Function at 0x419ac8
Capabilities:
Get disk information
Log keystrokes via polling
Parse credit card information

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x150
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x2c], ecx
mov ecx, eax
and ecx, 0x10000
mov dword [ebp - 0x54], ecx
mov ecx, eax
and ecx, 0x20000
mov dword [ebp - 0x50], ecx
mov ecx, eax
and ecx, 0x40000
movzx eax, al
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp eax, ebx
sete cl
push esi
push edi
mov dword [ebp + 0xc], ebx
mov dword [ebp - 8], ecx
xor ecx, ecx
cmp eax, 1
sete cl
xor edx, edx
cmp eax, 2
sete dl
cmp dword [ebp - 8], ebx
mov dword [ebp + 0x1c], ecx
mov dword [ebp + 4], edx
jne 0x419b31
cmp ecx, ebx
mov byte [ebp + 0x37], bl
je 0x419b35
mov byte [ebp + 0x37], 1
mov eax, dword [ebp + 0x74]
add eax, 0xfffffffe
mov dword [ebp - 0x34], eax
mov dword [ebp + 0x20], eax
push 1
lea eax, [ebp + 0x74]
push eax
push 0x4aa340
call fcn.0043fbfd
add esp, 0xc
cmp dword [ebp - 8], ebx
push 0x24
pop edx
push 0x23
pop esi
movzx eax, al
push 0x7c
mov dword [ebp - 0x30], eax
mov dword [ebp + 0x30], 0x100001
mov dword [ebp + 0x10], 0x100002
mov dword [ebp + 0x14], 0x100003
pop edi
jne 0x419b92
cmp dword [ebp + 0x1c], ebx
je 0x419b8a
mov dword [ebp + 0x30], edi
mov dword [ebp + 0x14], edx
jmp 0x419b98
cmp dword [ebp + 4], ebx
je 0x419b9b
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x30], edx
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x10], esi
mov eax, dword [ebp + 0x74]
mov cx, word [eax]
cmp cx, 0x2a
mov byte [ebp + 0x47], 0
jne 0x419bb7
mov ecx, dword [ebp + 0x30]
mov dword [ebp - 0xc], 0x2a
jmp 0x419bc9
cmp cx, dx
je 0x419bc6
cmp cx, si
je 0x419bc6
cmp cx, di
jne 0x419bd4
movzx ecx, cx
inc eax
inc eax
mov dword [ebp + 0xc], ecx
mov byte [ebp + 0x47], cl
mov dword [ebp + 0x74], eax
cmp word [eax], 0x5b
mov edi, eax
sete byte [ebp + 0x57]
cmp byte [ebp + 0x57], 0
mov dword [ebp + 0x3c], edi
je 0x419c44
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea ecx, [edi + eax*2 - 2]
jmp 0x419bf9
mov word [ecx], bx
dec ecx
dec ecx
mov ax, word [ecx]
call fcn.00437e2d
test al, al
jne 0x419bf4
cmp word [ecx], 0x5d
jne 0x419c0e
mov word [ecx], bx
push 2
pop edx
add edi, edx
xor ecx, ecx
jmp 0x419c39
mov eax, ecx
call fcn.00437e2d
test al, al
jne 0x419c37
cmp cx, 0x5b
je 0x419c2e
cmp cx, 0x28
jne 0x419c44
mov eax, dword [ebp + 0x20]
add dword [ebp + 0x20], edx
mov word [eax], cx
add edi, edx
mov cx, word [edi]
cmp cx, bx
mov dword [ebp + 0x3c], edi
jne 0x419c17
push 1
lea eax, [ebp + 0x74]
push eax
push 0x4aa340
mov dword [ebp + 0x74], edi
call fcn.0043fbfd
mov ecx, dword [ebp + 0x74]
movzx eax, al
add esp, 0xc
cmp byte [ebp + 0x57], 0
mov edi, ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x50], edi
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x18], ebx
mov byte [ebp + 0x7b], 0
je 0x419e3a
mov esi, dword [ebp + 0x1c]
xor eax, eax
mov ax, word [ecx]
xor dl, dl
cmp ax, 0x22
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x38], ecx
mov byte [ebp + 0x6b], 0
je 0x419cca
