Function at 0x4aec70
Capabilities:
Contain obfuscated stackstrings
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be157
mov eax, dword fs:[0]
push eax
sub esp, 0xb20
mov eax, dword [0x4e5b00]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb24], ecx
mov dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xb24]
cmp dword [eax + 0xc], 0
je 0x4aece7
mov ecx, dword [ebp - 0xb24]
add ecx, 0x64
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404680
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xb20]
or edx, 1
mov dword [ebp - 0xb20], edx
mov eax, dword [ebp + 8]
jmp 0x4af37e
mov eax, dword [ebp - 0xb24]
mov dword [eax + 0xc], 1
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x228], 0
mov byte [ebp - 0x11c], 0
push 0x63
push 0
lea ecx, [ebp - 0x11b]
push ecx
call fcn.00465660
add esp, 0xc
mov byte [ebp - 0x47c], 0
push 0x21f
push 0
lea edx, [ebp - 0x47b]
push edx
call fcn.00465660
add esp, 0xc
mov byte [ebp - 0xb4], 0
xor eax, eax
mov dword [ebp - 0xb3], eax
mov dword [ebp - 0xaf], eax
mov dword [ebp - 0xab], eax
mov word [ebp - 0xa7], ax
mov byte [ebp - 0xa5], al
lea ecx, [ebp - 0x258]
call fcn.0041b540
mov dword [ebp - 4], 1
mov byte [ebp - 0x34], 0x53
mov byte [ebp - 0x33], 0x43
mov byte [ebp - 0x32], 0x53
mov byte [ebp - 0x31], 0x49
mov byte [ebp - 0x30], 0x44
mov byte [ebp - 0x2f], 0x49
mov byte [ebp - 0x2e], 0x53
mov byte [ebp - 0x2d], 0x4b
mov byte [ebp - 0x2c], 0
push 0x64
push 0
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00465660
add esp, 0xc
push 0x24
push 0
lea edx, [ebp - 0x5c]
push edx
call fcn.00465660
add esp, 0xc
push 0x18
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.00465660
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.00465660
add esp, 0xc
mov byte [ebp - 0x23c], 0x5c
mov byte [ebp - 0x23b], 0x5c
mov byte [ebp - 0x23a], 0x2e
mov byte [ebp - 0x239], 0x5c
mov byte [ebp - 0x238], 0x50
mov byte [ebp - 0x237], 0x68
mov byte [ebp - 0x236], 0x79
mov byte [ebp - 0x235], 0x73
mov byte [ebp - 0x234], 0x69
mov byte [ebp - 0x233], 0x63
mov byte [ebp - 0x232], 0x61
mov byte [ebp - 0x231], 0x6c
mov byte [ebp - 0x230], 0x44
mov byte [ebp - 0x22f], 0x72
mov byte [ebp - 0x22e], 0x69
mov byte [ebp - 0x22d], 0x76
mov byte [ebp - 0x22c], 0x65
mov byte [ebp - 0x22b], 0x25
mov byte [ebp - 0x22a], 0x64
mov byte [ebp - 0x229], 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00460c94
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
je 0x4aefa1
push 0
lea eax, [ebp - 0x228]
push eax
push 0x18
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0
push 0x74080
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4aef9c
mov dword [ebp - 0x5c], 0x200
mov byte [ebp - 0x57], 1
mov byte [ebp - 0x56], 1
mov eax, dword [ebp + 0xc]
and eax, 1
je 0x4aeef9
mov byte [ebp - 0x53], 0xb0
jmp 0x4aeefd
mov byte [ebp - 0x53], 0xa0
cmp dword [ebp + 0xc], 0
jbe 0x4aef21
movzx edx, byte [ebp - 0x21]
mov ecx, dword [ebp + 0xc]
sar edx, cl
and edx, 0x10
neg edx
sbb edx, edx
and edx, 0xffffffb5
add edx, 0xec
mov byte [ebp - 0x52], dl
jmp 0x4aef25
mov byte [ebp - 0x52], 0xec
push 0
lea eax, [ebp - 0x228]
push eax
push 0x220
lea ecx, [ebp - 0x47c]
push ecx
push 0x24
lea edx, [ebp - 0x5c]
push edx
push 0x7c088
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4aef81
mov byte [ebp - 0x52], 0xec
push 0
lea ecx, [ebp - 0x228]
push ecx
push 0x220
lea edx, [ebp - 0x47c]
push edx
push 0x24
lea eax, [ebp - 0x5c]
push eax
push 0x7c088
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push pe_nt_image_headers32
lea edx, [ebp - 0x46c]
push edx
lea eax, [ebp - 0x224]
push eax
call fcn.00469530
add esp, 0xc
jmp 0x4af0ef
mov byte [ebp - 0x488], 0x5c
mov byte [ebp - 0x487], 0x5c
mov byte [ebp - 0x486], 0x2e
mov byte [ebp - 0x485], 0x5c
mov byte [ebp - 0x484], 0x53
mov byte [ebp - 0x483], 0x63
mov byte [ebp - 0x482], 0x73
mov byte [ebp - 0x481], 0x69
mov byte [ebp - 0x480], 0x25
mov byte [ebp - 0x47f], 0x64
mov byte [ebp - 0x47e], 0x3a
mov byte [ebp - 0x47d], 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x488]
push edx
lea eax, [ebp - 0x11c]
push eax
call fcn.00460c94
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
je 0x4af0ef
push 0x48
push 0
lea edx, [ebp - 0xa4]
push edx
call fcn.00465660
add esp, 0xc
push 8
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0xa0]
push ecx
call fcn.00469530
add esp, 0xc
mov dword [ebp - 0x90], 2
mov dword [ebp - 0x84], 0x220
mov dword [ebp - 0x8c], 0x1b0501
mov dword [ebp - 0x80], 0x200
mov byte [ebp - 0x7b], 1
mov byte [ebp - 0x7a], 1
mov edx, dword [ebp + 0xc]
and edx, 1
je 0x4af09b
mov byte [ebp - 0x77], 0xb0
jmp 0x4af09f
mov byte [ebp - 0x77], 0xa0
mov byte [ebp - 0x76], 0xec
push 0
lea eax, [ebp - 0x228]
push eax
push 0x23c
lea ecx, [ebp - 0x6cc]
push ecx
push 0x48
lea edx, [ebp - 0xa4]
push edx
push 0x4d008
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4af0ef
push pe_nt_image_headers32
lea ecx, [ebp - 0x6a0]
push ecx
lea edx, [ebp - 0x224]
push edx
call fcn.00469530
add esp, 0xc
push 0x14
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xb1c]
push ecx
mov ecx, dword [ebp - 0xb24]
call fcn.004ae0d0
mov dword [ebp - 0xb28], eax
mov edx, dword [ebp - 0xb28]
mov dword [ebp - 0xb2c], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xb2c]
push eax
lea ecx, [ebp - 0x258]
call fcn.0041b560
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb1c]
call fcn.00401750
push 0x4c9459
lea ecx, [ebp - 0x258]
push ecx
call fcn.00404b30
add esp, 8
movzx edx, al
test edx, edx
je 0x4af2df
mov byte [ebp - 0x6e0], 0x5c
mov byte [ebp - 0x6df], 0x5c
mov byte [ebp - 0x6de], 0x2e
mov byte [ebp - 0x6dd], 0x5c
mov byte [ebp - 0x6dc], 0x50
mov byte [ebp - 0x6db], 0x68
mov byte [ebp - 0x6da], 0x79
mov byte [ebp - 0x6d9], 0x73
mov byte [ebp - 0x6d8], 0x69
mov byte [ebp - 0x6d7], 0x63
mov byte [ebp - 0x6d6], 0x61
mov byte [ebp - 0x6d5], 0x6c
mov byte [ebp - 0x6d4], 0x44
mov byte [ebp - 0x6d3], 0x72
mov byte [ebp - 0x6d2], 0x69
mov byte [ebp - 0x6d1], 0x76
mov byte [ebp - 0x6d0], 0x65
mov byte [ebp - 0x6cf], 0x25
mov byte [ebp - 0x6ce], 0x64
mov byte [ebp - 0x6cd], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x6e0]
push ecx
lea edx, [ebp - 0x11c]
push edx
call fcn.00460c94
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
je 0x4af2dd
mov dword [ebp - 0xaf8], 0
push 0xc
push 0
lea ecx, [ebp - 0x6ec]
push ecx
call fcn.00465660
add esp, 0xc
push 0x400
push 0
lea edx, [ebp - 0xaf4]
push edx
call fcn.00465660
add esp, 0xc
mov dword [ebp - 0x6f0], 0x400
push 0
lea eax, [ebp - 0xaf8]
push eax
mov ecx, dword [ebp - 0x6f0]
push ecx
lea edx, [ebp - 0xaf4]
push edx
push 0xc
lea eax, [ebp - 0x6ec]
push eax
push 0x2d1400
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4af2dd
push 0x400
lea edx, [ebp - 0xaf4]
push edx
mov ecx, dword [ebp - 0xb24]
call fcn.004ae2c0
mov dword [ebp - 0xafc], eax
push 0xa
lea eax, [ebp - 0xb4]
push eax
mov ecx, dword [ebp - 0xafc]
push ecx
call sub.ntdll.dll__ultoa
add esp, 0xc
push eax
lea ecx, [ebp - 0x258]
call fcn.004028f0
jmp 0x4af32c
lea ecx, [ebp - 0x258]
call fcn.00423b50
push eax
lea ecx, [ebp - 0x258]
call fcn.00401780
push eax
mov ecx, dword [ebp - 0xb24]
call fcn.004ae2c0
mov dword [ebp - 0xb00], eax
push 0xa
lea edx, [ebp - 0xb4]
push edx
mov eax, dword [ebp - 0xb00]
push eax
call sub.ntdll.dll__ultoa
add esp, 0xc
push eax
lea ecx, [ebp - 0x258]
call fcn.004028f0
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x258]
push edx
mov ecx, dword [ebp - 0xb24]
add ecx, 0x64
call fcn.0041b560
mov eax, dword [ebp - 0xb24]
add eax, 0x64
push eax
mov ecx, dword [ebp + 8]
call fcn.00404680
mov ecx, dword [ebp - 0xb20]
or ecx, 1
mov dword [ebp - 0xb20], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.00401750
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.004606fe
mov esp, ebp
pop ebp
ret 8