Function at 0x41a5f7
Capabilities:
Get disk information
Log keystrokes via polling
Parse credit card information

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x160
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 0x78]
mov eax, ecx
and eax, 0x10000
mov dword [ebp - 0x4c], eax
mov eax, ecx
and eax, 0x20000
mov dword [ebp - 0x40], eax
mov eax, ecx
and eax, 0x40000
push ebx
xor ebx, ebx
mov dword [ebp - 8], eax
movzx eax, cl
xor ecx, ecx
cmp eax, ebx
sete cl
push esi
push edi
mov dword [ebp], ebx
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp eax, 1
sete cl
xor edx, edx
cmp eax, 2
sete dl
cmp dword [ebp - 0xc], ebx
mov dword [ebp + 0x1c], ecx
mov dword [ebp - 4], edx
jne 0x41a65d
cmp ecx, ebx
mov byte [ebp + 0x3a], bl
je 0x41a661
mov byte [ebp + 0x3a], 1
mov eax, dword [ebp + 0x74]
add eax, 0xfffffffe
mov dword [ebp - 0x44], eax
mov dword [ebp + 0x18], eax
push 1
lea eax, [ebp + 0x74]
push eax
push 0x4c0580
call fcn.00445f31
add esp, 0xc
cmp dword [ebp - 0xc], ebx
push 0x24
pop edx
push 0x23
pop esi
movzx eax, al
push 0x7c
mov dword [ebp - 0x3c], eax
mov dword [ebp + 0x2c], 0x100001
mov dword [ebp + 0x14], 0x100002
mov dword [ebp + 0x24], 0x100003
pop edi
jne 0x41a6be
cmp dword [ebp + 0x1c], ebx
je 0x41a6b6
mov dword [ebp + 0x2c], edi
mov dword [ebp + 0x24], edx
jmp 0x41a6c4
cmp dword [ebp - 4], ebx
je 0x41a6c7
mov dword [ebp], edi
mov dword [ebp + 0x2c], edx
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x14], esi
mov eax, dword [ebp + 0x74]
mov cx, word [eax]
cmp cx, 0x2a
mov byte [ebp + 0x47], 0
jne 0x41a6e3
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 8], 0x2a
jmp 0x41a6f5
cmp cx, dx
je 0x41a6f2
cmp cx, si
je 0x41a6f2
cmp cx, di
jne 0x41a700
movzx ecx, cx
inc eax
inc eax
mov dword [ebp], ecx
mov byte [ebp + 0x47], cl
mov dword [ebp + 0x74], eax
cmp word [eax], 0x5b
mov edi, eax
sete byte [ebp + 0x57]
cmp byte [ebp + 0x57], 0
mov dword [ebp + 0x3c], edi
je 0x41a770
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea ecx, [edi + eax*2 - 2]
jmp 0x41a725
mov word [ecx], bx
dec ecx
dec ecx
mov ax, word [ecx]
call fcn.0043daaf
test al, al
jne 0x41a720
cmp word [ecx], 0x5d
jne 0x41a73a
mov word [ecx], bx
push 2
pop edx
add edi, edx
xor ecx, ecx
jmp 0x41a765
mov eax, ecx
call fcn.0043daaf
test al, al
jne 0x41a763
cmp cx, 0x5b
je 0x41a75a
cmp cx, 0x28
jne 0x41a770
mov eax, dword [ebp + 0x18]
add dword [ebp + 0x18], edx
mov word [eax], cx
add edi, edx
mov cx, word [edi]
cmp cx, bx
mov dword [ebp + 0x3c], edi
jne 0x41a743
push 1
lea eax, [ebp + 0x74]
push eax
push 0x4c0580
mov dword [ebp + 0x74], edi
call fcn.00445f31
mov ecx, dword [ebp + 0x74]
movzx eax, al
add esp, 0xc
cmp byte [ebp + 0x57], 0
mov edi, ecx
mov dword [ebp - 0x38], eax
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x50], edi
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x10], ebx
mov byte [ebp + 0x7b], 0
je 0x41a966
mov esi, dword [ebp + 0x1c]
xor eax, eax
mov ax, word [ecx]
xor dl, dl
cmp ax, 0x22
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x30], ecx
mov byte [ebp + 0x6b], 0
je 0x41a7f6
cmp ax, 0x27
je 0x41a7f6
cmp ax, bx
je 0x41a829
push eax
call fcn.004439f7
add esp, 4
test al, al
jne 0x41a7ee
xor esi, esi
add ecx, 2
mov dword [ebp + 0x50], ecx