cmp ax, 0x27
je 0x419cca
cmp ax, bx
je 0x419cfd
push eax
call fcn.004129ca
add esp, 4
test al, al
jne 0x419cc2
xor esi, esi
add ecx, 2
mov dword [ebp + 0x50], ecx
jmp 0x419cfd
xor eax, eax
mov ax, word [ecx + 2]
push eax
call fcn.004129ca
add esp, 4
test al, al
jne 0x419cdf
xor esi, esi
push 0xc1
lea eax, [ebp + 0x38]
push ebx
push eax
call fcn.00419202
add esp, 0xc
mov dword [ebp + 0x50], eax
mov byte [ebp + 0x6b], 1
mov dl, 1
mov dword [ebp + 0x3c], eax
lea ecx, [ebp + 0x50]
call fcn.0040e2c3
mov edi, dword [ebp + 0x50]
xor ecx, ecx
jmp 0x419d9a
mov eax, ecx
call fcn.00437e2d
test al, al
je 0x419d34
cmp dl, 1
jg 0x419da6
lea ecx, [ebp + 0x50]
inc dl
call fcn.0040e2c3
mov edi, dword [ebp + 0x50]
dec edi
dec edi
jmp 0x419d95
cmp cx, 0x3e
je 0x419df6
cmp cx, 0x3c
je 0x419df6
cmp cx, 0x3d
je 0x419df6
cmp cx, 0x21
je 0x419df6
cmp esi, ebx
je 0x419d91
cmp dword [ebp + 0x1c], ebx
je 0x419d91
cmp cx, 0x26
je 0x419d77
cmp cx, 0x7c
je 0x419d77
cmp cx, 0x40
jne 0x419d91
mov ax, word [edi + 2]
call fcn.00437e2d
test al, al
je 0x419d91
mov ax, word [edi - 2]
call fcn.00437e2d
test al, al
jne 0x419dda
test dl, dl
jg 0x419da6
inc edi
inc edi
mov dword [ebp + 0x50], edi
mov cx, word [edi]
cmp cx, bx
jne 0x419d0f
cmp byte [ebp + 0x6b], 0
jne 0x419e28
push 0xc1
lea eax, [ebp + 0x38]
push ebx
push eax
call fcn.00419202
add esp, 0xc
cmp byte [ebp + 0x7b], 0
mov dword [ebp + 0x3c], eax
je 0x419e28
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x18]
call fcn.0043dea2
jmp 0x419e75
lea eax, [edi + 2]
mov cx, word [eax]
cmp cx, word [edi]
jne 0x419df0
mov word [edi], bx
mov edi, eax
mov byte [ebp + 0x7b], 5
jmp 0x419dfa
mov byte [ebp + 0x7b], 3
jmp 0x419dfa
mov byte [ebp + 0x7b], 1
cmp byte [ebp + 0x7b], 1
lea ecx, [edi + 2]
mov dword [ebp + 0x38], ecx
jne 0x419dac
mov ax, word [ecx]
cmp ax, 0x3e
je 0x419e21
cmp ax, 0x3c
je 0x419e21
cmp ax, 0x3d
je 0x419e21
cmp ax, 0x21
jne 0x419dac
inc ecx
inc ecx
mov dword [ebp + 0x38], ecx
jmp 0x419dac
mov eax, dword [ebp + 0x3c]
cmp word [eax], bx
je 0x419e7e
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x3c], eax
jmp 0x419e7e
movzx ecx, word [ecx]
cmp cx, bx
je 0x419e7e
mov eax, ecx
cmp ax, 0x3e
je 0x419e68
cmp ax, 0x3c
je 0x419e68
cmp ax, 0x3d
je 0x419e68
cmp ax, 0x21
je 0x419e68
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x419e44
jmp 0x419e7e
push edi
lea ecx, [ebp + 0x18]
mov byte [ebp + 0x7b], 1
call fcn.0044655b
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x5c], eax
mov word [edi], bx
mov eax, dword [ebp + 0xc]
push 0x4c1b94
mov dword [ebp + 0x24], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [ebp + 0x74]
cmp word [eax], 0x2a
mov edi, dword [ebp - 0xc]
jne 0x419ebb
cmp byte [ebp + 0x57], 0
je 0x419ebb
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x30], ecx
jne 0x419ead
cmp edi, ebx
je 0x419ebb
mov ecx, dword [ebp + 0x30]
inc eax
push 0x2a
inc eax
mov dword [ebp + 0x24], ecx
pop edi
mov dword [ebp + 0x74], eax
mov esi, dword [ebp + 0x2c]
cmp byte [esi + 0x92], 0
jne 0x419f64
cmp byte [esi + 9], 0
jne 0x419f64
cmp edi, ebx
