Function at 0x408950
Capabilities:
Check for time delay via gettickcount
Enumerate gui resources
Get disk information
Get memory capacity
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d4
mov eax, dword [0x42d024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x3bc], edi
call fcn.0040ac70
lea ecx, [ebp - 0x158]
push ecx
push eax
call fcn.00414909
add esp, 8
test eax, eax
jne 0x408991
mov dword [ebp - 0x3bc], 0xfffffffc
lea edx, [ebp - 0x168]
push edx
mov dword [ebp - 0x168], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x160]
shrd ecx, eax, 0x14
shr eax, 0x14
mov esi, 2
cmp eax, edi
ja 0x4089e3
jb 0x4089ce
cmp ecx, 0x200
ja 0x4089d7
add dword [ebp - 0x3bc], 5
jmp 0x4089e9
cmp eax, edi
ja 0x4089e3
cmp ecx, 0x2000
jb 0x4089e9
sub dword [ebp - 0x3bc], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, 0x88888889
mul edx
shr edx, 5
cmp edx, 5
ja 0x408a13
add dword [ebp - 0x3bc], 3
jmp 0x408a1e
cmp edx, 0x3c
jb 0x408a1e
sub dword [ebp - 0x3bc], esi
push 5
mov dword [ebp - 0x3c4], edi
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x14]
add esp, 4
push eax
call fcn.00415e1b
add esp, 4
mov ebx, eax
cmp eax, edi
jne 0x408a4b
mov ebx, 0x4275bc
push 6
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x18]
add esp, 4
push eax
call fcn.00415e1b
add esp, 4
cmp eax, edi
mov edi, eax
jne 0x408a71
mov edi, 0x4275bc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408a76
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408a86
sub eax, esi
lea esi, [eax + edx + 0x2e]
push esi
call fcn.00414f9a
add esp, 4
mov dword [ebp - 0x3c0], eax
test eax, eax
je 0x408a93
push 0x5c
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edx, dword [ecx + 0x170]
mov esi, dword [ebp - 0x3c0]
add esp, 4
push edi
push ebx
push edx
push esi
call fcn.0041512c
lea eax, [ebp - 0x290]
push eax
push esi
call fcn.00415fe8
mov edi, eax
add esp, 0x18
test edi, edi
je 0x408bcf
cmp edi, 0xffffffff
je 0x408bcf
mov esi, dword [ebp - 0x3c4]
push 0x5d
call fcn.004051a0
mov ecx, dword [0x42f218]
mov ecx, dword [ecx + 0x174]
add esp, 4
lea eax, [ebp - 0x26c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408b30
test dl, dl
je 0x408b2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408b30
add eax, 2
add ecx, 2
test dl, dl
jne 0x408b10
xor eax, eax
jmp 0x408b35
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408ba2
mov ecx, 0x42a6d4
lea eax, [ebp - 0x26c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408b64
test dl, dl
je 0x408b60
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408b64
add eax, 2
add ecx, 2
test dl, dl
jne 0x408b44
xor eax, eax
jmp 0x408b69
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408ba2
mov ecx, 0x42a6d8
lea eax, [ebp - 0x26c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408b98
test dl, dl
je 0x408b94
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408b98
add eax, 2
add ecx, 2
test dl, dl
jne 0x408b78
xor eax, eax
jmp 0x408b9d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408ba2
inc esi
lea edx, [ebp - 0x290]
push edx
push edi
call fcn.0041610f
add esp, 8
test eax, eax
je 0x408af4
push edi
call fcn.0041623d
add esp, 4
cmp esi, 1
ja 0x408bcf
add dword [ebp - 0x3bc], 3
mov eax, dword [ebp - 0x3c0]
push eax
call fcn.00414f60
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add esp, 4
xor esi, esi
mov dword [ebp - 0x3c8], 0x5c3a41
xor ebx, ebx
lea edx, [ebp - 0x158]
push edx
lea eax, [ebp - 0x3c8]
lea ecx, [ebx + 0x41]
push eax
mov byte [ebp - 0x3c8], cl
call fcn.00414909
add esp, 8
test eax, eax
jne 0x408c24
lea ecx, [ebp - 0x3c8]
push ecx
call edi
cmp eax, 3
jne 0x408c24
inc esi
inc ebx
cmp ebx, 0x1a
jb 0x408bf2
cmp esi, 1
ja 0x408c37
inc dword [ebp - 0x3bc]
jmp 0x408c43
cmp esi, 3
jb 0x408c43
sub dword [ebp - 0x3bc], 2
push 9
mov dword [ebp - 0x3c0], 0
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x24]
add esp, 4
push eax
call fcn.00415e1b
add esp, 4
mov ebx, eax
test eax, eax
jne 0x408c74
mov ebx, 0x4275bc
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408c80
sub eax, edx
lea edi, [eax + 0x20]
lea esp, [esp]
push edi
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x408c90
push ebx
push str._s.
