Function at 0x1001c76
Capabilities:
Create process on windows
Enumerate gui resources
Get disk information
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1220
call fcn.01005730
mov eax, dword [0x1007028]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 9
pop ecx
xor ebx, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push 0x1001318
mov dword [ebp - 0x1174], eax
xor eax, eax
push ebx
mov dword [ebp - 0x11bc], ebx
lea edi, [ebp - 0x11b8]
rep stosd dword es:[edi], eax
inc eax
push ebx
push ebx
mov dword [ebp - 0x1178], ebx
mov dword [ebp - 0x117c], ebx
mov dword [ebp - 0x1184], eax
mov dword [ebp - 0x1188], eax
mov dword [ebp - 0x1180], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [ebp - 0x1194], eax
je 0x1001cfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1001cfb
mov dword [ebp - 0x1188], ebx
mov dword [0x1007038], esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push esi
call fcn.01003061
push 0x7f00
push ebx
mov dword [ebp - 0x1198], 0x1001304
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x68
push esi
mov dword [ebp - 0x11a4], eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x11a8], eax
mov eax, dword [sym.imp.USER32.dll_DefDlgProcW]
mov dword [ebp - 0x11b8], eax
lea eax, [ebp - 0x11bc]
push eax
mov dword [ebp - 0x11a0], 6
mov dword [ebp - 0x11ac], esi
mov dword [ebp - 0x11bc], 3
mov dword [ebp - 0x11b0], 0x1e
call dword [sym.imp.USER32.dll_RegisterClassW]
lea eax, [ebp - 0x117c]
push eax
lea eax, [ebp - 0x1178]
push eax
push dword [ebp - 0x1174]
call fcn.01001811
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1174]
call fcn.010019f9
test eax, eax
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
jne 0x1001db3
test byte [ebp - 0x1178], 3
je 0x1001f5b
test byte [ebp - 0x1178], 1
je 0x1001dc6
push 0x66
call fcn.01004d06
pop ecx
jmp 0x1001df7
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x104
lea eax, [ebp - 0x1170]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
movzx eax, word [ebp - 0xc]
push eax
lea eax, [ebp - 0x1170]
push eax
push 0x64
call fcn.01004d06
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1174], eax
mov edi, 0x1001a92
je 0x1001e1a
push eax
push edi
call dword [sym.imp.USER32.dll_EnumWindows]
push dword [ebp - 0x1174]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x1007040], ebx
jne 0x1001e6a
push 0x40
lea eax, [ebp - 0x94]
push eax
push 0x4b0
push dword [0x1007038]
call esi
lea eax, [ebp - 0x94]
push eax
push edi
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x40
lea eax, [ebp - 0x94]
push eax
push 0x4b3
push dword [0x1007038]
call esi
lea eax, [ebp - 0x94]
push eax
push edi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x1188], ebx
jne 0x1001e7c
mov dword [0x1007040], 1
cmp dword [0x1007040], ebx
jne 0x1001f71
test byte [ebp - 0x1178], 2
jne 0x1001f7c
push 0x6b8
call fcn.010017e5
cmp eax, ebx
pop ecx
je 0x1001ebf
push dword [ebp - 0x117c]
lea ecx, [ebp - 0xc]
push dword [ebp - 0x1178]
push ecx
mov ecx, eax
call fcn.01004977
mov edi, eax
jmp 0x1001ec1
xor edi, edi
cmp edi, ebx
je 0x1002067
cmp dword [edi + 0x6b0], ebx
jne 0x1002052
cmp dword [edi], 0x1a
jne 0x1002028
cmp dword [edi + 0x670], ebx
je 0x1001f04
push 0xffffffffffffffff
push dword [edi + 0x66c]
mov dword [edi + 0x6b0], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [edi + 0x6b0], ebx
lea eax, [ebp - 0xc]
push eax
push 0x65
call fcn.01004d06
pop ecx
pop ecx
push 0x100
mov dword [ebp - 0x1174], eax
lea eax, [ebp - 0xf68]
push eax
push 0x14
push dword [0x1007038]
call esi
push 0x10000
lea eax, [ebp - 0xf68]
push eax
push dword [ebp - 0x1174]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x1174]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 1
mov ecx, edi
call fcn.01001c50
lea eax, [ebp - 0xc]
push eax
call fcn.010053d0
test eax, eax
jne 0x1001db3
jmp 0x10022d3
mov dword [ebp - 0x1184], ebx
jmp 0x10022d3
mov word [ebp - 0x12], 0x3a
mov word [ebp - 0x10], 0x5c
mov word [ebp - 0xe], bx
mov dword [ebp - 0x1174], 0x41
