Function at 0x40d160
Capabilities:
Access peb ldr_data
Check os version
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42cae4
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
xor ecx, ecx
push edi
mov dword [esi + 0x1c8], ebx
xor eax, eax
mov edx, dword [esi + 0x18c]
cmp eax, 0x460
mov dword [edx + eax + 0x10], ebx
jge 0x40d1b0
mov edx, dword [esi + 0x184]
cmp dword [edx + ecx + 0x10], ebx
je 0x40d1b0
inc dword [esi + 0x1c8]
add eax, 0x38
add ecx, 0x2c
cmp eax, 0x690
jl 0x40d18d
mov eax, dword [esi + 0x1c4]
mov ecx, dword [esi + 0x204]
mov dword [ecx + eax*4], 1
mov eax, dword [esi + 0x228]
cmp eax, ebx
mov dword [esi + 0x1d8], ebx
mov dword [esi + 0x1d0], ebx
mov dword [esi + 0x1f8], ebx
mov dword [esi + 0x220], ebx
mov dword [esi + 0x1d4], ebx
mov dword [esi + 0x20c], ebx
mov dword [esi + 0x208], ebx
mov dword [esi + 0x1f0], 0x2bc
mov byte [esi + 0x26c], bl
mov byte [esi + 0xd44], 1
mov byte [esi + 0xd54], bl
je 0x40d22b
mov dword [esi + 0x208], 1
mov eax, dword [esi + 0x1c4]
inc eax
mov dword [esi + 0x1c4], eax
mov edx, dword [0x438030]
mov dword [esp + 0x18], edx
mov ecx, dword [esi + 0xd68]
lea edx, [esp + 0x18]
push ecx
push eax
push 0x43793c
push edx
mov dword [esp + 0xb8], ebx
call fcn.0041f627
add esp, 0x10
xor ecx, ecx
xor eax, eax
mov edi, 0x3e8
mov edx, 6
mov ebp, dword [esi + 0x18c]
cmp eax, 0x460
mov dword [eax + ebp + 0x10], ebx
jge 0x40d296
mov ebp, dword [esi + 0x184]
mov dword [ecx + ebp + 0x20], edi
mov ebp, dword [esi + 0x184]
mov dword [ecx + ebp + 0x1c], edx
cmp eax, 0x118
jge 0x40d2a7
mov ebp, dword [esi + 0x198]
mov dword [ecx + ebp + 0x10], ebx
add eax, 0x38
add ecx, 0x2c
cmp eax, 0x7a8
jl 0x40d271
mov eax, dword [esi + 0x1c4]
mov ecx, eax
and ecx, 0x80000003
jns 0x40d2c9
dec ecx
or ecx, 0xfffffffc
inc ecx
jne 0x40d323
cmp eax, ebx
je 0x40d323
xor ecx, ecx
xor eax, eax
mov edx, dword [esi + 0x184]
cmp eax, 0xdc
mov dword [edx + eax + 0x10], ebx
jge 0x40d2f8
mov edx, dword [esi + 0x198]
mov dword [edx + eax + 0x10], ebx
mov edx, dword [esi + 0x19c]
mov dword [edx + ecx + 0x10], ebx
add eax, 0x2c
add ecx, 0x28
cmp eax, 0x370
jl 0x40d2d3
mov dword [esi + 0x1d4], ebx
mov dword [esi + 0x1c8], ebx
mov dword [esi + 0x1cc], ebx
mov dword [esi + 0x1dc], ebx
mov dword [esi + 0x1e0], ebx
mov eax, dword [esi + 0x1c4]
inc eax
and eax, 0x80000003
jns 0x40d336
dec eax
or eax, 0xfffffffc
inc eax
jne 0x40d35d
mov ecx, esi
mov byte [esi + 0x26c], 1
call fcn.00410850
test al, al
jne 0x40d35d
mov eax, dword [esi + 0x1c4]
mov byte [esi + 0x26c], bl
inc eax
mov dword [esi + 0x1c4], eax
mov ecx, dword [esi + 0x1c4]
cmp ecx, 0x14
jle 0x40d493
xor eax, eax
dec ecx
test ecx, ecx
mov edx, 1
jle 0x40d3a7
xor ecx, ecx
mov edi, dword [esi + 0x204]
cmp dword [edi + eax*4], ebx
je 0x40d3a5
cmp eax, 5
jge 0x40d394
mov edi, dword [esi + 0x198]
mov dword [edi + ecx + 0x10], ebx
mov edi, dword [esi + 0x1c4]
inc eax
add ecx, 0x2c
dec edi
cmp eax, edi
jl 0x40d37a
jmp 0x40d3a7
xor edx, edx
cmp dword [esi + 0x22c], ebx
je 0x40d48d
cmp edx, ebx
je 0x40d48d
push ebx
push ebx
push ebx
lea ecx, [esp + 0x5c]
push ebx
push ecx
lea edx, [esp + 0x44]
push 0xb
push edx
push 0x437938
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [esp + 0x20]
push eax
call fcn.0041f71e
mov ecx, dword [eax]
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x24]
push 0x10
push edx
push eax
mov dword [esp + 0x28], ecx
call fcn.0041e4c4
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
lea ecx, [esp + 0x24]
xor edi, edi
push ecx
call ebp
test eax, eax
jle 0x40d43b
push ebx
lea ecx, [esp + 0x20]
call fcn.0041f731
mov eax, dword [eax + 8]
cdq
and edx, 3
add eax, edx
mov dl, byte [esp + edi + 0x24]
sar eax, 2
inc al
add dl, al
mov byte [esp + edi + 0x24], dl
lea edx, [esp + 0x24]
push edx
inc edi
call ebp
cmp edi, eax
jl 0x40d40d
mov eax, dword [0x438030]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14]
push ecx
push 0x4378ec
push edx
mov byte [esp + 0xb4], 1
call fcn.0041f627
add esp, 0xc
lea eax, [esp + 0x14]
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00424104
call fcn.00412660
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0xa8], bl
call fcn.0042438f
mov dword [esi + 0x1c4], ebx
mov ecx, dword [0x438030]
mov dword [esp + 0x10], ecx
mov al, byte [esi + 0x26c]
mov byte [esp + 0xa8], 2
cmp al, bl
je 0x40d4c3
lea edx, [esp + 0x10]
push 0x4378dc
push edx
call fcn.0041f627
add esp, 8
jmp 0x40d4dd
mov eax, dword [esi + 0x1c4]
lea ecx, [esp + 0x10]
inc eax
push eax
push 0x4378c8
push ecx
call fcn.0041f627
add esp, 0xc
push ebx
push 1
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
call fcn.00424104
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0xbc], 3
call fcn.00424104
push 1
push 0x46
lea ecx, [esp + 0x48]
mov byte [esp + 0xc0], 2
call fcn.004076e0
mov edi, eax
mov ecx, dword [edi + 4]
mov byte [esp + 0xa8], 4
mov dword [esi + 0x1a4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 0x1a8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0x1ac], eax
mov ecx, dword [edi + 0x10]
lea edx, [edi + 0x14]
mov dword [esi + 0x1b0], ecx
push edx
lea ecx, [esi + 0x1b4]
call fcn.00424438
lea eax, [edi + 0x18]
lea ecx, [esi + 0x1b8]
push eax
call fcn.00424438
mov cl, byte [edi + 0x1c]
mov byte [esp + 0xa8], 2
mov byte [esi + 0x1bc], cl
lea ecx, [esp + 0x30]
call fcn.00405100
mov eax, dword [esi + 0xd64]
lea ecx, [esp + 0x10]
inc eax
mov dword [esi + 0xd68], ebx
mov dword [esi + 0xd64], eax
mov dword [esi + 0xd6c], ebx
mov byte [esp + 0xa8], bl
call fcn.0042438f
lea ecx, [esp + 0x18]
mov dword [esp + 0xa8], 0xffffffff
call fcn.0042438f
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
pop ebp
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x9c
ret 8