Function at 0x47fbd0
Capabilities:
Check os version
Create thread
Get disk information
Hide graphical window
Read .ini file

Disassembly:
sub esp, 0x6b4
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x6ac], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], edx
push eax
mov ebp, ecx
mov dword [esp + 0x28], 8
mov dword [esp + 0x2c], 0x42ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x104
push 0x4def98
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
push 0x5c
push 0
push 0x4def98
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
sub eax, 0x4def98
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x4805bd
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
xor ecx, ecx
push 0x4def98
push 0x4deb78
mov word [eax + 0x4def98], cx
call esi
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x4c0ac4
push 0x4deb78
call ebx
push 0x4def98
push 0x4ded80
call esi
push 0x4c0ad4
push 0x4ded80
call ebx
push 0x4def98
push Shell_NotifyIconW
call esi
push 0x4c0af8
push Shell_NotifyIconW
call ebx
push 0x4def98
push 0x4de958
call esi
push 0x4c0b1c
push 0x4de958
call ebx
mov esi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x2a8]
push Shell_NotifyIconW
push 0x104
push eax
push 0
push 0x4ad370
push 0x4bf76c
call esi
lea eax, [esp + 0x2a8]
push eax
push 0x4de958
call ebx
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileIntW]
push 0x4ded80
push 0xc8
push 0x4c1084
push 0x4af780
call edi
push 2
push 0x32
mov dword [0x4c5198], eax
mov dword [InitializeSListHead], ebp
call fcn.0048f633
add esp, 8
mov dword [0x4ddf34], eax
push 0x4ded80
push 0
push 0x4ba750
push 0x4af780
call edi
test eax, eax
jne 0x47fe53
push 0x206
push eax
mov word [esp + 0xa8], ax
lea eax, [esp + 0xaa]
push eax
call fcn.0048e770
add esp, 0xc
xor eax, eax
mov word [esp + 0x4b0], ax
push 0x206
push eax
lea eax, [esp + 0x4ba]
push eax
call fcn.0048e770
add esp, 0xc
xor eax, eax
mov word [esp + 0x2a8], ax
push 0x206
push eax
lea eax, [esp + 0x2b2]
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0x20]
push 0
push 0
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0x104
lea eax, [esp + 0x2c0]
push eax
push 0x4b0a54
call dword [sym.imp.kernel32.dll_GetVolumeInformationW]
push dword [esp + 0x18]
lea eax, [esp + 0xa4]
push 0x4af8c0
push 0x104
push eax
call fcn.0040a370
add esp, 0x10
lea eax, [esp + 0x4b0]
push 0x4ded80
push 0x104
push eax
push 0x4ad29c
push 0x4bbf4c
push 0x4ad35c
call esi
lea eax, [esp + 0x4b0]
push eax
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x47fe53
mov esi, dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
push 0x4ded80
push 0x4ad29c
push 0x4bbf58
push 0x4bbf5c
call esi
push 0x4ded80
lea eax, [esp + 0xa4]
push eax
push 0x4bbf4c
push 0x4ad35c
call esi
call fcn.00470d10
test eax, eax
jne 0x47feb4
push eax
push 0x471080
push dword [0x4def88]
push 0x4ade14
push ebp
call dword [sym.imp.user32.dll_DialogBoxParamW]
test eax, eax
je 0x47feb4
mov dword [0x4dde90], 1
mov dword [0x4dde94], 1
mov dword [0x4dde98], 1
mov dword [0x4ddea0], 1
mov dword [0x4ddea4], 1
mov dword [0x4dde8c], 1
push 0
mov esi, dword [sym.imp.user32.dll_CreateWindowExW]
push ebp
push 0
push 0
push 0
push 0
push 0
push 0
push 0x4cf0000
push 0x4df858
push reloc.user32.dll_GetWindowLongW
push 0
call esi
mov ebx, eax
mov dword [esp + 0x20], ebx
test ebx, ebx
jne 0x47feff
mov ecx, dword [esp + 0x6bc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x6b4
ret
push 0
push ebp
push 0
push ebx
push 0
push 0
push 0
push 0
push 0xc0480000
push 0
push 0x4ad77c
push 8
mov dword [0x4def88], ebx
call esi
push 0x470b30
push 0xfffffffffffffffc
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.user32.dll_SetWindowLongW]
push 0x4e97
push ebp
call dword [sym.imp.user32.dll_LoadBitmapW]
lea ecx, [esp + 0x2c]
mov dword [0x4dde88], eax
push ecx
xorps xmm0, xmm0
push 0x18
push eax
movups xmmword [esp + 0x38], xmm0
movq qword [esp + 0x48], xmm0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
lea eax, [esp + 0x5c]
xorps xmm0, xmm0
push eax
push 0
push 0x30
movups xmmword [esp + 0x68], xmm0
call dword [sym.imp.user32.dll_SystemParametersInfoW]
mov ebp, dword [sym.imp.user32.dll_GetSystemMetrics]
push 1
call ebp
push 0x40
push dword [esp + 0x38]
mov esi, eax
push dword [esp + 0x38]
sub esi, dword [esp + 0x70]
push 1
call ebp
sub eax, dword [esp + 0x40]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
push 0
call ebp
sub eax, dword [esp + 0x40]
mov esi, dword [esp + 0x24]
cdq
sub eax, edx
sar eax, 1
push eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.user32.dll_SetWindowPos]
mov edx, 0x4ad870
mov ecx, 0x4ad81c
call fcn.004773a0
mov ebp, dword [sym.imp.user32.dll_SendMessageW]
push eax
push 0
push 0xc
push esi
call ebp
push 0x4ded80
push 5
push 0x4b982c
push 0x4af780
call edi
mov edx, 0x64
sub edx, eax
mov ecx, esi
call fcn.0047f9e0
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], 0x114
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
cmp dword [esp + 0xa4], 6
jne 0x48005a
mov eax, dword [esp + 0xa8]
test eax, eax
jne 0x480038
mov eax, 1
mov dword [0x4de950], eax
jmp 0x48005f
cmp eax, 1
jne 0x480049
mov eax, 2
mov dword [0x4de950], eax
jmp 0x48005f
cmp eax, 2
jne 0x48005a
mov eax, 3
mov dword [0x4de950], eax
jmp 0x48005f
mov eax, dword [0x4de950]
sub eax, 1
je 0x48006e
sub eax, 2
mov eax, 0x200
je 0x480073
mov eax, 0x100
push 0x4ded80
push 5
push 0x4b982c
push 0x4af780
mov dword [0x4c5180], eax
call edi
mov edx, 0x64
mov ecx, ebx
sub edx, eax
call fcn.0047f9e0
mov edx, 0x4ae300
mov ecx, 0x4ad81c
call fcn.004773a0
mov ebx, dword [0x4def88]
push 0x2710
push ebx
push eax
push 0x40800000
call dword [sym.imp.COMCTL32.dll_CreateStatusWindowW]
mov dword [reloc.kernel32.dll_InitializeSListHead], eax
test eax, eax
je 0x48019d
push ebx
call dword [sym.imp.user32.dll_GetDC]
mov esi, eax
lea eax, [esp + 0x48]
push eax
push ebx
call dword [sym.imp.user32.dll_GetClientRect]
push esi
push ebx
mov dword [esp + 0x80], 0x136
mov dword [esp + 0x84], 0x2bc
mov dword [esp + 0x88], 0x7d0
call dword [sym.imp.user32.dll_ReleaseDC]
lea eax, [esp + 0x78]
push eax
push 4
push 0x404
push dword [reloc.kernel32.dll_InitializeSListHead]
call ebp
push Shell_NotifyIconW
push 0x400
push 0x4c4980
push 0
push 0x4ad0cc
push 0x4ba19c
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
mov ebx, dword [sym.imp.kernel32.dll_lstrlenW]
xor esi, esi
push 0x4c4980
call ebx
test eax, eax
jle 0x480185
lea edi, [esi + 0xa]
nop word [eax + eax]
cmp word [esi*2 + 0x4c4980], 0x7e
jne 0x480173
mov word [esi*2 + 0x4c4980], di
push 0x4c4980
inc esi
call ebx
cmp esi, eax
jl 0x480160
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileIntW]
push 0x4c4980
push 2
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call ebp
mov esi, dword [esp + 0x14]
push 0
push 0x3e8
push 1
push dword [0x4def88]
call dword [sym.imp.user32.dll_SetTimer]
call fcn.00477520
call fcn.0047b450
call fcn.00464a90
call fcn.0047beb0
call fcn.0047ebf0
call fcn.0047b620
push 0x4ded80
push 0
push 0x4ba6cc
push 0x4af780
call edi
test eax, eax
je 0x48020c
push 0x4ded80
push 0
push 0x4c1094
push 0x4c0a94
call edi
mov ecx, dword [esp + 0x1c]
test eax, eax
mov edx, 3
cmovne ecx, edx
mov dword [esp + 0x1c], ecx
mov edx, 0x4ae65c
mov ecx, 0x4ad81c
call fcn.004773a0
push eax
push 0
push 0xc
push esi
call ebp
call fcn.004040b0
mov edx, 0x4aeb38
mov ecx, 0x4ad81c
call fcn.004773a0
push eax
push 0
push 0xc
push esi
call ebp
call fcn.0040b540
mov edx, 0x4aeb80
mov ecx, 0x4ad81c
call fcn.004773a0
push eax
push 0
push 0xc
push esi
call ebp
call fcn.00414ff0
mov edx, 0x4aeb88
mov ecx, 0x4ad81c
call fcn.004773a0
push eax
push 0
push 0xc
push esi
call ebp
call fcn.00427040
mov edx, 0x4aeb98
mov ecx, 0x4ad81c
call fcn.004773a0
push eax
push 0
push 0xc
push esi
call ebp
call fcn.00432670
mov edx, 0x4aeb90
mov ecx, 0x4ad81c
call fcn.004773a0
push eax
push 0
push 0xc
push esi
call ebp
call fcn.004449a0
mov edx, 0x4aeba0
mov ecx, 0x4ad81c
call fcn.004773a0
push eax
push 0
push 0xc
push esi
call ebp
call fcn.00449870
mov edx, 0x4b0c30
mov ecx, 0x4ad81c
call fcn.004773a0
push eax
push 0
push 0xc
push esi
call ebp
call fcn.004541c0
push 0x4ded80
push 0
push 0x4ba6b0
push 0x4af780
call edi
push 3
push 0
push 0
push 0
test eax, eax
mov eax, dword [sym.imp.user32.dll_SetWindowPos]
push 0
jne 0x480316
push 0xfffffffffffffffe
jmp 0x480318
push 0xffffffffffffffff
push dword [0x4def88]
call eax
mov esi, dword [sym.imp.user32.dll_SystemParametersInfoW]
push 0
push reloc.user32.dll_GetDlgItemTextW
push 0
push 0x10
call esi
push 0x4ded80
push 0
push 0x4ba6f4
push 0x4af780
call edi
push 2
push 0
test eax, eax
jne 0x480352
push 1
jmp 0x480354
push 0
push 0x11
call esi
push 0x4ded80
push 0
push 0x4ba6bc
push 0x4af780
call edi
mov dword [0x4df1b0], eax
call fcn.0047a520
call fcn.00470d10
test eax, eax
je 0x480391
push 1
push 0x755e
push dword [0x4df1a8]
call dword [sym.imp.user32.dll_EnableMenuItem]
lea eax, [esp + 0x68]
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetWindowRect]
lea eax, [esp + 0x48]
push eax
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetClientRect]
mov eax, dword [esp + 0x70]
sub eax, dword [esp + 0x50]
mov esi, dword [0x4c51a4]
mov ebx, dword [0x4c51a0]
add esi, eax
mov eax, dword [esp + 0x74]
sub eax, dword [esp + 0x54]
push 0x4ded80
push 0
push 0x4ba6cc
add ebx, eax
mov dword [0x4c51a4], esi
push 0x4af780
mov dword [0x4c51a0], ebx
call edi
test eax, eax
je 0x480428
push 0x4ded80
push dword [0x4c51a4]
push 0x4c0a88
push 0x4c0a94
call edi
push 0x4ded80
push dword [0x4c51a0]
mov esi, eax
push 0x4c0aa0
push 0x4c0a94
call edi
mov ebx, eax
push 0
call dword [sym.imp.user32.dll_GetSystemMetrics]
cdq
sub eax, edx
mov ebp, eax
mov eax, esi
cdq
sub eax, edx
sar ebp, 1
sar eax, 1
push 1
sub ebp, eax
call dword [sym.imp.user32.dll_GetSystemMetrics]
cdq
sub eax, edx
mov ecx, eax
mov eax, ebx
cdq
push 0x4ded80
sub eax, edx
sar ecx, 1
push 0
sar eax, 1
push 0x4ba6e0
sub ecx, eax
push 0x4af780
mov dword [esp + 0x28], ecx
call edi
test eax, eax
je 0x48049f
push 0x4ded80
push ebp
push 0x4c0ab0
push 0x4c0a94
call edi
push 0x4ded80
mov ebp, eax
mov eax, dword [esp + 0x1c]
push eax
push 0x4c0abc
push 0x4c0a94
call edi
jmp 0x4804a3
mov eax, dword [esp + 0x18]
push 0
push ebx
push esi
push eax
push ebp
push 1
push dword [0x4def88]
call dword [sym.imp.user32.dll_SetWindowPos]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.user32.dll_DestroyWindow]
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push 5
push dword [reloc.kernel32.dll_InitializeSListHead]
call esi
push dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
push ebx
call esi
push ebx
call dword [sym.imp.user32.dll_UpdateWindow]
push 0x4ded80
push 0
push 0x4b9868
push 0x4af780
call edi
test eax, eax
je 0x480519
push 0
push 0x4627f0
push dword [0x4def88]
push 0x4c10b0
push dword [InitializeSListHead]
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov esi, dword [sym.imp.kernel32.dll_CreateThread]
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0x474a70
push 0
push 0
call esi
xor eax, eax
push 0x206
push eax
mov word [esp + 0xa8], ax
lea eax, [esp + 0xaa]
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0xa0]
push 0x4def98
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4b9650
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xa0]
push eax
push 0
push 0x4b966c
push 0x4b9684
call edi
cmp eax, 0x5a3d
jle 0x4805b3
cmp dword [0x4db794], 0
jne 0x4805b3
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0x45e960
push 0
push 0
call esi
mov eax, 1
jmp 0x47fee6
call fcn.0048d945
int3