Function at 0x4135de
Capabilities:
Get disk information
Log keystrokes via polling
Parse credit card information

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x110
mov eax, dword [ebp + 0x78]
and eax, 0x10000
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x78]
and eax, 0x20000
push ebx
push esi
mov dword [ebp + 0x20], ecx
xor ecx, ecx
mov dword [ebp - 0x54], eax
movzx eax, byte [ebp + 0x78]
push edi
xor edi, edi
cmp eax, edi
sete cl
xor ebx, ebx
cmp eax, 1
sete bl
mov dword [ebp + 8], edi
mov dword [ebp - 0x14], ecx
xor ecx, ecx
cmp eax, 2
sete cl
cmp dword [ebp - 0x14], edi
mov dword [ebp + 0x14], ebx
mov dword [ebp], ecx
jne 0x41363b
cmp ebx, edi
mov byte [ebp + 0x42], 0
je 0x41363f
mov byte [ebp + 0x42], 1
mov esi, dword [ebp + 0x74]
push 1
lea eax, [ebp + 0x74]
push eax
add esi, 0xfffffffe
push 0x4833f8
mov dword [ebp + 0x2c], edi
mov dword [ebp - 0x30], esi
mov dword [ebp + 0x18], esi
call fcn.0042df66
add esp, 0xc
cmp dword [ebp - 0x14], edi
movzx eax, al
push 0x24
mov dword [ebp - 0x40], eax
mov dword [ebp + 4], 0x100001
mov dword [ebp + 0x10], 0x100002
mov dword [ebp + 0x24], 0x100003
pop edx
je 0x41368d
mov dword [ebp + 0x24], 0x7c
jmp 0x4136ab
cmp ebx, edi
je 0x41369d
mov dword [ebp + 4], 0x7c
mov dword [ebp + 0x24], edx
jmp 0x4136ae
cmp dword [ebp], edi
je 0x4136b5
push 0x7c
pop eax
mov dword [ebp + 0x24], eax
mov dword [ebp + 8], eax
mov dword [ebp + 4], edx
mov dword [ebp + 0x10], 0x23
mov eax, dword [ebp + 0x74]
mov cx, word [eax]
cmp cx, dx
mov byte [ebp + 0x43], 0
je 0x4136d0
cmp cx, 0x23
je 0x4136d0
cmp cx, 0x7c
jne 0x4136de
movzx ecx, cx
inc eax
inc eax
mov dword [ebp + 8], ecx
mov byte [ebp + 0x43], cl
mov dword [ebp + 0x74], eax
mov dword [ebp + 0x5c], eax
mov ax, word [eax]
cmp ax, 0x5b
sete byte [ebp + 0x4b]
cmp byte [ebp + 0x4b], 0
je 0x413734
push 2
mov word [esi], ax
lea edx, [esi + 2]
pop esi
add dword [ebp + 0x5c], esi
xor ecx, ecx
jmp 0x413726
mov eax, ecx
call fcn.00426fde
test al, al
je 0x413712
add dword [ebp + 0x5c], esi
jmp 0x413729
cmp cx, 0x5b
je 0x41371e
cmp cx, 0x28
jne 0x413734
mov word [edx], cx
add edx, esi
add dword [ebp + 0x5c], esi
mov dword [ebp + 0x18], edx
mov eax, dword [ebp + 0x5c]
mov cx, word [eax]
cmp cx, di
jne 0x413702
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x74], eax
push 1
lea eax, [ebp + 0x74]
push eax
push 0x4833f8
call fcn.0042df66
mov edx, dword [ebp + 0x74]
movzx eax, al
add esp, 0xc
cmp byte [ebp + 0x4b], 0
mov esi, edx
mov dword [ebp - 0x34], eax
mov dword [ebp + 0x50], edi
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x60], edi
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x3c], esi
mov dword [ebp + 0x34], edi
mov dword [ebp + 0x44], edi
mov dword [ebp + 0x38], edi
mov dword [ebp + 0x1c], edi
mov byte [ebp + 0x7b], 0
je 0x41392c
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x30], eax
mov ax, word [edx]
xor bl, bl
cmp ax, 0x22
mov dword [ebp + 0x5c], edx
mov dword [ebp + 0x28], edx
mov byte [ebp + 0x6b], 0
jne 0x4137cf
xor eax, eax
mov ax, word [edx + 2]
push eax
call fcn.0040ee76
add esp, 4
test al, al
jne 0x4137b2
mov dword [ebp + 0x30], edi
push 1
lea eax, [ebp + 0x28]
push edi
push eax
call fcn.00413513
mov edx, dword [ebp + 0x74]
add esp, 0xc
mov byte [ebp + 0x6b], 1
mov bl, 1
mov dword [ebp + 0x5c], eax
jmp 0x4137e7
cmp ax, di
je 0x4137ea
push eax
call fcn.0040ee76
add esp, 4
test al, al
jne 0x4137e4
mov dword [ebp + 0x30], edi
lea eax, [edx + 2]
mov dword [ebp + 0x3c], eax
lea ecx, [ebp + 0x3c]
call fcn.00409e64
mov esi, dword [ebp + 0x3c]
xor ecx, ecx
jmp 0x41388b
mov eax, ecx
call fcn.00426fde
test al, al
je 0x413821
cmp bl, 1
jg 0x413897
lea ecx, [ebp + 0x3c]
inc bl
call fcn.00409e64
mov esi, dword [ebp + 0x3c]
dec esi
dec esi
jmp 0x413886
cmp cx, 0x3e
je 0x4138e6
cmp cx, 0x3c
je 0x4138e6
cmp cx, 0x3d
je 0x4138e6
cmp cx, 0x21
je 0x4138e6
cmp dword [ebp + 0x30], edi
je 0x413882
cmp dword [ebp + 0x14], 0
je 0x413880
cmp cx, 0x26
je 0x413866
cmp cx, 0x7c
je 0x413866
cmp cx, 0x40
jne 0x413880
mov ax, word [esi + 2]
call fcn.00426fde
test al, al
je 0x413880
mov ax, word [esi - 2]
call fcn.00426fde
test al, al
jne 0x4138c8
xor edi, edi
test bl, bl
jg 0x413897
inc esi
inc esi
mov dword [ebp + 0x3c], esi
mov cx, word [esi]
cmp cx, di
jne 0x4137fc
cmp byte [ebp + 0x6b], 0
jne 0x41391b
push 1
lea eax, [ebp + 0x28]
push edi
push eax
call fcn.00413513
add esp, 0xc
cmp byte [ebp + 0x7b], 0
mov dword [ebp + 0x5c], eax
je 0x413918
sub eax, esi
sar eax, 1
push eax
push esi
lea ecx, [ebp + 0x1c]
call fcn.0042c51d
jmp 0x413964
lea eax, [esi + 2]
mov cx, word [eax]
xor edi, edi
cmp cx, word [esi]
jne 0x4138e0
mov word [esi], di
mov esi, eax
mov byte [ebp + 0x7b], 5
jmp 0x4138ea
mov byte [ebp + 0x7b], 3
jmp 0x4138ea
mov byte [ebp + 0x7b], 1
cmp byte [ebp + 0x7b], 1
lea ecx, [esi + 2]
mov dword [ebp + 0x28], ecx
jne 0x41389d
mov ax, word [ecx]
cmp ax, 0x3e
je 0x413911
cmp ax, 0x3c
je 0x413911
cmp ax, 0x3d
je 0x413911
cmp ax, 0x21
jne 0x41389d
inc ecx
inc ecx
mov dword [ebp + 0x28], ecx
jmp 0x41389d
mov edx, dword [ebp + 0x74]
mov eax, dword [ebp + 0x5c]
cmp word [eax], di
je 0x413970
add dword [ebp + 0x5c], 2
mov word [eax], di
jmp 0x41396d
xor eax, eax
mov ax, word [edx]
jmp 0x413950
cmp ax, 0x3e
je 0x413957
cmp ax, 0x3c
je 0x413957
cmp ax, 0x3d
je 0x413957
cmp ax, 0x21
je 0x413957
inc esi
inc esi
mov ax, word [esi]
cmp ax, di
jne 0x413933
jmp 0x413970
