Function at 0x4018ed
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information
Get mac address on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov dword [ebp - 0x14d], 0xffffff00
mov dword [ebp - 0x149], 0xffffffff
mov byte [ebp - 0x145], 0
mov dword [ebp - 0x16e], 0x64616564
mov dword [ebp - 0x16a], 0x66656562
mov dword [ebp - 0x166], 0x30303030
mov dword [ebp - 0x162], 0x30303030
mov dword [ebp - 0x15e], 0x30303030
mov dword [ebp - 0x15a], 0x30303030
mov dword [ebp - 0x156], 0x30303030
mov dword [ebp - 0x152], 0x30303030
mov byte [ebp - 0x14e], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Generating__s_n
call sym._printf
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 0xc]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 7
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._GetAdaptersInfo_8
sub esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6f
jne 0x4019d3
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._realloc
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._GetAdaptersInfo_8
sub esp, 8
test eax, eax
je 0x401a21
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp + 4], str.GetAdapterInfo_failed__aborting._n
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov dword [esp], 1
call sym._exit
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
jmp 0x401a4a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1a0]
cmp eax, 6
jne 0x401a42
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401a30
mov eax, dword [ebp - 0xc]
add eax, 3
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shl eax, 5
add eax, 8
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
jmp 0x401acd
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1a0]
cmp eax, 6
jne 0x401ac5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x190]
test eax, eax
je 0x401ac1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x190]
mov edx, dword [ebp - 0x18]
lea ecx, [edx + 0x194]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
call sym._hashMACAddress
add dword [ebp - 0x1c], 0x20
jmp 0x401ac5
sub dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401a7b
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._free
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x134]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x134]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberA]
call eax
sub esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, 0x41
mov dword [esp + 8], eax
mov dword [esp + 4], str._C:_
lea eax, [ebp - 0x134]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x134]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
call eax
sub esp, 0x20
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._hashVolumeSerial
add dword [ebp - 0x1c], 0x20
mov dword [esp + 8], 0x20
lea eax, [ebp - 0x16e]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._memcpy
add dword [ebp - 0x1c], 0x20
lea eax, [ebp - 0x144]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemTime]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x144]
mov dword [esp], eax
call sym._hashSystemTime
add dword [ebp - 0x1c], 0x20
mov dword [esp + 8], 8
lea eax, [ebp - 0x14d]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x10]
shl eax, 5
add eax, 8
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._encryptData
mov dword [esp + 4], 0x40d09f
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
shl eax, 5
lea edx, [eax + 8]
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
nop
leave
ret