jne 0x419f68
push 1
push ebx
lea ecx, [ebp + 0x58]
push ecx
push eax
mov ecx, esi
call fcn.0044c8eb
mov eax, dword [ebp + 0x58]
push ebx
push ebx
lea ecx, [ebp + 0x58]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x38], eax
mov dword [ebp + 0x58], ebx
call fcn.0044bafc
cmp dword [ebp + 0x5c], ebx
je 0x419f57
push 1
push ebx
lea eax, [ebp + 0x28]
push eax
push dword [ebp + 0x5c]
mov ecx, esi
call fcn.0044c8eb
mov eax, dword [ebp + 0x28]
push ebx
push ebx
lea ecx, [ebp + 0x28]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x4c], eax
mov dword [ebp + 0x28], ebx
call fcn.0044bafc
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push dword [ebp + 0x28]
lea ecx, [ebp + 0x58]
mov edi, eax
call fcn.0043ddea
mov eax, dword [ebp + 0x58]
lea eax, [eax + edi*2]
lea ecx, [ebp - 0x4c]
mov dword [ebp + 0x5c], eax
call fcn.00437e1a
lea ecx, [ebp - 0x38]
call fcn.00437e1a
jmp 0x41a0b0
cmp edi, ebx
je 0x419fa5
cmp byte [esi + 9], 0
jne 0x419f82
cmp word [eax], 0x26
je 0x419f82
lea ecx, [ebp + 0x58]
push ecx
push eax
call fcn.004459c3
pop ecx
pop ecx
jmp 0x419fb4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00413152
cmp eax, ebx
je 0x419f95
mov eax, dword [eax]
jmp 0x419f9a
mov eax, 0x4a69d4
push eax
lea ecx, [ebp + 0x58]
call fcn.0044655b
jmp 0x419fb4
push 1
push ebx
lea ecx, [ebp + 0x58]
push ecx
push eax
mov ecx, esi
call fcn.0044c8eb
cmp dword [ebp + 0x5c], ebx
je 0x41a0b0
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp edi, ebx
mov esi, eax
je 0x41a08a
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x38], 0x4a69d4
mov dword [ebp + 0x50], ebx
mov cx, word [eax]
cmp cx, 0x3e
je 0x419ff8
cmp cx, 0x3c
je 0x419ff8
cmp cx, 0x3d
je 0x419ff8
cmp cx, 0x21
jne 0x419ffc
inc eax
inc eax
jmp 0x419fdd
mov ecx, dword [ebp + 0x2c]
mov edi, eax
sub edi, dword [ebp + 0x5c]
sar edi, 1
cmp byte [ecx + 9], 0
jne 0x41a023
cmp word [eax], 0x26
je 0x41a023
lea ecx, [ebp + 0x50]
push ecx
push eax
call fcn.004459c3
mov eax, dword [ebp + 0x50]
pop ecx
pop ecx
jmp 0x41a035
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push ebx
push eax
call fcn.00413152
cmp eax, ebx
je 0x41a038
mov eax, dword [eax]
mov dword [ebp + 0x38], eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ebx, eax
lea eax, [ebx + edi]
add eax, esi
push eax
lea ecx, [ebp + 0x58]
call fcn.0043ddc3
test edi, edi
je 0x41a068
mov eax, dword [ebp + 0x58]
push edi
push dword [ebp + 0x5c]
lea eax, [eax + esi*2]
push eax
call fcn.0040515a
add esp, 0xc
mov eax, dword [ebp + 0x58]
inc ebx
push ebx
push dword [ebp + 0x38]
add edi, esi
lea eax, [eax + edi*2]
push eax
call fcn.0040515a
add esp, 0xc
lea ecx, [ebp + 0x50]
call fcn.00437e1a
xor ebx, ebx
jmp 0x41a0a7
mov ecx, dword [ebp + 0x2c]
push 1
push ebx
lea eax, [ebp + 0x28]
push eax
push dword [ebp + 0x5c]
call fcn.0044c8eb
push dword [ebp + 0x28]
lea ecx, [ebp + 0x58]
call fcn.0043ddea
mov eax, dword [ebp + 0x58]
lea eax, [eax + esi*2]
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x58]
push 0x4c1b94
mov dword [ebp + 0x74], eax