jmp 0x41a829
xor eax, eax
mov ax, word [ecx + 2]
push eax
call fcn.004439f7
add esp, 4
test al, al
jne 0x41a80b
xor esi, esi
push 0xc1
lea eax, [ebp + 0x30]
push ebx
push eax
call fcn.00419ccc
add esp, 0xc
mov dword [ebp + 0x50], eax
mov byte [ebp + 0x6b], 1
mov dl, 1
mov dword [ebp + 0x3c], eax
lea ecx, [ebp + 0x50]
call fcn.0040f369
mov edi, dword [ebp + 0x50]
xor ecx, ecx
jmp 0x41a8c6
mov eax, ecx
call fcn.0043daaf
test al, al
je 0x41a860
cmp dl, 1
jg 0x41a8d2
lea ecx, [ebp + 0x50]
inc dl
call fcn.0040f369
mov edi, dword [ebp + 0x50]
dec edi
dec edi
jmp 0x41a8c1
cmp cx, 0x3e
je 0x41a922
cmp cx, 0x3c
je 0x41a922
cmp cx, 0x3d
je 0x41a922
cmp cx, 0x21
je 0x41a922
cmp esi, ebx
je 0x41a8bd
cmp dword [ebp + 0x1c], ebx
je 0x41a8bd
cmp cx, 0x26
je 0x41a8a3
cmp cx, 0x7c
je 0x41a8a3
cmp cx, 0x40
jne 0x41a8bd
mov ax, word [edi + 2]
call fcn.0043daaf
test al, al
je 0x41a8bd
mov ax, word [edi - 2]
call fcn.0043daaf
test al, al
jne 0x41a906
test dl, dl
jg 0x41a8d2
inc edi
inc edi
mov dword [ebp + 0x50], edi
mov cx, word [edi]
cmp cx, bx
jne 0x41a83b
cmp byte [ebp + 0x6b], 0
jne 0x41a954
push 0xc1
lea eax, [ebp + 0x30]
push ebx
push eax
call fcn.00419ccc
add esp, 0xc
cmp byte [ebp + 0x7b], 0
mov dword [ebp + 0x3c], eax
je 0x41a954
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x10]
call fcn.0044407f
jmp 0x41a9bf
lea eax, [edi + 2]
mov cx, word [eax]
cmp cx, word [edi]
jne 0x41a91c
mov word [edi], bx
mov edi, eax
mov byte [ebp + 0x7b], 5
jmp 0x41a926
mov byte [ebp + 0x7b], 3
jmp 0x41a926
mov byte [ebp + 0x7b], 1
cmp byte [ebp + 0x7b], 1
lea ecx, [edi + 2]
mov dword [ebp + 0x30], ecx
jne 0x41a8d8
mov ax, word [ecx]
cmp ax, 0x3e
je 0x41a94d
cmp ax, 0x3c
je 0x41a94d
cmp ax, 0x3d
je 0x41a94d
cmp ax, 0x21
jne 0x41a8d8
inc ecx
inc ecx
mov dword [ebp + 0x30], ecx
jmp 0x41a8d8
mov eax, dword [ebp + 0x3c]
cmp word [eax], bx
je 0x41a9c8
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x3c], eax
jmp 0x41a9c8
cmp dword [ebp + 0x1c], ebx
je 0x41a9a8
cmp word [ecx], 0x22
jne 0x41a9a8
lea edi, [ecx + 2]
mov ax, word [edi]
cmp ax, bx
je 0x41a9c8
inc edi
inc edi
cmp ax, 0x22
je 0x41a9a8
mov ax, word [edi]
cmp ax, bx
jne 0x41a97c
jmp 0x41a9a8
cmp ax, 0x3e
je 0x41a9b2
cmp ax, 0x3c
je 0x41a9b2
cmp ax, 0x3d
je 0x41a9b2
cmp ax, 0x21
je 0x41a9b2
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x41a98e
jmp 0x41a9c8
push edi
lea ecx, [ebp + 0x10]
mov byte [ebp + 0x7b], 1
call fcn.0044ce38
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x5c], eax
mov word [edi], bx
mov eax, dword [ebp]
push 0x4d8d24
mov dword [ebp + 0x30], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x2a
mov edi, dword [ebp - 8]
jne 0x41aa05
cmp byte [ebp + 0x57], 0
je 0x41aa05
mov ecx, dword [ebp]
cmp dword [ebp + 0x2c], ecx
jne 0x41a9f7
cmp edi, ebx
je 0x41aa05
mov ecx, dword [ebp + 0x2c]
inc eax
push 0x2a
inc eax
mov dword [ebp + 0x30], ecx
pop edi
mov dword [ebp + 0x74], eax
mov esi, dword [ebp + 0x34]
cmp byte [esi + 0x92], 0
jne 0x41aaae
cmp byte [esi + 9], 0
jne 0x41aaae
cmp edi, ebx
jne 0x41aab2
push 1
push ebx
lea ecx, [ebp + 0x58]
push ecx
push eax
mov ecx, esi
call fcn.00454bdd
mov eax, dword [ebp + 0x58]
push ebx
push ebx
lea ecx, [ebp + 0x58]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x48], eax
