Function at 0x460ee3
Capabilities:
Check os version
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x499abf
mov eax, dword fs:[0]
push eax
sub esp, 0x9c0
mov eax, dword [0x4d4028]
xor eax, esp
mov dword [esp + 0x9b8], eax
push ebx
push esi
push edi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x9d0]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x58]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x24], ebx
je 0x460f61
mov al, byte [eax]
test al, al
je 0x460f61
mov eax, 0x80004005
mov ecx, dword [esp + 0x9d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9b8]
xor ecx, esp
call fcn.00490f79
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
push dword [ebx + 0x58]
cmp eax, 0x80000000
lea eax, [esp + 0xb0]
push eax
setb byte [esp + 0x2b]
call fcn.0045cbb6
push esi
push 4
mov ecx, ebx
lea edx, [esp + 0xb4]
mov dword [esp + 0x9e0], esi
call fcn.0045d023
test al, al
jne 0x460fab
lea ecx, [esp + 0xac]
call fcn.0045cc5a
jmp 0x460f38
cmp byte [esp + 0x23], 0
je 0x461365
mov dword [esp + 0x10], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x460fcd
mov al, byte [eax]
test al, al
jne 0x460f9d
xor eax, eax
mov byte [esp + 0x9d8], 1
lea edi, [esp + 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
add eax, 0x41
movzx edi, ax
push edi
lea eax, [esp + 0x7c0]
push str._C:_
push eax
mov dword [esp + 0x50], 8
call fcn.0044f343
add esp, 0xc
lea eax, [esp + 0x7bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x461025
mov byte [esp + 0x9d8], 0
jmp 0x4610ef
push edi
lea eax, [esp + 0x7c0]
push str.._C:
push eax
call fcn.0044f343
add esp, 0xc
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push 0xc0000000
lea eax, [esp + 0x7d4]
push eax
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x46107b
push edi
push edi
push 3
push edi
push 1
push SysReAllocString
lea eax, [esp + 0x7d4]
push eax
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x461018
lea eax, [ebx + 0x14]
push eax
mov edx, ebx
lea ecx, [esp + 0xb0]
call fcn.0045cc87
test al, al
jne 0x461103
push edi
lea eax, [esp + 0x40]
push eax
push 8
lea eax, [esp + 0x50]
push eax
push 8
push eax
push 0x41018
push dword [esp + 0x38]
mov dword [esp + 0x5c], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4610d6
mov al, byte [ebx]
cmp al, byte [esp + 0x48]
jne 0x4610d6
mov al, byte [ebx + 2]
cmp al, byte [esp + 0x4a]
jne 0x4610d6
mov al, byte [ebx + 3]
cmp al, byte [esp + 0x4b]
je 0x461332
mov byte [esp + 0x9d8], 0
cmp dword [esp + 0x1c], 0xffffffff
je 0x4610ef
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1a
jle 0x460fc0
jmp 0x46140e
lea edi, [ebx + 0x14]
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
dec eax
push eax
mov ecx, edi
mov dword [esp + 0x40], edi
call dword [0x4a2bc4]
cmp ax, 0x3a
jne 0x461137
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
add eax, 0xfffffffe
push eax
mov ecx, edi
call dword [0x4a2bc4]
mov ecx, edi
jmp 0x46133c
xor esi, esi
push esi
lea eax, [esp + 0x38]
push eax
push esi
push 0x20019
push esi
push esi
push esi
push str.SYSTEMMountedDevices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x461343
push edi
lea ecx, [esp + 0x2c]
call dword [0x4a2ec0]
mov edi, 0x103
push edi
lea eax, [esp + 0x6b9]
push esi
mov byte [esp + 0x9e0], 2
push eax
mov byte [esp + 0x6c0], 0
call fcn.00491fe0
add esp, 0xc
push edi
lea eax, [esp + 0x5b1]
push esi
push eax
mov byte [esp + 0x5b8], 0
call fcn.00491fe0
mov eax, dword [esp + 0x34]
add esp, 0xc
cmp dword [eax - 0xc], 1
jle 0x4611d6
push 1
lea ecx, [esp + 0x2c]
call dword [0x4a2bc4]
cmp ax, 0x5c
jne 0x4611d6
push 0x3f
push 1
lea ecx, [esp + 0x30]
call dword [0x4a2bc8]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x6b8]
push eax
push esi
push esi
push dword [esp + 0x38]
mov dword [esp + 0x44], 0x104
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46131c
mov byte [esp + 0x10], 0x41
mov esi, 0x104
push esi
lea eax, [esp + 0x5b0]
push 0
push eax
call fcn.00491fe0
add esp, 0xc
push 1
push dword [esp + 0x14]
lea ecx, [esp + 0x70]
mov dword [esp + 0x38], esi
call dword [0x4a2600]
lea ecx, [esp + 0x54]
push ecx
mov ecx, eax
mov ebx, str.DosDevices_
mov byte [esp + 0x9dc], 3
call fcn.0040ec10
pop ecx
push eax
lea eax, [esp + 0x44]
push eax
mov edi, 0x4a5e6c
mov byte [esp + 0x9e0], 4
call fcn.0040a1d0
pop ecx
pop ecx
lea ecx, [esp + 0x54]
call dword [0x4a2ee8]
lea ecx, [esp + 0x68]
mov byte [esp + 0x9d8], 7
call dword [0x4a2ee8]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x5b0]
push eax
push 0
push 0
push dword [esp + 0x50]
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4612be
push 0x41
pop ecx
lea edi, [esp + 0x5ac]
lea esi, [esp + 0x6b4]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x4612e1
lea ecx, [esp + 0x40]
mov byte [esp + 0x9d8], 2
call dword [0x4a2ee8]
inc byte [esp + 0x10]
cmp byte [esp + 0x10], 0x5a
jle 0x461208
jmp 0x461318
push 1
push dword [esp + 0x14]
lea ecx, [esp + 0x60]
call dword [0x4a2600]
mov byte [esp + 0x9d8], 8
mov ecx, dword [esp + 0x3c]
push eax
call dword [0x4a2ea0]
lea ecx, [esp + 0x58]
call dword [0x4a2ee8]
lea ecx, [esp + 0x40]
call dword [0x4a2ee8]
mov ebx, dword [esp + 0x24]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x28]
call dword [0x4a2ee8]
jmp 0x461343
mov eax, dword [esp + 0x10]
add eax, 0x41
lea ecx, [ebx + 0x14]
push eax
call dword [0x4a2694]
mov byte [esp + 0x9d8], 0
cmp dword [esp + 0x1c], 0xffffffff
je 0x46140e
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46140e
lea ecx, [ebx + 0x14]
call dword [0x4a2db4]
push 6
xor eax, eax
pop ecx
lea edi, [esp + 0x94]
rep stosd dword es:[edi], eax
mov al, byte [ebx]
mov byte [esp + 0x96], al
mov al, byte [ebx + 2]
lea esi, [esp + 0x74]
mov byte [esp + 0x94], 6
mov byte [esp + 0x9c], al
call fcn.00489b7f
lea eax, [esp + 0x94]
push eax
mov byte [esp + 0x9dc], 9
call dword [esp + 0x84]
test eax, eax
pop ecx
je 0x4613fd
cmp byte [esp + 0x95], 1
jne 0x4613fd
movzx eax, byte [esp + 0x9f]
test al, al
jbe 0x4613fd
add al, 0x41
push 1
lea ecx, [esp + 0x60]
push eax
call dword [0x4a2600]
push eax
lea ecx, [ebx + 0x14]
mov byte [esp + 0x9dc], 0xa
call dword [0x4a2ea0]
lea ecx, [esp + 0x5c]
call dword [0x4a2ee8]
lea ecx, [esp + 0x74]
mov byte [esp + 0x9d8], 0
call fcn.00489c2a
lea esi, [ebx + 0x14]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jne 0x461444
push esi
mov edx, ebx
lea ecx, [esp + 0xb0]
call fcn.0045cc87
push 1
mov ecx, esi
call dword [0x4a2bc4]
cmp ax, 0x3f
jne 0x461444
push 0x5c
push 1
mov ecx, esi
call dword [0x4a2bc8]
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x461455
mov al, byte [eax]
test al, al
jne 0x460f9d
lea eax, [ebx + 0x10]
push eax
lea edi, [ebx + 8]
push edi
lea esi, [ebx + 4]
push esi
lea ecx, [esp + 0xb8]
call fcn.0045d18b
mov ecx, esi
call dword [0x4a2d84]
mov ecx, edi
call dword [0x4a2d84]
lea ecx, [ebx + 0x10]
call dword [0x4a2d84]
push dword [edi]
lea eax, [ebx + 0xc]
push dword [esi]
push dword [ebx + 0x14]
push str.__s:___s__s
push eax
call dword [0x4a2ee0]
mov eax, dword [ebx + 0x58]
add esp, 0x14
test eax, eax
je 0x4614b0
mov al, byte [eax]
test al, al
jne 0x460f9d
lea eax, [ebx + 0x23]
push eax
lea eax, [ebx + 0x22]
push eax
lea eax, [ebx + 0x21]
push eax
lea eax, [ebx + 0x20]
push eax
lea eax, [ebx + 0x1f]
push eax
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebx + 0x1b]
push eax
lea eax, [ebx + 0x1a]
push eax
lea eax, [ebx + 0x19]
push eax
lea eax, [ebx + 0x18]
push eax
lea eax, [esp + 0xd4]
call fcn.0045d31a
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x4614f5
mov al, byte [eax]
test al, al
jne 0x460f9d
push 0
lea eax, [ebx + 0x25]
push eax
lea eax, [ebx + 0x24]
push eax
lea eax, [ebx + 0x1e]
push eax
lea eax, [ebx + 0x1d]
push eax
lea eax, [esp + 0xc0]
call fcn.0045d4d6
lea eax, [ebx + 0x27]
push eax
lea eax, [ebx + 0x26]
push eax
lea eax, [esp + 0xb4]
call fcn.0045d6cf
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x461538
mov al, byte [eax]
test al, al
jne 0x460f9d
mov eax, ebx
call fcn.00461b52
test al, al
mov edi, 0xffff
je 0x46165c
call fcn.004900d8
mov eax, dword [eax + 4]
cmp dword [eax + 0x204], 0
je 0x46165c
lea eax, [ebx + 0x48]
mov dword [esp + 0x38], eax
call fcn.0043d660
and dword [esp + 0x10], 0
mov esi, edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x50], edi
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x461599
mov al, byte [eax]
test al, al
jne 0x460f9d
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xb0]
mov dword [esp + 0x18], esi
call fcn.0045da71
test al, al
jne 0x4615e0
push esi
push edi
lea eax, [esp + 0xb4]
call fcn.0045d8c2
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0xbc]
call fcn.0045dc47
cmp dword [esp + 0x14], 0
jne 0x4615ef
mov eax, dword [esp + 0x50]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x14], eax
jbe 0x4615ff
mov dword [esp + 0x14], eax
cmp eax, eax
jne 0x46160d
inc dword [esp + 0x10]
sub esi, 0xb0
jmp 0x461643
mov eax, dword [esp + 0x38]
and dword [esp + 0x10], 0
lea ebx, [esp + 0x14]
call fcn.004617e0
mov eax, dword [esp + 0x14]
cmp eax, 0x840
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
jbe 0x46163d
lea esi, [eax - 0x210]
jmp 0x461588
lea esi, [eax - 0xb0]
cmp dword [esp + 0x10], 3
jl 0x461588
push edi
push edi
lea eax, [esp + 0xb4]
call fcn.0045d8c2
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x46166d
mov al, byte [eax]
test al, al
jne 0x460f9d
call fcn.004900d8
mov eax, dword [eax + 4]
cmp dword [eax + 0x208], 0
je 0x46177d
lea eax, [ebx + 0x38]
mov dword [esp + 0x38], eax
call fcn.0043d660
and dword [esp + 0x10], 0
mov esi, edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], edi
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x4616ba
mov al, byte [eax]
test al, al
jne 0x461781
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xb0]
mov dword [esp + 0x1c], esi
call fcn.0045d99b
test al, al
jne 0x461701
push edi
push esi
lea eax, [esp + 0xb4]
call fcn.0045d8c2
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xbc]
call fcn.0045dc47
cmp dword [esp + 0x18], 0
jne 0x461710
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x18], eax
jbe 0x461720
mov dword [esp + 0x18], eax
cmp eax, eax
jne 0x46172e
inc dword [esp + 0x10]
sub esi, 0xb0
jmp 0x461764
mov eax, dword [esp + 0x38]
and dword [esp + 0x10], 0
lea ebx, [esp + 0x18]
call fcn.004617e0
mov eax, dword [esp + 0x18]
cmp eax, 0x840
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
jbe 0x46175e
lea esi, [eax - 0x210]
jmp 0x4616a9
lea esi, [eax - 0xb0]
cmp dword [esp + 0x10], 3
jl 0x4616a9
push edi
push edi
lea eax, [esp + 0xb4]
call fcn.0045d8c2
xor esi, esi
jmp 0x461786
mov esi, 0x80004005
lea ecx, [esp + 0xac]
call fcn.0045cc5a
mov eax, esi
jmp 0x460f3d