Function at 0x404b40
Capabilities:
Get disk information
Get disk size
Get system information on windows
Query or enumerate registry value
Write file on windows

Disassembly:
mov eax, 0x15b0
call fcn.00406d20
lea eax, [esp + 0x2c]
push 0x42acd8
push eax
call fcn.0040678f
add esp, 8
lea ecx, [esp + 0x148]
push 0x42acd4
push ecx
call fcn.0040678f
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
test al, 8
je 0x404bc5
push 0x42acd0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x404bc5
call fcn.00406739
and eax, 0x80000001
jns 0x404b9c
dec eax
or eax, 0xfffffffe
inc eax
je 0x404bc5
lea edx, [esp + 0x2c]
push 0x42acd0
push edx
call fcn.0040678f
add esp, 8
lea eax, [esp + 0x148]
push 0x42accc
push eax
call fcn.0040678f
add esp, 8
push ebx
push ebp
push esi
lea ecx, [esp + 0x2c]
push edi
push ecx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x2c]
lea eax, [esp + 0x3c0]
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x3c]
push eax
push ecx
push 0
mov edi, 0x100
push str.CurrentBuildNumber
push edx
mov dword [esp + 0x44], edi
call esi
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x1c0]
push eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x3c]
push ecx
push edx
push 0
push str.CSDVersion
push eax
mov byte [esp + 0x1d8], 0
mov dword [esp + 0x44], edi
call esi
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetVersion]
lea edx, [esp + 0x170]
mov ebx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [esp + 0x50]
lea ecx, [esp + 0x194]
push eax
push 0x2c
push ecx
push 0
call dword [0x42ba88]
xor edx, edx
lea eax, [esp + 0x58]
mov dl, bh
and ebx, 0xff
and edx, 0xff
push edx
push ebx
push str.Microsoft__R__Windows_NT__TM__Version__d._d
push eax
call fcn.0040678f
lea ecx, [esp + 0x68]
push ecx
call fcn.00404b10
mov al, byte [esp + 0x1d4]
add esp, 0x14
test al, al
jne 0x404cc6
lea edx, [esp + 0x3c0]
lea eax, [esp + 0x58]
push edx
push str._Build__s_._n
push eax
call fcn.0040678f
add esp, 0xc
jmp 0x404ce8
lea ecx, [esp + 0x1c0]
lea edx, [esp + 0x3c0]
push ecx
push edx
lea eax, [esp + 0x60]
push str._Build__s:__s_._n
push eax
call fcn.0040678f
add esp, 0x10
lea ecx, [esp + 0x58]
push ecx
call fcn.00404b10
mov ecx, dword [esp + 0x188]
add esp, 4
cmp ecx, 1
mov edx, str.Multiprocessor_Kernel
ja 0x404d0b
mov edx, 0x42bb50
cmp ecx, 1
mov eax, 0x42ac50
ja 0x404d1a
mov eax, 0x42bb50
push edx
mov edx, dword [esp + 0x1a4]
shl edx, 0xc
shr edx, 0x14
inc edx
push edx
push eax
push ecx
lea eax, [esp + 0x68]
push str._d_System_Processor_s___d_MB_Memory___s_n
push eax
call fcn.0040678f
lea ecx, [esp + 0x70]
push ecx
call fcn.00404b10
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 0x1c
push 0x1f4
push 0xfffffffffffffff6
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push eax
call edi
cmp eax, 0x102
je 0x404d74
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15b0
ret
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x14], 0
push 0x42ac20
call fcn.00404b10
mov eax, dword [0x42bab4]
add esp, 4
test eax, eax
je 0x404e0b
mov dword [esp + 0x10], 0
mov ecx, dword [0x42ba84]
lea edx, [esp + 0x20]
push 0
push edx
lea eax, [esp + 0x5c8]
push 0x1000
push eax
push ecx
call ebx
push 0
push 0
call fcn.00406739
and eax, 0x8000000f
jns 0x404dd8
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [0x42ba84]
shl eax, 0xc
push eax
push edx
call ebp
push 0
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xfa
mov dword [esp + 0x10], eax
jl 0x404da6
jmp 0x404e22
push 0x1f4
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 4
mov dword [esp + 0x14], eax
jl 0x404d88
lea eax, [esp + 0x2c0]
push 0x100
lea ecx, [esp + 0x58]
push eax
lea edx, [esp + 0x54]
push ecx
lea eax, [esp + 0x40]
push edx
push eax
lea ecx, [esp + 0x4d4]
push 0x100
lea edx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [esp + 0x158]
lea ecx, [esp + 0x58]
push eax
push str._nChecking_file_system_on__s_n
push ecx
call fcn.0040678f
lea edx, [esp + 0x64]
push edx
call fcn.00404b10
add esp, 0x10
lea eax, [esp + 0x2c0]
lea ecx, [esp + 0x58]
push eax
push str.The_type_of_the_file_system_is__s_n
push ecx
call fcn.0040678f
lea edx, [esp + 0x64]
push edx
call fcn.00404b10
mov eax, dword [esp + 0x44]
add esp, 0x10
mov ecx, eax
lea edx, [esp + 0x58]
and ecx, 0xffff
shr eax, 0x10
push ecx
push eax
push str.Volume_Serial_Number_is__04x__04x_n
push edx
call fcn.0040678f
lea eax, [esp + 0x68]
push eax
call fcn.00404b10
push str.CHKDSK_is_verifying_files_and_directories..._n
call fcn.00404b10
add esp, 0x18
mov dword [esp + 0x14], 0xa
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x58]
push ecx
push str._d_percent_completed.
