OleUIBusyA
push 0
push str.SoftwareORM_src
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x698
call fcn.004833a0
add esp, 0x28
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ebx, dword [0x51685f]
test ebx, ebx
je 0x402e4e
push ebx
call fcn.00482541
add esp, 4
pop eax
mov dword [0x51685f], eax
push 0x4a42ea
push dword [0x51685f]
call fcn.004025b6
add esp, 8
cmp eax, 0
jne 0x402e8f
mov eax, str.index
push eax
mov ebx, dword [0x51685f]
test ebx, ebx
je 0x402e89
push ebx
call fcn.00482541
add esp, 4
pop eax
mov dword [0x51685f], eax
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x40], ebx
mov ebx, dword [ebp - 0x40]
mov dword [ebx], 0x40
mov dword [ebp - 0x40], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
nop
nop
nop
cmp dword [ebp - 0x40], esp
je 0x402ec0
push 6
call fcn.0048254d
add esp, 4
mov eax, 0x4a440a
test eax, eax
je 0x402edc
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0048253b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [0x516863]
test ebx, ebx
je 0x402ef0
push ebx
call fcn.00482541
add esp, 4
pop eax
mov dword [0x516863], eax
push 0x516863
call fcn.00403f5d
mov dword [ebp - 0x40], eax
push 0x80000301
push 0
push dword [0x51685b]
push 1
mov ebx, 0x168
call fcn.004830d0
add esp, 0x10
mov dword [ebp - 0x44], eax
mov ebx, dword [0x516857]
add ebx, 4
mov dword [ebp - 0x48], ebx
push 0x80000301
push 0
mov ebx, dword [ebp - 0x48]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.004830d0
add esp, 0x10
mov dword [ebp - 0x4c], eax
mov ebx, dword [0x516857]
add ebx, 8
mov dword [ebp - 0x50], ebx
push 0x80000301
push 0
mov ebx, dword [ebp - 0x50]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.004830d0
add esp, 0x10
mov dword [ebp - 0x54], eax
mov ebx, dword [0x516857]
add ebx, 0xc
mov dword [ebp - 0x58], ebx
push 0x80000301
push 0
mov ebx, dword [ebp - 0x58]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.004830d0
add esp, 0x10
mov dword [ebp - 0x5c], eax
push 0x80000301
push 0
push 0x104e
push 1
mov ebx, 0x168
call fcn.004830d0
add esp, 0x10
mov dword [ebp - 0x60], eax
mov ebx, dword [ebp - 8]
add ebx, 8
mov dword [ebp - 0x64], ebx
push 0x80000401
mov ebx, dword [ebp - 0x64]
push dword [ebx + 4]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.004830d0
add esp, 0x10
mov dword [ebp - 0x68], eax
push dword [ebp - 0x68]
push str.mem
push dword [0x51685f]
push str.src
push dword [ebp - 0x60]
push str.ver
push dword [ebp - 0x5c]
push 0x4a443b
push dword [ebp - 0x54]
push 0x4a443f
push dword [ebp - 0x4c]
push 0x4a4443
push dword [ebp - 0x44]
push str.GetVer.php_bit
push dword [ebp - 0x40]
mov ecx, 0xf
call fcn.00402aba
add esp, 0x3c
mov dword [ebp - 0x6c], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x403056
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x403066
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x403076
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x54]
test ebx, ebx
je 0x403086
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x5c]
test ebx, ebx
je 0x403096
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x4030a6
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x68]
test ebx, ebx
je 0x4030b6
push ebx
call fcn.00482541
add esp, 4
lea eax, [ebp - 0x6c]
push eax
call fcn.00404184
mov dword [ebp - 0x70], eax
mov ebx, dword [ebp - 0x6c]
test ebx, ebx
je 0x4030d2
push ebx
call fcn.00482541
add esp, 4
push VariantCopy
push 0
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x4030e5
mov eax, 0x4a4322
push eax
push 1
mov ebx, 0x168
call fcn.004830d0
add esp, 0x10
mov dword [ebp - 0x74], eax
mov ebx, dword [ebp - 0x70]
test ebx, ebx
je 0x40310b
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x74]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40311f
push ebx
call fcn.00482541
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov ebx, dword [0x516867]
mov dword [ebp - 0x40], ebx
mov eax, 0x4a4457
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
mov eax, str.LIST:
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404449
mov dword [ebp - 0x4c], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x403160
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x403170
push ebx
call fcn.00482541
add esp, 4
push OleUIBusyA
push 0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x403183
mov eax, 0x4a42ea
push eax
push 1
mov ebx, 0x9dc
call fcn.00483540
add esp, 0x10
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x4031a9
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x40]
mov dword [ebx], eax
mov ebx, dword [0x516867]
add ebx, 4
mov dword [ebp - 0x40], ebx
mov eax, 0x4a4457
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
mov eax, str.DIY:
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404449
mov dword [ebp - 0x4c], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x4031f1
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x403201
push ebx
call fcn.00482541
add esp, 4
push OleUIBusyA
push 0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x403214
mov eax, 0x4a42ea
push eax
push 1
mov ebx, 0x9dc
call fcn.00483540
add esp, 0x10
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x40323a
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x40]
mov dword [ebx], eax
mov ebx, dword [0x516867]
add ebx, 8
mov dword [ebp - 0x40], ebx
mov eax, 0x4a4457
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
mov eax, str.SYS:
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404449
mov dword [ebp - 0x4c], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x403282
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x403292
push ebx
call fcn.00482541
add esp, 4
push OleUIBusyA
push 0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4032a5
mov eax, 0x4a42ea
push eax
push 1
mov ebx, 0x9dc
call fcn.00483540
add esp, 0x10
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x4032cb
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x40]
mov dword [ebx], eax
mov ebx, dword [0x516867]
add ebx, 0x14
mov dword [ebp - 0x40], ebx
mov eax, 0x4a4457
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
mov eax, str.UTP:
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404449
mov dword [ebp - 0x4c], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x403313
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x403323
push ebx
call fcn.00482541
add esp, 4
push OleUIBusyA
push 0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x403336
mov eax, 0x4a42ea
push eax
push 1
mov ebx, 0x9dc
call fcn.00483540
add esp, 0x10
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x40335c
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x40]
mov dword [ebx], eax
mov eax, 0x4a4457
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
mov eax, str.HOT:
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404449
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x403398
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x4033a8
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x48]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4033bc
push ebx
call fcn.00482541
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
xor ecx, ecx
lea eax, [ebp - 0x14]
mov ebx, eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, 6
jg 0x40349a
mov ebx, dword [0x516867]
mov ebx, dword [ebx + 0x18]
call fcn.004019e2
push ebx
push ecx
mov eax, dword [ebp - 0x14]
dec eax
jns 0x4033f8
push 4
call fcn.0048254d
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x40340b
push 1
call fcn.0048254d
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x40], ebx
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 0x14]
push OleUIBusyA
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x40343c
mov eax, 0x4a42ea
push eax
push 3
mov ebx, 0x13c
call fcn.00483620
add esp, 0x28
mov dword [ebp - 0x44], eax
push OleUIBusyA
push 0
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x403465
mov eax, 0x4a42ea
push eax
push 1
mov ebx, 0x9dc
call fcn.00483540
add esp, 0x10
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x40348b
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x40]
mov dword [ebx], eax
pop ebx
pop ecx
jmp 0x4033c7
add esp, 8
mov ebx, dword [0x516867]
mov dword [ebp - 0x40], ebx
mov ebx, dword [ebp - 0x40]
mov eax, dword [ebx]
mov dword [0x51686b], eax
mov ebx, dword [0x516867]
add ebx, 0x10
mov dword [ebp - 0x40], ebx
mov eax, 0x4a4457
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
mov eax, str.VERS:
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00404449
mov dword [ebp - 0x4c], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x4034f0
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x403500
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x4c]
push eax
mov ebx, dword [ebp - 0x40]
mov ebx, dword [ebx]
test ebx, ebx
je 0x403516
push ebx
call fcn.00482541
add esp, 4
pop eax
mov ebx, dword [ebp - 0x40]
mov dword [ebx], eax
mov eax, 0x4a4479
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00403f5d
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x403540
push ebx
call fcn.00482541
add esp, 4
push 0
mov ebx, 0x104
call fcn.00483690
add esp, 4
mov dword [ebp - 0x48], eax
mov eax, 0x4a448d
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00403f5d
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x403579
push ebx
call fcn.00482541
add esp, 4
push dword [ebp - 0x50]
push dword [ebp - 0x48]
mov ecx, 2
call fcn.00402aba
add esp, 8
mov dword [ebp - 0x54], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x40359f
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x50]
test ebx, ebx
je 0x4035af
push ebx
call fcn.00482541
add esp, 4
mov dword [ebp - 0x58], esp
push dword [ebp - 0x54]
push dword [ebp - 0x44]
call dword [0x51697b]
nop
nop
nop
nop
cmp dword [ebp - 0x58], esp
je 0x4035d4
push 6
call fcn.0048254d
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x4035e4
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x54]
test ebx, ebx
je 0x4035f4
push ebx
call fcn.00482541
add esp, 4
mov eax, 0x4a4479
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00403f5d
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x403618
push ebx
call fcn.00482541
add esp, 4
push 0
mov ebx, 0x104
call fcn.00483690
add esp, 4
mov dword [ebp - 0x48], eax
push 0
mov ebx, 0x108
call fcn.00483730
add esp, 4
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
push 0x4a44b6
push dword [ebp - 0x48]
mov ecx, 3
call fcn.00402aba
add esp, 0xc
mov dword [ebp - 0x50], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x40366d
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x40367d
push ebx
call fcn.00482541
add esp, 4
mov dword [ebp - 0x54], esp
push dword [ebp - 0x50]
push dword [ebp - 0x44]
call dword [0x51697b]
nop
nop
nop
nop
cmp dword [ebp - 0x54], esp
je 0x4036a2
push 6
call fcn.0048254d
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x4036b2
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x50]
test ebx, ebx
je 0x4036c2
push ebx
call fcn.00482541
add esp, 4
mov dword [ebp - 0x40], esp
call dword [0x51697f]
nop
nop
nop
nop
cmp dword [ebp - 0x40], esp
je 0x4036e1
push 6
call fcn.0048254d
add esp, 4
push OleUIBusyA
push 0
push str.Mozilla_4.0__compatible__MSIE_8.0__Windows_NT_6.1__Trident_4.0__SLCC2__.NET_CLR_2.0.50727__.NET_CLR_3.5.30729__.NET_CLR_3.0.30729__Media_Center_PC_6.0_
push 1
mov ebx, 0x198
call fcn.00483970
add esp, 0x10
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], esp
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x40370f
add eax, 8
push eax
call dword [0x516983]
nop
nop
nop
nop
add esp, 4
cmp dword [ebp - 0x44], esp
je 0x40372f
push 6
call fcn.0048254d
add esp, 4
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x40373f
push ebx
call fcn.00482541
add esp, 4
xor ecx, ecx
lea eax, [ebp - 0x14]
mov ebx, eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, 5
jg 0x403914
fild dword [ebp - 0x14]
fstp qword [ebp - 0x44]
fld qword [ebp - 0x44]
fadd qword [0x4a4550]
fstp qword [ebp - 0x4c]
fld qword [ebp - 0x4c]
call fcn.0040174b
push 0x80000101
push 0
push eax
push 1
mov ebx, 0x140
call fcn.00482ff0
add esp, 0x10
mov dword [ebp - 0x50], eax
push 0x4a4558
push dword [ebp - 0x50]
mov ecx, 2
call fcn.00402aba
