Function at 0x402db1
Capabilities:
Create process on windows
Get disk information

Disassembly:
sub esp, 0x350
mov eax, dword [0x40f644]
xor eax, dword [esp + 0x350]
push ebx
push ebp
mov ebp, dword [esp + 0x35c]
push edi
mov dword [esp + 0x358], eax
mov dword [0x418a10], ebp
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x1d
push 0x4189e0
push 0x3fd
push dword [0x418a10]
call edi
push 0x7f00
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
mov dword [0x4188a4], eax
call dword [sym.imp.USER32.dll_SetCursor]
push ebx
call fcn.0040166d
test eax, eax
pop ecx
je 0x403382
push ebx
call fcn.004022e2
test eax, eax
pop ecx
je 0x403382
call fcn.004021a8
test eax, eax
je 0x402e44
push 0x10
push 0x421
jmp 0x402e54
cmp dword [esp + 0x364], ebx
je 0x402e62
push 0x10
push 0x401
push ebx
call fcn.00401993
add esp, 0xc
jmp 0x403382
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push ebx
push str.WinZip2WClass
call esi
test eax, eax
jne 0x402e81
push ebx
push str.WinZipWClass
call esi
test eax, eax
je 0x402ea0
push 0x40b307
push 0x15
push 0x401
push ebx
call fcn.00401993
add esp, 0x10
cmp eax, 2
jne 0x402e69
jmp 0x403381
push 0x12b
lea eax, [esp + 0x24]
push eax
push 0x3fe
push dword [0x418a10]
call edi
jmp 0x402ed7
push 0x40b307
push 0x15
push 0x402
push ebx
call fcn.00401993
add esp, 0x10
cmp eax, 2
je 0x403381
lea eax, [esp + 0x20]
push eax
push ebx
call esi
test eax, eax
jne 0x402eb9
push str.WinZip_Quick_Pick_Active
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
je 0x402f0b
call fcn.00401765
cmp eax, ebx
je 0x402f0b
push ebx
push 3
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.0040556c
cmp eax, 0xffffffff
jne 0x402f1c
push 0x40
jmp 0x4032c5
call fcn.00401428
test eax, eax
je 0x403381
mov esi, dword [esp + 0x36c]
mov byte [0x418a20], bl
jmp 0x402f3d
cmp al, 0x20
jne 0x402f43
inc esi
mov al, byte [esi]
cmp al, bl
jne 0x402f38
cmp byte [esi], bl
je 0x402f86
push 6
push esi
push str._argv0
call fcn.00406e98
add esp, 0xc
test eax, eax
jne 0x402f86
add esi, 6
mov al, byte [esi]
cmp al, bl
je 0x402f86
cmp al, 0x20
jne 0x402f6f
inc esi
mov al, byte [esi]
cmp al, bl
jne 0x402f64
cmp byte [esi], bl
je 0x402f86
push 0x103
push esi
push 0x418a20
call fcn.00406120
add esp, 0xc
push 0x104
mov esi, 0x418b40
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40fe30
push ebx
push esi
call fcn.00401398
mov eax, dword [0x40fe44]
mov dword [0x40fe28], eax
mov eax, dword [0x40fe48]
push esi
mov dword [0x40fe2c], eax
call fcn.00405b92
add esp, 0x10
cmp eax, ebx
je 0x402fc8
mov byte [eax + 1], bl
mov ebp, str.C:WinZip
push ebp
call section..text
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x402fe5
push 0x40b8a0
push ebp
call esi
push ebp
call fcn.004015ec
test eax, eax
jne 0x402ff7
push 0x40b89c
push ebp
call esi
mov esi, 0x12c
push esi
lea eax, [esp + 0x24]
push eax
push 0x40b307
push 0x40b898
push str.extensions
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
lea eax, [esp + 0x20]
push esi
push eax
call fcn.004017e9
cmp byte [esp + 0x28], bl
pop ecx
pop ecx
je 0x403096
lea eax, [esp + 0x20]
push 0x20
push eax
call fcn.00405bd3
cmp eax, ebx
pop ecx
pop ecx
je 0x40303e
mov byte [eax], bl
lea eax, [esp + 0x20]
push eax
call fcn.00405b92
mov edi, eax
cmp edi, ebx
pop ecx
je 0x403096
lea eax, [edi + 1]
push str.winzip
push eax
mov byte [eax + 7], bl
mov byte [eax + 6], bl
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403096
lea eax, [esp + 0x20]
push eax
mov byte [edi], bl
call fcn.004015ec
test eax, eax
je 0x40308f
cmp byte [esp + 0x20], 0x22
lea eax, [esp + 0x21]
je 0x403087
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
call fcn.00401d4f
pop ecx