push edx
call fcn.0040678f
lea eax, [esp + 0x64]
push eax
call fcn.00404b10
push 0x42ab6c
call fcn.00404b10
mov eax, dword [0x42bab4]
add esp, 0x14
test eax, eax
je 0x404fd4
mov dword [esp + 0x10], 0
call fcn.00406739
cdq
mov ecx, 0xc8
idiv ecx
add edx, 0x14
test edx, edx
jle 0x404fb2
mov ecx, dword [0x42ba84]
lea edx, [esp + 0x20]
push 0
push edx
lea eax, [esp + 0x5c8]
push 0x1000
push eax
push ecx
call ebx
push 0
push 0
call fcn.00406739
and eax, 0x8000000f
jns 0x404f75
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [0x42ba84]
shl eax, 0xc
push eax
push edx
call ebp
push 0
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
inc dword [esp + 0x10]
call fcn.00406739
cdq
mov ecx, 0xc8
idiv ecx
mov eax, dword [esp + 0x10]
add edx, 0x14
cmp eax, edx
jl 0x404f43
call fcn.00406739
cdq
mov ecx, 0x12c
idiv ecx
push edx
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
jmp 0x404ff7
call fcn.00406739
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x64
push edx
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
call fcn.00406739
and eax, 0x80000007
jns 0x405008
dec eax
or eax, 0xfffffff8
inc eax
cmp eax, 1
jne 0x405074
call fcn.00406739
and eax, 0x80000001
jns 0x40501e
dec eax
or eax, 0xfffffffe
inc eax
mov dword [esp + 0x10], str.File
jne 0x405030
mov dword [esp + 0x10], str.Directory
call fcn.00406739
and eax, 0x800000ff
jns 0x405043
dec eax
or eax, 0xffffff00
inc eax
inc eax
push eax
call fcn.00406739
cdq
mov ecx, 0x2710
idiv ecx
lea eax, [esp + 0x5c]
push edx
mov edx, dword [esp + 0x18]
push edx
push str._n_s__d_has__d_lost_allocation_units._n
push eax
call fcn.0040678f
lea ecx, [esp + 0x6c]
push ecx
call fcn.00404b10
add esp, 0x18
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x64
mov dword [esp + 0x14], eax
jl 0x404eef
lea edx, [esp + 0x58]
push str.File_and_directory_verification_completed._n
push edx
call fcn.0040678f
lea eax, [esp + 0x60]
push eax
call fcn.00404b10
lea ecx, [esp + 0x2cc]
push str.NTFS
push ecx
call fcn.0040bb70
add esp, 0x14
test eax, eax
jne 0x405389
push str.CHKDSK_is_verifying_indexes..._n
call fcn.00404b10
add esp, 4
mov dword [esp + 0x14], 0xa
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x58]
push edx
push str._d_percent_completed.
push eax
call fcn.0040678f
lea ecx, [esp + 0x64]
push ecx
call fcn.00404b10
push 0x42ab6c
call fcn.00404b10
mov eax, dword [0x42bab4]
add esp, 0x14
test eax, eax
je 0x4051b6
mov dword [esp + 0x10], 0
call fcn.00406739
cdq
mov ecx, 0x32
idiv ecx
add edx, 0x14
test edx, edx
jle 0x405194
mov ecx, dword [0x42ba84]
lea edx, [esp + 0x20]
push 0
push edx
lea eax, [esp + 0x5c8]
push 0x1000
push eax
push ecx
call ebx
push 0
push 0
call fcn.00406739
and eax, 0x8000000f
jns 0x405157
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [0x42ba84]
shl eax, 0xc
push eax
push edx
call ebp
push 0
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
inc dword [esp + 0x10]
call fcn.00406739
cdq
mov ecx, 0x32
idiv ecx
mov eax, dword [esp + 0x10]
add edx, 0x14
cmp eax, edx
jl 0x405125
call fcn.00406739
cdq
mov ecx, 0x12c
idiv ecx
push edx
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
jmp 0x4051d9
call fcn.00406739
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
push edx
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
call fcn.00406739
cdq
mov ecx, 0xc
idiv ecx
cmp edx, 1
jne 0x405215
call fcn.00406739
cdq
mov ecx, 0x2710
idiv ecx
push edx
lea edx, [esp + 0x5c]
push str._nIndex__d_is_corrupt._n
push edx
call fcn.0040678f
lea eax, [esp + 0x64]
push eax
call fcn.00404b10
add esp, 0x10
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x64
mov dword [esp + 0x14], eax
jl 0x4050d1
push str.Index_verification_completed._n
call fcn.00404b10
push str.CHKDSK_is_verifying_security_descriptors..._n
call fcn.00404b10
add esp, 8
mov dword [esp + 0x14], 0xa
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x58]
push ecx
push str._d_percent_completed.
