Function at 0x4035d7
Capabilities:
Get disk size
Terminate process

Disassembly:
mov eax, 0x41a52d
call fcn.00410e40
sub esp, 0x510
mov eax, dword [0x4240b8]
push esi
push edi
mov dword [ebp - 0x10], eax
xor eax, eax
push eax
push 0xffffffffffffffff
push eax
push eax
mov edi, ebx
mov dword [ebp - 0x4f4], eax
call fcn.004034fc
push dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea esi, [ebx + 0x12]
push esi
call edi
push dword [0x424cec]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [0x424e6c]
mov ecx, 0x424e6c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x4fc], eax
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x500]
push eax
call fcn.00404444
push 0x41da74
push 0x41de80
lea eax, [ebp - 0x500]
push eax
mov byte [ebp - 4], 1
call fcn.0040448f
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x500]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 0xc]
mov dword [ebp - 0x518], eax
lea eax, [ebp - 0x4f0]
push eax
call edi
and dword [ebp + 8], 0
mov byte [ebx + 0x10], 0
jmp 0x4038d9
push 0x5e
push esi
call fcn.0040f1c9
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x4f8], eax
je 0x4039b3
add eax, 2
push 0x5e
push eax
mov dword [ebp - 0x504], eax
call fcn.0040f1c9
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x50c], eax
je 0x4039b3
add eax, 2
push eax
call fcn.0040f1eb
mov ecx, dword [ebp + 8]
push 0xe
mov dword [ebp - 0x51c], eax
lea eax, [ecx + eax + 0x1000]
push str.http:__
push esi
mov dword [ebp + 8], eax
call fcn.0041a086
add esp, 0x10
test eax, eax
jne 0x403710
mov eax, dword [ebp - 0x4f8]
sub eax, esi
sar eax, 1
inc eax
push eax
push esi
lea eax, [ebp - 0x220]
jmp 0x40375f
push dword [0x424c6c]
lea eax, [ebp - 0x4fc]
push 0x4256d8
push str.http:___s:_d
push eax
call fcn.004023bd
add esp, 0x10
push dword [ebp - 0x4fc]
lea eax, [ebp - 0x220]
push eax
call edi
mov eax, dword [ebp - 0x4f8]
sub eax, esi
sar eax, 1
inc eax
push eax
push esi
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x220]
push 0x2f
push eax
call fcn.0040f24f
pop ecx
inc eax
inc eax
pop ecx
push eax
mov eax, dword [ebp - 0x518]
lea eax, [ebp + eax*2 - 0x4f0]
push eax
call edi
push 0x54
call fcn.0040d863
pop ecx
mov dword [ebp - 0x4f8], eax
test eax, eax
mov byte [ebp - 4], 2
je 0x403818
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x510]
push eax
call fcn.00404444
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x514]
mov byte [ebp - 4], 3
or dword [ebp - 0x4f4], 1
push eax
call fcn.00404444
lea eax, [ebx + 0x12]
push eax
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x51c]
mov dword [ebp - 4], 4
push dword [ebp - 0x504]
or dword [ebp - 0x4f4], 2
call fcn.0040f1eb
pop ecx
push eax
push 2
push dword [ebp - 0x4f8]
call fcn.00403449
mov dword [ebp - 0x4f8], eax
jmp 0x40381f
and dword [ebp - 0x4f8], 0
test byte [ebp - 0x4f4], 2
je 0x40383d
mov eax, dword [ebp - 0x514]
and dword [ebp - 0x4f4], 0xfffffffd
add eax, 0xfffffff0
call fcn.0040252d
mov dword [ebp - 4], 1
test byte [ebp - 0x4f4], 1
je 0x403862
mov eax, dword [ebp - 0x510]
and dword [ebp - 0x4f4], 0xfffffffe
add eax, 0xfffffff0
call fcn.0040252d
mov eax, dword [ebp - 0x50c]
add eax, 2
push 0x5e
push eax
call fcn.0040f1c9
test eax, eax
pop ecx
pop ecx
je 0x4039b3
lea esi, [eax + 2]
push esi
call fcn.0040f1eb
pop ecx
mov ecx, dword [ebp - 0x4f8]
mov dword [ecx + 0x50], eax
push ebx
mov eax, ecx
call fcn.00403431
cmp byte [ebx + 0x10], 0
jne 0x4038bf
push 0x5e
push esi
call fcn.0040f1c9
test eax, eax
pop ecx
pop ecx
je 0x4038bb
add eax, 2
push eax
call fcn.0040f1eb
cmp eax, 1
pop ecx
je 0x4038bf
mov byte [ebx + 0x10], 1
push 0xa
push dword [ebp - 0x50c]
call fcn.0040f1c9
test eax, eax
pop ecx
pop ecx
je 0x4039b3
lea esi, [eax + 2]
cmp word [esi], 0xa
jne 0x403692
push 4
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x6d
lea ecx, [ebp - 0x4fc]
call fcn.00409d85
mov eax, dword [ebp + 8]
shr eax, 0x14
inc eax
push eax
movzx eax, word [ebp - 0x18]
push eax
push dword [ebp - 0x4fc]
lea eax, [ebp - 0x2e8]
push eax
call fcn.0040f27f
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
add esp, 0x10
lea eax, [ebp - 0x508]
push eax
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
mov eax, dword [ebp - 0x504]
cmp eax, edi
ja 0x40398c
jae 0x403981
push 5
call fcn.00409c2c
lea eax, [eax*2 + 0x425b50]
push eax
lea eax, [ebp - 0x2e8]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
je 0x4039ac
lea eax, [ebp - 0x508]
push eax
push edi
push edi
lea eax, [ebp - 0x18]
push eax
call esi
mov eax, dword [ebp - 0x504]
cmp eax, edi
jb 0x403944
ja 0x40398c
mov eax, dword [ebp - 0x508]
cmp eax, dword [ebp + 8]
jbe 0x403944
mov eax, dword [ebp - 0x500]
add eax, 0xfffffff0
call fcn.0040252d
mov eax, dword [ebp - 0x4fc]
add eax, 0xfffffff0
call fcn.0040252d
xor eax, eax
jmp 0x4039e0
push 0xfffffffffffffffa
call fcn.0040f475
xor eax, eax
push eax
push 0xffffffffffffffff
push eax
push eax
mov edi, ebx
call fcn.004034fc
mov eax, dword [ebp - 0x500]
add eax, 0xfffffff0
call fcn.0040252d
mov eax, dword [ebp - 0x4fc]
add eax, 0xfffffff0
call fcn.0040252d
push 0xfffffffffffffffa
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.00410647
leave
ret 8