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push dword [ebp + 0x74]
call fcn.0040f54c
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
pop ecx
push dword [ebp + 0x74]
call esi
mov edx, dword [ebp + 0x74]
mov edi, dword [ebp + 0x5c]
cmp edi, ebx
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
mov dword [ebp], edx
mov dword [ebp + 0x50], edi
jne 0x41a0f7
push edx
call esi
mov edx, dword [ebp + 0x74]
lea edi, [edx + eax*2]
mov dword [ebp + 0x50], edi
cmp edi, ebx
mov ecx, edx
mov dword [ebp + 0x38], ebx
je 0x41a117
mov ax, word [edx]
jmp 0x41a10e
cmp ecx, edi
jae 0x41a117
inc ecx
inc ecx
mov ax, word [ecx]
call fcn.00437e2d
test al, al
je 0x41a105
sub ecx, edx
sar ecx, 1
cmp byte [ebp + 0x7b], 0
mov dword [ebp + 0x5c], ecx
jne 0x41a13d
cmp dword [ebp + 4], ebx
jne 0x41a13d
cmp word [edx], 0x3a
je 0x41a13d
cmp dword [ebp + 0x1c], ebx
je 0x41a597
jmp 0x41a8ba
mov dword [ebp + 0x40], edi
cmp word [edx], 0x3a
jne 0x41a150
cmp byte [ebp + 0x7b], 0
jne 0x41a150
or dword [ebp + 0x24], 0xffffffff
cmp byte [ebp + 0x7b], 1
jne 0x41a171
lea eax, [edi + 2]
mov cx, word [eax]
cmp cx, 0x3d
je 0x41a16e
cmp word [edi], 0x3c
jne 0x41a177
cmp cx, 0x3e
jne 0x41a177
mov dword [ebp + 0x40], eax
cmp byte [ebp + 0x7b], 0
je 0x41a17b
add dword [ebp + 0x40], 2
lea ecx, [ebp + 0x40]
call fcn.0040e2c3
cmp byte [ebp + 0x37], 0
mov ebx, dword [ebp + 0x40]
je 0x41a1c9
cmp word [ebx], 0x3f
jne 0x41a1c9
inc ebx
inc ebx
lea ecx, [ebp + 0x7c]
mov byte [ebp + 0x56], 1
mov dword [ebp + 0x40], ebx
call fcn.0040e2c3
mov esi, dword [ebp + 0x24]
cmp esi, dword [ebp + 0x30]
je 0x41a1d2
movzx eax, word [edx]
cmp dword [ebp + 0x30], eax
je 0x41a1bd
cmp dword [ebp + 0x10], eax
je 0x41a1bd
cmp dword [ebp + 0x14], eax
jne 0x41a1cf
inc edx
mov esi, eax
inc edx
mov dword [ebp + 0x38], esi
mov dword [ebp + 0x74], edx
jmp 0x41a1d2
mov byte [ebp + 0x56], 0
jmp 0x41a1a3
mov esi, dword [ebp + 0x24]
cmp dword [ebp + 4], 0
je 0x41a205
cmp byte [ebp + 0x47], 0
jne 0x41a205
cmp esi, dword [ebp + 0x14]
je 0x41a205
lea ecx, [ebp + 0x74]
call fcn.0040e2c3
mov edx, dword [ebp + 0x74]
mov ax, word [edx]
cmp ax, 0x30
jb 0x41a1fd
cmp ax, 0x39
jbe 0x41a205
cmp ax, 0x2e
je 0x41a205
xor esi, esi
xor eax, eax
cmp dword [ebp - 8], eax
jne 0x41a21a
cmp dword [ebp + 0x38], eax
jne 0x41a21a
cmp word [edx], 0x27
jne 0x41a21a
mov esi, dword [ebp + 0x30]
cmp dword [ebp + 0x30], esi
jne 0x41a2c1
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x78], edx
call fcn.0040e2c3
mov esi, dword [ebp + 0x78]
lea ecx, [edi - 2]
jmp 0x41a244
mov ax, word [ecx]
call fcn.00437e2d
test al, al
je 0x41a248
dec ecx
dec ecx
cmp ecx, esi
jae 0x41a236
sub ecx, esi
inc ecx
inc ecx
sar ecx, 1
mov edi, ecx
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x78], ebx
call fcn.0040e2c3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x78]
add ecx, 0xfffffffe
jmp 0x41a274
mov ax, word [ecx]
call fcn.00437e2d
test al, al
je 0x41a278
dec ecx
dec ecx
cmp ecx, edx
jae 0x41a266
sub ecx, edx
inc ecx
inc ecx
sar ecx, 1
mov ebx, ecx
cmp edi, ebx
mov eax, edi
jle 0x41a288
mov eax, ebx
