Function at 0x4039fd
Capabilities:
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4dc
push esi
and dword [ebp - 0xc], 0
jmp 0x403a14
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jg 0x403a63
push 2
push 0xa7
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, 0xd4
push 0x65
pop ecx
call fcn.004037ad
mov dword [ebp - 0x14], eax
push 0x53
pop ecx
mov eax, 0x9a
call fcn.004037dd
mov dword [ebp - 0x14], eax
mov ecx, 0xf1
push 0x29
pop eax
call fcn.00403800
mov dword [ebp - 0x14], eax
jmp 0x403a0d
mov dword [ebp - 8], 0xd3d01a7c
or dword [ebp - 0x138], 0xffffffff
and eax, dword [ebp - 0x138]
mov dword [ebp - 0x14], eax
mov ax, ax
sub dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x10], 0
push 0x74
push 0x11
push 0x85
push 0xaa
mov eax, 0xd4
push 0x6b
pop ecx
push 0x4b
pop edx
call fcn.00403809
add esp, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 8], 0
push 0x68
pop ecx
or ecx, 0x98eded87
mov eax, 0x5c827b72
xor edx, edx
div ecx
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x160]
or ecx, 0xca4177d3
mov eax, 0x685e2a55
xor edx, edx
div ecx
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
xor eax, 0x15
mov dword [ebp - 0x178], eax
push 0x18
pop eax
sub eax, dword [ebp - 0x178]
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
or ecx, 0xe9ac3f1a
mov eax, 0xb4
xor edx, edx
div ecx
mov dword [ebp - 0x15c], eax
mov eax, 0xd4
and eax, dword [ebp - 0x15c]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
add eax, 0x15ce9199
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x174]
or ecx, 0x434b3134
mov eax, 0x681248d4
xor edx, edx
div ecx
mov dword [ebp - 0x184], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and eax, 0x40be
mov ecx, dword [ebp - 0x184]
or ecx, 0x1eae07ed
xor edx, edx
div ecx
mov dword [ebp - 0x158], eax
push 0x6a
pop ecx
or ecx, 0xfa5fd1de
mov eax, dword [ebp - 0x158]
xor edx, edx
div ecx
mov dword [ebp - 0x168], edx
mov ecx, dword [ebp - 0x168]
or ecx, 0x8bd939b8
push 0x3b
pop eax
xor edx, edx
div ecx
mov dword [ebp - 0x17c], eax
mov ecx, 0xc0
or ecx, 0x3ff5c088
mov eax, dword [ebp - 0x17c]
xor edx, edx
div ecx
mov dword [ebp - 0x164], edx
mov ecx, dword [ebp - 0x14]
or ecx, 0xe517c11b
mov eax, dword [ebp - 0x164]
xor edx, edx
div ecx
mov dword [ebp - 0x180], edx
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x14], eax
push 0x58
call dword [sym.imp.USER32.dll_CharLowerW]
cmp eax, 0x78
jne 0x40418a
and dword [ebp - 0x2b4], 0
lea eax, [ebp - 0x2ac]
push eax
call fcn.004043df
pop ecx
and dword [ebp - 0x190], 0
jmp 0x403c28
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xa
jge 0x403c42
push 0
push 0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x403c1b
lea eax, [ebp - 0x2a4]
push eax
call fcn.004043df
pop ecx
and dword [ebp - 0x190], 0
jmp 0x403c65
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xa
jge 0x403c7f
push 0
push 0
push str.kernelzdef
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x403c58
lea eax, [ebp - 0x198]
push eax
call fcn.004043df
pop ecx
mov eax, dword [ebp - 0x2a4]
sub eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x198]
sub eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x17
jle 0x403ccf
and dword [ebp - 0x2b8], 0
jmp 0x403ced
mov eax, dword [ebp - 0x18c]
shl eax, 1
cmp eax, dword [ebp - 0x2b0]
ja 0x403c05
mov dword [ebp - 0x2b8], 1
cmp dword [ebp - 0x2b8], 0
je 0x40418a
and dword [ebp - 0x390], 0
push dword [ebp - 0x2c4]
call fcn.00403722
pop ecx
mov dword [0x426244], eax
push dword [sym.imp.USER32.dll_SendMessageA]
pop dword [ebp - 0x390]
mov eax, dword [0x426244]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x390]
movzx eax, byte [eax]
shl eax, 9
mov dword [ebp - 0x2e0], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and eax, 0x5a09788c
or eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2e0]
imul eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x2d8], eax