push esi
call fcn.0041512c
add esp, 0xc
lea eax, [ebp - 0x3b8]
push eax
push esi
call fcn.00415fe8
mov edi, eax
add esp, 8
test edi, edi
je 0x408cf3
cmp edi, 0xffffffff
je 0x408cf3
lea esp, [esp]
inc dword [ebp - 0x3c0]
lea ecx, [ebp - 0x3b8]
push ecx
push edi
call fcn.0041610f
add esp, 8
test eax, eax
je 0x408cd0
push edi
call fcn.0041623d
add esp, 4
push esi
call fcn.00414f60
add esp, 4
cmp dword [ebp - 0x3c0], 0x19
ja 0x408d0c
add dword [ebp - 0x3bc], 2
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x120]
sub eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x124]
cmp eax, 0x400
jne 0x408d4b
mov esi, ecx
sub esi, edx
cmp esi, 0x300
je 0x408d6f
cmp eax, 0x320
jne 0x408d5e
mov esi, ecx
sub esi, edx
cmp esi, 0x258
je 0x408d6f
cmp eax, 0x280
jne 0x408d75
sub ecx, edx
cmp ecx, 0x1e0
jne 0x408d75
inc dword [ebp - 0x3bc]
push 0x5f
call fcn.004051a0
mov eax, dword [0x42f218]
mov esi, dword [eax + 0x17c]
add esp, 4
push 0x5e
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x178]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 4
lea edx, [ebp - 0x3c0]
push edx
push 0x20019
push 0
push eax
push connect
mov byte [ebp - 0x14], 0
call edi
mov eax, dword [ebp - 0x3c0]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x408dfa
lea ecx, [ebp - 0x3c4]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push esi
push eax
mov dword [ebp - 0x3c4], 4
call ebx
mov eax, dword [ebp - 0x3c0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x60
call fcn.004051a0
mov ecx, dword [0x42f218]
mov esi, dword [ecx + 0x180]
add esp, 4
push 0x5e
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x178]
add esp, 4
lea ecx, [ebp - 0x3c0]
push ecx
push 0x20019
push 0
push eax
push connect
mov byte [ebp - 0xc], 0
call edi
mov eax, dword [ebp - 0x3c0]
test eax, eax
je 0x408e74
lea edx, [ebp - 0x3c4]
push edx
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push esi
push eax
mov dword [ebp - 0x3c4], 4
call ebx
mov edx, dword [ebp - 0x3c0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x14], 0
je 0x408e90
cmp byte [ebp - 0xc], 0
je 0x408e90
add dword [ebp - 0x3bc], 2
jmp 0x408e90
push 0x105
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x408e90
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x408eca
mov eax, dword [0x42e1e8]
mov ecx, dword [eax]
mov edx, esi
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x408ec0
push 0x61
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edx, dword [ecx + 0x184]
add esp, 4
mov dword [ebp - 0x3c4], edx
xor edi, edi
jmp 0x408ef0
mov eax, dword [ebp + edi*4 - 0x3c4]
push eax
push esi
call fcn.004151b0
add esp, 8
test eax, eax
jne 0x408f0d
inc edi
cmp edi, 1
jb 0x408ef0
jmp 0x408f14
add dword [ebp - 0x3bc], 4
push esi
call fcn.00414f60