test eax, eax
jle 0x41a2a7
cmp dword [ebp - 0x54], 0
push eax
push edx
push esi
je 0x41a29d
call dword [sym.imp.SHLWAPI.DLL_StrCmpNW]
jmp 0x41a2a3
call dword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
test eax, eax
jne 0x41a2ab
sub edi, ebx
mov eax, edi
cdq
xor ecx, ecx
mov edi, eax
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], edx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], ecx
jmp 0x41a6c4
cmp dword [ebp + 0x14], esi
jne 0x41a370
fldz
lea eax, [ebp - 4]
fstp qword [ebp - 4]
push eax
lea eax, [ebp + 0x74]
fldz
push eax
fstp qword [ebp - 0x14]
call fcn.00442c62
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.00442c62
fld qword [ebp - 4]
add esp, 0x10
call fcn.00493354
fld qword [ebp - 0x14]
mov edi, eax
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], edx
call fcn.00493354
cmp byte [ebp + 0x7b], 1
mov ecx, eax
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], edx
jg 0x41a6c4
fild qword [ebp + 0x48]
fld qword [ebp - 4]
fucompp
fnstsw ax
test ah, 0x44
jp 0x41a33d
fild qword [ebp + 0x60]
fld qword [ebp - 0x14]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x41a6c4
fld qword [ebp - 4]
fcomp qword [ebp - 0x14]
fnstsw ax
test ah, 0x41
jne 0x41a352
xor eax, eax
inc eax
jmp 0x41a2ab
fld qword [ebp - 0x14]
fld qword [ebp - 4]
fucompp
fnstsw ax
test ah, 0x44
jp 0x41a368
xor eax, eax
jmp 0x41a2ab
or eax, 0xffffffff
jmp 0x41a2ab
cmp dword [ebp + 0x10], esi
jne 0x41a397
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.004428d3
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.004428d3
add esp, 0x10
jmp 0x41a6be
cmp dword [ebp + 0x5c], 3
jl 0x41a8b1
lea ecx, [ebp + 0x40]
mov byte [ebp + 0x6b], 0
call fcn.0040e2c3
mov eax, dword [ebp + 0x40]
cmp word [eax], 0x23
jne 0x41a3bf
inc eax
inc eax
mov dword [ebp + 0x40], eax
mov byte [ebp + 0x6b], 1
mov bl, byte [ebp + 0x1c]
fldz
mov dword [ebp + 8], eax
fstp qword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp + 0x7b], 0
call fcn.00442c62
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp + 8], eax
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004428d3
mov eax, dword [ebp + 8]
add esp, 0x10
cmp word [eax], 0x2e
jne 0x41a40b
fld qword [ebp - 0x1c]
call fcn.00493354
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
push 3
pop edi
cmp dword [ebp + 0x5c], edi
jl 0x41a54e
cmp dword [ebp + 0x5c], 5
jg 0x41a54e
mov esi, dword [ebp]
push edi
push 0x4aa338
push esi
call dword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
test eax, eax
jne 0x41a551
cmp dword [ebp + 0x5c], edi
je 0x41a473
mov ax, word [esi + 6]
xor ecx, ecx
mov cx, word [esi + 8]
mov edx, 0xffdf
and eax, edx
and ecx, edx
cmp dword [ebp + 0x5c], 4
jne 0x41a479
cmp ax, 0x41
jne 0x41a461
xor bl, bl
jmp 0x41a473
cmp ax, 0x42
je 0x41a4a3
cmp ax, 0x55
jne 0x41a567
mov bl, 1
mov byte [ebp + 0x7b], 1
jmp 0x41a4a3
cmp dword [ebp + 0x5c], 5
jne 0x41a551
cmp ax, 0x42
jne 0x41a567
cmp cx, 0x55
jne 0x41a497
mov bl, 1
jmp 0x41a4a3
cmp cx, 0x41
jne 0x41a567
xor bl, bl
movsx eax, bl
push eax
call fcn.0041329d
