Function at 0x531930
Capabilities:
Get disk information
Inspect load icon resource
Query or enumerate registry value

Disassembly:
sub esp, 0x1b4
mov eax, dword [esp + 0x1c0]
push ebx
push ebp
push esi
push edi
push eax
call fcn.005315f0
mov esi, dword [esp + 0x1cc]
add esp, 4
xor edi, edi
mov dword [esp + 0x24], 0x30
push 0x65
push esi
mov dword [esp + 0x30], 0x40
mov dword [esp + 0x34], 0x5314a0
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], 0x58bae8
mov dword [esp + 0x54], edi
call fcn.00575d80
push eax
call fcn.00574f76
add esp, 8
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
call edi
push 8
lea ebx, [eax + eax + 0x280]
call edi
push 4
lea ebp, [eax + eax + 0x1e0]
call edi
push 0
add ebp, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push esi
push 0
push 0
push ebp
push ebx
push 0x64
push 0x64
push 0
push str.THPS4
push 0x58bae8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea edx, [esp + 0x60]
push eax
push edx
mov dword [0xaab47c], eax
call esi
test eax, eax
je 0x531a53
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x54]
push eax
call edi
lea ecx, [esp + 0x54]
push ecx
call ebx
mov edx, dword [0xaab47c]
push 1
push 0
push 0
lea eax, [esp + 0x60]
push edx
push eax
call esi
test eax, eax
jne 0x531a2d
mov eax, dword [0xaab47c]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
xor ebp, ebp
cmp eax, ebp
jne 0x531a81
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5b6684
call fcn.00535ef0
mov eax, dword [0xaab47c]
add esp, 8
cmp eax, ebp
je 0x531a86
push 2
push eax
call edi
mov eax, dword [esp + 0x1d0]
xor esi, esi
mov cl, byte [eax]
cmp cl, 0x20
jne 0x531aa2
mov byte [eax], 0
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x20
je 0x531a96
mov cl, byte [eax]
test cl, cl
je 0x531ab2
mov dword [esp + esi*4 + 0x70], eax
inc esi
cmp esi, 0x14
jb 0x531a91
mov dword [esp + esi*4 + 0x70], ebp
call fcn.00535d30
test al, al
je 0x531b20
lea ecx, [esp + 0x70]
dec esi
push ecx
push esi
call fcn.00530220
add esp, 8
call fcn.0043f5a0
mov eax, dword [0xaab480]
cmp eax, ebp
je 0x531ae8
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0xaab480], ebp
mov eax, dword [0xb1f2b0]
cmp eax, ebp
je 0x531af7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0xb1f2b0], ebp
call fcn.00464840
mov eax, dword [0xaab478]
cmp eax, ebp
je 0x531b11
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [0xaab474]
cmp eax, ebp
je 0x531b20
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 1
push ebp
push ebp
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [0xaab47c]
push 2
push edx
mov dword [0xaab478], ebp
mov dword [0xaab474], ebp
call edi
mov esi, dword [sym.imp.USER32.dll_ShowCursor]
push 1
call esi
test eax, eax
jl 0x531b47
mov al, byte [0xb085fc]
test al, al
jne 0x531b6d
push 0x1000
push 0x5b6674
push 0x5b6628
push ebp
jmp 0x531ecc
mov eax, dword [0x59a760]
mov byte [esp + 0x13], 0x41
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
cmp ebx, ebp
je 0x531be1
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov al, byte [esp + 0x13]
cmp al, 0x5a
jg 0x531be1
test bl, 1
je 0x531bd1
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
push ecx
call edi
cmp eax, 3
jne 0x531bd1
push ebp
push ebp
push ebp
push ebp
push 0x5b6f50
lea edx, [esp + 0xd8]
push 0x100
lea eax, [esp + 0x2c]
push edx
push eax
call esi
test eax, eax
jne 0x531be1
mov cl, byte [esp + 0x13]
shr ebx, 1
inc cl
cmp ebx, ebp
mov byte [esp + 0x13], cl
jne 0x531b93
mov eax, dword [0x5a1d20]
xor esi, esi
mov cl, byte [eax]
cmp cl, 0xff
je 0x531c07
lea edx, [esp + 0xc4]
sub edx, eax
not cl
mov byte [edx + eax], cl
mov cl, byte [eax + 1]
inc esi
inc eax
cmp cl, 0xff
jne 0x531bf8
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc4]
push ecx
push 1
push ebp
push edx
push reloc.WS2_32.dll_bind
mov byte [esp + esi + 0xd8], 0
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x531c83
mov edx, dword [esp + 0x14]
mov byte [esp + 0xc7], al
lea eax, [esp + 0x18]
lea ecx, [esp + 0xc4]
push eax
push str.SmoTheOneWasHere
push ebp
push ebp
push ecx
push edx
mov byte [esp + 0xde], 0x79
mov dword [esp + 0x30], 0x11
mov byte [esp + 0xdd], 0x65
mov byte [esp + 0xdc], 0x4b
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [0x5b6f50]
xor ecx, ecx
xor esi, esi
mov al, byte [ecx + str.SmoTheOneWasHere]
cmp al, 0x39
jbe 0x531ca1
and eax, 0xff
sub eax, 0x41
jmp 0x531ca9
and eax, 0xff
sub eax, 0x16
movsx eax, byte [eax + esi + 0x5a7ac0]
cmp eax, 0x20
mov dword [ecx*4 + 0xab5b60], eax
jne 0x531cc4
mov byte [0xaab48c], 1
mov dl, byte [ecx + 0x5a80d4]
add esi, 0x24
sub eax, edx
sub eax, edi
and eax, 0x1f
mov dword [ecx*4 + 0xab5b60], eax
shr edi, 2
inc ecx
cmp ecx, 0x10
jb 0x531c8d
mov dword [0xab5b5c], 0
mov edi, 0xab5b60
mov eax, 0x5a8f40
mov ebp, 0x10
xor edx, edx
mov esi, eax
mov eax, dword [esi]
test eax, 0x40000000
je 0x531d3a
mov ebx, 1
mov ecx, edx
shl ebx, cl
test dword [edi], ebx
setne cl
test eax, eax
jns 0x531d21
test cl, cl
sete cl
test cl, cl
je 0x531d3a
mov ebx, 1
mov cl, al
mov eax, dword [0xab5b5c]
shl ebx, cl
or eax, ebx
mov dword [0xab5b5c], eax
inc edx
add esi, 4
cmp edx, 5
jb 0x531d01
add edi, 4
dec ebp
mov eax, esi
jne 0x531cfd
mov dword [esp + 0x14], 0xab5b60
mov eax, 0x5a8f40
mov dword [esp + 0x18], 0x10
xor esi, esi
mov dword [esp + 0x20], eax
mov edx, dword [eax]
test edx, 0x40000000
jne 0x531de3
mov edi, dword [0xab5b5c]
xor bl, bl
xor eax, eax
mov ebp, edx
mov ecx, eax
shr ebp, cl
mov ecx, 1
mov dword [esp + 0x1c], ecx
mov ecx, ebp
mov ebp, dword [esp + 0x1c]
shl ebp, cl
test edi, ebp
je 0x531d9a
test bl, bl
sete bl
add eax, 8
cmp eax, 0x18
jb 0x531d7a
test edx, edx
jns 0x531dab
test bl, bl
sete bl
mov ecx, esi
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0x14]
test bl, bl
mov edx, dword [ecx]
je 0x531dc9
test edx, eax
jne 0x531de3
push str.fail_1_n
jmp 0x531dd2
test edx, eax
je 0x531de3
push str.fail_2_n
mov edx, dword [0x5a0800]
mov byte [edx], 1
call fcn.00535ef0
add esp, 4
mov eax, dword [esp + 0x20]
inc esi
add eax, 4
cmp esi, 5
mov dword [esp + 0x20], eax
jb 0x531d66
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add edx, 4
dec ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
jne 0x531d60
mov eax, dword [0xab5b5c]
xor edi, edi
mov edx, eax
shl edx, 0x10
xor edx, eax
add edx, 0x5c0fe635
xor eax, eax
lea esi, [eax*8]
mov ebx, edx
mov ecx, esi
mov dword [esp + 0x1c], edx
shr ebx, cl
mov ecx, dword [eax*4 + 0x5aa250]
xor edx, edx
and ebx, 0xff
mov dl, byte [ebx + ecx]
mov ecx, esi
mov ebx, edx
mov edx, dword [esp + 0x1c]
shl ebx, cl
or edi, ebx
inc eax
cmp eax, 4
jb 0x531e28
xor ebx, ebx
xor edx, edx
xor esi, esi
xor eax, eax
mov cl, byte [edx + eax + 0x5aa6e8]
mov ebp, 1
shl ebp, cl
test edi, ebp
je 0x531e82
mov ebp, 1
mov ecx, eax
shl ebp, cl
or esi, ebp
inc eax
cmp eax, 8
jb 0x531e65
mov ecx, edx
add edx, 8
shl esi, cl
or ebx, esi
cmp edx, 0x20
jb 0x531e61
add ebx, 0x2e4ba461
mov eax, ebx
shl eax, 0x10
xor eax, ebx
sub eax, 0x1d35ca01
cmp eax, 0x12fcb049
mov dword [0xab5b58], eax
jb 0x531ebb
cmp eax, 0x142ddd49
jbe 0x531ed2
push 0x1000
push 0x5b660c
push 0x5b65a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00575611
call fcn.00534b00
call fcn.0053b020
push 0
call fcn.00575600
pop edi
pop esi
pop ebp
pop ebx
nop
nop
nop
nop