Function at 0x410e00
Capabilities:
Enumerate gui resources
Enumerate processes
Get disk information
Get disk size
Get memory capacity
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x410e16
push 1
call fcn.00413e95
add esp, 4
test eax, eax
je 0x410e26
push 0x112
mov dword [esi], eax
mov dword [esi + 4], 0
call fcn.00404a40
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x448]
add esp, 4
push ecx
call fcn.00403c30
add esp, 4
push 0
call fcn.00404a40
mov edx, dword [0x42c160]
mov ebx, dword [edx]
add esp, 4
push 0xc
mov dword [ebp - 0x3bc], ebx
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x30]
add esp, 4
push eax
call fcn.00414c6b
add esp, 4
test eax, eax
je 0x410e9f
mov edi, eax
mov dword [ebp - 0x3d0], eax
jmp 0x410eaa
mov edi, 0x425582
mov dword [ebp - 0x3d0], edi
push 0xd
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x34]
add esp, 4
push eax
call fcn.00414c6b
add esp, 4
mov dword [ebp - 0x3f0], eax
test eax, eax
jne 0x410eda
mov dword [ebp - 0x3f0], 0x425582
call fcn.004043a0
mov dword [ebp - 0x3d4], eax
call fcn.00404210
push 0xe
mov dword [ebp - 0x3c4], eax
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x38]
add esp, 4
push eax
call fcn.00414c6b
add esp, 4
mov dword [ebp - 0x3ec], eax
test eax, eax
jne 0x410f20
mov dword [ebp - 0x3ec], 0x425582
push 0xf
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x3c]
add esp, 4
push eax
call fcn.00414c6b
add esp, 4
mov dword [ebp - 0x3cc], eax
test eax, eax
jne 0x410f4f
mov dword [ebp - 0x3cc], 0x425582
call fcn.0040a650
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410f57
sub eax, edx
mov dword [ebp - 0x3c0], eax
mov eax, ebx
lea edx, [eax + 1]
jmp 0x410f70
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410f70
sub eax, edx
mov dword [ebp - 0x3e4], eax
call fcn.00409760
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410f87
sub eax, edx
mov dword [ebp - 0x3f8], eax
mov eax, edi
lea edx, [eax + 1]
jmp 0x410fa0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410fa0
sub eax, edx
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410fb8
sub eax, edx
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3d4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410fd0
sub eax, edx
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410fe8
sub eax, edx
mov ebx, eax
mov eax, dword [ebp - 0x3ec]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411000
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x3cc]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x411014
sub eax, edi
add eax, ecx
mov ecx, dword [ebp - 0x3c0]
add eax, ebx
add eax, dword [ebp - 0x3c8]
add eax, dword [ebp - 0x3fc]
add eax, dword [ebp - 0x3f4]
add eax, dword [ebp - 0x3f8]
add eax, dword [ebp - 0x3e4]
lea edi, [eax + ecx + 0xe2]
lea esp, [esp]
push edi
call fcn.00413e95
add esp, 4
mov dword [ebp - 0x3c8], eax
test eax, eax
je 0x411050
lea edx, [ebp - 0x168]
push edx
mov dword [ebp - 0x168], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ebx, dword [ebp - 0x160]
mov edi, dword [ebp - 0x15c]
push 0x11a
call fcn.00404a40
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x468]
mov edx, dword [ebp - 0x3cc]
mov eax, dword [ebp - 0x3ec]
add esp, 4
shrd ebx, edi, 0x14
shr edi, 0x14
push edi
push ebx
mov ebx, dword [ebp - 0x3d4]
push edx
mov edx, dword [ebp - 0x3f0]
push eax
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3c0], ecx
mov ecx, dword [ebp - 0x3c4]
push ecx
push ebx
push edx
push eax
call fcn.00409760
push eax
push ecx
call fcn.00407da0
mov ecx, dword [ebp - 0x3bc]
add esp, 4
push eax
push ecx
call fcn.0040a650
mov edx, dword [ebp - 0x3c0]
mov edi, dword [ebp - 0x3c8]
push eax
push edx
push edi
call fcn.00413fd6
push edi
call fcn.00403c30
add esp, 0x3c
push 0x427e98
call fcn.00403c30
add esp, 4
test ebx, ebx
je 0x41112c
mov eax, ebx
push eax
call fcn.00413e5b
add esp, 4
mov eax, dword [ebp - 0x3c4]
test eax, eax
je 0x41113f
push eax
call fcn.00413e5b
add esp, 4
mov ecx, dword [ebp - 0x3c8]
push ecx
call fcn.00413e5b
add esp, 4
push 0x113
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x44c]
add esp, 4
push eax
call fcn.00403c30
add esp, 4
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ebx, [ebx]
push 0x92
call fcn.00413e95
mov edi, eax
add esp, 4
test edi, edi
je 0x411190
movzx eax, word [ebp - 0x120]
movzx ecx, word [ebp - 0x110]
sub ecx, eax
mov ebx, 0x427e9c
jns 0x4111bf
mov ebx, 0x427d3c
push 0x11b