mov ecx, dword [ebp - 0x2d8]
or ecx, 0x39de4863
xor eax, eax
xor edx, edx
div ecx
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2dc]
mov dword [0x426244], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x2d0], eax
mov eax, dword [0x426244]
xor eax, 0
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
xor eax, 0x1f
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x390]
movzx eax, byte [eax]
shl eax, 0x1c
imul eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f0], eax
mov eax, 0x19bb
sub eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
mov dword [0x426244], eax
mov eax, dword [ebp - 0x2d0]
mov al, byte [eax]
mov byte [ebp - 0x2c9], al
mov eax, dword [ebp - 0x390]
movzx eax, byte [eax]
shl eax, 0x19
push 0
call fcn.0040399d
pop ecx
mov dword [0x426244], eax
movzx eax, byte [ebp - 0x2c9]
cmp eax, 0xe9
je 0x403e29
and dword [ebp - 0x394], 0
jmp 0x404181
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x2c4], eax
mov eax, dword [0x426244]
and eax, 0x32cf174c
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
and eax, 0xf
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2c4]
mov eax, dword [eax]
and eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
mov dword [0x426244], eax
mov eax, dword [ebp - 0x2c4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x390]
lea eax, [ecx + eax + 5]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c8]
movzx ecx, byte [eax + 0xb]
mov eax, dword [ebp - 0x2c4]
push dword [eax]
call fcn.0040373f
pop ecx
mov dword [0x426244], eax
mov eax, dword [0x426244]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x2c8]
movzx eax, byte [eax]
shl eax, 9
mov dword [ebp - 0x328], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and eax, 0x5a09788c
or eax, dword [ebp - 0x32c]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x328]
imul eax, dword [ebp - 0x31c]
mov dword [ebp - 0x320], eax
mov ecx, dword [ebp - 0x320]
or ecx, 0x39de4863
xor eax, eax
xor edx, edx
div ecx
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
mov dword [0x426244], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x318], eax
mov eax, dword [0x426244]
xor eax, 0
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
xor eax, 0x1f
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x2c8]
movzx eax, byte [eax]
shl eax, 0x1c
imul eax, dword [ebp - 0x334]
mov dword [ebp - 0x338], eax
mov eax, 0x19bb
sub eax, dword [ebp - 0x338]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov dword [0x426244], eax
mov eax, dword [ebp - 0x318]
mov al, byte [eax]
mov byte [ebp - 0x311], al
mov eax, dword [ebp - 0x2c8]
movzx eax, byte [eax]
shl eax, 0x19
push 0
call fcn.0040399d
pop ecx
mov dword [0x426244], eax
movzx eax, byte [ebp - 0x311]
cmp eax, 0xe9
je 0x403fb4
and dword [ebp - 0x394], 0
jmp 0x404181
mov eax, dword [ebp - 0x2c4]
mov eax, dword [eax]
imul eax, eax, 0x644b
mov dword [ebp - 0x340], eax
mov eax, dword [0x426244]
add eax, dword [ebp - 0x340]
mov dword [ebp - 0x344], eax
mov eax, 0x779f2e1b
sub eax, dword [ebp - 0x344]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x2c8]
movzx eax, byte [eax + 0xf]
or eax, dword [ebp - 0x348]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
mov dword [0x426244], eax
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2c8]
movzx eax, byte [eax + 1]
mov ecx, dword [ebp - 0x2bc]
push dword [ecx]
call fcn.00403768
pop ecx
mov dword [0x426244], eax
mov eax, dword [ebp - 0x2bc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c8]
lea eax, [ecx + eax + 5]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c8]
movzx eax, byte [eax + 7]
push eax
mov eax, dword [ebp - 0x2c4]
mov ecx, dword [eax]
call fcn.00403783
pop ecx
mov dword [0x426244], eax
mov eax, dword [0x426244]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x2c0]
movzx eax, byte [eax]
shl eax, 9