mov ebp, dword [esp + 0x364]
push ebp
call fcn.00405ae1
mov al, byte [0x418b40]
mov byte [esp + 0x10], al
mov eax, 0x105
push eax
lea ecx, [esp + 0x258]
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x24]
push ecx
push eax
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x31], 0x3a
mov byte [esp + 0x32], 0x5c
mov byte [esp + 0x33], bl
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x403133
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x14c]
dec ecx
cmp byte [eax + ecx], 0x52
jne 0x403133
push str.winzip
lea eax, [esp + 0x150]
push eax
mov byte [esp + 0x15a], bl
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403133
mov dword [0x418a08], 1
push ebx
push 0x402ae1
push ebx
push 0x64
pop edi
push edi
push ebp
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ecx, 0x3ee
cmp eax, ecx
jne 0x403159
push 0x2040
push ecx
jmp 0x4032ca
cmp eax, ebx
je 0x403381
push ebx
push 0x401a14
push ebx
push esi
push ebp
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x418a0c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x7f02
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
mov dword [0x4188a4], eax
call dword [sym.imp.USER32.dll_SetCursor]
push dword [0x418a0c]
mov dword [0x418a00], eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push edi
push dword [0x418a0c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push ebx
push ebx
push 0x402
push edi
push dword [0x418a0c]
mov dword [0x418c44], eax
call esi
mov eax, dword [0x40ff7c]
push ebx
push 0xa
pop ecx
xor edx, edx
div ecx
push eax
push 0x400
push edi
push dword [0x418a0c]
call esi
push dword [0x418a0c]
call fcn.00401565
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, eax
cmp edi, ebx
pop ecx
je 0x40324a
push 0x4188c0
lea eax, [esp + 0x24]
push str._swinzip32.ex_
push eax
call ebp
push 0x40fce0
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.00401398
mov eax, dword [0x40fcf4]
add esp, 0x18
push 1
push dword [0x418a0c]
mov dword [0x40fe20], eax
mov eax, dword [0x40fcf8]
mov dword [0x40fe24], eax
call fcn.0040242a
mov edi, eax
mov eax, dword [0x418a00]
push eax
mov dword [0x4188a4], eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [0x40ff7c]
push ebx
push 0xa
pop ecx
xor edx, edx
div ecx
push eax
push 0x402
push 0x64
push dword [0x418a0c]
call esi
cmp edi, ebx
mov esi, 0x40e164
je 0x40329d
push esi
push 0x4188c0
push dword [0x418a0c]
call fcn.004056da
add esp, 0xc
test eax, eax
je 0x402f15
push ebx
push dword [0x418a0c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x418a0c]
mov dword [0x418c44], ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp edi, ebx
jne 0x4032d8
push 0x2040
push 0x3ee
push ebx
call fcn.00401993
add esp, 0xc
jmp 0x403381
cmp dword [0x418a08], ebx
mov eax, 0x40b884
jne 0x4032ea
mov eax, 0x40b880
push 0x418a20
push eax
push esi
push 0x4188c0
lea eax, [esp + 0x30]
push str.__s_s___install_s__f:__s_
push eax
call ebp
push 0x4187a0
call fcn.004066d9
add esp, 0x1c
call fcn.00401165
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
push 5
lea eax, [esp + 0x24]
push eax
call edi
cmp eax, 0x20
jae 0x403381
cmp dword [0x418a08], ebx
mov eax, 0x40b884
jne 0x40333a
mov eax, 0x40b880
push 0x418a20
push eax
push esi
lea eax, [esp + 0x2c]
push str._s__install_s__f:__s_
push eax
call ebp
add esp, 0x14
push 5
lea eax, [esp + 0x24]
push eax
call edi
cmp eax, 0x20
jae 0x403381
push esi
push 0x4188c0
lea eax, [esp + 0x28]
push str.Error_running__s_s
push eax
call ebp
add esp, 0x10
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov ecx, dword [esp + 0x358]
xor ecx, dword [esp + 0x35c]
pop edi
pop ebp
xor eax, eax
pop ebx
call fcn.00405dc3
add esp, 0x350
ret 0x10