push edx
call fcn.0040678f
lea eax, [esp + 0x64]
push eax
call fcn.00404b10
push 0x42ab6c
call fcn.00404b10
mov eax, dword [0x42bab4]
add esp, 0x14
test eax, eax
je 0x405347
mov dword [esp + 0x10], 0
call fcn.00406739
cdq
mov ecx, 0x28
idiv ecx
add edx, 0x14
test edx, edx
jle 0x405309
mov ecx, dword [0x42ba84]
lea edx, [esp + 0x20]
push 0
push edx
lea eax, [esp + 0x5c8]
push 0x1000
push eax
push ecx
call ebx
push 0
push 0
call fcn.00406739
and eax, 0x8000000f
jns 0x4052cc
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [0x42ba84]
shl eax, 0xc
push eax
push edx
call ebp
push 0
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
inc dword [esp + 0x10]
call fcn.00406739
cdq
mov ecx, 0x28
idiv ecx
mov eax, dword [esp + 0x10]
add edx, 0x14
cmp eax, edx
jl 0x40529a
call fcn.00406739
cdq
mov ecx, 0xc
idiv ecx
cmp edx, 1
jne 0x40536a
call fcn.00406739
cdq
mov ecx, 0x2710
idiv ecx
push edx
lea edx, [esp + 0x5c]
push str._nDescriptor__d_is_corrupt._n
push edx
call fcn.0040678f
lea eax, [esp + 0x64]
push eax
call fcn.00404b10
add esp, 0x10
jmp 0x40536a
call fcn.00406739
cdq
mov ecx, 0x12c
idiv ecx
add edx, 0x64
push edx
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x64
mov dword [esp + 0x14], eax
jl 0x405246
push str.Security_descriptor_verification_completed._n
call fcn.00404b10
add esp, 4
lea edx, [esp + 0x18]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x16c]
push eax
lea edx, [esp + 0x44]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, 0xa
call fcn.00406dc0
push edx
push eax
lea eax, [esp + 0x60]
push str.__10I64d_kilobytes_total_disk_space._n
push eax
call fcn.0040678f
lea ecx, [esp + 0x68]
push ecx
call fcn.00404b10
lea edx, [esp + 0x2d4]
push str.NTFS
push edx
call fcn.0040bb70
add esp, 0x1c
test eax, eax
jne 0x405574
call fcn.00406739
cdq
mov ecx, 0x4e20
idiv ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
sub eax, edx
mov edx, dword [esp + 0x2c]
sbb edx, ecx
mov ecx, 0xa
call fcn.00406dc0
push edx
push eax
lea edx, [esp + 0x64]
push str.__10I64d_kilobytes_in__d_user_files._n
push edx
call fcn.0040678f
lea eax, [esp + 0x6c]
push eax
call fcn.00404b10
add esp, 0x18
call fcn.00406739
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
push edx
call fcn.00406739
cdq
mov ecx, 0x7d0
idiv ecx
push edx
lea edx, [esp + 0x60]
push str.__10d_kilobytes_in__d_indexes._n
push edx
call fcn.0040678f
lea eax, [esp + 0x68]
push eax
call fcn.00404b10
add esp, 0x14
call fcn.00406739
cdq
mov ecx, 0x4e20
idiv ecx
add edx, 0x1f4
push edx
lea edx, [esp + 0x5c]
push str.__10d_kilobytes_in_use_by_system._n
push edx
call fcn.0040678f
lea eax, [esp + 0x64]
push eax
call fcn.00404b10
add esp, 0x10
lea ecx, [esp + 0x58]
push 0x810
push str.__10d_kilobytes_occupied_by_log_file._n
push ecx
call fcn.0040678f
lea edx, [esp + 0x64]
push edx
call fcn.00404b10
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add esp, 0x10
mov ecx, 0xa
call fcn.00406dc0
push edx
push eax
lea eax, [esp + 0x60]
push str.__10I64d_kilobytes_available_on_disk._n_n
push eax
call fcn.0040678f
lea ecx, [esp + 0x68]
push ecx
call fcn.00404b10
add esp, 0x14
push 0x200
push str.__10d_bytes_in_each_allocation_unit._n
lea edx, [esp + 0x60]
push edx
call fcn.0040678f
lea eax, [esp + 0x64]
push eax
call fcn.00404b10
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
add esp, 0x10
mov ecx, 9
call fcn.00406dc0
push edx
push eax
lea ecx, [esp + 0x60]
push str.__10I64d_total_allocation_units_on_disk._n
push ecx
call fcn.0040678f
lea edx, [esp + 0x68]
push edx
call fcn.00404b10
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
add esp, 0x14
mov ecx, 9
call fcn.00406dc0
push edx
push eax
lea eax, [esp + 0x60]
push str.__10I64d_allocation_units_available_on_disk._n
push eax
call fcn.0040678f
lea ecx, [esp + 0x68]
push ecx
jmp 0x4056f8
call fcn.00406739
cdq
mov ecx, 0x12c
idiv ecx
push edx
call fcn.00406739
cdq
mov ecx, 0xc350
idiv ecx
push edx
lea edx, [esp + 0x60]
push str.__10d_bytes_in__d_hidden_files._n
push edx
call fcn.0040678f
lea eax, [esp + 0x68]
push eax
call fcn.00404b10
add esp, 0x14
call fcn.00406739
cdq
mov ecx, 0x7d0
idiv ecx
add edx, 0x1f4
push edx
call fcn.00406739
cdq
mov ecx, 0x30d40
idiv ecx
push edx
lea edx, [esp + 0x60]
push str.__10d_bytes_in__d_directories._n
push edx
call fcn.0040678f
lea eax, [esp + 0x68]
push eax
call fcn.00404b10
add esp, 0x14
call fcn.00406739
cdq
mov ecx, 0x4e20
idiv ecx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add edx, 0x3e8
push edx
mov edx, dword [esp + 0x28]
sub edx, eax
mov eax, dword [esp + 0x2c]
sbb eax, ecx
lea ecx, [esp + 0x5c]
push eax
push edx
push str.__10I64d_bytes_in__d_user_files._n
push ecx
call fcn.0040678f
lea edx, [esp + 0x6c]
push edx
call fcn.00404b10
add esp, 0x18
lea eax, [esp + 0x58]
push 0x10000
push str.__10d_bytes_in_extended_attributes._n
push eax
call fcn.0040678f
lea ecx, [esp + 0x64]
push ecx
call fcn.00404b10
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x58]
push edx
push eax
push str.__10I64d_bytes_available_on_disk._n_n
push ecx
call fcn.0040678f
lea edx, [esp + 0x68]
push edx
call fcn.00404b10
add esp, 0x14
push 0x41c2
lea eax, [esp + 0x5c]
push str.__10d_bytes_in_each_allocation_unit._n
push eax
call fcn.0040678f
lea ecx, [esp + 0x64]
push ecx
call fcn.00404b10
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
add esp, 0x10
push 0
push 0x41c2
push edx
push eax
call fcn.00406d50
push edx
push eax
lea ecx, [esp + 0x60]
push str.__10I64d_total_allocation_units_on_disk._n
push ecx
call fcn.0040678f
lea edx, [esp + 0x68]
push edx
call fcn.00404b10
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
add esp, 0x14
push 0
push 0x41c2
push eax
push ecx
call fcn.00406d50
push edx
push eax
lea edx, [esp + 0x60]
push str.__10I64d_allocation_units_available_on_disk._n
push edx
call fcn.0040678f
lea eax, [esp + 0x68]
push eax
call fcn.00404b10
add esp, 0x14
push 0xbb8
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
je 0x405720
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x15b0
ret
mov dword [esp + 0x14], 0
push 0x42ac20
call fcn.00404b10
add esp, 4
mov dword [esp + 0x10], 0
mov eax, dword [0x42ba84]
lea ecx, [esp + 0x20]
push 0
push ecx
lea edx, [esp + 0x5c8]
push 0x1000
push edx
push eax
call ebx
push 0
push 0
call fcn.00406739
and eax, 0x8000000f
jns 0x40576e
dec eax
or eax, 0xfffffff0
inc eax
mov ecx, dword [0x42ba84]
shl eax, 0xc
push eax
push ecx
call ebp
push 0
push 0xfffffffffffffff6
call esi
push eax
call edi
cmp eax, 0x102
jne 0x404d67
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xfa
mov dword [esp + 0x10], eax
jl 0x40573d
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 2
mov dword [esp + 0x14], eax
jl 0x405728
push 0x3a98
push 0xfffffffffffffff6
call esi
push eax
call edi
pop edi
cmp eax, 0x102
pop esi
pop ebp
setne al
pop ebx
add esp, 0x15b0
ret