mov dword [ebp + 0x58], ebx
call fcn.004537c3
cmp dword [ebp + 0x5c], ebx
je 0x41aaa1
push 1
push ebx
lea eax, [ebp + 0x28]
push eax
push dword [ebp + 0x5c]
mov ecx, esi
call fcn.00454bdd
mov eax, dword [ebp + 0x28]
push ebx
push ebx
lea ecx, [ebp + 0x28]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x5c], eax
mov dword [ebp + 0x28], ebx
call fcn.004537c3
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push dword [ebp + 0x28]
lea ecx, [ebp + 0x58]
mov esi, eax
call fcn.00443fc7
mov eax, dword [ebp + 0x58]
lea eax, [eax + esi*2]
lea ecx, [ebp - 0x5c]
mov dword [ebp + 0x5c], eax
call fcn.0043db4f
lea ecx, [ebp - 0x48]
call fcn.0043db4f
jmp 0x41abf9
cmp edi, ebx
je 0x41aaef
cmp byte [esi + 9], 0
jne 0x41aacc
cmp word [eax], 0x26
je 0x41aacc
lea ecx, [ebp + 0x58]
push ecx
push eax
call fcn.0044c6a5
pop ecx
pop ecx
jmp 0x41aafe
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00414abb
cmp eax, ebx
je 0x41aadf
mov eax, dword [eax]
jmp 0x41aae4
mov eax, 0x4bca0c
push eax
lea ecx, [ebp + 0x58]
call fcn.0044ce38
jmp 0x41aafe
push 1
push ebx
lea ecx, [ebp + 0x58]
push ecx
push eax
mov ecx, esi
call fcn.00454bdd
cmp dword [ebp + 0x5c], ebx
je 0x41abf9
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
xor esi, esi
cmp edi, esi
mov ebx, eax
je 0x41abd1
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x50], 0x4bca0c
mov dword [ebp + 0x20], esi
mov cx, word [eax]
cmp cx, 0x3e
je 0x41ab44
cmp cx, 0x3c
je 0x41ab44
cmp cx, 0x3d
je 0x41ab44
cmp cx, 0x21
jne 0x41ab48
inc eax
inc eax
jmp 0x41ab29
mov ecx, dword [ebp + 0x34]
mov edi, eax
sub edi, dword [ebp + 0x5c]
sar edi, 1
cmp byte [ecx + 9], 0
jne 0x41ab6f
cmp word [eax], 0x26
je 0x41ab6f
lea ecx, [ebp + 0x20]
push ecx
push eax
call fcn.0044c6a5
mov eax, dword [ebp + 0x20]
pop ecx
pop ecx
jmp 0x41ab7e
push 0xffffffffffffffff
push esi
push eax
call fcn.00414abb
cmp eax, esi
je 0x41ab81
mov eax, dword [eax]
mov dword [ebp + 0x50], eax
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
lea eax, [esi + edi]
add eax, ebx
push eax
lea ecx, [ebp + 0x58]
call fcn.00443fa0
test edi, edi
je 0x41abb1
mov eax, dword [ebp + 0x58]
push edi
push dword [ebp + 0x5c]
lea eax, [eax + ebx*2]
push eax
call fcn.004055fd
add esp, 0xc
mov eax, dword [ebp + 0x58]
inc esi
push esi
push dword [ebp + 0x50]
add edi, ebx
lea eax, [eax + edi*2]
push eax
call fcn.004055fd
add esp, 0xc
lea ecx, [ebp + 0x20]
call fcn.0043db4f
jmp 0x41abee
mov ecx, dword [ebp + 0x34]
push 1
push esi
lea eax, [ebp + 0x28]
push eax
push dword [ebp + 0x5c]
call fcn.00454bdd
push dword [ebp + 0x28]
lea ecx, [ebp + 0x58]
call fcn.00443fc7
mov eax, dword [ebp + 0x58]
lea eax, [eax + ebx*2]
mov dword [ebp + 0x5c], eax
xor ebx, ebx
mov eax, dword [ebp + 0x58]
push 0x4d8d24
mov dword [ebp + 0x74], eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push dword [ebp + 0x74]
call fcn.004108af
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
pop ecx
push dword [ebp + 0x74]
call esi
mov edx, dword [ebp + 0x74]
mov edi, dword [ebp + 0x5c]
cmp edi, ebx
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x50], edi
jne 0x41ac40
push edx
call esi
mov edx, dword [ebp + 0x74]
lea edi, [edx + eax*2]
mov dword [ebp + 0x50], edi