mov dword [ebp - 0x378], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and eax, 0x5a09788c
or eax, dword [ebp - 0x37c]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x378]
imul eax, dword [ebp - 0x36c]
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x370]
or ecx, 0x39de4863
push 0xc
pop eax
xor edx, edx
div ecx
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
mov dword [0x426244], eax
mov eax, dword [ebp - 0x2c0]
add eax, 0xc
mov dword [ebp - 0x368], eax
mov eax, dword [0x426244]
xor eax, 0xc
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
xor eax, 0x1f
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x2c0]
movzx eax, byte [eax]
shl eax, 0x1c
imul eax, dword [ebp - 0x384]
mov dword [ebp - 0x388], eax
mov eax, 0x19bb
sub eax, dword [ebp - 0x388]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
mov dword [0x426244], eax
mov eax, dword [ebp - 0x368]
mov al, byte [eax]
mov byte [ebp - 0x361], al
mov eax, dword [ebp - 0x2c0]
movzx eax, byte [eax]
shl eax, 0x19
push 0xc
call fcn.0040399d
pop ecx
mov dword [0x426244], eax
movzx eax, byte [ebp - 0x361]
cmp eax, 0xe8
je 0x404177
and dword [ebp - 0x394], 0
jmp 0x404181
mov dword [ebp - 0x394], 1
cmp dword [ebp - 0x394], 0
je 0x40419f
mov eax, 0x80
call fcn.0040386c
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.msvcrt.dll_exit]
and dword [ebp - 0x130], 0
lea eax, [ebp - 0x1c]
push eax
push 0x42444c
push reloc.OLEAUT32.dll_SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 6
je 0x4041eb
push 0x21
push 0xfb
push dword [ebp - 0x130]
mov ecx, 0xef
call fcn.00403873
add esp, 0xc
mov dword [ebp - 0x14], eax
jmp 0x404400
and dword [ebp - 0x4c4], 0
lea eax, [ebp - 0x4bc]
push eax
call fcn.004043df
pop ecx
and dword [ebp - 0x3a0], 0
jmp 0x404215
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0xa
jge 0x40422f
push 0
push 0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x404208
lea eax, [ebp - 0x4b4]
push eax
call fcn.004043df
pop ecx
and dword [ebp - 0x3a0], 0
jmp 0x404252
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0xa
jge 0x40426c
push 0
push 0
push str.kernelzdef
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x404245
lea eax, [ebp - 0x3a8]
push eax
call fcn.004043df
pop ecx
mov eax, dword [ebp - 0x4b4]
sub eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x3a8]
sub eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0x17
jle 0x4042bc
and dword [ebp - 0x4c8], 0
jmp 0x4042da
mov eax, dword [ebp - 0x39c]
shl eax, 1
cmp eax, dword [ebp - 0x4c0]
ja 0x4041f2
mov dword [ebp - 0x4c8], 1
cmp dword [ebp - 0x4c8], 0
je 0x4043c2
mov dword [ebp - 0x148], 0xce50c25c
mov dword [ebp - 0x144], 0xce50c25c
mov dword [ebp - 0x14c], 0xf75e398e
mov dword [ebp - 0x13c], 0x888d3af0
mov dword [ebp - 0x140], 0x7772c50f
mov dword [ebp - 0x154], 0xc5953fdb
mov dword [ebp - 0x150], 0xc5953fdb
xor eax, eax
xor eax, 0xb8134f91
mov eax, 0
mov eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x144]
or eax, 0x485032cf
push edi
pop dword [0x426234]
mov ecx, dword [str.q_bS_D]
xor ecx, dword [ebp - 0x14c]
xor ecx, 0x40808b
not ecx
xor eax, eax
or eax, 0x5da73814
push ecx
mov eax, dword [ebp - 0x13c]
or eax, dword [ebp - 0x140]
xor eax, 0x16501cc9
not eax
mov cx, cx
mov ecx, 0x4032c3
xor eax, eax
not eax
xor eax, 0xa5c36c5d
not eax
push 0x4043b0
lea esi, [esi]
push ecx
ret
mov eax, dword [ebp - 0x14]
mov ecx, 0x404503
call fcn.004038c5
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.msvcrt.dll_exit]
pop esi
leave
ret 0x10
push 0xc
push 0x4245d0
call fcn.0040baec
and dword [ebp - 4], 0
cli
push dword [ebp + 0x14]
mov esi, dword [ebp - 0x1c]
mov eax, esi
call fcn.004038cd
pop ecx
mov ecx, eax
imul esi, esi, 0x7a1e
mov eax, esi
or ecx, 0xf0ec086e
xor edx, edx
div ecx
lea eax, [edx + 0x5bc6]
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004039fd
add eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.msvcrt.dll_exit]
xor eax, eax
inc eax
ret