add esp, 8
mov dword [ebp - 0x54], eax
mov ebx, dword [ebp - 0x50]
test ebx, ebx
je 0x4037b3
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x54]
push eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4037c7
push ebx
call fcn.00482541
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], esp
push dword [ebp - 0x18]
call dword [0x516987]
nop
nop
nop
nop
cmp dword [ebp - 0x40], esp
je 0x4037ed
push 6
call fcn.0048254d
add esp, 4
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jne 0x40390d
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x40], esp
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
nop
nop
nop
nop
cmp dword [ebp - 0x40], esp
je 0x403836
push 6
call fcn.0048254d
add esp, 4
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp dword [ebp - 0x1c], edx
jl 0x40384b
jg 0x40384a
cmp dword [ebp - 0x20], eax
jbe 0x40384b
inc ecx
mov eax, ecx
test eax, eax
je 0x403892
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40387d
push eax
mov ebx, eax
call fcn.00401ec6
inc eax
push eax
call fcn.0048253b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x40388e
push ebx
call fcn.00482541
add esp, 4
pop eax
mov dword [ebp - 0x3c], eax
push str.ORMBackup
push dword [ebp - 0x18]
mov ecx, 2
call fcn.00402aba
add esp, 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4038be
push ebx
call fcn.00482541
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.004045f5
test eax, eax
je 0x40390d
push 0x4a44b6
push dword [ebp - 0x18]
mov ecx, 2
call fcn.00402aba
add esp, 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ebx, dword [0x51686f]
test ebx, ebx
je 0x403902
push ebx
call fcn.00482541
add esp, 4
pop eax
mov dword [0x51686f], eax
jmp 0x403914
pop ebx
pop ecx
jmp 0x403746
add esp, 8
push 0x4a42ea
push dword [0x51686f]
call fcn.004025b6
add esp, 8
cmp eax, 0
jne 0x403953
push 0x4a42ea
push dword [ebp - 0x3c]
call fcn.004025b6
add esp, 8
cmp eax, 0
jne 0x403953
mov eax, 1
jmp 0x403955
xor eax, eax
test eax, eax
je 0x403997
push 0
push 0
push 0
push 0x80000301
push 0
push 0
push OleUIBusyA
push 0
push 0x4a4565
push 3
mov ebx, 0x300
call fcn.00483a50
add esp, 0x28
mov eax, 0
jmp 0x403f0b
push 0x4a42ea
push dword [0x51686f]
call fcn.004025b6
add esp, 8
cmp eax, 0
jne 0x403a10
push str.ORMBackup_
push dword [ebp - 0x3c]
mov ecx, 2
call fcn.00402aba
add esp, 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ebx, dword [0x51686f]
test ebx, ebx
je 0x4039e2
push ebx
call fcn.00482541
add esp, 4
pop eax
mov dword [0x51686f], eax
push OleUIBusyA
push 0
mov eax, dword [0x51686f]
test eax, eax
jne 0x4039fd
mov eax, 0x4a42ea
push eax
push 1
mov ebx, 0x234
call fcn.00483c90
add esp, 0x10
mov eax, 0x4a45a0
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00401926
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x403a34
push ebx
call fcn.00482541
add esp, 4
push 0
push 0
push dword [ebp - 0x44]
call fcn.00404843
mov dword [ebp - 0x48], eax
push 1
mov eax, 0x4b17a8
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
push 1
mov eax, 0x4b17a8
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x54], 0
push 0
push dword [ebp - 0x54]
push 1
push 5
mov dword [ebp - 0x58], 0
push 0
push dword [ebp - 0x58]
mov dword [ebp - 0x5c], 0
push 0
push dword [ebp - 0x5c]
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x60]
push eax
mov eax, 0x4b286e
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x68], 0
push 0
lea eax, [ebp - 0x68]
push eax
mov eax, 0x4b4389
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push 1
push 1
push dword [ebp - 0x48]
call fcn.00405c73
mov ebx, dword [ebp - 0x6c]
test ebx, ebx
je 0x403ae1
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x68]
test ebx, ebx
je 0x403af1
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x403b01
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x403b11
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x50]
test ebx, ebx
je 0x403b21
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x403b31
push ebx
call fcn.00482541
add esp, 4
mov eax, 0x4a4356