cmp byte [ebp + 0x7b], 0
mov edi, eax
mov eax, edx
pop ecx
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], eax
mov ecx, edi
je 0x41a4cf
add ecx, 0xfffff
adc eax, 0
shrd ecx, eax, 0x14
shr eax, 0x14
cmp byte [ebp + 0x56], 0
jne 0x41aa7d
xor esi, esi
cmp dword [ebp + 0x24], esi
jle 0x41aae5
cmp byte [ebp + 0x7b], 0
je 0x41a6c1
mov dword [ebp - 0x28], eax
and dword [ebp - 0x28], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
fild qword [ebp - 0x5c]
mov dword [ebp - 0x2c], esi
fild qword [ebp - 0x2c]
fchs
faddp st(1)
fcom qword [ebp - 0x1c]
fnstsw ax
test ah, 0x41
jne 0x41a521
xor eax, eax
fstp st(0)
inc eax
jmp 0x41a538
fld qword [ebp - 0x1c]
fld st(1)
fucompp
fnstsw ax
fstp st(0)
test ah, 0x44
jp 0x41a535
xor eax, eax
jmp 0x41a538
or eax, 0xffffffff
cdq
mov edi, eax
xor ecx, ecx
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], edx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], esi
jmp 0x41a6c4
mov esi, dword [ebp]
cmp dword [ebp + 0x5c], edi
jne 0x41a567
push edi
push 0x4aa330
push esi
call dword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
test eax, eax
je 0x41a5c2
mov edx, dword [ebp + 0x74]
cmp word [edx], 0x3a
jne 0x41a6db
mov ax, word [edx + 2]
cmp ax, 0x65
jne 0x41a589
add edx, 4
mov dword [ebp + 0x74], edx
jmp 0x41a8ba
cmp ax, 0x70
jne 0x41a5b2
add edx, 4
mov dword [ebp + 0x74], edx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push edx
call fcn.004160e4
xor ecx, ecx
add esp, 0x14
test eax, eax
setg cl
mov edi, ecx
jmp 0x41a9bf
cmp ax, 0x6b
jne 0x41a6db
add edx, 4
mov dword [ebp + 0x74], edx
mov edx, dword [ebp + 0x40]
xor eax, eax
mov ax, word [edx]
push eax
call fcn.004129ca
add esp, 4
test al, al
je 0x41a5f8
xor ecx, ecx
mov cx, word [edx + 2]
push ecx
call fcn.004129ca
add esp, 4
test al, al
jne 0x41a5f4
or cx, 0x20
cmp cx, 0x78
jne 0x41a5f8
mov byte [ebp + 0x6b], 2
xor esi, esi
cmp byte [ebp + 0x6b], 0
jne 0x41a610
push esi
push edx
call fcn.00415da5
cdq
pop ecx
pop ecx
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
cmp dword [ebp + 0x64], esi
jl 0x41aae5
jg 0x41a624
cmp dword [ebp + 0x60], esi
jbe 0x41aae5
cmp dword [ebp + 0x64], esi
jl 0x41a646
jg 0x41a631
cmp dword [ebp + 0x60], 0x61
jb 0x41a646
cmp dword [ebp + 0x64], esi
jg 0x41a646
jl 0x41a63e
cmp dword [ebp + 0x60], 0x7a
ja 0x41a646
add dword [ebp + 0x60], 0xffffffe0
adc dword [ebp + 0x64], 0xffffffff
push dword [ebp + 0x60]
call dword [sym.imp.USER32.DLL_GetAsyncKeyState]
mov cx, ax
and cx, 0x8000
neg cx
mov word [ebp - 0xa2], si
sbb ecx, ecx
and ecx, dword [ebp + 0x60]
cmp ecx, 0x41
mov eax, ecx
cdq
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x4c], edx
mov word [ebp - 0xa4], cx
jl 0x41a680
cmp ecx, 0x5a
jle 0x41a6a0
cmp ecx, 0x30
jl 0x41a68a
cmp ecx, 0x39
jle 0x41a6a0
push ecx
lea eax, [ebp - 0xa4]
push 0x4aa324
push eax
call dword [sym.imp.USER32.DLL_wsprintfW]
add esp, 0xc
cmp byte [ebp + 0x56], 0
mov ecx, dword [ebp + 0x2c]
lea eax, [ebp - 0xa4]
push eax
jne 0x41aa84
push 0x4aa310
call fcn.0043d658
mov edi, dword [ebp + 0x48]