cmp edi, ebx
mov ecx, edx
mov dword [ebp + 8], ebx
je 0x41ac60
mov ax, word [edx]
jmp 0x41ac57
cmp ecx, edi
jae 0x41ac60
inc ecx
inc ecx
mov ax, word [ecx]
call fcn.0043daaf
test al, al
je 0x41ac4e
sub ecx, edx
sar ecx, 1
cmp byte [ebp + 0x7b], 0
mov dword [ebp + 0x5c], ecx
jne 0x41aca9
cmp dword [ebp - 4], ebx
jne 0x41aca9
xor ecx, ecx
mov cx, word [edx]
cmp cx, 0x3a
je 0x41aca9
mov eax, dword [ebp + 0x30]
cmp dword [ebp + 0x14], eax
je 0x41ac8a
cmp dword [ebp + 0x24], eax
jne 0x41ac9b
mov eax, ecx
call fcn.00443b15
test al, al
jne 0x41aca9
cmp cx, 0x2d
je 0x41aca9
cmp dword [ebp + 0x1c], ebx
je 0x41b116
jmp 0x41b4eb
mov dword [ebp + 0x40], edi
cmp word [edx], 0x3a
jne 0x41acbc
cmp byte [ebp + 0x7b], 0
jne 0x41acbc
or dword [ebp + 0x30], 0xffffffff
cmp byte [ebp + 0x7b], 1
jne 0x41acdd
lea eax, [edi + 2]
mov cx, word [eax]
cmp cx, 0x3d
je 0x41acda
cmp word [edi], 0x3c
jne 0x41ace3
cmp cx, 0x3e
jne 0x41ace3
mov dword [ebp + 0x40], eax
cmp byte [ebp + 0x7b], 0
je 0x41ace7
add dword [ebp + 0x40], 2
lea ecx, [ebp + 0x40]
call fcn.0040f369
cmp byte [ebp + 0x3a], 0
mov ebx, dword [ebp + 0x40]
je 0x41ad35
cmp word [ebx], 0x3f
jne 0x41ad35
inc ebx
inc ebx
lea ecx, [ebp + 0x7c]
mov byte [ebp + 0x56], 1
mov dword [ebp + 0x40], ebx
call fcn.0040f369
mov esi, dword [ebp + 0x30]
cmp esi, dword [ebp + 0x2c]
je 0x41ad3e
movzx eax, word [edx]
cmp dword [ebp + 0x2c], eax
je 0x41ad29
cmp dword [ebp + 0x14], eax
je 0x41ad29
cmp dword [ebp + 0x24], eax
jne 0x41ad3b
inc edx
mov esi, eax
inc edx
mov dword [ebp + 8], esi
mov dword [ebp + 0x74], edx
jmp 0x41ad3e
mov byte [ebp + 0x56], 0
jmp 0x41ad0f
mov esi, dword [ebp + 0x30]
cmp dword [ebp - 4], 0
je 0x41ad71
cmp byte [ebp + 0x47], 0
jne 0x41ad71
cmp esi, dword [ebp + 0x24]
je 0x41ad71
lea ecx, [ebp + 0x74]
call fcn.0040f369
mov edx, dword [ebp + 0x74]
mov ax, word [edx]
cmp ax, 0x30
jb 0x41ad69
cmp ax, 0x39
jbe 0x41ad71
cmp ax, 0x2e
je 0x41ad71
xor esi, esi
xor eax, eax
cmp dword [ebp - 0xc], eax
jne 0x41ad86
cmp dword [ebp + 8], eax
jne 0x41ad86
cmp word [edx], 0x27
jne 0x41ad86
mov esi, dword [ebp + 0x2c]
cmp dword [ebp + 0x2c], esi
jne 0x41ae2d
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x78], edx
call fcn.0040f369
lea ecx, [edi - 2]
mov edi, dword [ebp + 0x78]
jmp 0x41adb0
mov ax, word [ecx]
call fcn.0043daaf
test al, al
je 0x41adb4
dec ecx
dec ecx
cmp ecx, edi
jae 0x41ada2
sub ecx, edi
inc ecx
inc ecx
sar ecx, 1
mov esi, ecx
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x78], ebx
call fcn.0040f369
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x78]
add ecx, 0xfffffffe
jmp 0x41ade0
mov ax, word [ecx]
call fcn.0043daaf
test al, al
je 0x41ade4
dec ecx
dec ecx
cmp ecx, edx
jae 0x41add2
sub ecx, edx
inc ecx
inc ecx
sar ecx, 1
mov ebx, ecx
cmp esi, ebx
mov eax, esi
jle 0x41adf4
mov eax, ebx
test eax, eax
jle 0x41ae13
cmp dword [ebp - 0x4c], 0
push eax
push edx
push edi
je 0x41ae09
call dword [sym.imp.SHLWAPI.DLL_StrCmpNW]
jmp 0x41ae0f
call dword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
test eax, eax
jne 0x41ae17
sub esi, ebx
mov eax, esi
cdq
xor ecx, ecx
mov edi, eax
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], edx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], ecx
jmp 0x41b264
cmp dword [ebp + 0x24], esi
jne 0x41aedc
fldz
lea eax, [ebp + 4]
fstp qword [ebp + 4]
push eax
lea eax, [ebp + 0x74]
fldz
push eax
fstp qword [ebp - 0x14]
call fcn.0045026a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.0045026a
fld qword [ebp + 4]
add esp, 0x10
call fcn.004aa574
fld qword [ebp - 0x14]
mov edi, eax
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], edx
call fcn.004aa574
cmp byte [ebp + 0x7b], 1
mov ecx, eax
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], edx
jg 0x41b264
fild qword [ebp + 0x48]
fld qword [ebp + 4]
fucompp
fnstsw ax
test ah, 0x44
jp 0x41aea9
fild qword [ebp + 0x60]
fld qword [ebp - 0x14]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x41b264
fld qword [ebp + 4]
fcomp qword [ebp - 0x14]
fnstsw ax
test ah, 0x41
jne 0x41aebe
xor eax, eax
inc eax
jmp 0x41ae17
fld qword [ebp - 0x14]
fld qword [ebp + 4]
fucompp
fnstsw ax
test ah, 0x44
jp 0x41aed4
xor eax, eax
jmp 0x41ae17
or eax, 0xffffffff
jmp 0x41ae17
cmp dword [ebp + 0x14], esi
jne 0x41af03
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.00450152
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.00450152
add esp, 0x10
jmp 0x41b25e
cmp dword [ebp + 0x5c], 3
jl 0x41b4e2
lea ecx, [ebp + 0x40]
mov byte [ebp + 0x6b], 0
mov byte [ebp + 0x3b], 1
call fcn.0040f369
mov eax, dword [ebp + 0x40]
cmp word [eax], 0x23
jne 0x41af2f
inc eax
inc eax
mov dword [ebp + 0x40], eax
mov byte [ebp + 0x6b], 1
mov bl, byte [ebp + 0x1c]
fldz
fstp qword [ebp - 0x1c]
mov byte [ebp + 0x7b], 0
cmp word [eax], 0x2a
jne 0x41af4a
inc eax
inc eax
mov dword [ebp + 0x40], eax
mov byte [ebp + 0x3b], 0
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00449260
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00448ed1
mov eax, dword [ebp + 0xc]
add esp, 0x10
cmp word [eax], 0x2e
jne 0x41af8a
fld qword [ebp - 0x1c]
call fcn.004aa574
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
push 3
pop edi
cmp dword [ebp + 0x5c], edi
jl 0x41b0cd
cmp dword [ebp + 0x5c], 5
jg 0x41b0cd
mov esi, dword [ebp + 0x20]
push edi
push 0x4c0578
push esi
call dword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
test eax, eax
jne 0x41b0d0
cmp dword [ebp + 0x5c], edi
je 0x41aff2
mov ax, word [esi + 6]
xor ecx, ecx
mov cx, word [esi + 8]
mov edx, 0xffdf
and eax, edx
and ecx, edx
cmp dword [ebp + 0x5c], 4
jne 0x41aff8
cmp ax, 0x41
jne 0x41afe0
xor bl, bl
jmp 0x41aff2
cmp ax, 0x42
je 0x41b022
cmp ax, 0x55
jne 0x41b0e6
mov bl, 1
mov byte [ebp + 0x7b], 1
jmp 0x41b022
cmp dword [ebp + 0x5c], 5
jne 0x41b0d0
cmp ax, 0x42
jne 0x41b0e6
cmp cx, 0x55
jne 0x41b016
mov bl, 1
jmp 0x41b022
cmp cx, 0x41
jne 0x41b0e6
xor bl, bl
movsx eax, bl
push eax
call fcn.00414c06
cmp byte [ebp + 0x7b], 0
mov edi, eax
mov eax, edx
pop ecx
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], eax
mov ecx, edi
je 0x41b04e
add ecx, 0xfffff
adc eax, 0
shrd ecx, eax, 0x14
shr eax, 0x14
cmp byte [ebp + 0x56], 0
jne 0x41b6ae
xor esi, esi
cmp dword [ebp + 8], esi
jle 0x41b716
cmp byte [ebp + 0x7b], 0
je 0x41b261
mov dword [ebp - 0x20], eax
and dword [ebp - 0x20], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ecx
fild qword [ebp - 0x64]
mov dword [ebp - 0x24], esi
fild qword [ebp - 0x24]
fchs
faddp st(1)
fcom qword [ebp - 0x1c]
fnstsw ax
test ah, 0x41
jne 0x41b0a0
xor eax, eax
fstp st(0)
inc eax
jmp 0x41b0b7
fld qword [ebp - 0x1c]
fld st(1)
fucompp
fnstsw ax
fstp st(0)
test ah, 0x44
jp 0x41b0b4
xor eax, eax
jmp 0x41b0b7
or eax, 0xffffffff
cdq
mov edi, eax
xor ecx, ecx
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], edx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], esi
jmp 0x41b264
mov esi, dword [ebp + 0x20]
cmp dword [ebp + 0x5c], edi
jne 0x41b0e6
push edi
push 0x4c0570
push esi
call dword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
test eax, eax
je 0x41b162
mov edx, dword [ebp + 0x74]
cmp word [edx], 0x3a
jne 0x41b283
mov ax, word [edx + 2]
cmp ax, 0x65
jne 0x41b108
add edx, 4
mov dword [ebp + 0x74], edx
jmp 0x41b4eb
cmp ax, 0x70
jne 0x41b152
add edx, 4
mov dword [ebp + 0x74], edx
xor ebx, ebx
push 0x3f
lea eax, [ebp + 0x78]
push 0x2a
push eax
mov dword [ebp + 0x78], edx
call fcn.0043e06b
mov eax, dword [ebp + 0x78]
mov ax, word [eax]
neg ax
push ebx
push ebx
push ebx
sbb eax, eax
and eax, 0x101
push eax
push dword [ebp + 0x74]
call fcn.004179bc
add esp, 0x20
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x41b5f0
cmp ax, 0x6b
jne 0x41b283
add edx, 4
mov dword [ebp + 0x74], edx
mov edx, dword [ebp + 0x40]
xor eax, eax
mov ax, word [edx]
push eax
call fcn.004439f7
add esp, 4
test al, al
je 0x41b198
xor ecx, ecx
mov cx, word [edx + 2]
push ecx
call fcn.004439f7
add esp, 4
test al, al
jne 0x41b194
or cx, 0x20
cmp cx, 0x78
jne 0x41b198
mov byte [ebp + 0x6b], 2
xor esi, esi
cmp byte [ebp + 0x6b], 0
jne 0x41b1b0
push esi
push edx
call fcn.00417882
cdq
pop ecx
pop ecx
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
cmp dword [ebp + 0x64], esi
jl 0x41b716
jg 0x41b1c4
cmp dword [ebp + 0x60], esi
jbe 0x41b716
cmp dword [ebp + 0x64], esi
jl 0x41b1e6
jg 0x41b1d1
cmp dword [ebp + 0x60], 0x61
jb 0x41b1e6
cmp dword [ebp + 0x64], esi
jg 0x41b1e6
jl 0x41b1de
cmp dword [ebp + 0x60], 0x7a
ja 0x41b1e6
add dword [ebp + 0x60], 0xffffffe0
adc dword [ebp + 0x64], 0xffffffff
push dword [ebp + 0x60]
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov cx, ax
and cx, 0x8000
neg cx
mov word [ebp - 0xb2], si
sbb ecx, ecx
and ecx, dword [ebp + 0x60]
cmp ecx, 0x41
mov eax, ecx
cdq
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x4c], edx
mov word [ebp - 0xb4], cx
jl 0x41b220
cmp ecx, 0x5a
jle 0x41b240
cmp ecx, 0x30
jl 0x41b22a
cmp ecx, 0x39
jle 0x41b240
push ecx
lea eax, [ebp - 0xb4]
push 0x4c0564
push eax
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0xc
cmp byte [ebp + 0x56], 0
mov ecx, dword [ebp + 0x34]
lea eax, [ebp - 0xb4]
push eax
jne 0x41b6b5
push 0x4c0550
call fcn.00443666
mov edi, dword [ebp + 0x48]
mov ecx, dword [ebp + 0x60]
mov esi, dword [ebp + 0x50]
mov dx, word [esi]
test dx, dx
jne 0x41b3bf
xor esi, esi
or edi, dword [ebp + 0x4c]
je 0x41b5f0
jmp 0x41b3dd
mov edx, dword [ebp + 0x20]
mov cx, word [edx]
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x50]
mov word [ebp - 0x58], cx
mov word [ebp - 0x56], 0x3a
mov word [ebp - 0x54], 0x5c
mov word [ebp - 0x52], bx
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x50]
xor esi, esi
cmp cx, 0x5c
lea eax, [ebp - 0x58]
jne 0x41b2c8
cmp edi, ebx
mov eax, edx
je 0x41b2c8
xor ecx, ecx
mov cx, word [edi]
cmp cx, bx
je 0x41b2c8
mov esi, ecx
mov word [edi], bx
movsx ecx, byte [ebp + 0x1c]
push ebx
push ecx
push eax
call fcn.0041090b
add esp, 0xc
cmp si, bx
je 0x41b2df
mov word [edi], si
cmp byte [ebp + 0x56], 0
jne 0x41b6c1
cmp dword [ebp + 8], ebx
jle 0x41b6d5
cmp byte [ebp + 0x3b], 0
je 0x41b382
mov ecx, eax
shrd ecx, edx, 0x14
shr edx, 0x14
mov dword [ebp - 0x28], edx
mov esi, 0x7fffffff
and edx, esi
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], edx
mov edx, dword [ebp + 0xc]
mov ecx, 0x80000000
and dword [ebp - 0x28], ecx
fild qword [ebp - 0x6c]
cmp word [edx], 0x2e
mov dword [ebp - 0x2c], ebx
fild qword [ebp - 0x2c]
fchs
faddp st(1)
jne 0x41b35d
and eax, 0xfffff
mov dword [ebp - 0x74], eax
xor eax, eax
mov dword [ebp - 0x30], eax
and eax, esi
and dword [ebp - 0x30], ecx
mov dword [ebp - 0x70], eax
fild qword [ebp - 0x74]
mov dword [ebp - 0x34], ebx
fild qword [ebp - 0x34]
fchs
faddp st(1)
fmul qword [0x4c0548]
faddp st(1)
fcom qword [ebp - 0x1c]
fnstsw ax
test ah, 0x41
jne 0x41b36e
fstp st(0)
xor eax, eax
inc eax
jmp 0x41b3a9
fld qword [ebp - 0x1c]
fld st(1)
fucompp
fnstsw ax
fstp st(0)
test ah, 0x44
jp 0x41b3a6
xor eax, eax
jmp 0x41b3a9
cmp dword [ebp + 0x64], ebx
jg 0x41b38e
jl 0x41b369
cmp dword [ebp + 0x60], ebx
jb 0x41b369
cmp edx, dword [ebp + 0x64]
jb 0x41b39c
ja 0x41b369
cmp eax, dword [ebp + 0x60]
jbe 0x41b39f
jmp 0x41b369
cmp eax, dword [ebp + 0x60]
jne 0x41b3a6
cmp edx, dword [ebp + 0x64]
je 0x41b37e
or eax, 0xffffffff
cdq
mov edi, eax
xor ecx, ecx
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], edx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], ebx
jmp 0x41b264
push 0x3d
pop ebx
cmp dx, bx
jne 0x41b3e3
cmp edi, ecx
jne 0x41b4ba
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jne 0x41b4ba
xor esi, esi
inc esi
jmp 0x41b5f0
cmp dx, 0x3e
jne 0x41b407
cmp word [esi + 2], bx
jne 0x41b407
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jl 0x41b4ba
jg 0x41b3db
cmp edi, ecx
jb 0x41b4ba
jmp 0x41b3db
cmp dx, 0x3c
jne 0x41b440
mov ax, word [esi + 2]
cmp ax, bx
jne 0x41b42e
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jg 0x41b4ba
jl 0x41b3db
cmp edi, ecx
ja 0x41b4ba
jmp 0x41b3db
cmp ax, 0x3e
jne 0x41b440
cmp edi, ecx
jne 0x41b3db
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jmp 0x41b4b4
cmp dx, 0x21
jne 0x41b45b
mov ax, word [esi + 2]
cmp ax, bx
je 0x41b434
cmp ax, 0x3e
je 0x41b416
cmp ax, 0x3c
je 0x41b3ef
cmp dx, 0x3e
jne 0x41b478
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jl 0x41b4ba
jg 0x41b3db
cmp edi, ecx
jbe 0x41b4ba
jmp 0x41b3db
cmp dx, 0x3c
jne 0x41b495
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jg 0x41b4ba
jl 0x41b3db
cmp edi, ecx
jae 0x41b4ba
jmp 0x41b3db
cmp dx, 0x26
jne 0x41b4a2
or edi, dword [ebp + 0x4c]
je 0x41b4ba
jmp 0x41b4b1
cmp dx, 0x7c
jne 0x41b4c1
or edi, dword [ebp + 0x4c]
jne 0x41b3db
or ecx, dword [ebp + 0x64]
jne 0x41b3db
xor esi, esi
jmp 0x41b5f0
cmp dx, 0x40
jne 0x41b716
xor eax, eax
or edi, dword [ebp + 0x4c]
je 0x41b4d3
inc eax
xor esi, esi
or ecx, dword [ebp + 0x64]
je 0x41b4db
inc esi
xor esi, eax
jmp 0x41b5f0
cmp dword [ebp - 4], eax
je 0x41b716
push edx
call fcn.00412ae5
pop ecx
push eax
mov dword [ebp + 0x74], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ecx, dword [ebp + 0x74]
xor ebx, ebx
mov bx, word [ecx]
mov edi, eax
mov dword [ebp + 0x78], 0xfffffff8
and ebx, 0xffdf
cmp bx, 0x41
jb 0x41b571
cmp bx, 0x5a
ja 0x41b571
cmp word [ecx + 2], 0x3a
jne 0x41b571
cmp word [ecx + 4], 0
je 0x41b544
cmp bx, 0x42
ja 0x41b571
push ebx
call fcn.004a9633
neg eax
sbb eax, eax
inc eax
pop ecx
mov dword [ebp + 0x78], eax
je 0x41b56e
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
xor ecx, ecx
mov cl, bl
sub cl, 0x41
mov esi, eax
shr esi, cl
and esi, 1
je 0x41b5f0
mov ecx, dword [ebp + 0x74]
cmp word [ecx + 4], 0
je 0x41b5f0
jmp 0x41b571
mov ecx, dword [ebp + 0x74]
test edi, edi
jle 0x41b58d
xor eax, eax
mov ax, word [ecx + edi*2 - 2]
push eax
call fcn.0040f3f6
add esp, 4
test al, al
je 0x41b58d
mov bl, 1
jmp 0x41b5ad
xor bl, bl
jmp 0x41b5b3
xor eax, eax
lea edx, [ecx + edi*2]
mov ax, word [edx]
push eax
call fcn.0040f3f6
add esp, 4
test al, al
je 0x41b5b0
and word [edx], 0
mov ecx, dword [ebp + 0x74]
dec edi
jns 0x41b591
xor edi, edi
inc edi
xor esi, esi
cmp edi, esi
je 0x41b5f0
cmp dword [ebp - 0x40], esi
je 0x41b5e2
mov ax, word [ecx]
cmp ax, si
je 0x41b5e2
cmp word [ecx + 2], 0x3a
jne 0x41b5e2
cmp dword [ebp + 0x78], esi
jg 0x41b5f0
jge 0x41b5e2
push eax
call fcn.004a9633
test eax, eax
pop ecx
je 0x41b5f0
mov ecx, dword [ebp + 0x74]
movsx eax, bl
push eax
push ecx
call fcn.004a986d
pop ecx
pop ecx
mov esi, eax
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x41b5fe
test esi, esi
sete al
jmp 0x41b603
test esi, esi
setne al
mov edx, dword [ebp + 0x18]
push 2
lea ecx, [eax + 0x30]
pop edi
mov word [edx], cx
add edx, edi
cmp byte [ebp + 0x57], 0
mov dword [ebp + 0x18], edx
je 0x41b705
mov esi, dword [ebp + 0x3c]
mov cx, word [esi]
test cx, cx
je 0x41b6da
cmp cx, 0x5b
je 0x41b671
cmp cx, 0x5d
je 0x41b671
cmp cx, 0x28
je 0x41b671
cmp cx, 0x29
je 0x41b671
cmp cx, 0x26
je 0x41b671
cmp cx, 0x7c
jne 0x41b65e
mov ax, word [esi + 2]
call fcn.0043daaf
test al, al
jne 0x41b671
cmp cx, 0x40
je 0x41b671
mov eax, ecx
call fcn.0043daaf
test al, al
je 0x41b686
jmp 0x41b679
mov word [edx], cx
add edx, edi
mov dword [ebp + 0x18], edx
add esi, edi
mov cx, word [esi]
test cx, cx
mov dword [ebp + 0x3c], esi
jne 0x41b62d
cmp word [esi], 0
je 0x41b6da
lea ecx, [ebp + 0x10]
call fcn.0043db4f
lea ecx, [ebp + 0x28]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
mov edi, dword [ebp + 0x3c]
xor ebx, ebx
jmp 0x41a770
push dword [ebp + 0x34]
push eax
push ecx
jmp 0x41b6c6
push dword [ebp + 0x7c]
call fcn.00443666
xor esi, esi
jmp 0x41b71b
push dword [ebp + 0x34]
push edx
push eax
push dword [ebp + 0x7c]
call fcn.0041280e
add esp, 0x10
mov esi, eax
jmp 0x41b71b
or esi, 0xffffffff
jmp 0x41b71b
mov eax, dword [ebp - 0x44]
mov word [eax - 6], 0x23
mov word [eax - 4], 0x26
lea ecx, [ebp - 0xf4]
add eax, 0xfffffffe
push ecx
mov ecx, dword [ebp + 0x34]
mov word [eax], 0x3d
and word [edx], 0
push eax
call fcn.0048a70c
cmp dword [ebp - 0x3c], 0
je 0x41b6d1
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x41b6d1
mov esi, 0x80070057
lea ecx, [ebp + 0x10]
call fcn.0043db4f
lea ecx, [ebp + 0x28]
call fcn.0043db4f
lea ecx, [ebp + 0x58]
call fcn.0043db4f
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc