Function at 0x40d974
Capabilities:
Check os version
Create directory
Delete registry key
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0x40d97c
push ebx
push esi
push edi
mov esi, 0x41bb34
mov edi, 0x41bb68
mov ebx, 0x41bbab
xor eax, eax
push ebp
push 0x40ee86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x40ee9c
call fcn.0040325c
cmp byte [0x41bbac], 0x66
jne 0x40da09
mov eax, edi
mov edx, 0x40eee0
call fcn.0040325c
mov eax, dword [0x41a2d4]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, dword [0x41bce8]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00405e40
mov edx, dword [ebp - 4]
mov eax, 0x41bb40
call fcn.0040325c
cmp byte [0x41bba9], 0
jne 0x40da09
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, edi
mov edx, 0x40ef6c
call fcn.0040325c
mov ecx, dword [0x41bce8]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00406264
lea eax, [ebp - 8]
call fcn.00405b84
mov edx, dword [ebp - 8]
mov eax, 0x41bb30
call fcn.0040325c
sbb al, 0x58
invalid
dec dword [ebp - 0x57170bbb]
cmp edi, 0xf4558bff
mov eax, esi
call fcn.0040325c
mov eax, 0x41bb38
mov ecx, 0x40eff4
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [0x41bb40]
call fcn.0040338c
test eax, eax
jne 0x40da83
mov eax, 0x41bb40
mov ecx, dword [0x41bcd8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, 0x41a1e8
mov ecx, dword [0x41a1e8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, 0x41bb28
mov ecx, dword [0x41bcd0]
mov edx, dword [0x41a1e8]
call fcn.004033d8
sub eax, 0xb8ffff59
sub al, 0xbb
inc ecx
add byte [ebx + 0x41bcd40d], cl
add byte [ebx + 0x41a1e815], cl
add al, ch
pop ss
pop ecx
invalid
push dword [ebx]
shl byte [ebx + 0x41bbb0], 0xe8
mov bl, 0x24
add byte [eax], al
mov eax, edi
mov edx, 0x40f004
call fcn.0040325c
cmp byte [0x41bba9], 0
je 0x40dd44
mov eax, dword [0x41bd94]
call fcn.00405130
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.00405d60
lea eax, [ebp - 0x10]
mov ecx, dword [0x41bd50]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x10]
call fcn.00404fdc
lea eax, [ebp - 0x14]
mov ecx, dword [0x41bd54]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x14]
call fcn.00404fdc
mov eax, dword [0x41bb28]
call fcn.00404fdc
mov eax, edi
mov edx, 0x40f0d4
call fcn.0040325c
mov ecx, dword [0x41bcd8]
mov edx, dword [0x41bd38]
mov eax, 0x80000002
call fcn.00406264
mov ecx, dword [0x41bcd8]
mov edx, dword [0x41bd40]
mov eax, 0x80000002
call fcn.00406264
mov ecx, dword [0x41bcd8]
mov edx, dword [0x41bd3c]
mov eax, 0x80000001
call fcn.00406264
mov ecx, dword [0x41bcdc]
mov edx, dword [0x41bd38]
mov eax, 0x80000001
call fcn.00406264
mov ecx, dword [0x41bce0]
mov edx, dword [0x41bd3c]
mov eax, 0x80000002
call fcn.00406264
lea eax, [ebp - 0x18]
mov ecx, dword [0x41bcec]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x18]
call fcn.00404fdc
lea eax, [ebp - 0x1c]
mov ecx, dword [0x41bcf0]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x1c]
call fcn.00404fdc
lea eax, [ebp - 0x20]
mov ecx, dword [0x41bcf4]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x20]
call fcn.00404fdc
lea eax, [ebp - 0x24]
mov ecx, dword [0x41bcf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x24]
call fcn.00404fdc
lea eax, [ebp - 0x28]
mov ecx, dword [0x41bcfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x28]
call fcn.00404fdc
lea eax, [ebp - 0x2c]
mov ecx, dword [0x41bd00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x2c]
call fcn.00404fdc
lea eax, [ebp - 0x30]
mov ecx, dword [0x41bd04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x30]
call fcn.00404fdc
mov eax, dword [0x41bd48]
call fcn.0040358c
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [0x41bd14]
call fcn.0040358c
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x40f148
call fcn.00414630
mov eax, 0x40f154
call fcn.00414630
mov eax, 0x40f160
call fcn.00414630
mov eax, edi
mov edx, 0x40f16c
call fcn.0040325c
mov eax, dword [0x41bb2c]
call fcn.00404fdc
mov eax, edi
mov edx, 0x40f224
call fcn.0040325c
push 0x200040
add byte [eax], ah
add byte [eax + 0x30], ch
inc eax
add byte [eax + 0x3c], ch
inc eax
add byte [ebp - 0x604737ab], cl
add byte [eax], al
add al, ch
jmp [ebx - 1]
invalid
push dword [ebp - 0x38]
push 0x40f248
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040344c
mov eax, dword [ebp - 0x34]
call fcn.0040358c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
lea eax, [ebp - 0x3c]
mov ecx, dword [0x41bd94]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x3c]
call fcn.0040358c
push eax
push 0x40f260
push 0
mov eax, dword [0x41a2e8]
mov eax, dword [eax]
call eax
mov eax, dword [0x41bb40]
call fcn.00405034
jmp 0x40ee48
push 0
mov eax, dword [0x41a1e8]
call fcn.0040358c
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x41bba8]
cmp byte [0x41bba8], 0
je 0x40dd7e
call fcn.00405498
mov eax, edi
mov edx, 0x40f270
call fcn.0040325c
mov eax, dword [0x41a2d4]
push eax
mov ecx, dword [0x41bd24]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00405d8c
push eax
call fcn.00404b38
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x40ee48
mov eax, edi
mov edx, 0x40f2bc
call fcn.0040325c
lea edx, [ebp - 0x40]
mov eax, dword [0x41bb40]
call fcn.00404b68
mov edx, dword [ebp - 0x40]
mov eax, 0x41bb44
call fcn.0040325c
call fcn.00402720
mov eax, edi
mov edx, 0x40f304
call fcn.0040325c
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x44]
mov ecx, dword [0x41bcec]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x44]
mov cl, 1
mov eax, dword [0x41bb40]
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x48]
mov ecx, dword [0x41bcec]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x48]
call fcn.00405ce0
mov byte [ebx], al
mov eax, dword [0x41a2d4]
push eax
mov ecx, dword [0x41bccc]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00405d8c
mov dword [0x41bba0], eax
cmp dword [0x41bba0], 0x9f
jge 0x40df58
cmp byte [ebx], 0
jne 0x40dec2
lea eax, [ebp - 0x4c]
mov ecx, dword [0x41bcec]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x41bb40]
call fcn.004034d8
je 0x40dec2
mov eax, dword [0x41bcec]
call fcn.00405130
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x50]
mov ecx, dword [0x41bcec]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x41bb40]
call fcn.00404d2c
mov byte [ebx], al
mov eax, edi
mov edx, 0x40f354
call fcn.0040325c
cmp byte [ebx], 0
je 0x40df58
push 0x9f
mov ecx, dword [0x41bccc]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00406004
mov byte [ebx], al
cmp dword [0x41bba0], 0
jle 0x40df1e
lea edx, [ebp - 0x54]
mov eax, dword [0x41bba0]
call fcn.004048e0
mov ecx, dword [ebp - 0x54]
mov eax, 0x41bb3c
mov edx, 0x40f3b8
call fcn.004033d8
jmp 0x40df28
mov eax, 0x41bb3c
call fcn.00403208
push 0x40f3c8
lea edx, [ebp - 0x5c]
mov eax, 0x9f
call fcn.004048e0
push dword [ebp - 0x5c]
push dword [0x41bb3c]
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.0040344c
mov eax, dword [ebp - 0x58]
call fcn.00410138
mov eax, edi
mov edx, 0x40f3dc
call fcn.0040325c
call fcn.0040cbb8
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x60]
mov ecx, dword [0x41bcf0]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [0x41bb40]
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x64]
mov ecx, dword [0x41bcf0]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x64]
call fcn.00405ce0
mov byte [ebx], al
mov eax, edi
mov edx, 0x40f490
call fcn.0040325c
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0x68]
mov ecx, dword [0x41bcf4]
mov edx, dword [esi]
call fcn.004033d8
mov edx, dword [ebp - 0x68]
xor ecx, ecx
mov eax, dword [0x41bb40]
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x6c]
mov ecx, dword [0x41bcf4]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x6c]
call fcn.00405ce0
mov byte [ebx], al
lea eax, [ebp - 0x70]
mov ecx, dword [0x41bd04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x70]
call fcn.00404dc0
test al, al
jne 0x40e093
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x74]
mov ecx, dword [0x41bd00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
mov ecx, dword [0x41bcf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x78]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x7c]
mov ecx, dword [0x41bd04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
mov ecx, dword [0x41bcfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x80]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
lea eax, [ebp - 0x84]
mov ecx, dword [0x41bcf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x84]
call fcn.00404dc0
test al, al
jne 0x40e145
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x88]
mov ecx, dword [0x41bcf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x88]
push eax
lea eax, [ebp - 0x8c]
mov ecx, dword [0x41bd00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
push 1
push 0
push 0x7a120
lea eax, [ebp - 0x90]
mov ecx, dword [0x41bcfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x90]
push eax
lea eax, [ebp - 0x94]
mov ecx, dword [0x41bd04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x94]
xor ecx, ecx
pop edx
call fcn.00404d2c
mov byte [ebx], al
mov eax, dword [0x41bb40]
call fcn.00405ce0
mov byte [ebx], al
mov eax, edi
mov edx, 0x40f4d8
call fcn.0040325c
lea eax, [ebp - 0x98]
mov ecx, dword [0x41bcf8]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x98]
call fcn.00405ce0
mov byte [ebx], al
lea eax, [ebp - 0x9c]
mov ecx, dword [0x41bcfc]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0x9c]
call fcn.00405ce0
mov byte [ebx], al
mov eax, edi
mov edx, 0x40f588
call fcn.0040325c
lea eax, [ebp - 0xa0]
mov ecx, dword [0x41bd00]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0xa0]
call fcn.00405ce0
mov byte [ebx], al
lea eax, [ebp - 0xa4]
mov ecx, dword [0x41bd04]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0xa4]
call fcn.00405ce0
mov byte [ebx], al
mov eax, 0x40f148
call fcn.00415784
mov eax, 0x40f154
call fcn.00415784
mov eax, 0x40f160
call fcn.00415784
mov eax, edi
mov edx, 0x40f634
call fcn.0040325c
mov eax, 0x40f688
call fcn.00415784
mov eax, edi
mov edx, 0x40f694
call fcn.0040325c
push 0
push 0
push 0x41bba4
mov ecx, 0x4070c0
xor edx, edx
xor eax, eax
call fcn.004031c4
push 0
push 0
push 0x41bba4
mov ecx, 0x406b70
xor edx, edx
xor eax, eax
call fcn.004031c4
mov eax, 0x41bb3c
mov ecx, dword [0x41bcec]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [0x41bb3c]
mov edx, dword [0x41bb40]
call fcn.004034d8
je 0x40e2c7
lea eax, [ebp - 0xa8]
mov ecx, dword [0x41bcf0]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0xa8]
mov edx, dword [0x41bb40]
call fcn.004034d8
je 0x40e2c7
lea eax, [ebp - 0xac]
mov ecx, dword [0x41bcf4]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0xac]
mov edx, dword [0x41bb40]
call fcn.004034d8
jne 0x40e2d3
mov eax, 0x41bb3c
call fcn.00403208
jmp 0x40e2e8
mov eax, 0x41bb3c
mov ecx, dword [0x41bb40]
mov edx, 0x40f724
call fcn.004033d8
mov al, byte [0x41bbac]
sub al, 0x64
je 0x40e2fb
dec al
je 0x40e312
dec al
je 0x40e329
jmp 0x40e33e
mov eax, 0x41bb3c
mov ecx, dword [0x41bb3c]
mov edx, 0x40f730
call fcn.004033d8
jmp 0x40e33e
mov eax, 0x41bb3c
mov ecx, dword [0x41bb3c]
mov edx, 0x40f73c
call fcn.004033d8
jmp 0x40e33e
mov eax, 0x41bb3c
mov ecx, dword [0x41bb3c]
mov edx, 0x40f748
call fcn.004033d8
mov eax, dword [0x41bb3c]
call fcn.00410138
mov eax, 0x41bbc4
mov ecx, dword [0x41bd14]
mov edx, 0x80000002
call fcn.004060bc
test al, al
jne 0x40e389
mov eax, 0x41bbc4
mov ecx, dword [0x41bd14]
mov edx, 0x80000002
call fcn.004060bc
test al, al
jne 0x40e389
mov eax, 0x40f758
call fcn.00410138
jmp 0x40ee48
push dword [esi]
push 0x40f768
push 0x40f778
mov eax, 0x41bb58
mov edx, 3
call fcn.0040344c
mov eax, dword [0x41bb58]
call fcn.00404dc0
test al, al
jne 0x40e41f
push 1
push 0x96
push 0x7a120
lea eax, [ebp - 0xb0]
mov ecx, dword [0x41bd08]
mov edx, dword [esi]
call fcn.004033d8
mov eax, dword [ebp - 0xb0]
mov cl, 1
mov edx, dword [0x41bb58]
call fcn.00404d2c
test al, al
je 0x40e40b
lea eax, [ebp - 0xb4]
mov ecx, dword [0x41bb58]
mov edx, 0x40f788
call fcn.004033d8
mov eax, dword [ebp - 0xb4]
call fcn.00410138
jmp 0x40e41f
mov eax, 0x40f7a4
call fcn.00410138
mov eax, 0x41bb58
call fcn.00403208
mov eax, dword [0x41bb58]
call fcn.0040338c
test eax, eax
jle 0x40e613
mov eax, 0x41bb60
mov ecx, 0x40f7b4
mov edx, dword [esi]
call fcn.004033d8
mov eax, 0x41bb5c
mov edx, 0x40f7c8
call fcn.0040325c
lea eax, [ebp - 0xb8]
mov ecx, 0x40f7dc
mov edx, dword [0x41bb60]
call fcn.004033d8
mov eax, dword [ebp - 0xb8]
call fcn.00404dc0
test al, al
je 0x40e485
mov eax, 0x41bb5c
mov edx, 0x40f7ec
call fcn.00403394
lea eax, [ebp - 0xbc]
mov ecx, 0x40f7fc
mov edx, dword [0x41bb60]
call fcn.004033d8
mov eax, dword [ebp - 0xbc]
call fcn.00404dc0
test al, al
je 0x40e4b9
mov eax, 0x41bb5c
mov edx, 0x40f80c
call fcn.00403394
lea eax, [ebp - 0xc0]
mov ecx, 0x40f81c
mov edx, dword [0x41bb60]
call fcn.004033d8
mov eax, dword [ebp - 0xc0]
call fcn.00404dc0
test al, al
je 0x40e4ed
mov eax, 0x41bb5c
mov edx, 0x40f82c
call fcn.00403394
lea eax, [ebp - 0xc4]
mov ecx, 0x40f83c
mov edx, dword [0x41bb60]
call fcn.004033d8
mov eax, dword [ebp - 0xc4]
call fcn.00404dc0
test al, al
je 0x40e521
mov eax, 0x41bb5c
mov edx, 0x40f84c
call fcn.00403394
lea eax, [ebp - 0xc8]
mov ecx, 0x40f85c
mov edx, dword [0x41bb60]
call fcn.004033d8
mov eax, dword [ebp - 0xc8]
call fcn.00404dc0
test al, al
je 0x40e555
mov eax, 0x41bb5c
mov edx, 0x40f86c
call fcn.00403394
lea eax, [ebp - 0xcc]
mov ecx, 0x40f87c
mov edx, dword [0x41bb60]
call fcn.004033d8
mov eax, dword [ebp - 0xcc]
call fcn.00404dc0
test al, al
je 0x40e589
mov eax, 0x41bb5c
mov edx, 0x40f88c
call fcn.00403394
lea eax, [ebp - 0xd0]
mov ecx, 0x40f89c
mov edx, dword [0x41bb60]
call fcn.004033d8
mov eax, dword [ebp - 0xd0]
call fcn.00404dc0
test al, al
je 0x40e5bd
mov eax, 0x41bb5c
mov edx, 0x40f8ac
call fcn.00403394
mov eax, dword [0x41bb5c]
mov edx, 0x40f8bc
call fcn.004034d8
jne 0x40e5da
mov eax, 0x40f8ec
call fcn.00410138
jmp 0x40e5fb
lea eax, [ebp - 0xd4]
mov ecx, dword [0x41bb5c]
mov edx, 0x40f8fc
call fcn.004033d8
mov eax, dword [ebp - 0xd4]
call fcn.00410138
push 0
mov ecx, 0x40f910
mov edx, 0x40f920
mov eax, 0x80000001
call fcn.00406004
jmp 0x40e61d
mov eax, 0x41bb5c
call fcn.00403208
call fcn.00415720
lea eax, [ebp - 0xd8]
mov ecx, 0x40f940
mov edx, dword [0x41bb40]
call fcn.004033d8
mov eax, dword [ebp - 0xd8]
push eax
lea eax, [ebp - 0xdc]
mov ecx, dword [0x41be24]
mov edx, dword [0x41bd44]
call fcn.004033d8
mov edx, dword [ebp - 0xdc]
mov ecx, dword [0x41bb40]
mov eax, 0x80000002
call fcn.00405f14
push 0x100002
mov eax, 0x41bcc0
mov ecx, 1
mov edx, dword [0x406b50]
call fcn.00403cc8
add esp, 4
mov eax, dword [0x41a2d4]
push eax
mov ecx, dword [0x41bd20]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00405d8c
mov dword [0x41bb88], eax
mov eax, dword [0x41a2d4]
push eax
mov ecx, dword [0x41bd4c]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00405d8c
mov dword [0x41bb98], eax
cmp dword [0x41bb98], 0x64
jge 0x40e952
mov eax, dword [0x41a2d4]
push eax
push 0x400
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [0x41bd18]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00405e40
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xe0]
call fcn.00404964
mov edx, dword [ebp - 0xe0]
mov eax, 0x41bb50
call fcn.0040325c
mov eax, dword [0x41bb50]
call fcn.0040338c
test eax, eax
je 0x40e73c
mov eax, dword [0x41bb50]
mov al, byte [eax]
add al, 0x9f
sub al, 0x1a
jb 0x40e74b
mov eax, 0x41bb50
mov edx, 0x40f958
call fcn.0040325c
mov eax, dword [0x41bb50]
mov bl, byte [eax]
cmp bl, 0x63
jb 0x40e92c
lea eax, [ebp - 0xe8]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xec]
call fcn.004027dc
mov edx, 0x40f95c
lea eax, [ebp - 0xec]
mov cl, 2
call fcn.004027ac
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf0]
call fcn.004027dc
mov edx, 0x40f960
lea eax, [ebp - 0xf0]
mov cl, 3
call fcn.004027ac
lea edx, [ebp - 0xf0]
mov eax, 0x41bb3c
call fcn.00403368
mov eax, dword [0x41bb3c]
call fcn.0040358c
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x40e7e0
sub eax, 1
jne 0x40e91b
xor eax, eax
mov dword [0x41bb8c], eax
lea eax, [ebp - 0xe8]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xec]
call fcn.004027dc
mov edx, 0x40f95c
lea eax, [ebp - 0xec]
mov cl, 2
call fcn.004027ac
lea edx, [ebp - 0xec]
lea eax, [ebp - 0xf0]
call fcn.004027dc
mov edx, 0x40f960
lea eax, [ebp - 0xf0]
mov cl, 3
call fcn.004027ac
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xf4]
call fcn.00403368
mov eax, dword [ebp - 0xf4]
call fcn.004093c4
lea eax, [ebp - 0xe8]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0xec]
call fcn.004027dc
mov edx, 0x40f95c
lea eax, [ebp - 0xec]
mov cl, 2
call fcn.004027ac
lea edx, [ebp - 0xec]
lea eax, [ebp - 0x100]
call fcn.004027dc
mov edx, 0x40f964
lea eax, [ebp - 0x100]
mov cl, 5
call fcn.004027ac
lea edx, [ebp - 0x100]
lea eax, [ebp - 0xf8]
call fcn.00403368
mov eax, dword [ebp - 0xf8]
call fcn.00410138
lea eax, [ebp - 0x104]
xor edx, edx
mov dl, bl
dec edx
call fcn.00403328
mov eax, dword [ebp - 0x104]
push eax
mov ecx, dword [0x41bd18]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00405f14
push 0
mov ecx, dword [0x41bd20]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00406004
cmp bl, 0x63
jne 0x40e91b
mov eax, 0x40f970
call fcn.00410138
xor eax, eax
mov dword [0x41bb88], eax
dec ebx
cmp bl, 0x62
jne 0x40e75b
mov dword [0x41bb98], 0x64
mov eax, dword [0x41bb98]
push eax
mov ecx, dword [0x41bd4c]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00406004
mov eax, edi
mov edx, 0x40f988
call fcn.0040325c
cmp dword [0x41bb98], 0xc8
jge 0x40e9f5
cmp byte [0x41bbac], 0x66
jne 0x40e97e
mov byte [0x41a1dc], 0
xor eax, eax
mov dword [0x41bb90], eax
mov eax, edi
mov edx, 0x40fa04
call fcn.0040325c
mov eax, dword [0x41a2d4]
push eax
mov ecx, dword [0x41bd1c]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00405d8c
mov dword [0x41bb94], eax
xor eax, eax
call fcn.00409c14
mov dword [0x41bb98], 0xc8
mov eax, dword [0x41bb98]
push eax
mov ecx, dword [0x41bd4c]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00406004
mov eax, 0x40fa34
call fcn.00410138
mov eax, edi
mov edx, 0x40fa4c
call fcn.0040325c
push 0
mov eax, 0x41bcc0
mov ecx, 1
mov edx, dword [0x406b50]
call fcn.00403cc8
add esp, 4
mov eax, edi
mov edx, 0x40fad8
call fcn.0040325c
mov eax, 0x41bbc4
call fcn.00406130
mov eax, dword [0x41bb44]
call fcn.0040338c
test eax, eax
jne 0x40ea6b
lea edx, [ebp - 0x108]
mov eax, dword [0x41bb40]
call fcn.00404b68
mov edx, dword [ebp - 0x108]
mov eax, 0x41bb44
call fcn.0040325c
mov eax, dword [0x41bb44]
call fcn.0040338c
test eax, eax
jne 0x40ea6b
call fcn.004075f4
jmp 0x40ee48
cmp byte [0x41bbac], 0x64
jne 0x40ea7e
call fcn.004104a4
call fcn.0040309c
mov byte [0x41a1dc], 0
mov eax, dword [0x41a2d4]
push eax
mov ecx, dword [0x41bd28]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00405d8c
dec eax
je 0x40eb3a
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x41bb28]
call fcn.0040358c
push eax
call sub.kernel32.dll_CreateFileA
mov dword [0x41bbb4], eax
push 2
push 0
push 0
mov eax, dword [0x41bbb4]
push eax
call sub.kernel32.dll_SetFilePointer
call fcn.004106d0
push 0
push 0x41bba4
mov eax, dword [0x41bb78]
call fcn.0040338c
push eax
mov eax, 0x41bb78
call fcn.004035dc
push eax
mov eax, dword [0x41bbb4]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, 0x41bb78
call fcn.00403208
mov eax, dword [0x41bbb4]
push eax
call sub.kernel32.dll_CloseHandle
push 1
mov ecx, dword [0x41bd28]
mov edx, dword [0x41bd14]
mov eax, 0x80000002
call fcn.00406004
mov eax, edi
mov edx, 0x40fb7c
call fcn.0040325c
push 0xea60
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x10c]
mov al, 1
call fcn.004049a0
mov ecx, dword [ebp - 0x10c]
mov eax, 0x41bb4c
mov edx, 0x40fc30
call fcn.004033d8
mov eax, edi
mov edx, 0x40fc44
call fcn.0040325c
mov eax, edi
mov edx, 0x40f634
call fcn.0040325c
mov eax, 7
call fcn.00402808
cmp eax, 5
ja case.default.0x40eb9d
jmp dword [eax*4 + 0x40eba4]
lea edx, [ebp - 0x110]
mov eax, 0x40fcc0
call fcn.004055b0
mov edx, dword [ebp - 0x110]
mov eax, 0x41bb48
invalid
invalid