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebp + 0x50]
mov dx, word [eax]
test dx, dx
jne 0x41a786
or edi, dword [ebp + 0x4c]
jmp 0x41a883
mov ax, word [esi]
mov word [ebp - 0x48], ax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x46], 0x3a
mov word [ebp - 0x44], 0x5c
mov word [ebp - 0x42], bx
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
movsx eax, byte [ebp + 0x1c]
push ebx
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040f5a8
add esp, 0xc
cmp byte [ebp + 0x56], bl
jne 0x41aa90
cmp dword [ebp + 0x24], ebx
jle 0x41aaa4
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [ebp - 0x20], edx
and dword [ebp - 0x20], 0x80000000
and edx, 0x7fffffff
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x24], ebx
fild qword [ebp - 0x64]
fild qword [ebp - 0x24]
fchs
faddp st(1)
fcom qword [ebp - 0x1c]
fnstsw ax
test ah, 0x41
jne 0x41a759
xor eax, eax
fstp st(0)
inc eax
jmp 0x41a770
fld qword [ebp - 0x1c]
fld st(1)
fucompp
fnstsw ax
fstp st(0)
test ah, 0x44
jp 0x41a76d
xor eax, eax
jmp 0x41a770
or eax, 0xffffffff
cdq
mov edi, eax
xor ecx, ecx
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], edx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], ebx
jmp 0x41a6c4
push 0x3d
pop ebx
cmp dx, bx
jne 0x41a7aa
cmp edi, ecx
jne 0x41a889
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jne 0x41a889
xor edi, edi
inc edi
jmp 0x41a9bf
push 0x3e
pop esi
cmp dx, si
jne 0x41a7d3
mov eax, dword [ebp + 0x50]
cmp word [eax + 2], bx
jne 0x41a7d3
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jl 0x41a889
jg 0x41a7a2
cmp edi, ecx
jb 0x41a889
jmp 0x41a7a2
cmp dx, 0x3c
jne 0x41a80e
mov eax, dword [ebp + 0x50]
mov ax, word [eax + 2]
cmp ax, bx
jne 0x41a7fd
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jg 0x41a889
jl 0x41a7a2
cmp edi, ecx
ja 0x41a889
jmp 0x41a7a2
cmp ax, si
jne 0x41a80e
cmp edi, ecx
jne 0x41a7a2
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jmp 0x41a883
cmp dx, 0x21
jne 0x41a82b
mov eax, dword [ebp + 0x50]
mov ax, word [eax + 2]
cmp ax, bx
je 0x41a802
cmp ax, si
je 0x41a7e5
cmp ax, 0x3c
je 0x41a7bb
cmp dx, si
jne 0x41a847
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jl 0x41a889
jg 0x41a7a2
cmp edi, ecx
jbe 0x41a889
jmp 0x41a7a2
cmp dx, 0x3c
jne 0x41a864
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x4c], eax
jg 0x41a889
jl 0x41a7a2
cmp edi, ecx
jae 0x41a889
jmp 0x41a7a2
cmp dx, 0x26
jne 0x41a871
or edi, dword [ebp + 0x4c]
je 0x41a889
jmp 0x41a880
cmp dx, 0x7c
jne 0x41a890
or edi, dword [ebp + 0x4c]
jne 0x41a7a2
or ecx, dword [ebp + 0x64]
jne 0x41a7a2
xor edi, edi
jmp 0x41a9bf
cmp dx, 0x40
jne 0x41aae5
xor eax, eax
or edi, dword [ebp + 0x4c]
je 0x41a8a2
inc eax
xor edi, edi
or ecx, dword [ebp + 0x64]
je 0x41a8aa
inc edi
xor edi, eax
jmp 0x41a9bf
cmp dword [ebp + 4], eax
je 0x41aae5
push edx
call fcn.0041161a
pop ecx
push eax
mov dword [ebp + 0x74], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ecx, dword [ebp + 0x74]
xor ebx, ebx
mov bx, word [ecx]
mov esi, eax
mov dword [ebp + 0x78], 0xfffffff8
and ebx, 0xffdf
cmp bx, 0x41
jb 0x41a940
cmp bx, 0x5a