call fcn.00404a40
movzx edx, word [ebp - 0x120]
movzx eax, word [ebp - 0x110]
sub eax, edx
cdq
xor eax, edx
add esp, 4
sub eax, edx
push eax
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x46c]
push ebx
push ecx
push edi
call fcn.00413fd6
push edi
call fcn.00403c30
add esp, 0x14
push 0x11c
call fcn.00404a40
movzx edx, word [ebp - 0x10c]
movzx eax, word [ebp - 0x10e]
movzx ecx, word [ebp - 0x110]
add esp, 4
push edx
movzx edx, word [ebp - 0x118]
push eax
movzx eax, word [ebp - 0x116]
push ecx
movzx ecx, word [ebp - 0x112]
push edx
mov edx, dword [0x42c160]
push eax
mov eax, dword [edx + 0x470]
push ecx
push eax
push edi
call fcn.00413fd6
push edi
call fcn.00403c30
add esp, 0x24
push 0x11d
call fcn.00404a40
mov ecx, dword [0x42c160]
mov ebx, dword [ecx + 0x474]
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
shr edx, 6
mov eax, 0x88888889
mul edx
shr edx, 5
push edx
push ebx
push edi
call fcn.00413fd6
add esp, 0xc
push edi
call fcn.00403c30
add esp, 4
push 0x427e98
call fcn.00403c30
add esp, 4
push edi
call fcn.00413e5b
add esp, 4
push 0x114
call fcn.00404a40
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x450]
add esp, 4
push ecx
call fcn.00403c30
add esp, 4
push fcn.00410c30
call fcn.00403510
add esp, 4
push 4
call fcn.00413e95
add esp, 4
test eax, eax
je 0x4112e4
xor edi, edi
push edi
push 0x410b70
mov dword [0x42c888], eax
mov dword [0x42c88c], edi
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x3c4], edi
cmp dword [0x42c88c], edi
jbe 0x41140f
mov edx, dword [0x42c888]
mov eax, dword [ebp - 0x3c4]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411335
mov ecx, dword [esi + 4]
sub eax, edx
mov edx, dword [esi]
mov edi, eax
lea ebx, [edi + ecx + 1]
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x3bc]
push ebx
push eax
call fcn.00413f29
add esp, 8
test eax, eax
je 0x41134f
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x411389
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x411377
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add edi, 2
lea ecx, [ecx]
push edi
push ebx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x4113a0
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + 1]
cmp eax, edx
jae 0x4113d2
mov ecx, 0x427e94
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
inc edx
cmp eax, edx
jb 0x4113c1
inc dword [esi + 4]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edi, dword [ebp - 0x3c4]
mov byte [eax + ecx], 0
mov edx, dword [0x42c888]
mov eax, dword [edx + edi*4]
test eax, eax
je 0x4113fa
push eax
call fcn.00413e5b
add esp, 4
inc edi
mov dword [ebp - 0x3c4], edi
cmp edi, dword [0x42c88c]
jb 0x41131d
xor edi, edi
mov eax, dword [0x42c888]
cmp eax, edi
je 0x411421
push eax
call fcn.00413e5b
add esp, 4
cmp byte [0x42c01c], 0
je 0x411443
lea ebx, [ebx]
push 0x32
call fcn.004144a4
add esp, 4
cmp byte [0x42c01c], 0
jne 0x411430
mov ecx, dword [0x42c014]
cmp ecx, edi
je 0x411477
mov edx, dword [0x42c018]
xor eax, eax
cmp edx, edi
jbe 0x411477
lea esp, [esp]
mov ebx, dword [ecx + eax*4]
cmp dword [ebx], fcn.00410c30
je 0x411472
inc eax
cmp eax, edx
jb 0x411460
jmp 0x411477
mov eax, ebx
mov dword [eax + 4], edi
mov edi, dword [esi + 4]
mov ebx, dword [esi]
mov byte [0x42c01c], 0
add edi, 3
push edi
push ebx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x411486
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp eax, ecx
jae 0x4114ba
mov ecx, 0x427e98
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x4114a7
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x115
mov byte [eax + ecx], 0
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x454]
add esp, 4
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4114f0
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
lea ebx, [ebx]
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x411510
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x41154a
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x411538
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0
push 2
mov byte [eax + ecx], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x3c4], eax
test eax, eax
je 0x411676
lea edx, [ebp - 0x290]
push edx
push eax
mov dword [ebp - 0x290], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x411669
mov edi, edi
lea eax, [ebp - 0x26c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4115a0
mov ecx, dword [esi + 4]
sub eax, edx
mov edx, dword [esi]
mov edi, eax
lea ebx, [edi + ecx + 1]
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x3bc]
push ebx
push eax
call fcn.00413f29
add esp, 8
test eax, eax
je 0x4115ba
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x4115f4
lea ecx, [ebp - 0x26c]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x4115e2
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add edi, 2
push edi
push ebx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x411608
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + 1]
cmp eax, edx
jae 0x411641
mov ecx, 0x427e94
sub ecx, eax
lea esp, [esp]
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
inc edx
cmp eax, edx
jb 0x411630
inc dword [esi + 4]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea edx, [ebp - 0x290]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x3c4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x411590
mov ecx, dword [ebp - 0x3c4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add edi, 3
mov edi, edi
push edi
push ebx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x411680
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + 2]
cmp eax, edx
jae 0x4116b4
mov ecx, 0x427e98
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x4116a1
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x116
mov byte [eax + ecx], 0
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x458]
add esp, 4
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4116e3
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x4116fd
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x411737
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x411725
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 9
mov byte [eax + ecx], 0
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x24]
add esp, 4
push eax
call fcn.00414c6b
add esp, 4
mov ebx, eax
test eax, eax
jne 0x41176a
mov ebx, 0x425582
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411770
sub eax, edx
lea edi, [eax + 8]
lea esp, [esp]
push edi
call fcn.00413e95
add esp, 4
mov dword [ebp - 0x3bc], eax
test eax, eax
je 0x411780
push ebx
mov edi, eax
push str._s.
push edi
call fcn.00413fd6
add esp, 0xc
lea eax, [ebp - 0x3b8]
push eax
push edi
call fcn.00414ee9
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41187a
cmp ebx, 0xffffffff
je 0x41187a
jmp 0x4117d0
mov ecx, 0x427d00
lea eax, [ebp - 0x394]
jmp 0x4117e0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411800
test dl, dl
je 0x4117fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411800
add eax, 2
add ecx, 2
test dl, dl
jne 0x4117e0
xor eax, eax
jmp 0x411805
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x411859
mov ecx, 0x427d04
lea eax, [ebp - 0x394]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411834
test dl, dl
je 0x411830
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411834
add eax, 2
add ecx, 2
test dl, dl
jne 0x411814
xor eax, eax
jmp 0x411839
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x411859
lea ecx, [ebp - 0x394]
push ecx
call fcn.00403c30
add esp, 4
push 0x427e94
call fcn.00403c30
add esp, 4
lea edx, [ebp - 0x3b8]
push edx
push ebx
call fcn.00415010
add esp, 8
test eax, eax
je 0x4117d0
push ebx
call fcn.0041513e
add esp, 4
push edi
call fcn.00413e5b
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add esp, 4
add edi, 3
jmp 0x411890
push edi
push ebx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x411890
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp eax, ecx
jae 0x4118c4
mov ecx, 0x427e98
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x4118b1
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x117
mov byte [eax + ecx], 0
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x45c]
add esp, 4
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4118f3
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
lea ecx, [ecx]
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x411910
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x41194a
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x411938
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push fcn.00410c30
mov byte [eax + ecx], 0
call fcn.00403510
add esp, 4
push 4
call fcn.00413e95
add esp, 4
test eax, eax
je 0x411963
mov dword [0x42c890], eax
push 4
call fcn.00413e95
add esp, 4
test eax, eax
je 0x411976
xor edi, edi
push edi
mov dword [0x42c894], eax
mov dword [0x42c898], edi
call fcn.00410c30
add esp, 4
mov dword [ebp - 0x3cc], edi
cmp dword [0x42c898], edi
jbe 0x411c83
lea esp, [esp]
mov edx, dword [0x42c894]
mov edi, dword [ebp - 0x3cc]
mov eax, dword [edx + edi*4]
cmp eax, 6
ja case.default.0x4119c8
jmp dword [eax*4 + 0x412510]
push 0x121
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x484]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4119f0
jmp 0x411b4a
push 0x122
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x488]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411a20
jmp 0x411b4a
push 0x123
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x48c]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411a50
jmp 0x411b4a
push 0x124
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x490]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411a80
jmp 0x411b4a
push 0x125
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x494]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411ab0
jmp 0x411b4a
push 0x126
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x498]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411ae0
jmp 0x411b4a
push 0x127
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x49c]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411b10
jmp 0x411b4a
push 0x128
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x4a0]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411b40
mov edx, dword [0x42c890]
mov eax, dword [edx + edi*4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411b56
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x108]
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411b70
sub eax, edi
lea edi, [edx + eax + 0x2e]
lea ecx, [ecx]
push edi
call fcn.00413e95
mov ebx, eax
add esp, 4
mov dword [ebp - 0x3e4], ebx
test ebx, ebx
je 0x411b80
push 0x11e
call fcn.00404a40
mov eax, dword [0x42c890]
mov ecx, dword [ebp - 0x3cc]
mov edx, dword [eax + ecx*4]
mov ecx, dword [0x42c160]
add esp, 4
push edx
mov edx, dword [ecx + 0x478]
lea eax, [ebp - 0x108]
push eax
push edx
push ebx
call fcn.00413fd6
mov eax, ebx
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411bd3
sub eax, edx
mov edx, dword [esi]
mov edi, eax
mov eax, dword [esi + 4]
lea ecx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
mov dword [ebp - 0x3c0], edx
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x3c0]
push eax
push ecx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x411bf3
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + edi]
cmp eax, edx
jae 0x411c38
mov ecx, ebx
sub ecx, eax
lea ecx, [ecx]
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x411c20
mov ebx, dword [ebp - 0x3e4]
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push ebx
mov byte [eax + ecx], 0
call fcn.00413e5b
mov edx, dword [ebp - 0x3cc]
mov eax, dword [0x42c890]
mov eax, dword [eax + edx*4]
add esp, 4
test eax, eax
je 0x411c68
push eax
call fcn.00413e5b
add esp, 4
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp eax, dword [0x42c898]
jb 0x4119b0
xor edi, edi
mov eax, dword [0x42c890]
cmp eax, edi
je 0x411c95
push eax
call fcn.00413e5b
add esp, 4
mov eax, dword [0x42c894]
cmp eax, edi
je 0x411ca7
push eax
call fcn.00413e5b
add esp, 4
cmp byte [0x42c01c], 0
je 0x411cc3
push 0x32
call fcn.004144a4
add esp, 4
cmp byte [0x42c01c], 0
jne 0x411cb0
mov ecx, dword [0x42c014]
cmp ecx, edi
je 0x411cf7
mov edx, dword [0x42c018]
xor eax, eax
cmp edx, edi
jbe 0x411cf7
lea esp, [esp]
mov ebx, dword [ecx + eax*4]
cmp dword [ebx], fcn.00410c30
je 0x411cf2
inc eax
cmp eax, edx
jb 0x411ce0
jmp 0x411cf7
mov ecx, ebx
mov dword [ecx + 4], edi
mov edi, dword [esi + 4]
mov ebx, dword [esi]
mov byte [0x42c01c], 0
add edi, 3
push edi
push ebx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x411d06
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + 2]
cmp eax, edx
jae 0x411d3a
mov ecx, 0x427e98
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x411d27
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x118
mov byte [eax + ecx], 0
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x460]
add esp, 4
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411d70
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
lea ebx, [ebx]
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x411d90
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x411dca
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [ecx + eax]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x411db8
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov byte [eax + ecx], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3d8], 0x5c3a41
mov dword [ebp - 0x3d0], ecx
mov eax, 1
shl eax, cl
lea edx, [ecx + 0x41]
mov byte [ebp - 0x3d8], dl
test dword [ebp - 0x3bc], eax
je 0x41204d
lea eax, [ebp - 0x3d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x411e2b
jmp dword [eax*4 + 0x41252c]
push 0x129
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x4a4]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x411e53
jmp 0x411f1a
push 0x12a
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x4a8]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x411e83
jmp 0x411f1a
push 0x12b
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x4ac]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x411eb2
jmp 0x411f1a
push 0x12c
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x4b0]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x411ee2
jmp 0x411f1a
push 0x12d
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x4b4]
lea edx, [ebp - 0x108]
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x411f10
push edi
push edi
lea eax, [ebp - 0x3e8]
push eax
lea ecx, [ebp - 0x3d8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x411f40
mov dword [ebp - 0x3e8], edi
mov dword [ebp - 0x3e4], edi
lea eax, [ebp - 0x3d8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411f50
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x108]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411f64
sub eax, edi
lea ebx, [eax + edx + 0x5f]
push ebx
call fcn.00413e95
mov edi, eax
add esp, 4
mov dword [ebp - 0x3c8], edi
test edi, edi
je 0x411f71
push 0x11f
call fcn.00404a40
mov edx, dword [ebp - 0x3e8]
mov eax, dword [ebp - 0x3e4]
shrd edx, eax, 0x1e
add esp, 4
shr eax, 0x1e
push eax
mov eax, dword [0x42c160]
push edx
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [eax + 0x47c]
lea edx, [ebp - 0x3d8]
push edx
push ecx
push edi
call fcn.00413fd6
mov eax, edi
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411fd0
sub eax, edx
mov edx, dword [esi + 4]
mov edi, eax
mov eax, dword [esi]
lea ebx, [edi + edx + 1]
mov dword [ebp - 0x3c0], eax
lea ebx, [ebx]
mov ecx, dword [ebp - 0x3c0]
push ebx
push ecx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x411ff0
mov dword [esi], eax
mov eax, dword [esi + 4]
lea edx, [eax + edi]
cmp eax, edx
jae 0x41202a
mov ecx, dword [ebp - 0x3c8]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [eax + ecx]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x412018
add dword [esi + 4], edi
mov edx, dword [ebp - 0x3c8]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edx
mov byte [eax + ecx], 0
call fcn.00413e5b
mov ecx, dword [ebp - 0x3d0]
add esp, 4
xor edi, edi
inc ecx
mov dword [ebp - 0x3d0], ecx
cmp ecx, 0x1a
jb 0x411df6
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add edi, 3
push edi
push ebx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x412065
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp eax, ecx
jae 0x412099
mov ecx, 0x427e98
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [eax + ecx]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x412086
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x119
mov byte [eax + ecx], 0
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x464]
add esp, 4
mov dword [ebp - 0x3c0], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4120c8
mov ecx, dword [esi]
sub eax, edx
mov edi, eax
mov eax, dword [esi + 4]
lea ebx, [edi + eax + 1]
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x3bc]
push ebx
push edx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x4120e2
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x412122
mov ecx, dword [ebp - 0x3c0]
sub ecx, eax
lea ebx, [ebx]
mov edx, dword [esi]
mov bl, byte [eax + ecx]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x412110
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov byte [eax + ecx], 0
push 0x12e
mov dword [ebp - 0x3dc], 0
call fcn.00404a40
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x4b8]
add esp, 4
lea edx, [ebp - 0x3dc]
push edx
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [ebp - 0x3dc]
test eax, eax
je 0x41246f
push 0x100
lea edx, [ebp - 0x108]
push edx
push 0
push eax
mov dword [ebp - 0x3d4], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x412462
jmp 0x4121a0
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4121b0
sub eax, edx
lea edi, [eax + 0x31]
lea esp, [esp]
push edi
call fcn.00413e95
add esp, 4
mov dword [ebp - 0x3c4], eax
test eax, eax
je 0x4121c0
push 0x12e
call fcn.00404a40
mov ecx, dword [0x42c160]
mov edx, dword [ecx + 0x4b8]
add esp, 4
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x3c4]
push edx
push 0x427ca8
push eax
call fcn.00413fd6
push 0x12f
call fcn.00404a40
mov eax, dword [ebp - 0x3c4]
mov ecx, dword [0x42c160]
mov edi, dword [ecx + 0x4bc]
add esp, 0x14
lea edx, [ebp - 0x3c8]
push edx
push 0x20019
push 0
push eax
xor bl, bl
push connect
mov byte [ebp - 0x270], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0x3c8]
test eax, eax
je 0x412424
lea ecx, [ebp - 0x3bc]
push ecx
lea edx, [ebp - 0x270]
push edx
push 0
push 0
push edi
push eax
mov dword [ebp - 0x3bc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41227e
mov bl, 1
mov eax, dword [ebp - 0x3c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x412424
lea eax, [ebp - 0x270]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4122a0
sub eax, edx
lea edi, [eax + 1]
lea esp, [esp]
push edi
call fcn.00413e95
mov ebx, eax
add esp, 4
mov dword [ebp - 0x3c0], ebx
test ebx, ebx
je 0x4122b0
push ebx
push 0
push 0
lea ecx, [ebp - 0x270]
push 0
push ecx
call fcn.0041535c
add esp, 0x14
push 0x14
call fcn.00404a40
mov edx, dword [0x42c160]
mov ecx, dword [edx + 0x50]
add esp, 4
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412310
test dl, dl
je 0x41230c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412310
add eax, 2
add ecx, 2
test dl, dl
jne 0x4122f0
xor eax, eax
jmp 0x412315
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41241b
lea eax, [ebp - 0x270]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412326
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x108]
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412340
sub eax, edi
lea ebx, [edx + eax + 0x18]
lea ecx, [ecx]
push ebx
call fcn.00413e95
mov edi, eax
add esp, 4
mov dword [ebp - 0x3d0], edi
test edi, edi
je 0x412350
push 0x120
call fcn.00404a40
mov edx, dword [0x42c160]
add esp, 4
lea eax, [ebp - 0x108]
push eax
mov eax, dword [edx + 0x480]
lea ecx, [ebp - 0x270]
push ecx
push eax
push edi
call fcn.00413fd6
mov eax, edi
add esp, 0x10
lea edx, [eax + 1]
jmp 0x4123a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4123a0
mov ecx, dword [esi + 4]
sub eax, edx
mov edx, dword [esi]
mov edi, eax
lea ebx, [edi + ecx + 1]
mov dword [ebp - 0x3bc], edx
lea ebx, [ebx]
mov eax, dword [ebp - 0x3bc]
push ebx
push eax
call fcn.00413f29
add esp, 8
test eax, eax
je 0x4123c0
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + edi]
cmp eax, ecx
jae 0x4123fa
mov ecx, dword [ebp - 0x3d0]
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [eax + ecx]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, edi
cmp eax, edx
jb 0x4123e8
add dword [esi + 4], edi
mov edx, dword [ebp - 0x3d0]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edx
mov byte [eax + ecx], 0
call fcn.00413e5b
mov ebx, dword [ebp - 0x3c0]
add esp, 4
push ebx
call fcn.00413e5b
add esp, 4
mov eax, dword [ebp - 0x3c4]
push eax
call fcn.00413e5b
mov eax, dword [ebp - 0x3d4]
mov edx, dword [ebp - 0x3dc]
add esp, 4
push 0x100
lea ecx, [ebp - 0x108]
inc eax
push ecx
push eax
push edx
mov dword [ebp - 0x3d4], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x4121a0
mov eax, dword [ebp - 0x3dc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esi + 4]
mov ebx, dword [esi]
add edi, 3
push edi
push ebx
call fcn.00413f29
add esp, 8
test eax, eax
je 0x412477
mov dword [esi], eax
mov eax, dword [esi + 4]
lea ecx, [eax + 2]
cmp eax, ecx
jae 0x4124ab
mov ecx, 0x427e98
sub ecx, eax
mov edx, dword [esi]
mov bl, byte [eax + ecx]
mov byte [eax + edx], bl
mov edx, dword [esi + 4]
inc eax
add edx, 2
cmp eax, edx
jb 0x412498
add dword [esi + 4], 2
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov byte [eax + ecx], 0
mov edi, dword [esi + 4]
inc edi
lea esp, [esp]
push edi
call fcn.00413e95
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4124c0
mov ecx, dword [esi]
mov edx, ebx
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4124d3
mov eax, dword [esi]
mov dword [esi + 4], 0
test eax, eax
je 0x4124f3
push eax
call fcn.00413e5b
add esp, 4
push esi
call fcn.00413e5b
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00412e08
mov esp, ebp
pop ebp
ret