mov ax, word [ebp - 0x1174]
push 0x6b8
mov word [ebp - 0x14], ax
call fcn.010017e5
cmp eax, ebx
pop ecx
je 0x1001fcb
push dword [ebp - 0x117c]
lea ecx, [ebp - 0x14]
push dword [ebp - 0x1178]
push ecx
mov ecx, eax
call fcn.01004977
mov edi, eax
jmp 0x1001fcd
xor edi, edi
cmp edi, ebx
je 0x1002012
cmp dword [edi + 0x6b0], ebx
jne 0x1001fe5
cmp dword [edi], 0x1a
je 0x1001fe5
mov ecx, edi
call fcn.01004766
mov eax, dword [edi + 0x670]
cmp eax, ebx
je 0x1001ffd
push ebx
push eax
mov dword [ebp - 0x1180], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x658]
push 1
mov ecx, edi
mov dword [ebp - 0x1184], eax
call fcn.01001c50
inc dword [ebp - 0x1174]
cmp word [ebp - 0x1174], 0x5a
jbe 0x1001f96
jmp 0x1002067
push edi
push ebx
call fcn.01002f52
test eax, eax
je 0x1002052
or byte [edi + 0x65f], 0x80
test byte [ebp - 0x1178], 5
jne 0x1002052
cmp dword [edi + 0x668], ebx
je 0x1002052
mov ecx, edi
call fcn.01004766
mov eax, dword [edi + 0x658]
push 1
mov ecx, edi
mov dword [ebp - 0x1184], eax
call fcn.01001c50
lea eax, [ebp - 0x1220]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 6
pop eax
cmp eax, eax
jne 0x10022d3
mov eax, dword [ebp - 0x1178]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
and eax, 8
mov dword [ebp - 0x1188], eax
mov ebx, 0x32c
and dword [ebp - 0x117c], 0
cmp dword [ebp - 0x1188], 0
je 0x100214a
lea eax, [ebp - 0x1190]
push eax
lea eax, [ebp - 0x11c4]
push eax
lea eax, [ebp - 0x11cc]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x1190]
mov ecx, dword [ebp - 0x118c]
shrd eax, ecx, 0x14
shr ecx, 0x14
cmp eax, 0xc8
mov dword [ebp - 0x1174], eax
jae 0x10021f9
cmp eax, 0x50
push ebx
lea eax, [ebp - 0x6ec]
push eax
jae 0x1002104
push 0x4b6
jmp 0x1002109
push 0x4b1
push dword [0x1007038]
call esi
push 0x40
lea eax, [ebp - 0x94]
push eax
push 0x4b0
push dword [0x1007038]
call esi
push dword [ebp - 0x1174]
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0xd68]
push eax
call edi
add esp, 0xc
push 0x40034
jmp 0x10021dd
test byte [ebp - 0x1178], 0x10
je 0x10022d1
lea eax, [ebp - 0x1190]
push eax
lea eax, [ebp - 0x11c4]
push eax
lea eax, [ebp - 0x11cc]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x1190]
mov ecx, dword [ebp - 0x118c]
shrd eax, ecx, 0x14
shr ecx, 0x14
cmp eax, 0x32
mov dword [ebp - 0x1174], eax
jae 0x10021f9
push 0x40
lea eax, [ebp - 0x94]
push eax
push 0x4b0
push dword [0x1007038]
call esi
push ebx
lea eax, [ebp - 0x6ec]
push eax
push 0x4b2
push dword [0x1007038]
call esi
push dword [ebp - 0x1174]
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0xd68]
push eax
call edi
add esp, 0xc
push 0x40014
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xd68]
push eax
push dword [ebp - 0x1180]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1002266
push 0x40
lea eax, [ebp - 0x94]
push eax
push 0x4b3
push dword [0x1007038]
call esi
push ebx
lea eax, [ebp - 0x6ec]
push eax
push 0x4b4
push dword [0x1007038]
call esi
push dword [ebp - 0x1174]
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0xd68]
push eax
call edi
add esp, 0xc
push 0x40124
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xd68]
push eax
push dword [ebp - 0x1180]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x117c], 1
cmp eax, 6
jne 0x10022d1
push 0x10012d4
lea eax, [ebp - 0x6ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x11dc]
push eax
lea eax, [ebp - 0x1220]
push eax
xor eax, eax
push eax
push eax
push 0x20
push eax
push eax
push eax
lea ecx, [ebp - 0x6ec]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10022d1
push dword [ebp - 0x11dc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x11d8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x117c], 0
jne 0x10022d1
call fcn.01001ba3
jmp 0x1002099
xor ebx, ebx
cmp dword [ebp - 0x1194], ebx
pop edi
pop esi
pop ebx
je 0x10022ea
push dword [ebp - 0x1194]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.01003077
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1184]
call fcn.01005499
leave
ret 0x10