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00403f5d
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x403b55
push ebx
call fcn.00482541
add esp, 4
push 0x4a436e
push dword [ebp - 0x44]
mov ecx, 2
call fcn.00402aba
add esp, 8
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x403b7d
push ebx
call fcn.00482541
add esp, 4
mov dword [ebp - 0x4c], 0
push 0
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], 0
push 0
push dword [ebp - 0x50]
mov dword [ebp - 0x54], 0
push 0
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push 1
push 0x208
push 1
push 0x2bc
mov dword [ebp - 0x5c], 0
push 0
push dword [ebp - 0x5c]
mov dword [ebp - 0x60], 0
push 0
push dword [ebp - 0x60]
push 1
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x64], 0
push 0
push dword [ebp - 0x64]
call fcn.0040d4ec
mov dword [ebp - 0x68], eax
mov ebx, dword [ebp - 0x48]
test ebx, ebx
je 0x403c05
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x403c15
push ebx
call fcn.00482541
add esp, 4
mov eax, dword [ebp - 0x68]
mov dword [0x516873], eax
mov dword [0x516877], 0x15e
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
push 0x41d1a1
push 0x51687b
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x138]
push 0x80000301
push 0
push 0xff
push 0x80000301
push 0
push 0x80
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x338
call fcn.00483cc0
add esp, 0x28
mov dword [ebp - 0x40], eax
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push 0x10
push 0x80000301
push 0
push 4
push 4
mov ebx, 0xc8
call fcn.00483cf0
add esp, 0x34
mov dword [ebp - 0x44], eax
push 1
push 1
push 1
push 0
push 1
mov eax, 0x4a4322
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
push 1
push 1
push 0x10
call fcn.0048253b
add esp, 4
mov dword [ebp - 0x4c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x50], 0
push 0
push dword [ebp - 0x50]
push 1
push 0xff
push 1
push dword [ebp - 0x44]
push 1
push dword [ebp - 0x40]
mov dword [ebp - 0x54], 0
push 0
lea eax, [ebp - 0x54]
push eax
push 1
mov eax, 0x4b286e
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
push eax
push 1
mov eax, 0x4b4389
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
push dword [0x516873]
mov dword [ebp - 0x60], 0
push 0
push dword [ebp - 0x60]
push 0x51687b
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x80]
mov ebx, dword [ebp - 0x5c]
test ebx, ebx
je 0x403d98
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x403da8
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x54]
test ebx, ebx
je 0x403db8
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x4c]
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x48]
push ebx
call fcn.00482541
add esp, 4
call fcn.0040de8d
mov dword [ebp - 0x40], esp
push 0
push 0
push 0
push 0x41d2f9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0x40], esp
je 0x403e12
push 6
call fcn.0048254d
add esp, 4
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0
push 0
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], 0
push 0
push dword [ebp - 0x50]
mov dword [ebp - 0x54], 0
push 0
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0
push 0
push dword [ebp - 0x58]
mov dword [ebp - 0x5c], 0
push 0
push dword [ebp - 0x5c]
push 3
push 0x51687b
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x120]
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0
push 0
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], 0
push 0
push dword [ebp - 0x50]
mov dword [ebp - 0x54], 0
push 0
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0
push 0
push dword [ebp - 0x58]
push 2
push 0x51687b
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x124]
push 1
push dword [0x516873]
call fcn.0041bc54
mov eax, 0
jmp 0x403f0b
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x403f28
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x403f38
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x403f48
push ebx
call fcn.00482541
add esp, 4
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x403f58
push ebx
call fcn.00482541
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret