Function at 0x40fad4
Capabilities:
Check os version
Create directory
Delete registry key
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0x40fadc
push ecx
xor eax, eax
push ebp
push 0x411271
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41eb74
mov edx, 0x411284
call fcn.0040326c
cmp byte [0x41ebb8], 0x66
jne 0x40fb7c
mov eax, 0x41eb74
mov edx, 0x4112b0
call fcn.0040326c
mov eax, dword [0x41d2d4]
push eax
push 0x400
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x41ecf4]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406400
mov edx, dword [ebp - 8]
mov eax, 0x41eb4c
call fcn.0040326c
cmp byte [0x41ebb5], 0
jne 0x40fb7c
mov eax, 0x41eb74
mov edx, 0x411384
call fcn.0040326c
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x41eb4c]
call fcn.00406258
mov byte [0x41ebb7], al
mov eax, 0x41eb74
mov edx, 0x4113b4
call fcn.0040326c
mov ecx, dword [0x41ecf4]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.004068e0
lea eax, [ebp - 0xc]
call fcn.004060d0
mov edx, dword [ebp - 0xc]
mov eax, 0x41eb3c
call fcn.0040326c
lea eax, [ebp - 0x10]
call fcn.0040613c
mov edx, dword [ebp - 0x10]
mov eax, 0x41eb40
call fcn.0040326c
mov eax, 0x41eb74
mov edx, 0x41148c
call fcn.0040326c
mov eax, 0x41eb44
mov ecx, 0x4114cc
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, 0x41eb74
mov edx, 0x4114dc
call fcn.0040326c
mov eax, dword [0x41eb4c]
call fcn.0040339c
test eax, eax
jne 0x40fc22
mov eax, 0x41eb4c
mov ecx, dword [0x41ece4]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, 0x41d1e8
mov ecx, dword [0x41d1e8]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, 0x41eb74
mov edx, 0x41155c
call fcn.0040326c
mov eax, 0x41eb34
mov ecx, dword [0x41ecdc]
mov edx, dword [0x41d1e8]
call fcn.004033e8
mov eax, 0x41eb38
mov ecx, dword [0x41ece0]
mov edx, dword [0x41d1e8]
call fcn.004033e8
xor eax, eax
mov dword [0x41ebbc], eax
call fcn.00412678
mov eax, 0x41eb74
mov edx, 0x411574
call fcn.0040326c
cmp byte [0x41ebb5], 0
je 0x40ff43
mov eax, dword [0x41eda0]
call fcn.00405338
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.004062ec
lea eax, [ebp - 0x14]
mov ecx, dword [0x41ed5c]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x14]
call fcn.004051dc
lea eax, [ebp - 0x18]
mov ecx, dword [0x41ed60]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x18]
call fcn.004051dc
mov eax, dword [0x41eb34]
call fcn.004051dc
mov eax, 0x41eb74
mov edx, 0x41161c
call fcn.0040326c
mov ecx, dword [0x41ece4]
mov edx, dword [0x41ed44]
mov eax, 0x80000002
call fcn.004068e0
mov ecx, dword [0x41ece4]
mov edx, dword [0x41ed4c]
mov eax, 0x80000002
call fcn.004068e0
mov ecx, dword [0x41ece4]
mov edx, dword [0x41ed48]
mov eax, 0x80000001
call fcn.004068e0
mov ecx, dword [0x41ece8]
mov edx, dword [0x41ed44]
mov eax, 0x80000001
call fcn.004068e0
mov ecx, dword [0x41ecec]
mov edx, dword [0x41ed48]
mov eax, 0x80000002
call fcn.004068e0
lea eax, [ebp - 0x1c]
mov ecx, dword [0x41ecf8]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x1c]
call fcn.004051dc
lea eax, [ebp - 0x20]
mov ecx, dword [0x41ecfc]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x20]
call fcn.004051dc
mov eax, 0x41eb74
mov edx, 0x411650
call fcn.0040326c
lea eax, [ebp - 0x24]
mov ecx, dword [0x41ed00]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x24]
call fcn.004051dc
lea eax, [ebp - 0x28]
mov ecx, dword [0x41ed04]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x28]
call fcn.004051dc
lea eax, [ebp - 0x2c]
mov ecx, dword [0x41ed08]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x2c]
call fcn.004051dc
lea eax, [ebp - 0x30]
mov ecx, dword [0x41ed0c]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x30]
call fcn.004051dc
lea eax, [ebp - 0x34]
mov ecx, dword [0x41ed10]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x34]
call fcn.004051dc
mov eax, dword [0x41ed54]
call fcn.0040359c
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [0x41ed20]
call fcn.0040359c
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x4116c0
call fcn.00417000
mov eax, 0x4116cc
call fcn.00417000
mov eax, 0x41eb74
mov edx, 0x4116d8
call fcn.0040326c
mov eax, 0x411720
call fcn.00417000
mov eax, 0x41eb74
mov edx, 0x41172c
call fcn.0040326c
mov eax, dword [0x41eb38]
call fcn.004051dc
mov eax, 0x41eb74
mov edx, 0x4117d8
call fcn.0040326c
push 0x200040
push 0x41184c
push 0x411858
lea edx, [ebp - 0x3c]
mov eax, 0x9f
call fcn.00404950
push dword [ebp - 0x3c]
push 0x411864
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.0040345c
mov eax, dword [ebp - 0x38]
call fcn.0040359c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
lea eax, [ebp - 0x40]
mov ecx, dword [0x41eda0]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x40]
call fcn.0040359c
push eax
push 0x41187c
push 0
mov eax, dword [0x41d2e8]
mov eax, dword [eax]
call eax
call fcn.00405238
jmp 0x411233
push 0
mov eax, dword [0x41d1e8]
call fcn.0040359c
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x41ebb4]
cmp byte [0x41ebb4], 0
je 0x40ff7d
call fcn.004057cc
mov eax, dword [0x41d2d4]
push eax
mov ecx, dword [0x41ed30]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406338
push eax
call fcn.00404c38
pop edx
sub eax, edx
jno 0x40ffa9
call fcn.00402a08
cmp eax, 0x1e
jl 0x411233
lea edx, [ebp - 0x44]
mov eax, dword [0x41eb4c]
call fcn.00404c94
mov edx, dword [ebp - 0x44]
mov eax, 0x41eb50
call fcn.0040326c
call fcn.00402720
mov eax, 0x41eb74
mov edx, 0x41188c
call fcn.0040326c
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x48]
mov ecx, dword [0x41ecf8]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov edx, dword [ebp - 0x48]
mov cl, 1
mov eax, dword [0x41eb4c]
call fcn.00404ec0
mov byte [0x41ebb7], al
lea eax, [ebp - 0x4c]
mov ecx, dword [0x41ecf8]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x4c]
call fcn.00406258
mov byte [0x41ebb7], al
mov eax, dword [0x41d2d4]
push eax
mov ecx, dword [0x41ecd8]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406338
mov dword [0x41ebac], eax
cmp dword [0x41ebac], 0x9f
jge 0x410170
cmp byte [0x41ebb7], 0
jne 0x4100d0
lea eax, [ebp - 0x50]
mov ecx, dword [0x41ecf8]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov edx, dword [ebp - 0x50]
mov eax, dword [0x41eb4c]
call fcn.004034e8
je 0x4100d0
mov eax, dword [0x41ecf8]
call fcn.00405338
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x54]
mov ecx, dword [0x41ecf8]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov edx, dword [ebp - 0x54]
mov cl, 1
mov eax, dword [0x41eb4c]
call fcn.00404ec0
mov byte [0x41ebb7], al
mov eax, 0x41eb74
mov edx, 0x4118e4
call fcn.0040326c
cmp byte [0x41ebb7], 0
je 0x410170
push 0x9f
mov ecx, dword [0x41ecd8]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406614
mov byte [0x41ebb7], al
cmp dword [0x41ebac], 0
jle 0x410136
lea edx, [ebp - 0x58]
mov eax, dword [0x41ebac]
call fcn.00404950
mov ecx, dword [ebp - 0x58]
mov eax, 0x41eb48
mov edx, 0x411998
call fcn.004033e8
jmp 0x410140
mov eax, 0x41eb48
call fcn.00403218
push 0x4119a8
lea edx, [ebp - 0x60]
mov eax, 0x9f
call fcn.00404950
push dword [ebp - 0x60]
push dword [0x41eb48]
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.0040345c
mov eax, dword [ebp - 0x5c]
call fcn.004128f8
call fcn.0040eacc
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x64]
mov ecx, dword [0x41ecfc]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov edx, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [0x41eb4c]
call fcn.00404ec0
mov byte [0x41ebb7], al
lea eax, [ebp - 0x68]
mov ecx, dword [0x41ecfc]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x68]
call fcn.00406258
mov byte [0x41ebb7], al
mov eax, 0x41eb74
mov edx, 0x4119bc
call fcn.0040326c
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x6c]
mov ecx, dword [0x41ed00]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x41eb4c]
call fcn.00404ec0
mov byte [0x41ebb7], al
lea eax, [ebp - 0x70]
mov ecx, dword [0x41ed00]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x70]
call fcn.00406258
mov byte [0x41ebb7], al
lea eax, [ebp - 0x74]
mov ecx, dword [0x41ed0c]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x74]
call fcn.00404f6c
test al, al
jne 0x4102e2
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x78]
mov ecx, dword [0x41ed0c]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
mov ecx, dword [0x41ed04]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
pop edx
call fcn.00404ec0
mov byte [0x41ebb7], al
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x80]
mov ecx, dword [0x41ed10]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x80]
push eax
lea eax, [ebp - 0x84]
mov ecx, dword [0x41ed08]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.00404ec0
mov byte [0x41ebb7], al
lea eax, [ebp - 0x88]
mov ecx, dword [0x41ed04]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x88]
call fcn.00404f6c
test al, al
jne 0x4103ae
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x8c]
mov ecx, dword [0x41ed04]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x8c]
push eax
lea eax, [ebp - 0x90]
mov ecx, dword [0x41ed0c]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x90]
xor ecx, ecx
pop edx
call fcn.00404ec0
mov byte [0x41ebb7], al
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x94]
mov ecx, dword [0x41ed08]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x94]
push eax
lea eax, [ebp - 0x98]
mov ecx, dword [0x41ed10]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.00404ec0
mov byte [0x41ebb7], al
mov eax, dword [0x41eb4c]
call fcn.00406258
mov byte [0x41ebb7], al
lea eax, [ebp - 0x9c]
mov ecx, dword [0x41ed04]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x9c]
call fcn.00406258
mov byte [0x41ebb7], al
lea eax, [ebp - 0xa0]
mov ecx, dword [0x41ed08]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0xa0]
call fcn.00406258
mov byte [0x41ebb7], al
mov eax, 0x41eb74
mov edx, 0x411a54
call fcn.0040326c
lea eax, [ebp - 0xa4]
mov ecx, dword [0x41ed0c]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0xa4]
call fcn.00406258
mov byte [0x41ebb7], al
lea eax, [ebp - 0xa8]
mov ecx, dword [0x41ed10]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0xa8]
call fcn.00406258
mov byte [0x41ebb7], al
mov eax, 0x41eb74
mov edx, 0x411a9c
call fcn.0040326c
mov eax, 0x4116c0
call fcn.00418534
mov eax, 0x4116cc
call fcn.00418534
mov eax, 0x411720
call fcn.00418534
mov eax, 0x411b00
call fcn.00418534
mov eax, 0x41eb74
mov edx, 0x4116d8
call fcn.0040326c
push 0
push 0
push 0x41ebb0
mov ecx, 0x407998
xor edx, edx
xor eax, eax
call fcn.004031d4
mov eax, 0x41eb74
mov edx, 0x411b0c
call fcn.0040326c
push 0
push 0
push 0x41ebb0
mov ecx, 0x40729c
xor edx, edx
xor eax, eax
call fcn.004031d4
mov eax, 0x41eb48
mov ecx, dword [0x41ecf8]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [0x41eb48]
mov edx, dword [0x41eb4c]
call fcn.004034e8
je 0x410567
lea eax, [ebp - 0xac]
mov ecx, dword [0x41ecfc]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0xac]
mov edx, dword [0x41eb4c]
call fcn.004034e8
je 0x410567
lea eax, [ebp - 0xb0]
mov ecx, dword [0x41ed00]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0xb0]
mov edx, dword [0x41eb4c]
call fcn.004034e8
jne 0x410573
mov eax, 0x41eb48
call fcn.00403218
jmp 0x410588
mov eax, 0x41eb48
mov ecx, dword [0x41eb4c]
mov edx, 0x411ba0
call fcn.004033e8
mov al, byte [0x41ebb8]
sub al, 0x64
je 0x41059b
dec al
je 0x4105b2
dec al
je 0x4105c9
jmp 0x4105de
mov eax, 0x41eb48
mov ecx, dword [0x41eb48]
mov edx, 0x411bac
call fcn.004033e8
jmp 0x4105de
mov eax, 0x41eb48
mov ecx, dword [0x41eb48]
mov edx, 0x411bb8
call fcn.004033e8
jmp 0x4105de
mov eax, 0x41eb48
mov ecx, dword [0x41eb48]
mov edx, 0x411bc4
call fcn.004033e8
mov eax, dword [0x41eb48]
call fcn.004128f8
mov eax, 0x41ebd0
mov ecx, dword [0x41ed20]
mov edx, 0x80000002
call fcn.004066e0
test al, al
jne 0x410629
mov eax, 0x41ebd0
mov ecx, dword [0x41ed20]
mov edx, 0x80000002
call fcn.004066e0
test al, al
jne 0x410629
mov eax, 0x411bd4
call fcn.004128f8
jmp 0x411233
mov eax, 0x41eb74
mov edx, 0x411bec
call fcn.0040326c
push dword [0x41eb40]
push 0x411ca4
push 0x411cb4
mov eax, 0x41eb64
mov edx, 3
call fcn.0040345c
mov eax, dword [0x41eb64]
call fcn.00404f6c
test al, al
jne 0x4106d6
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0xb4]
mov ecx, dword [0x41ed14]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0xb4]
mov cl, 1
mov edx, dword [0x41eb64]
call fcn.00404ec0
test al, al
je 0x4106c2
lea eax, [ebp - 0xb8]
mov ecx, dword [0x41eb64]
mov edx, 0x411cc4
call fcn.004033e8
mov eax, dword [ebp - 0xb8]
call fcn.004128f8
jmp 0x4106d6
mov eax, 0x411ce0
call fcn.004128f8
mov eax, 0x41eb64
call fcn.00403218
mov eax, 0x41eb74
mov edx, 0x4112b0
call fcn.0040326c
mov eax, dword [0x41eb64]
call fcn.0040339c
test eax, eax
jle 0x4108dd
mov eax, 0x41eb6c
mov ecx, 0x411cf0
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, 0x41eb68
mov edx, 0x411d04
call fcn.0040326c
lea eax, [ebp - 0xbc]
mov ecx, 0x411d18
mov edx, dword [0x41eb6c]
call fcn.004033e8
mov eax, dword [ebp - 0xbc]
call fcn.00404f6c
test al, al
je 0x41074f
mov eax, 0x41eb68
mov edx, 0x411d28
call fcn.004033a4
lea eax, [ebp - 0xc0]
mov ecx, 0x411d38
mov edx, dword [0x41eb6c]
call fcn.004033e8
mov eax, dword [ebp - 0xc0]
call fcn.00404f6c
test al, al
je 0x410783
mov eax, 0x41eb68
mov edx, 0x411d48
call fcn.004033a4
lea eax, [ebp - 0xc4]
mov ecx, 0x411d58
mov edx, dword [0x41eb6c]
call fcn.004033e8
mov eax, dword [ebp - 0xc4]
call fcn.00404f6c
test al, al
je 0x4107b7
mov eax, 0x41eb68
mov edx, 0x411d68
call fcn.004033a4
lea eax, [ebp - 0xc8]
mov ecx, 0x411d78
mov edx, dword [0x41eb6c]
call fcn.004033e8
mov eax, dword [ebp - 0xc8]
call fcn.00404f6c
test al, al
je 0x4107eb
mov eax, 0x41eb68
mov edx, 0x411d88
call fcn.004033a4
lea eax, [ebp - 0xcc]
mov ecx, 0x411d98
mov edx, dword [0x41eb6c]
call fcn.004033e8
mov eax, dword [ebp - 0xcc]
call fcn.00404f6c
test al, al
je 0x41081f
mov eax, 0x41eb68
mov edx, 0x411da8
call fcn.004033a4
lea eax, [ebp - 0xd0]
mov ecx, 0x411db8
mov edx, dword [0x41eb6c]
call fcn.004033e8
mov eax, dword [ebp - 0xd0]
call fcn.00404f6c
test al, al
je 0x410853
mov eax, 0x41eb68
mov edx, 0x411dc8
call fcn.004033a4
lea eax, [ebp - 0xd4]
mov ecx, 0x411dd8
mov edx, dword [0x41eb6c]
call fcn.004033e8
mov eax, dword [ebp - 0xd4]
call fcn.00404f6c
test al, al
je 0x410887
mov eax, 0x41eb68
mov edx, 0x411de8
call fcn.004033a4
mov eax, dword [0x41eb68]
mov edx, 0x411df8
call fcn.004034e8
jne 0x4108a4
mov eax, 0x411e28
call fcn.004128f8
jmp 0x4108c5
lea eax, [ebp - 0xd8]
mov ecx, dword [0x41eb68]
mov edx, 0x411e38
call fcn.004033e8
mov eax, dword [ebp - 0xd8]
call fcn.004128f8
push 0
mov ecx, 0x411e48
mov edx, 0x411e58
mov eax, 0x80000001
call fcn.00406614
jmp 0x4108e7
mov eax, 0x41eb68
call fcn.00403218
call fcn.004184bc
lea eax, [ebp - 0xdc]
mov ecx, 0x411e78
mov edx, dword [0x41eb4c]
call fcn.004033e8
mov eax, dword [ebp - 0xdc]
push eax
lea eax, [ebp - 0xe0]
mov ecx, dword [0x41ee30]
mov edx, dword [0x41ed50]
call fcn.004033e8
mov edx, dword [ebp - 0xe0]
mov ecx, dword [0x41eb4c]
mov eax, 0x80000002
call fcn.004064ec
mov eax, 0x41eb74
mov edx, 0x411e90
call fcn.0040326c
mov eax, dword [0x41d2d4]
push eax
mov ecx, dword [0x41ed2c]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406338
mov dword [0x41eb94], eax
mov eax, dword [0x41d2d4]
push eax
mov ecx, dword [0x41ed58]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406338
mov dword [0x41eba4], eax
cmp dword [0x41eba4], 0x64
jge 0x410c72
mov eax, dword [0x41d2d4]
push eax
push 0x400
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [0x41ed24]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406400
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0xe4]
call fcn.00404a14
mov edx, dword [ebp - 0xe4]
mov eax, 0x41eb5c
call fcn.0040326c
mov eax, dword [0x41eb5c]
call fcn.0040339c
test eax, eax
je 0x410a10
mov eax, 1
mov edx, dword [0x41eb5c]
dec eax
test edx, edx
je 0x410a00
cmp eax, dword [edx - 4]
jb 0x410a05
call fcn.00402a00
inc eax
mov al, byte [edx + eax - 1]
add al, 0x9f
sub al, 0x1a
jb 0x410a1f
mov eax, 0x41eb5c
mov edx, 0x411f44
call fcn.0040326c
push 0x100002
mov eax, 0x41eccc
mov ecx, 1
mov edx, dword [0x40727c]
call fcn.00403d10
add esp, 4
mov eax, 1
mov edx, dword [0x41eb5c]
dec eax
test edx, edx
je 0x410a51
cmp eax, dword [edx - 4]
jb 0x410a56
call fcn.00402a00
inc eax
mov al, byte [edx + eax - 1]
cmp al, 0x63
jb 0x410c43
mov byte [ebp - 1], al
lea eax, [ebp - 0xec]
mov dl, byte [ebp - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf0]
call fcn.004027dc
mov edx, 0x411f48
lea eax, [ebp - 0xf0]
mov cl, 2
call fcn.004027ac
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xf4]
call fcn.004027dc
mov edx, 0x411f4c
lea eax, [ebp - 0xf4]
mov cl, 3
call fcn.004027ac
mov eax, dword [ebp - 0xf4]
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x410ad8
sub eax, 1
jne 0x410c2f
xor eax, eax
mov dword [0x41eb98], eax
lea eax, [ebp - 0xec]
mov dl, byte [ebp - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf0]
call fcn.004027dc
mov edx, 0x411f48
lea eax, [ebp - 0xf0]
mov cl, 2
call fcn.004027ac
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xf4]
call fcn.004027dc
mov edx, 0x411f4c
lea eax, [ebp - 0xf4]
mov cl, 3
call fcn.004027ac
lea edx, [ebp - 0xf4]
lea eax, [ebp - 0xf8]
call fcn.00403378
mov eax, dword [ebp - 0xf8]
call fcn.0040a7a8
lea eax, [ebp - 0xec]
mov dl, byte [ebp - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf0]
call fcn.004027dc
mov edx, 0x411f48
lea eax, [ebp - 0xf0]
mov cl, 2
call fcn.004027ac
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0x104]
call fcn.004027dc
mov edx, 0x411f50
lea eax, [ebp - 0x104]
mov cl, 4
call fcn.004027ac
lea edx, [ebp - 0x104]
lea eax, [ebp - 0xfc]
call fcn.00403378
mov eax, dword [ebp - 0xfc]
call fcn.004128f8
mov eax, 0x41eb74
mov edx, 0x411f5c
call fcn.0040326c
lea eax, [ebp - 0x108]
xor edx, edx
mov dl, byte [ebp - 1]
sub edx, 1
jno 0x410be5
call fcn.00402a08
call fcn.00403338
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [0x41ed24]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.004064ec
push 0
mov ecx, dword [0x41ed2c]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406614
cmp byte [ebp - 1], 0x63
jne 0x410c2f
mov eax, 0x411fec
call fcn.004128f8
xor eax, eax
mov dword [0x41eb94], eax
dec byte [ebp - 1]
cmp byte [ebp - 1], 0x62
jne 0x410a66
mov dword [0x41eba4], 0x64
mov eax, dword [0x41eba4]
test eax, eax
jns 0x410c5b
call fcn.00402a00
push eax
mov ecx, dword [0x41ed58]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406614
mov eax, 0x41eb74
mov edx, 0x412000
call fcn.0040326c
cmp dword [0x41eba4], 0xc8
jge 0x410d35
cmp byte [0x41ebb8], 0x66
jne 0x410ca1
mov byte [0x41d1dc], 0
xor eax, eax
mov dword [0x41eb9c], eax
mov eax, dword [0x41d2d4]
push eax
mov ecx, dword [0x41ed28]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406338
mov dword [0x41eba0], eax
push 0x100002
mov eax, 0x41eccc
mov ecx, 1
mov edx, dword [0x40727c]
call fcn.00403d10
add esp, 4
xor eax, eax
call fcn.0040b348
mov dword [0x41eba4], 0xc8
mov eax, dword [0x41eba4]
test eax, eax
jns 0x410d05
call fcn.00402a00
push eax
mov ecx, dword [0x41ed58]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406614
mov eax, 0x4120b0
call fcn.004128f8
mov eax, 0x41eb74
mov edx, 0x4120c8
call fcn.0040326c
push 0
mov eax, 0x41eccc
mov ecx, 1
mov edx, dword [0x40727c]
call fcn.00403d10
add esp, 4
mov eax, 0x41eb74
mov edx, 0x412114
call fcn.0040326c
mov eax, 0x41ebd0
call fcn.00406764
mov eax, dword [0x41eb50]
call fcn.0040339c
test eax, eax
jne 0x410dbd
lea edx, [ebp - 0x10c]
mov eax, dword [0x41eb4c]
call fcn.00404c94
mov edx, dword [ebp - 0x10c]
mov eax, 0x41eb50
call fcn.0040326c
mov eax, dword [0x41eb50]
call fcn.0040339c
test eax, eax
jne 0x410dbd
call fcn.00407fdc
jmp 0x411233
cmp byte [0x41ebb8], 0x64
jne 0x410dd0
call fcn.00412cb4
call fcn.004030ac
mov byte [0x41d1dc], 0
mov eax, dword [0x41d2d4]
push eax
mov ecx, dword [0x41ed34]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406338
dec eax
je 0x410edb
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x41eb34]
call fcn.0040359c
push eax
call sub.kernel32.dll_CreateFileA
mov dword [0x41ebc0], eax
mov eax, 0x41eb74
mov edx, 0x412208
call fcn.0040326c
push 2
push 0
push 0
mov eax, dword [0x41ebc0]
push eax
call sub.kernel32.dll_SetFilePointer
call fcn.00412f9c
push 0
push 0x41ebb0
mov eax, dword [0x41eb84]
call fcn.0040339c
test eax, eax
jns 0x410e60
call fcn.00402a00
push eax
mov eax, 0x41eb84
call fcn.004035ec
mov edx, 1
dec edx
test eax, eax
je 0x410e7a
cmp edx, dword [eax - 4]
jb 0x410e7f
call fcn.00402a00
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [0x41ebc0]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, 0x41eb84
call fcn.00403218
mov eax, 0x41eb74
mov edx, 0x41161c
call fcn.0040326c
mov eax, dword [0x41ebc0]
push eax
call sub.kernel32.dll_CloseHandle
push 1
mov ecx, dword [0x41ed34]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.00406614
mov eax, 0x41eb74
mov edx, 0x412224
call fcn.0040326c
push 0xea60
call sub.kernel32.dll_Sleep
mov eax, 0x41eb74
mov edx, 0x41225c
call fcn.0040326c
lea edx, [ebp - 0x110]
mov al, 1
call fcn.00404a90
mov ecx, dword [ebp - 0x110]
mov eax, 0x41eb58
mov edx, 0x412328
call fcn.004033e8
mov eax, 0x41eb74
mov edx, 0x41233c
call fcn.0040326c
mov eax, 0x41eb74
mov edx, 0x412378
call fcn.0040326c
mov eax, 7
call fcn.00402808
cmp eax, 5
ja case.default.0x410f47
jmp dword [eax*4 + 0x410f4e]
lea edx, [ebp - 0x114]
mov eax, 0x4123b0
call fcn.004058f4
mov edx, dword [ebp - 0x114]
mov eax, 0x41eb54
call fcn.0040326c
jmp 0x41106a
lea edx, [ebp - 0x118]
mov eax, 0x4123cc
call fcn.004058f4
mov edx, dword [ebp - 0x118]
mov eax, 0x41eb54
call fcn.0040326c
jmp 0x41106a
lea edx, [ebp - 0x11c]
mov eax, 0x4123e8
call fcn.004058f4
mov edx, dword [ebp - 0x11c]
mov eax, 0x41eb54
call fcn.0040326c
jmp 0x41106a
lea edx, [ebp - 0x120]
mov eax, 0x412404
call fcn.004058f4
mov edx, dword [ebp - 0x120]
mov eax, 0x41eb54
call fcn.0040326c
jmp 0x41106a
lea edx, [ebp - 0x124]
mov eax, 0x412420
call fcn.004058f4
mov edx, dword [ebp - 0x124]
mov eax, 0x41eb54
call fcn.0040326c
jmp 0x41106a
lea edx, [ebp - 0x128]
mov eax, 0x41243c
call fcn.004058f4
mov edx, dword [ebp - 0x128]
mov eax, 0x41eb54
call fcn.0040326c
jmp 0x41106a
lea edx, [ebp - 0x12c]
mov eax, 0x412454
call fcn.004058f4
mov edx, dword [ebp - 0x12c]
mov eax, 0x41eb54
call fcn.0040326c
mov eax, 0x41eb74
mov edx, 0x412470
call fcn.0040326c
lea eax, [ebp - 0x130]
mov ecx, dword [0x41ed5c]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov edx, dword [ebp - 0x130]
mov eax, dword [0x41eb34]
call fcn.00417d00
test al, al
je 0x4110c0
lea eax, [ebp - 0x134]
mov ecx, dword [0x41ed60]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov edx, dword [ebp - 0x134]
mov eax, dword [0x41eb38]
call fcn.00417d00
test al, al
jne 0x4110d9
mov eax, 0x41eb74
mov edx, 0x412378
call fcn.0040326c
call fcn.00412cb4
jmp 0x411233
call fcn.00405b0c
lea eax, [ebp - 0x138]
mov ecx, dword [0x41ed5c]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x138]
call fcn.0040be64
test al, al
je 0x41112b
lea eax, [ebp - 0x13c]
mov ecx, dword [0x41ed60]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x13c]
call fcn.0040be64
jmp 0x411233
call fcn.00405b0c
lea eax, [ebp - 0x140]
mov ecx, dword [0x41ed5c]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x140]
call fcn.0040be64
test al, al
je 0x41118c
mov eax, 0x41eb74
mov edx, 0x4124d0
call fcn.0040326c
lea eax, [ebp - 0x144]
mov ecx, dword [0x41ed60]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x144]
call fcn.0040be64
jmp 0x411233
call fcn.00405b0c
lea eax, [ebp - 0x148]
mov ecx, dword [0x41ed5c]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x148]
call fcn.0040be64
test al, al
je 0x4111db
lea eax, [ebp - 0x14c]
mov ecx, dword [0x41ed60]
mov edx, dword [0x41eb40]
call fcn.004033e8
mov eax, dword [ebp - 0x14c]
call fcn.0040be64
jmp 0x411233
mov eax, 0x41eb74
mov edx, 0x41172c
call fcn.0040326c
call fcn.00405b0c
mov eax, 0x41eb74
mov edx, 0x41258c
call fcn.0040326c
call fcn.0040d5d8
test al, al
jne 0x411233
call fcn.00405b0c
call fcn.0040e178
test al, al
jne 0x411233
call fcn.0040d5d8
mov eax, 0x4125bc
call fcn.004128f8
mov eax, 0x41eb74
mov edx, 0x4125d0
call fcn.0040326c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411278
lea eax, [ebp - 0x14c]
mov edx, 0x12
call fcn.0040323c
lea eax, [ebp - 0xfc]
mov edx, 2
call fcn.0040323c
lea eax, [ebp - 0xe8]
mov edx, 0x39
call fcn.0040323c
ret