add esp, 4
push 0x62
xor bl, bl
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edx, dword [ecx + 0x188]
add esp, 4
push 0x408890
mov dword [ebp - 0x3c4], edx
call fcn.00403be0
add esp, 4
push 4
call fcn.00414f9a
add esp, 4
test eax, eax
je 0x408f48
xor edi, edi
push edi
push 0x408890
mov dword [0x42f21c], eax
mov dword [0x42f468], edi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x42f468], edi
jbe 0x408fc6
xor esi, esi
test bl, bl
jne 0x408fa7
lea ecx, [ecx]
cmp esi, 1
jae 0x408fa7
mov eax, dword [0x42f21c]
mov ecx, dword [ebp + esi*4 - 0x3c4]
mov eax, dword [eax + edi*4]
push ecx
push eax
call fcn.004151b0
add esp, 8
test eax, eax
jne 0x408fa5
inc esi
jmp 0x408f80
mov bl, 1
mov edx, dword [0x42f21c]
mov eax, dword [edx + edi*4]
test eax, eax
je 0x408fbd
push eax
call fcn.00414f60
add esp, 4
inc edi
cmp edi, dword [0x42f468]
jb 0x408f77
mov eax, dword [0x42f21c]
test eax, eax
je 0x408fd8
push eax
call fcn.00414f60
add esp, 4
cmp byte [0x42f0d4], 0
je 0x408ff4
push 0x32
call fcn.004156a1
add esp, 4
cmp byte [0x42f0d4], 0
jne 0x408fe1
mov ecx, dword [0x42f0cc]
test ecx, ecx
je 0x40902b
mov edx, dword [0x42f0d0]
xor eax, eax
test edx, edx
je 0x40902b
lea ebx, [ebx]
mov esi, dword [ecx + eax*4]
cmp dword [esi], 0x408890
je 0x409022
inc eax
cmp eax, edx
jb 0x409010
jmp 0x40902b
mov eax, esi
mov dword [eax + 4], 0
mov byte [0x42f0d4], 0
test bl, bl
je 0x40903d
add dword [ebp - 0x3bc], 4
push 0x64
call fcn.004051a0
mov ecx, dword [0x42f218]
mov esi, dword [ecx + 0x190]
add esp, 4
push 0x63
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x18c]
add esp, 4
lea ecx, [ebp - 0x3c0]
push ecx
push 0x20019
push 0
push eax
push connect
mov byte [ebp - 0x118], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0x3c0]
test eax, eax
je 0x4090c5
lea edx, [ebp - 0x3c4]
push edx
lea ecx, [ebp - 0x118]
push ecx
push 0
push 0
push esi
push eax
mov dword [ebp - 0x3c4], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x3c0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x65
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x194]
add esp, 4
push 0x66
mov dword [ebp - 0x3d4], ecx
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x198]
add esp, 4
push 0x67
mov dword [ebp - 0x3d0], eax
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edx, dword [ecx + 0x19c]
add esp, 4
mov dword [ebp - 0x3cc], edx
xor esi, esi
lea ebx, [ebx]
mov eax, dword [ebp + esi*4 - 0x3d4]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.004151b0
add esp, 8
test eax, eax
jne 0x409158
inc esi
cmp esi, 3
jb 0x409120
mov eax, dword [ebp - 0x3bc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3bc]
pop edi
pop esi
xor ecx, ebp
add eax, 4
pop ebx
call fcn.00413f0d
mov esp, ebp
pop ebp
ret