push esi
lea ecx, [ebp + 0x1c]
mov byte [ebp + 0x7b], 1
call fcn.004362a2
mov eax, dword [ebp + 0x1c]
mov word [esi], di
mov dword [ebp + 0x34], eax
mov edx, dword [ebp + 0x74]
mov ebx, dword [ebp + 0x20]
cmp byte [ebx + 0x8a], 0
jne 0x413a0b
cmp byte [ebx + 0xb], 0
jne 0x413a0b
push 1
push edi
lea eax, [ebp + 0x44]
push eax
push edx
mov ecx, ebx
call fcn.0043d4de
mov eax, dword [ebp + 0x44]
push edi
push edi
lea ecx, [ebp + 0x44]
push ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x38], eax
mov dword [ebp + 0x44], edi
call fcn.0043c12f
mov esi, dword [ebp + 0x34]
cmp esi, edi
je 0x413a01
push 1
push edi
lea eax, [ebp + 0x38]
push eax
push esi
mov ecx, ebx
call fcn.0043d4de
mov eax, dword [ebp + 0x38]
push edi
push edi
lea ecx, [ebp + 0x38]
push ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp + 0x38], edi
call fcn.0043c12f
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 0x38]
lea ecx, [ebp + 0x44]
mov esi, eax
call fcn.0042c465
mov eax, dword [ebp + 0x44]
lea ecx, [ebp - 0x3c]
lea esi, [eax + esi*2]
call fcn.0042704a
lea ecx, [ebp - 0x38]
call fcn.0042704a
jmp 0x413a4c
push 1
push edi
lea eax, [ebp + 0x44]
push eax
push edx
mov ecx, ebx
call fcn.0043d4de
mov esi, dword [ebp + 0x34]
cmp esi, edi
je 0x413a4c
push 1
push edi
lea eax, [ebp + 0x38]
push eax
push esi
mov ecx, ebx
call fcn.0043d4de
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 0x38]
lea ecx, [ebp + 0x44]
mov esi, eax
call fcn.0042c465
mov eax, dword [ebp + 0x44]
lea esi, [eax + esi*2]
mov eax, dword [ebp + 0x44]
push eax
mov dword [ebp + 0x74], eax
call fcn.0040b1aa
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
pop ecx
push dword [ebp + 0x74]
call ebx
cmp esi, edi
mov edx, dword [ebp + 0x74]
lea eax, [edx + eax*2]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp + 0x3c], esi
jne 0x413a83
push edx
call ebx
mov edx, dword [ebp + 0x74]
lea esi, [edx + eax*2]
mov dword [ebp + 0x3c], esi
cmp esi, edi
mov eax, dword [ebp + 8]
mov ecx, edx
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x30], edi
je 0x413aa9
mov ax, word [edx]
jmp 0x413aa0
cmp ecx, esi
jae 0x413aa9
inc ecx
inc ecx
mov ax, word [ecx]
call fcn.00426fde
test al, al
je 0x413a97
sub ecx, edx
sar ecx, 1
cmp byte [ebp + 0x7b], 0
mov dword [ebp + 0x28], ecx
jne 0x413ac9
cmp dword [ebp], edi
jne 0x413ac9
cmp dword [ebp + 0x14], edi
je 0x413f1b
jmp 0x414219
cmp byte [ebp + 0x7b], 1
mov dword [ebp + 0x4c], esi
jne 0x413aed
lea eax, [esi + 2]
mov cx, word [eax]
cmp cx, 0x3d
je 0x413aea
cmp word [esi], 0x3c
jne 0x413af3
cmp cx, 0x3e
jne 0x413af3
mov dword [ebp + 0x4c], eax
cmp byte [ebp + 0x7b], 0
je 0x413af7
add dword [ebp + 0x4c], 2
lea ecx, [ebp + 0x4c]
call fcn.00409e64
cmp byte [ebp + 0x42], 0
je 0x413bb0
mov eax, dword [ebp + 0x4c]
cmp word [eax], 0x3f
jne 0x413bb0
add dword [ebp + 0x4c], 2
lea ecx, [ebp + 0x7c]
mov byte [ebp + 0x5b], 1
call fcn.00409e64
mov ebx, dword [ebp + 4]
cmp dword [ebp + 8], ebx
je 0x413b4a
movzx eax, word [edx]
cmp ebx, eax
je 0x413b3f
cmp dword [ebp + 0x10], eax
je 0x413b3f
cmp dword [ebp + 0x24], eax
jne 0x413b4a
inc edx
inc edx
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x74], edx
cmp dword [ebp], edi
je 0x413b80
cmp byte [ebp + 0x43], 0
jne 0x413b80
mov eax, dword [ebp + 0x34]
cmp eax, dword [ebp + 0x24]
je 0x413b80
lea ecx, [ebp + 0x74]
call fcn.00409e64
mov edx, dword [ebp + 0x74]
mov ax, word [edx]
cmp ax, 0x30
jb 0x413b77
cmp ax, 0x39
jbe 0x413b80
cmp ax, 0x2e
je 0x413b80
mov dword [ebp + 0x34], edi
cmp dword [ebp - 0x14], edi
jne 0x413b92
cmp dword [ebp + 0x30], edi
jne 0x413b92
cmp word [edx], 0x27
mov eax, ebx
je 0x413b95
mov eax, dword [ebp + 0x34]
cmp ebx, eax
jne 0x413c47
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x78], edx
call fcn.00409e64
mov edi, dword [ebp + 0x78]
lea ecx, [esi - 2]
jmp 0x413bc7
mov byte [ebp + 0x5b], 0
jmp 0x413b26
mov ax, word [ecx]
call fcn.00426fde
test al, al
je 0x413bcb
dec ecx
dec ecx
cmp ecx, edi
jae 0x413bb9
mov eax, dword [ebp + 0x4c]
sub ecx, edi
inc ecx
inc ecx
sar ecx, 1
mov esi, ecx
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x78], eax
call fcn.00409e64
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x78]
add ecx, 0xfffffffe
jmp 0x413bfa
mov ax, word [ecx]
call fcn.00426fde
test al, al
je 0x413bfe
dec ecx
dec ecx
cmp ecx, edx
jae 0x413bec
sub ecx, edx
inc ecx
inc ecx
sar ecx, 1
mov ebx, ecx
cmp esi, ebx
mov eax, esi
jle 0x413c0e
mov eax, ebx
test eax, eax
jle 0x413c2d
cmp dword [ebp - 0x44], 0
push eax
push edx
push edi
je 0x413c23
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
jmp 0x413c29
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x413c31
sub esi, ebx
mov eax, esi
cdq
xor ecx, ecx
mov esi, eax
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x54], edx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], ecx
jmp 0x414048
cmp dword [ebp + 0x24], eax
jne 0x413cf6
fldz
lea eax, [ebp - 8]
fstp qword [ebp - 8]
push eax
lea eax, [ebp + 0x74]
fldz
push eax
fstp qword [ebp - 0x10]
call fcn.004308e7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.004308e7
fld qword [ebp - 8]
add esp, 0x10
call fcn.0046d480
fld qword [ebp - 0x10]
mov esi, eax
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x54], edx
call fcn.0046d480
cmp byte [ebp + 0x7b], 1
mov ecx, eax
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], edx
jg 0x414048
fild qword [ebp + 0x50]
fld qword [ebp - 8]
fucompp
fnstsw ax
test ah, 0x44
jp 0x413cc3
fild qword [ebp + 0x60]
fld qword [ebp - 0x10]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x414048
fld qword [ebp - 8]
fcomp qword [ebp - 0x10]
fnstsw ax
test ah, 0x41
jne 0x413cd8
xor eax, eax
inc eax
jmp 0x413c31
fld qword [ebp - 0x10]
fld qword [ebp - 8]
fucompp
fnstsw ax
test ah, 0x44
jp 0x413cee
xor eax, eax
jmp 0x413c31
or eax, 0xffffffff
jmp 0x413c31
cmp dword [ebp + 0x10], eax
jne 0x413d1d
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x74]
push eax
call fcn.0043066d
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.0043066d
add esp, 0x10
jmp 0x414042
cmp dword [ebp + 0x28], 3
jl 0x414210
lea ecx, [ebp + 0x4c]
mov byte [ebp + 0x6b], 0
call fcn.00409e64
mov eax, dword [ebp + 0x4c]
cmp word [eax], 0x23
jne 0x413d45
inc eax
inc eax
mov dword [ebp + 0x4c], eax
mov byte [ebp + 0x6b], 1
mov bl, byte [ebp + 0x14]
fldz
mov dword [ebp + 0xc], eax
fstp qword [ebp - 0x1c]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0xc]
push eax
mov byte [ebp + 0x7b], 0
call fcn.004308e7
mov dword [ebp + 0x30], eax
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0043066d
mov eax, dword [ebp + 0xc]
add esp, 0x10
cmp word [eax], 0x2e
jne 0x413d91
fld qword [ebp - 0x1c]
call fcn.0046d480
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
mov edi, dword [ebp + 0x28]
cmp edi, 3
jl 0x413ed2
cmp edi, 5
jg 0x413ed2
mov esi, dword [ebp - 4]
push 3
push 0x4833f0
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x413ed5
cmp edi, 3
je 0x413df8
mov ax, word [esi + 6]
xor ecx, ecx
mov cx, word [esi + 8]
mov edx, 0xffdf
and eax, edx
and ecx, edx
cmp edi, 4
jne 0x413dfe
cmp ax, 0x41
jne 0x413de6
xor bl, bl
jmp 0x413df8
cmp ax, 0x42
je 0x413e27
cmp ax, 0x55
jne 0x413eeb
mov bl, 1
mov byte [ebp + 0x7b], 1
jmp 0x413e27
cmp edi, 5
jne 0x413ed5
cmp ax, 0x42
jne 0x413eeb
cmp cx, 0x55
jne 0x413e1b
mov bl, 1
jmp 0x413e27
cmp cx, 0x41
jne 0x413eeb
xor bl, bl
movsx eax, bl
push eax
call fcn.0040f145
cmp byte [ebp + 0x7b], 0
mov esi, eax
mov eax, edx
pop ecx
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x54], eax
mov ecx, esi
je 0x413e53
add ecx, 0xfffff
adc eax, 0
shrd ecx, eax, 0x14
shr eax, 0x14
cmp byte [ebp + 0x5b], 0
jne 0x4143a2
xor edi, edi
cmp dword [ebp + 0x30], edi
jle 0x41440d
cmp byte [ebp + 0x7b], 0
je 0x414045
mov dword [ebp - 0x28], eax
and dword [ebp - 0x28], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
fild qword [ebp - 0x5c]
mov dword [ebp - 0x2c], edi
fild qword [ebp - 0x2c]
fchs
faddp st(1)
fcom qword [ebp - 0x1c]
fnstsw ax
test ah, 0x41
jne 0x413ea5
xor eax, eax
fstp st(0)
inc eax
jmp 0x413ebc
fld qword [ebp - 0x1c]
fld st(1)
fucompp
fnstsw ax
fstp st(0)
test ah, 0x44
jp 0x413eb9
xor eax, eax
jmp 0x413ebc
or eax, 0xffffffff
cdq
mov esi, eax
xor ecx, ecx
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x54], edx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], edi
jmp 0x414048
mov esi, dword [ebp - 4]
cmp edi, 3
jne 0x413eeb
push edi
push 0x4833e8
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x413f46
mov edx, dword [ebp + 0x74]
cmp word [edx], 0x3a
jne 0x41405f
mov ax, word [edx + 2]
cmp ax, 0x65
jne 0x413f0d
add edx, 4
mov dword [ebp + 0x74], edx
jmp 0x414219
cmp ax, 0x70
jne 0x413f36
add edx, 4
mov dword [ebp + 0x74], edx
xor edi, edi
push edi
push edi
push edi
push edi
push edx
call fcn.004117bf
xor ecx, ecx
add esp, 0x14
test eax, eax
setg cl
mov esi, ecx
jmp 0x4142e4
cmp ax, 0x6b
jne 0x41405f
add edx, 4
mov dword [ebp + 0x74], edx
mov edx, dword [ebp + 0x4c]
xor eax, eax
mov ax, word [edx]
push eax
call fcn.0040ee76
add esp, 4
test al, al
je 0x413f7c
xor ecx, ecx
mov cx, word [edx + 2]
push ecx
call fcn.0040ee76
add esp, 4
test al, al
jne 0x413f78
or cx, 0x20
cmp cx, 0x78
jne 0x413f7c
mov byte [ebp + 0x6b], 2
xor esi, esi
cmp byte [ebp + 0x6b], 0
jne 0x413f94
push esi
push edx
call fcn.004115a4
cdq
pop ecx
pop ecx
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
cmp dword [ebp + 0x64], esi
jl 0x41440d
jg 0x413fa8
cmp dword [ebp + 0x60], esi
jbe 0x41440d
cmp dword [ebp + 0x64], esi
jl 0x413fca
jg 0x413fb5
cmp dword [ebp + 0x60], 0x61
jb 0x413fca
cmp dword [ebp + 0x64], esi
jg 0x413fca
jl 0x413fc2
cmp dword [ebp + 0x60], 0x7a
ja 0x413fca
add dword [ebp + 0x60], 0xffffffe0
adc dword [ebp + 0x64], 0xffffffff
push dword [ebp + 0x60]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov cx, ax
and cx, 0x8000
neg cx
mov word [ebp - 0xa2], si
sbb ecx, ecx
and ecx, dword [ebp + 0x60]
cmp ecx, 0x41
mov eax, ecx
cdq
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], edx
mov word [ebp - 0xa4], cx
jl 0x414004
cmp ecx, 0x5a
jle 0x414024
cmp ecx, 0x30
jl 0x41400e
cmp ecx, 0x39
jle 0x414024
push ecx
lea eax, [ebp - 0xa4]
push str.0x_lX
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp byte [ebp + 0x5b], 0
mov ecx, dword [ebp + 0x20]
lea eax, [ebp - 0xa4]
push eax
jne 0x4143b6
push str.PressKey
call fcn.0042af0d
mov esi, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x60]
mov edi, dword [ebp + 0x3c]
mov dx, word [edi]
test dx, dx
jne 0x41410a
or esi, dword [ebp + 0x54]
jmp 0x414169
mov ax, word [esi]
mov word [ebp - 0x50], ax
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x4e], 0x3a
mov word [ebp - 0x4c], 0x5c
mov word [ebp - 0x4a], bx
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
movsx eax, byte [ebp + 0x14]
push ebx
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0040b206
add esp, 0xc
cmp byte [ebp + 0x5b], bl
jne 0x4143c0
cmp dword [ebp + 0x30], ebx
jle 0x4143c7
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [ebp - 0x20], edx
and dword [ebp - 0x20], 0x80000000
and edx, 0x7fffffff
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x24], ebx
fild qword [ebp - 0x64]
fild qword [ebp - 0x24]
fchs
faddp st(1)
fcom qword [ebp - 0x1c]
fnstsw ax
test ah, 0x41
jne 0x4140dd
xor eax, eax
fstp st(0)
inc eax
jmp 0x4140f4
fld qword [ebp - 0x1c]
fld st(1)
fucompp
fnstsw ax
fstp st(0)
test ah, 0x44
jp 0x4140f1
xor eax, eax
jmp 0x4140f4
or eax, 0xffffffff
cdq
mov esi, eax
xor ecx, ecx
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x54], edx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x64], ebx
jmp 0x414048
push 0x3d
pop ebx
cmp dx, bx
jne 0x41412b
cmp esi, ecx
jne 0x4141d5
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x54], eax
jne 0x4141d5
jmp 0x4141e7
cmp dx, 0x3e
jne 0x414137
cmp word [edi + 2], bx
je 0x414189
cmp dx, 0x3c
jne 0x41414c
mov ax, word [edi + 2]
cmp ax, bx
je 0x414173
cmp ax, 0x3e
je 0x41415b
cmp dx, 0x21
jne 0x414199
mov ax, word [edi + 2]
cmp ax, bx
jne 0x41416d
cmp esi, ecx
jne 0x4141e7
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x54], eax
je 0x4141d5
jmp 0x4141e7
cmp ax, 0x3e
jne 0x414183
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x54], eax
jg 0x4141d5
jl 0x4141e7
cmp esi, ecx
ja 0x4141d5
jmp 0x4141e7
cmp ax, 0x3c
jne 0x414199
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x54], eax
jl 0x4141d5
jg 0x4141e7
cmp esi, ecx
jb 0x4141d5
jmp 0x4141e7
cmp dx, 0x3e
jne 0x4141af
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x54], eax
jl 0x4141d5
jg 0x4141e7
cmp esi, ecx
jbe 0x4141d5
jmp 0x4141e7
cmp dx, 0x3c
jne 0x4141c5
mov eax, dword [ebp + 0x64]
cmp dword [ebp + 0x54], eax
jg 0x4141d5
jl 0x4141e7
cmp esi, ecx
jae 0x4141d5
jmp 0x4141e7
cmp dx, 0x26
jne 0x4141dc
or esi, dword [ebp + 0x54]
je 0x4141d5
or ecx, dword [ebp + 0x64]
jne 0x4141e7
xor esi, esi
jmp 0x4142e4
cmp dx, 0x7c
jne 0x4141ef
or esi, dword [ebp + 0x54]
je 0x4141d0
xor esi, esi
inc esi
jmp 0x4142e4
cmp dx, 0x40
jne 0x41440d
xor eax, eax
or esi, dword [ebp + 0x54]
je 0x414201
inc eax
xor esi, esi
or ecx, dword [ebp + 0x64]
je 0x414209
inc esi
xor esi, eax
jmp 0x4142e4
cmp dword [ebp], edi
je 0x41440d
push edx
call fcn.0040ce49
pop ecx
push eax
mov dword [ebp + 0x74], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x74]
xor ebx, ebx
mov bx, word [ecx]
mov edi, eax
and ebx, 0xffdf
cmp bx, 0x41
jb 0x41426a
cmp bx, 0x5a
ja 0x41426a
cmp word [ecx + 2], 0x3a
jne 0x41426a
cmp word [ecx + 4], 0
jne 0x41426a
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ecx, ecx
mov cl, bl
sub cl, 0x41
mov esi, eax
shr esi, cl
and esi, 1
jmp 0x4142e4
test edi, edi
jle 0x414286
xor eax, eax
mov ax, word [ecx + edi*2 - 2]
push eax
call fcn.00409eda
add esp, 4
test al, al
je 0x414286
mov bl, 1
jmp 0x4142a6
xor bl, bl
jmp 0x4142ac
xor eax, eax
lea edx, [ecx + edi*2]
mov ax, word [edx]
push eax
call fcn.00409eda
add esp, 4
test al, al
je 0x4142a9
and word [edx], 0
mov ecx, dword [ebp + 0x74]
dec edi
jns 0x41428a
xor edi, edi
inc edi
xor esi, esi
cmp edi, esi
je 0x4142e4
cmp dword [ebp - 0x54], esi
je 0x4142d6
xor eax, eax
mov ax, word [ecx]
cmp ax, si
je 0x4142d6
cmp word [ecx + 2], 0x3a
jne 0x4142d6
push eax
call fcn.0046bfe7
test eax, eax
pop ecx
je 0x4142e4
mov ecx, dword [ebp + 0x74]
movsx eax, bl
push eax
push ecx
call fcn.0046c212
pop ecx
pop ecx
mov esi, eax
xor eax, eax
cmp dword [ebp - 0x34], eax
je 0x4142f2
test esi, esi
sete al
jmp 0x4142f7
test esi, esi
setne al
mov edx, dword [ebp + 0x18]
mov dword [ebp + 0x2c], eax
add eax, 0x30
push 2
pop edi
mov word [edx], ax
add edx, edi
cmp byte [ebp + 0x4b], 0
mov dword [ebp + 0x18], edx
je 0x4143f7
mov esi, dword [ebp + 0x5c]
mov cx, word [esi]
test cx, cx
je 0x4143cc
cmp cx, 0x5b
je 0x414368
cmp cx, 0x5d
je 0x414368
cmp cx, 0x28
je 0x414368
cmp cx, 0x29
je 0x414368
cmp cx, 0x26
je 0x414368
cmp cx, 0x7c
jne 0x414355
mov ax, word [esi + 2]
call fcn.00426fde
test al, al
jne 0x414368
cmp cx, 0x40
je 0x414368
mov eax, ecx
call fcn.00426fde
test al, al
je 0x41437d
jmp 0x414370
mov word [edx], cx
add edx, edi
mov dword [ebp + 0x18], edx
add esi, edi
mov cx, word [esi]
test cx, cx
mov dword [ebp + 0x5c], esi
jne 0x414324
cmp word [esi], 0
je 0x4143cc
lea ecx, [ebp + 0x1c]
call fcn.0042704a
lea ecx, [ebp + 0x38]
call fcn.0042704a
lea ecx, [ebp + 0x44]
call fcn.0042704a
xor edi, edi
jmp 0x413734
push dword [ebp + 0x20]
push eax
push ecx
push dword [ebp + 0x7c]
call fcn.0040cd27
add esp, 0x10
mov esi, eax
jmp 0x414412
push dword [ebp + 0x7c]
call fcn.0042af0d
jmp 0x414412
push dword [ebp + 0x20]
push edx
push eax
jmp 0x4143a7
or esi, 0xffffffff
jmp 0x414412
mov eax, dword [ebp - 0x30]
mov word [eax - 6], 0x23
mov word [eax - 4], 0x26
lea ecx, [ebp + 0x2c]
add eax, 0xfffffffe
push ecx
mov ecx, dword [ebp + 0x20]
mov word [eax], 0x3d
and word [edx], 0
push eax
call fcn.004637ad
mov dword [ebp + 0x2c], eax
cmp dword [ebp - 0x40], 0
je 0x414408
xor eax, eax
cmp dword [ebp + 0x2c], eax
sete al
mov dword [ebp + 0x2c], eax
mov esi, dword [ebp + 0x2c]
jmp 0x414412
mov esi, 0x80070057
lea ecx, [ebp + 0x1c]
call fcn.0042704a
lea ecx, [ebp + 0x38]
call fcn.0042704a
lea ecx, [ebp + 0x44]
call fcn.0042704a
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc