Function at 0x412080
Capabilities:
Enumerate gui resources
Enumerate processes
Get disk information
Get disk size
Get memory capacity
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x42d024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x412096
push 1
call fcn.00414f9a
add esp, 4
test eax, eax
je 0x4120a6
mov dword [esi], eax
mov byte [eax], 0
push 0x151
mov dword [esi + 4], 0
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x544]
add esp, 4
push ecx
call fcn.00404350
add esp, 4
push 0xc
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x30]
add esp, 4
push eax
call fcn.00415e1b
add esp, 4
test eax, eax
je 0x41210b
mov ebx, eax
mov dword [ebp - 0x3d8], eax
jmp 0x412116
mov ebx, 0x4275bc
mov dword [ebp - 0x3d8], ebx
push 0xd
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x34]
add esp, 4
push eax
call fcn.00415e1b
add esp, 4
mov dword [ebp - 0x3f0], eax
test eax, eax
jne 0x412145
mov dword [ebp - 0x3f0], 0x4275bc
push 1
call fcn.00404ac0
mov edi, eax
add esp, 4
mov dword [ebp - 0x3d0], edi
call fcn.00404930
push 0xe
mov dword [ebp - 0x3c4], eax
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x38]
add esp, 4
push eax
call fcn.00415e1b
add esp, 4
mov dword [ebp - 0x3ec], eax
test eax, eax
jne 0x412192
mov dword [ebp - 0x3ec], 0x4275bc
push 0xf
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x3c]
add esp, 4
push eax
call fcn.00415e1b
add esp, 4
mov dword [ebp - 0x3cc], eax
test eax, eax
jne 0x4121c2
mov dword [ebp - 0x3cc], 0x4275bc
call fcn.0040b500
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4121d0
sub eax, edx
mov dword [ebp - 0x3bc], eax
call fcn.0040a5e0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4121e7
sub eax, edx
mov dword [ebp - 0x3c0], eax
mov eax, ebx
lea edx, [eax + 1]
jmp 0x412200
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412200
sub eax, edx
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412218
sub eax, edx
mov dword [ebp - 0x3f4], eax
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412230
sub eax, edx
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412248
sub eax, edx
mov ebx, eax
mov eax, dword [ebp - 0x3ec]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412260
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x3cc]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x412274
sub eax, edi
add eax, ecx
mov ecx, dword [ebp - 0x3bc]
add eax, ebx
add eax, dword [ebp - 0x3c8]
add eax, dword [ebp - 0x3f4]
add eax, dword [ebp - 0x3e4]
add eax, dword [ebp - 0x3c0]
lea edi, [eax + ecx + 0xe9]
push edi
call fcn.00414f9a
add esp, 4
mov dword [ebp - 0x3c8], eax
test eax, eax
je 0x4122a6
lea edx, [ebp - 0x168]
push edx
mov dword [ebp - 0x168], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ebx, dword [ebp - 0x160]
mov edi, dword [ebp - 0x15c]
push 0
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax]
add esp, 4
push 0x159
mov dword [ebp - 0x3bc], ecx
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x564]
mov ecx, dword [ebp - 0x3cc]
mov edx, dword [ebp - 0x3ec]
add esp, 4
shrd ebx, edi, 0x14
shr edi, 0x14
push edi
push ebx
mov ebx, dword [ebp - 0x3d0]
push ecx
mov ecx, dword [ebp - 0x3f0]
push edx
mov edx, dword [ebp - 0x3d8]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3c4]
push eax
push ebx
push ecx
push edx
call fcn.0040a5e0
push eax
push ecx
call fcn.00408950
add esp, 4
push eax
mov eax, dword [ebp - 0x3bc]
push eax
call fcn.0040b500
mov ecx, dword [ebp - 0x3c0]
mov edi, dword [ebp - 0x3c8]
push eax
push ecx
push edi
call fcn.0041512c
push edi
call fcn.00404350
add esp, 0x3c
push 0x42a8a0
call fcn.00404350
add esp, 4
test ebx, ebx
je 0x41239a
mov edx, ebx
push edx
call fcn.00414f60
add esp, 4
mov eax, dword [ebp - 0x3c4]
test eax, eax
je 0x4123ad
push eax
call fcn.00414f60
add esp, 4
mov eax, dword [ebp - 0x3c8]
push eax
call fcn.00414f60
add esp, 4
push 0x152
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edx, dword [ecx + 0x548]
add esp, 4
push edx
call fcn.00404350
add esp, 4
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x412400
push 0x92
call fcn.00414f9a
mov edi, eax
add esp, 4
test edi, edi
je 0x412400
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x110]
sub eax, edx
mov ebx, 0x428a5c
jns 0x41242f
mov ebx, 0x42a734
push 0x15a
call fcn.004051a0
movzx ecx, word [ebp - 0x120]
movzx eax, word [ebp - 0x110]
sub eax, ecx
cdq
xor eax, edx
add esp, 4
sub eax, edx
mov edx, dword [0x42f218]
push eax
mov eax, dword [edx + 0x568]
push ebx
push eax
push edi
call fcn.0041512c
push edi
call fcn.00404350
add esp, 0x14
push 0x15b
call fcn.004051a0
movzx ecx, word [ebp - 0x10c]
movzx edx, word [ebp - 0x10e]
movzx eax, word [ebp - 0x110]
add esp, 4
push ecx
movzx ecx, word [ebp - 0x118]
push edx
movzx edx, word [ebp - 0x116]
push eax
movzx eax, word [ebp - 0x112]
push ecx
mov ecx, dword [0x42f218]
push edx
mov edx, dword [ecx + 0x56c]
push eax
push edx
push edi
call fcn.0041512c
push edi
call fcn.00404350
add esp, 0x24
push 0x15c
call fcn.004051a0
mov eax, dword [0x42f218]
mov ebx, dword [eax + 0x570]
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, 0x88888889
mul edx
shr edx, 5
push edx
push ebx
push edi
call fcn.0041512c
add esp, 0xc
push edi
call fcn.00404350
add esp, 4
push 0x42a8a0
call fcn.00404350
add esp, 4
push edi
call fcn.00414f60
add esp, 4
push 0x153
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x54c]
add esp, 4
push eax
call fcn.00404350
add esp, 4
push 0x411df0
call fcn.00403be0
add esp, 4
push 4
call fcn.00414f9a
add esp, 4
test eax, eax
je 0x412555
xor edi, edi
push edi
push 0x411df0
mov dword [0x42f9b4], eax
mov dword [0x42f9b8], edi
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x3c4], edi
cmp dword [0x42f9b8], edi
jbe 0x412685
mov edi, edi
mov edx, dword [0x42f9b4]
mov ecx, dword [ebp - 0x3c4]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4125a8
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x4125c2
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x412602
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
lea ebx, [ebx]
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x4125f0
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add edi, 2
push edi
push ebx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x412616
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + 1]
cmp eax, edx
jae 0x412648
mov ecx, 0x428a94
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
inc edx
cmp eax, edx
jb 0x412637
inc dword [esi + 4]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edi, dword [ebp - 0x3c4]
mov byte [eax + ecx], 0
mov edx, dword [0x42f9b4]
mov eax, dword [edx + edi*4]
test eax, eax
je 0x412670
push eax
call fcn.00414f60
add esp, 4
inc edi
mov dword [ebp - 0x3c4], edi
cmp edi, dword [0x42f9b8]
jb 0x412590
xor edi, edi
mov eax, dword [0x42f9b4]
cmp eax, edi
je 0x412697
push eax
call fcn.00414f60
add esp, 4
cmp byte [0x42f0d4], 0
je 0x4126b3
push 0x32
call fcn.004156a1
add esp, 4
cmp byte [0x42f0d4], 0
jne 0x4126a0
mov ecx, dword [0x42f0cc]
cmp ecx, edi
je 0x4126e7
mov edx, dword [0x42f0d0]
xor eax, eax
cmp edx, edi
jbe 0x4126e7
lea esp, [esp]
mov ebx, dword [ecx + eax*4]
cmp dword [ebx], 0x411df0
je 0x4126e2
inc eax
cmp eax, edx
jb 0x4126d0
jmp 0x4126e7
mov eax, ebx
mov dword [eax + 4], edi
mov edi, dword [esi + 4]
mov ebx, dword [esi]
mov byte [0x42f0d4], 0
add edi, 3
push edi
push ebx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x4126f6
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp eax, ecx
jae 0x41272a
mov ecx, 0x42a8a0
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x412717
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x154
mov byte [eax + ecx], 0
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x550]
add esp, 4
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412760
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
lea ebx, [ebx]
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x412780
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x4127ba
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x4127a8
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0
push 2
mov byte [eax + ecx], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x3c4], eax
test eax, eax
je 0x4128e6
lea edx, [ebp - 0x290]
push edx
push eax
mov dword [ebp - 0x290], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4128d9
mov edi, edi
lea eax, [ebp - 0x26c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412810
mov ecx, dword [esi + 4]
sub eax, edx
mov edx, dword [esi]
mov edi, eax
lea ebx, [edi + ecx + 1]
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x3bc]
push ebx
push eax
call fcn.0041507f
add esp, 8
test eax, eax
je 0x41282a
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x412864
lea ecx, [ebp - 0x26c]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x412852
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add edi, 2
push edi
push ebx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x412878
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + 1]
cmp eax, edx
jae 0x4128b1
mov ecx, 0x428a94
sub ecx, eax
lea esp, [esp]
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
inc edx
cmp eax, edx
jb 0x4128a0
inc dword [esi + 4]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea edx, [ebp - 0x290]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x3c4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x412800
mov ecx, dword [ebp - 0x3c4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add edi, 3
mov edi, edi
push edi
push ebx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x4128f0
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + 2]
cmp eax, edx
jae 0x412924
mov ecx, 0x42a8a0
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x412911
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x155
mov byte [eax + ecx], 0
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x554]
add esp, 4
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412953
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x41296d
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x4129a7
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x412995
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 9
mov byte [eax + ecx], 0
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x24]
add esp, 4
push eax
call fcn.00415e1b
add esp, 4
mov ebx, eax
test eax, eax
jne 0x4129da
mov ebx, 0x4275bc
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4129e0
sub eax, edx
lea edi, [eax + 8]
lea esp, [esp]
push edi
call fcn.00414f9a
add esp, 4
mov dword [ebp - 0x3bc], eax
test eax, eax
je 0x4129f0
push ebx
mov edi, eax
push str._s.
push edi
call fcn.0041512c
add esp, 0xc
lea eax, [ebp - 0x3b8]
push eax
push edi
call fcn.00415fe8
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x412aea
cmp ebx, 0xffffffff
je 0x412aea
jmp 0x412a40
mov ecx, 0x42a6d4
lea eax, [ebp - 0x394]
jmp 0x412a50
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412a70
test dl, dl
je 0x412a6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412a70
add eax, 2
add ecx, 2
test dl, dl
jne 0x412a50
xor eax, eax
jmp 0x412a75
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x412ac9
mov ecx, 0x42a6d8
lea eax, [ebp - 0x394]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412aa4
test dl, dl
je 0x412aa0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412aa4
add eax, 2
add ecx, 2
test dl, dl
jne 0x412a84
xor eax, eax
jmp 0x412aa9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x412ac9
lea ecx, [ebp - 0x394]
push ecx
call fcn.00404350
add esp, 4
push 0x428a94
call fcn.00404350
add esp, 4
lea edx, [ebp - 0x3b8]
push edx
push ebx
call fcn.0041610f
add esp, 8
test eax, eax
je 0x412a40
push ebx
call fcn.0041623d
add esp, 4
push edi
call fcn.00414f60
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add esp, 4
add edi, 3
jmp 0x412b00
push edi
push ebx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x412b00
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp eax, ecx
jae 0x412b34
mov ecx, 0x42a8a0
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x412b21
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x156
mov byte [eax + ecx], 0
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x558]
add esp, 4
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412b63
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
lea ecx, [ecx]
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x412b80
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x412bba
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x412ba8
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push fcn.00411eb0
mov byte [eax + ecx], 0
call fcn.00403be0
add esp, 4
push 4
call fcn.00414f9a
add esp, 4
test eax, eax
je 0x412bd3
mov dword [0x42f9bc], eax
push 4
call fcn.00414f9a
add esp, 4
test eax, eax
je 0x412be6
xor edi, edi
push edi
mov dword [0x42f9c0], eax
mov dword [0x42f9c4], edi
call fcn.00411eb0
add esp, 4
mov dword [ebp - 0x3cc], edi
cmp dword [0x42f9c4], edi
jbe 0x412ef3
lea esp, [esp]
mov edx, dword [0x42f9c0]
mov edi, dword [ebp - 0x3cc]
mov eax, dword [edx + edi*4]
cmp eax, 6
ja case.default.0x412c38
jmp dword [eax*4 + 0x413780]
push 0x160
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x580]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x412c60
jmp 0x412dba
push 0x161
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x584]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x412c90
jmp 0x412dba
push 0x162
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x588]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x412cc0
jmp 0x412dba
push 0x163
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x58c]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x412cf0
jmp 0x412dba
push 0x164
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x590]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x412d20
jmp 0x412dba
push 0x165
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x594]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x412d50
jmp 0x412dba
push 0x166
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x598]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x412d80
jmp 0x412dba
push 0x167
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x59c]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x412db0
mov edx, dword [0x42f9bc]
mov eax, dword [edx + edi*4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412dc6
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x108]
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412de0
sub eax, edi
lea edi, [edx + eax + 0x2e]
lea ecx, [ecx]
push edi
call fcn.00414f9a
mov ebx, eax
add esp, 4
mov dword [ebp - 0x3e4], ebx
test ebx, ebx
je 0x412df0
push 0x15d
call fcn.004051a0
mov eax, dword [0x42f9bc]
mov ecx, dword [ebp - 0x3cc]
mov edx, dword [eax + ecx*4]
mov ecx, dword [0x42f218]
add esp, 4
push edx
mov edx, dword [ecx + 0x574]
lea eax, [ebp - 0x108]
push eax
push edx
push ebx
call fcn.0041512c
mov eax, ebx
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412e43
sub eax, edx
mov edx, dword [esi]
mov edi, eax
mov eax, dword [esi + 4]
lea ecx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
mov dword [ebp - 0x3c0], edx
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x3c0]
push eax
push ecx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x412e63
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + edi]
cmp eax, edx
jae 0x412ea8
mov ecx, ebx
sub ecx, eax
lea ecx, [ecx]
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x412e90
mov ebx, dword [ebp - 0x3e4]
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push ebx
mov byte [eax + ecx], 0
call fcn.00414f60
mov edx, dword [ebp - 0x3cc]
mov eax, dword [0x42f9bc]
mov eax, dword [eax + edx*4]
add esp, 4
test eax, eax
je 0x412ed8
push eax
call fcn.00414f60
add esp, 4
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp eax, dword [0x42f9c4]
jb 0x412c20
xor edi, edi
mov eax, dword [0x42f9bc]
cmp eax, edi
je 0x412f05
push eax
call fcn.00414f60
add esp, 4
mov eax, dword [0x42f9c0]
cmp eax, edi
je 0x412f17
push eax
call fcn.00414f60
add esp, 4
cmp byte [0x42f0d4], 0
je 0x412f33
push 0x32
call fcn.004156a1
add esp, 4
cmp byte [0x42f0d4], 0
jne 0x412f20
mov ecx, dword [0x42f0cc]
cmp ecx, edi
je 0x412f67
mov edx, dword [0x42f0d0]
xor eax, eax
cmp edx, edi
jbe 0x412f67
lea esp, [esp]
mov ebx, dword [ecx + eax*4]
cmp dword [ebx], fcn.00411eb0
je 0x412f62
inc eax
cmp eax, edx
jb 0x412f50
jmp 0x412f67
mov ecx, ebx
mov dword [ecx + 4], edi
mov edi, dword [esi + 4]
mov ebx, dword [esi]
mov byte [0x42f0d4], 0
add edi, 3
push edi
push ebx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x412f76
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + 2]
cmp eax, edx
jae 0x412faa
mov ecx, 0x42a8a0
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x412f97
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x157
mov byte [eax + ecx], 0
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x55c]
add esp, 4
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412fe0
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
lea ebx, [ebx]
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x413000
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x41303a
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x413028
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov byte [eax + ecx], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3d4], 0x5c3a41
mov dword [ebp - 0x3d0], ecx
mov eax, 1
shl eax, cl
lea edx, [ecx + 0x41]
mov byte [ebp - 0x3d4], dl
test dword [ebp - 0x3bc], eax
je 0x4132bd
lea eax, [ebp - 0x3d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x41309b
jmp dword [eax*4 + 0x41379c]
push 0x168
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x5a0]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4130c3
jmp 0x41318a
push 0x169
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x5a4]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4130f3
jmp 0x41318a
push 0x16a
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x5a8]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x413122
jmp 0x41318a
push 0x16b
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x5ac]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x413152
jmp 0x41318a
push 0x16c
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x5b0]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x413180
push edi
push edi
lea eax, [ebp - 0x3e8]
push eax
lea ecx, [ebp - 0x3d4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x4131b0
mov dword [ebp - 0x3e8], edi
mov dword [ebp - 0x3e4], edi
lea eax, [ebp - 0x3d4]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4131c0
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x108]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4131d4
sub eax, edi
lea ebx, [eax + edx + 0x5f]
push ebx
call fcn.00414f9a
mov edi, eax
add esp, 4
mov dword [ebp - 0x3c8], edi
test edi, edi
je 0x4131e1
push 0x15e
call fcn.004051a0
mov edx, dword [ebp - 0x3e8]
mov eax, dword [ebp - 0x3e4]
shrd edx, eax, 0x1e
add esp, 4
shr eax, 0x1e
push eax
mov eax, dword [0x42f218]
push edx
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [eax + 0x578]
lea edx, [ebp - 0x3d4]
push edx
push ecx
push edi
call fcn.0041512c
mov eax, edi
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413240
sub eax, edx
mov edx, dword [esi + 4]
mov edi, eax
mov eax, dword [esi]
lea ebx, [edi + edx + 1]
mov dword [ebp - 0x3c0], eax
lea ebx, [ebx]
mov ecx, dword [ebp - 0x3c0]
push ebx
push ecx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x413260
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + edi]
cmp eax, edx
jae 0x41329a
mov ecx, dword [ebp - 0x3c8]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [eax + ecx]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x413288
add dword [esi + 4], edi
mov edx, dword [ebp - 0x3c8]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edx
mov byte [eax + ecx], 0
call fcn.00414f60
mov ecx, dword [ebp - 0x3d0]
add esp, 4
xor edi, edi
inc ecx
mov dword [ebp - 0x3d0], ecx
cmp ecx, 0x1a
jb 0x413066
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add edi, 3
push edi
push ebx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x4132d5
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp eax, ecx
jae 0x413309
mov ecx, 0x42a8a0
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [eax + ecx]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x4132f6
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x158
mov byte [eax + ecx], 0
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x560]
add esp, 4
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413338
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x413352
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x413392
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
lea ebx, [ebx]
mov edx, dword [esi]
mov bl, byte [eax + ecx]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x413380
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov byte [eax + ecx], 0
push 0x16d
mov dword [ebp - 0x3dc], 0
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x5b4]
add esp, 4
lea edx, [ebp - 0x3dc]
push edx
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [ebp - 0x3dc]
test eax, eax
je 0x4136df
push 0x100
lea edx, [ebp - 0x108]
push edx
push 0
push eax
mov dword [ebp - 0x3d8], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4136d2
jmp 0x413410
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413420
sub eax, edx
lea edi, [eax + 0x31]
lea esp, [esp]
push edi
call fcn.00414f9a
add esp, 4
mov dword [ebp - 0x3c4], eax
test eax, eax
je 0x413430
push 0x16d
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edx, dword [ecx + 0x5b4]
add esp, 4
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x3c4]
push edx
push 0x42a684
push eax
call fcn.0041512c
push 0x16e
call fcn.004051a0
mov eax, dword [ebp - 0x3c4]
mov ecx, dword [0x42f218]
mov edi, dword [ecx + 0x5b8]
add esp, 0x14
lea edx, [ebp - 0x3c8]
push edx
push 0x20019
push 0
push eax
xor bl, bl
push connect
mov byte [ebp - 0x270], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0x413694
lea ecx, [ebp - 0x3bc]
push ecx
lea edx, [ebp - 0x270]
push edx
push 0
push 0
push edi
push eax
mov dword [ebp - 0x3bc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4134ee
mov bl, 1
mov eax, dword [ebp - 0x3c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x413694
lea eax, [ebp - 0x270]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413510
sub eax, edx
lea edi, [eax + 1]
lea esp, [esp]
push edi
call fcn.00414f9a
mov ebx, eax
add esp, 4
mov dword [ebp - 0x3c0], ebx
test ebx, ebx
je 0x413520
push ebx
push 0
push 0
lea ecx, [ebp - 0x270]
push 0
push ecx
call fcn.0041645b
add esp, 0x14
push 0x14
call fcn.004051a0
mov edx, dword [0x42f218]
mov ecx, dword [edx + 0x50]
add esp, 4
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x413580
test dl, dl
je 0x41357c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x413580
add eax, 2
add ecx, 2
test dl, dl
jne 0x413560
xor eax, eax
jmp 0x413585
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41368b
lea eax, [ebp - 0x270]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413596
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x108]
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4135b0
sub eax, edi
lea ebx, [edx + eax + 0x18]
lea ecx, [ecx]
push ebx
call fcn.00414f9a
mov edi, eax
add esp, 4
mov dword [ebp - 0x3d0], edi
test edi, edi
je 0x4135c0
push 0x15f
call fcn.004051a0
mov edx, dword [0x42f218]
add esp, 4
lea eax, [ebp - 0x108]
push eax
mov eax, dword [edx + 0x57c]
lea ecx, [ebp - 0x270]
push ecx
push eax
push edi
call fcn.0041512c
mov eax, edi
add esp, 0x10
lea edx, [eax + 1]
jmp 0x413610
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413610
mov ecx, dword [esi + 4]
sub eax, edx
mov edx, dword [esi]
mov edi, eax
lea ebx, [edi + ecx + 1]
mov dword [ebp - 0x3bc], edx
lea ebx, [ebx]
mov eax, dword [ebp - 0x3bc]
push ebx
push eax
call fcn.0041507f
add esp, 8
test eax, eax
je 0x413630
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x41366a
mov ecx, dword [ebp - 0x3d0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [eax + ecx]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x413658
add dword [esi + 4], edi
mov edx, dword [ebp - 0x3d0]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edx
mov byte [eax + ecx], 0
call fcn.00414f60
mov ebx, dword [ebp - 0x3c0]
add esp, 4
push ebx
call fcn.00414f60
add esp, 4
mov eax, dword [ebp - 0x3c4]
push eax
call fcn.00414f60
mov eax, dword [ebp - 0x3d8]
mov edx, dword [ebp - 0x3dc]
add esp, 4
push 0x100
lea ecx, [ebp - 0x108]
inc eax
push ecx
push eax
push edx
mov dword [ebp - 0x3d8], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x413410
mov eax, dword [ebp - 0x3dc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add edi, 3
push edi
push ebx
call fcn.0041507f
add esp, 8
test eax, eax
je 0x4136e7
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp eax, ecx
jae 0x41371b
mov ecx, 0x42a8a0
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [eax + ecx]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x413708
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov edi, dword [esi + 4]
inc edi
lea esp, [esp]
push edi
call fcn.00414f9a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x413730
mov ecx, dword [esi]
mov edx, ebx
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x413743
mov eax, dword [esi]
mov dword [esi + 4], 0
test eax, eax
je 0x413763
push eax
call fcn.00414f60
add esp, 4
push esi
call fcn.00414f60
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00413f0d
mov esp, ebp
pop ebp
ret