ja 0x41a940
cmp word [ecx + 2], 0x3a
jne 0x41a940
cmp word [ecx + 4], 0
je 0x41a913
cmp bx, 0x42
ja 0x41a940
push ebx
call fcn.00492567
neg eax
sbb eax, eax
inc eax
pop ecx
mov dword [ebp + 0x78], eax
je 0x41a93d
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
xor ecx, ecx
mov cl, bl
sub cl, 0x41
mov edi, eax
shr edi, cl
and edi, 1
je 0x41a9bf
mov ecx, dword [ebp + 0x74]
cmp word [ecx + 4], 0
je 0x41a9bf
jmp 0x41a940
mov ecx, dword [ebp + 0x74]
test esi, esi
jle 0x41a95c
xor eax, eax
mov ax, word [ecx + esi*2 - 2]
push eax
call fcn.0040e33b
add esp, 4
test al, al
je 0x41a95c
mov bl, 1
jmp 0x41a97c
xor bl, bl
jmp 0x41a982
xor eax, eax
lea edx, [ecx + esi*2]
mov ax, word [edx]
push eax
call fcn.0040e33b
add esp, 4
test al, al
je 0x41a97f
and word [edx], 0
mov ecx, dword [ebp + 0x74]
dec esi
jns 0x41a960
xor esi, esi
inc esi
xor edi, edi
cmp esi, edi
je 0x41a9bf
cmp dword [ebp - 0x50], edi
je 0x41a9b1
mov ax, word [ecx]
cmp ax, di
je 0x41a9b1
cmp word [ecx + 2], 0x3a
jne 0x41a9b1
cmp dword [ebp + 0x78], edi
jg 0x41a9bf
jge 0x41a9b1
push eax
call fcn.00492567
test eax, eax
pop ecx
je 0x41a9bf
mov ecx, dword [ebp + 0x74]
movsx eax, bl
push eax
push ecx
call fcn.004927a1
pop ecx
pop ecx
mov edi, eax
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x41a9cd
test edi, edi
sete al
jmp 0x41a9d2
test edi, edi
setne al
mov edx, dword [ebp + 0x20]
push 2
lea ecx, [eax + 0x30]
pop edi
mov word [edx], cx
add edx, edi
cmp byte [ebp + 0x57], 0
mov dword [ebp + 0x20], edx
je 0x41aad4
mov esi, dword [ebp + 0x3c]
mov cx, word [esi]
test cx, cx
je 0x41aaa9
cmp cx, 0x5b
je 0x41aa40
cmp cx, 0x5d
je 0x41aa40
cmp cx, 0x28
je 0x41aa40
cmp cx, 0x29
je 0x41aa40
cmp cx, 0x26
je 0x41aa40
cmp cx, 0x7c
jne 0x41aa2d
mov ax, word [esi + 2]
call fcn.00437e2d
test al, al
jne 0x41aa40
cmp cx, 0x40
je 0x41aa40
mov eax, ecx
call fcn.00437e2d
test al, al
je 0x41aa55
jmp 0x41aa48
mov word [edx], cx
add edx, edi
mov dword [ebp + 0x20], edx
add esi, edi
mov cx, word [esi]
test cx, cx
mov dword [ebp + 0x3c], esi
jne 0x41a9fc
cmp word [esi], 0
je 0x41aaa9
lea ecx, [ebp + 0x18]
call fcn.00437e1a
lea ecx, [ebp + 0x28]
call fcn.00437e1a
lea ecx, [ebp + 0x58]
call fcn.00437e1a
mov edi, dword [ebp + 0x3c]
xor ebx, ebx
jmp 0x419c44
push dword [ebp + 0x2c]
push eax
push ecx
jmp 0x41aa95
push dword [ebp + 0x7c]
call fcn.0043d658
xor esi, esi
jmp 0x41aaea
push dword [ebp + 0x2c]
push edx
push eax
push dword [ebp + 0x7c]
call fcn.0041134d
add esp, 0x10
mov esi, eax
jmp 0x41aaea
or esi, 0xffffffff
jmp 0x41aaea
mov eax, dword [ebp - 0x34]
mov word [eax - 6], 0x23
mov word [eax - 4], 0x26
lea ecx, [ebp - 0xe4]
add eax, 0xfffffffe
push ecx
mov ecx, dword [ebp + 0x2c]
mov word [eax], 0x3d
and word [edx], 0
push eax
call fcn.0047ec1e
cmp dword [ebp - 0x30], 0
je 0x41aaa0
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x41aaa0
mov esi, 0x80070057
lea ecx, [ebp + 0x18]
call fcn.00437e1a
lea ecx, [ebp + 0x28]
call fcn.00437e1a
lea ecx, [ebp + 0x58]
call fcn.00437e1a
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc