Function at 0x40a750
Capabilities:
Check for peb beingdebugged flag
Create thread
Get disk information
Get graphical window text
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x44db2e
mov eax, dword fs:[0]
push eax
sub esp, 0x31c
mov eax, dword [0x4651b0]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4651b0]
xor eax, esp
push eax
lea eax, [esp + 0x330]
mov dword fs:[0], eax
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, ecx
push 0x3e8
push edi
call esi
push 0x3ec
mov ebx, eax
push edi
mov dword [esp + 0x28], ebx
call esi
push 0x3ef
push edi
mov dword [esp + 0x30], eax
call esi
push 0x3f0
push edi
mov dword [esp + 0x38], eax
call esi
push 0x3e9
push edi
mov dword [esp + 0x1c], eax
call esi
push 0x3ea
push edi
mov dword [esp + 0x20], eax
call esi
push 0x3ed
push edi
mov dword [esp + 0x24], eax
call esi
push 1
push edi
mov dword [esp + 0x34], eax
call esi
push 0x206
xor ebp, ebp
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x12a]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x130], ax
call fcn.0043ad60
add esp, 0xc
push 0x208
lea edx, [esp + 0x128]
push edx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
mov word [esp + 0x7c], ax
mov ebx, 7
lea eax, [esp + 0x124]
mov dword [esp + 0x90], ebx
mov dword [esp + 0x8c], ebp
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
cmp dx, bp
jne 0x40a850
sub eax, ecx
sar eax, 1
push eax
lea eax, [esp + 0x128]
lea esi, [esp + 0x7c]
call fcn.00401760
mov esi, vtable.TString.0
mov dword [esp + 0x74], esi
mov dword [esp + 0x338], ebp
cmp dword [esp + 0x8c], ebp
jne 0x40a905
push 0x73
lea ebx, [esp + 0x58]
call fcn.00403b00
mov eax, dword [esp + 0x5c]
mov ebx, 8
cmp dword [esp + 0x70], ebx
jae 0x40a8a7
lea eax, [esp + 0x5c]
push 0x40
push 0x45a5f0
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [esp + 0x54], esi
cmp dword [esp + 0x70], ebx
jb 0x40a8cd
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.00438e12
add esp, 4
xor edx, edx
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], dx
mov dword [esp + 0x74], esi
cmp dword [esp + 0x90], ebx
jb 0x40a8fe
mov eax, dword [esp + 0x7c]
push eax
call fcn.00438e12
add esp, 4
xor eax, eax
jmp 0x40aee8
xor ecx, ecx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xcc], ebp
mov word [esp + 0xbc], cx
mov dword [esp + 0xb4], esi
push 0x45201c
lea ebx, [ecx + 1]
xor eax, eax
lea edx, [esp + 0x7c]
mov byte [esp + 0x33c], 1
call fcn.00407290
cmp eax, 0xffffffff
je 0x40aa95
lea edx, [esp + 0x78]
push edx
mov ecx, eax
xor edx, edx
lea esi, [esp + 0x3c]
call fcn.00401640
mov byte [esp + 0x338], 2
xor ecx, ecx
xor ebp, ebp
push 0xffffffffffffffff
mov word [esp + 0x60], cx
push ebp
lea ecx, [esp + 0x60]
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], ebp
call fcn.00401670
mov esi, vtable.TString.0
mov dword [esp + 0x54], esi
push 0xffffffffffffffff
push ebp
lea eax, [esp + 0x60]
lea ecx, [esp + 0xc0]
mov byte [esp + 0x340], 3
call fcn.00401670
mov ebx, 8
mov dword [esp + 0x54], esi
cmp dword [esp + 0x70], ebx
jb 0x40a9c3
mov edx, dword [esp + 0x5c]
push edx
call fcn.00438e12
add esp, 4
xor eax, eax
mov byte [esp + 0x338], 1
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], ebp
mov word [esp + 0x5c], ax
cmp dword [esp + 0x50], ebx
jb 0x40a9f1
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00438e12
add esp, 4
mov eax, dword [esp + 0xbc]
cmp dword [esp + 0xd0], ebx
jae 0x40aa08
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
je 0x40aab1
cmp dword [esp + 0xd0], ebx
jb 0x40aa8c
mov eax, dword [esp + 0xbc]
cmp eax, ebp
je 0x40aa3b
push ebp
push eax
call fcn.0043922e
add esp, 8
cmp eax, 0xffffffff
jne 0x40aab1
push 0xa7
lea ebx, [esp + 0x58]
call fcn.00403b00
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x40aa58
lea eax, [esp + 0x5c]
push 0x40
push 0x45a5f0
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x54]
call fcn.004010f0
lea ecx, [esp + 0xb4]
call fcn.004010f0
lea ecx, [esp + 0x74]
call fcn.004010f0
xor eax, eax
jmp 0x40aee8
lea eax, [esp + 0xbc]
jmp 0x40aa2c
lea edx, [esp + 0xbc]
push 0
push edx
call fcn.0043922e
add esp, 8
cmp eax, 0xffffffff
je 0x40aa3b
xor ebp, ebp
lea ebx, [ebp + 8]
mov eax, dword [esp + 0x8c]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x40aac4
call fcn.00438e02
mov eax, dword [esp + 0x7c]
cmp dword [esp + 0x90], ebx
jae 0x40aad5
lea eax, [esp + 0x7c]
cmp word [eax + esi*2], 0x5c
je 0x40aaef
push 1
push 0x45201c
lea eax, [esp + 0x80]
call fcn.00404520
sub esp, 0x20
mov esi, esp
lea ecx, [esi + 4]
mov dword [esp + 0x54], esp
xor eax, eax
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebp
push 0xffffffffffffffff
mov word [ecx + 4], ax
push ebp
lea eax, [esp + 0xa0]
call fcn.00401670
mov dword [esi], vtable.TString.0
call fcn.00403090
push 0x83
lea ebx, [esp + 0x98]
call fcn.00403b00
mov byte [esp + 0x338], 4
cmp dword [esp + 0xb0], 8
mov eax, dword [esp + 0x9c]
jae 0x40ab56
lea eax, [esp + 0x9c]
mov ecx, dword [esp + 0x30]
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push ecx
call ebp
push 0x74
lea ebx, [esp + 0x58]
call fcn.00403b00
mov byte [esp + 0x338], 5
test eax, eax
je 0x40ab80
add eax, 4
jmp 0x40ab82
xor eax, eax
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xa0]
call fcn.00401670
mov byte [esp + 0x338], 4
mov ebx, 8
mov esi, vtable.TString.0
mov dword [esp + 0x54], esi
cmp dword [esp + 0x70], ebx
jb 0x40abbb
mov edx, dword [esp + 0x5c]
push edx
call fcn.00438e12
add esp, 4
mov eax, dword [esp + 0x9c]
cmp dword [esp + 0xb0], ebx
jae 0x40abd2
lea eax, [esp + 0x9c]
push eax
mov eax, dword [esp + 0x18]
push eax
call ebp
push 0x75
lea ebx, [esp + 0x58]
call fcn.00403b00
mov byte [esp + 0x338], 6
test eax, eax
je 0x40abf6
add eax, 4
jmp 0x40abf8
xor eax, eax
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xa0]
call fcn.00401670
mov byte [esp + 0x338], 4
mov dword [esp + 0x54], esi
mov esi, 8
cmp dword [esp + 0x70], esi
jb 0x40ac2c
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.00438e12
add esp, 4
mov eax, dword [esp + 0x9c]
cmp dword [esp + 0xb0], esi
jae 0x40ac43
lea eax, [esp + 0x9c]
mov esi, dword [esp + 0x2c]
push eax
push esi
call ebp
push 0x65
push 0xfffffffffffffff4
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
call esi
push 0x76
lea ebx, [esp + 0x58]
call fcn.00403b00
xor ebp, ebp
mov byte [esp + 0x338], 7
cmp eax, ebp
je 0x40ac76
add eax, 4
jmp 0x40ac78
xor eax, eax
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0xa0]
call fcn.00401670
mov ebx, 8
mov dword [esp + 0x54], vtable.TString.0
cmp dword [esp + 0x70], ebx
jb 0x40aca7
mov edx, dword [esp + 0x5c]
push edx
call fcn.00438e12
add esp, 4
mov eax, dword [esp + 0x9c]
cmp dword [esp + 0xb0], ebx
jae 0x40acbe
lea eax, [esp + 0x9c]
mov ebx, dword [esp + 0x24]
push eax
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 2
push 0xfffffffffffffff4
push ebx
call esi
mov eax, dword [esp + 0x1c]
push ebp
push ebp
push pe_nt_image_headers32
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x20]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
push ecx
mov ebx, eax
call esi
mov edx, dword [esp + 0x28]
push ebp
push edx
call esi
mov eax, dword [esp + 0x14]
push 5
push eax
call esi
mov ecx, dword [esp + 0x18]
push 5
push ecx
call esi
call fcn.004036e0
mov eax, 7
mov dword [esp + 0xf4], eax
mov esi, vtable.TString.0
mov dword [esp + 0x114], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0xf0], ebp
mov word [esp + 0xe0], dx
mov dword [esp + 0xd8], esi
mov dword [esp + 0x110], ebp
mov word [esp + 0x100], ax
mov dword [esp + 0xf8], esi
mov dword [esp + 0x118], ebp
mov byte [esp + 0x11c], al
push 0xffffffffffffffff
mov byte [esp + 0x33c], 8
push ebp
lea eax, [esp + 0x80]
lea ecx, [esp + 0x104]
mov dword [esp + 0xdc], edi
call fcn.00401670
cmp ebx, ebp
setne cl
lea ebx, [esp + 0x54]
mov byte [esp + 0x11c], cl
call fcn.00402960
xor ebp, ebp
mov byte [esp + 0x338], 9
cmp eax, ebp
je 0x40adb5
add eax, 4
jmp 0x40adb7
xor eax, eax
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0xe4]
call fcn.00401670
mov ebx, 8
mov byte [esp + 0x338], bl
mov dword [esp + 0x54], esi
cmp dword [esp + 0x70], ebx
jb 0x40ade9
mov edx, dword [esp + 0x5c]
push edx
call fcn.00438e12
add esp, 4
mov eax, dword [0x468230]
cmp eax, ebp
je 0x40adfc
mov ecx, dword [0x468234]
add eax, ecx
jmp 0x40adfe
xor eax, eax
mov dword [esp + 0x118], eax
mov eax, dword [0x468378]
lea edx, [esp + 0xd4]
push edx
mov edx, dword [eax + 8]
mov ecx, 0x468378
call edx
push 0x468380
push 4
push 0x468378
push 0x40bdb0
push ebp
push ebp
call fcn.00439408
add esp, 0x18
push eax
mov dword [0x46837c], eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
lea esi, [esp + 0xd4]
call fcn.00405610
mov esi, vtable.TString.0
mov dword [esp + 0x94], esi
cmp dword [esp + 0xb0], ebx
jb 0x40ae74
mov eax, dword [esp + 0x9c]
push eax
call fcn.00438e12
add esp, 4
xor ecx, ecx
mov edi, 7
mov dword [esp + 0xb0], edi
mov dword [esp + 0xac], ebp
mov word [esp + 0x9c], cx
mov dword [esp + 0xb4], esi
cmp dword [esp + 0xd0], ebx
jb 0x40aeb1
mov edx, dword [esp + 0xbc]
push edx
call fcn.00438e12
add esp, 4
xor eax, eax
mov dword [esp + 0xd0], edi
mov dword [esp + 0xcc], ebp
mov word [esp + 0xbc], ax
mov dword [esp + 0x74], esi
cmp dword [esp + 0x90], ebx
jb 0x40aee3
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.00438e12
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x330]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x318]
xor ecx, esp
call fcn.00438b17
add esp, 0x328
ret