Function at 0x459380
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e155
mov eax, dword fs:[0]
push eax
sub esp, 0x8ec
mov eax, dword [0x4e2e58]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8d0], ecx
push 0x100
push 0
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, 1
imul eax, edx, 3
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 0x80
jae 0x4593f5
jmp 0x4593fa
call fcn.00498f50
mov ecx, dword [ebp - 0x874]
mov byte [ebp + ecx - 0x110], 0
push 0x80
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x8cc]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
lea edx, [ebp - 0x860]
push edx
push 0x80
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x8f0]
call sub.mfc120.dll_Ordinal_503
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_316]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x210]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x90], 0x57
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x90], 0x54
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x90], 0x43
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x90], 0x59
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x90], 0x30
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x90], 0x30
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x90], 0x30
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x90], 0x31
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x90], 0x2e
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x90], 0x62
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x90], 0x69
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x90], 0x6e
mov edx, 1
imul eax, edx, 0xc
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 0x80
jae 0x459551
jmp 0x459556
call fcn.00498f50
mov ecx, dword [ebp - 0x86c]
mov byte [ebp + ecx - 0x90], 0
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_1524]
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_5764]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x88c]
sub eax, 1
push eax
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_1645]
movsx ecx, al
cmp ecx, 0x5c
jne 0x4595ff
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x884]
push ecx
call fcn.00413a60
add esp, 0xc
mov dword [ebp - 0x89c], eax
mov edx, dword [ebp - 0x89c]
mov dword [ebp - 0x87c], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x87c]
push eax
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_1521]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x884]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
jmp 0x459663
push 0x5c
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_1688]
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x84c]
push edx
lea eax, [ebp - 0x8a0]
push eax
call fcn.00413a60
add esp, 0xc
mov dword [ebp - 0x878], eax
mov ecx, dword [ebp - 0x878]
mov dword [ebp - 0x898], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x898]
push edx
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_1521]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8a0]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
lea ecx, [ebp - 0x8b4]
call sub.mfc120.dll_Ordinal_500
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8c8]
call sub.mfc120.dll_Ordinal_500
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x894]
call fcn.00413570
mov dword [ebp - 0x85c], 0
push 0
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_1656]
push eax
lea ecx, [ebp - 0x8f0]
call sub.mfc120.dll_Ordinal_4662
cmp eax, 1
jne 0x45988c
push 0
push 2
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_1656]
push eax
lea ecx, [ebp - 0x8c8]
call sub.mfc120.dll_Ordinal_11782
cmp eax, 1
jne 0x459881
push 0x404
lea eax, [ebp - 0x714]
push eax
lea ecx, [ebp - 0x8c8]
call sub.mfc120.dll_Ordinal_12165
mov ecx, 4
imul edx, ecx, 0xe
mov eax, dword [ebp + edx - 0x410]
and eax, 0xff
movzx ecx, al
mov edx, 4
imul eax, edx, 6
mov edx, dword [ebp + eax - 0x410]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
mov word [ebp - 0x840], cx
mov ecx, 4
imul edx, ecx, 6
mov eax, dword [ebp + edx - 0x410]
and eax, 0xff
movzx ecx, al
mov edx, 4
imul eax, edx, 0x16
mov edx, dword [ebp + eax - 0x410]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
mov word [ebp - 0x844], cx
movzx ecx, word [ebp - 0x840]
and ecx, 0xffff
movzx edx, cx
movzx eax, word [ebp - 0x844]
and eax, 0xffff
movzx ecx, ax
shl ecx, 0x10
or edx, ecx
mov dword [ebp - 0x854], edx
mov edx, dword [ebp - 0x414]
xor edx, dword [ebp - 0x854]
mov dword [ebp - 0x414], edx
mov eax, 4
imul ecx, eax, 0x18
mov edx, dword [ebp + ecx - 0x410]
and edx, 0xff
movzx eax, dl
mov ecx, 4
imul edx, ecx, 3
mov ecx, dword [ebp + edx - 0x410]
and ecx, 0xff
movzx edx, cl
shl edx, 8
or eax, edx
mov word [ebp - 0x840], ax
mov eax, 4
imul ecx, eax, 0x17
mov edx, dword [ebp + ecx - 0x410]
and edx, 0xff
movzx eax, dl
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + ecx - 0x410]
and edx, 0xff
movzx ecx, dl
shl ecx, 8
or eax, ecx
mov word [ebp - 0x844], ax
movzx edx, word [ebp - 0x840]
and edx, 0xffff
movzx eax, dx
movzx ecx, word [ebp - 0x844]
and ecx, 0xffff
movzx edx, cx
shl edx, 0x10
or eax, edx
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0x38c]
xor eax, dword [ebp - 0x854]
mov dword [ebp - 0x38c], eax
mov ecx, dword [ebp - 0x414]
cmp ecx, dword [ebp - 0x38c]
jne 0x459877
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x85c], edx
jmp 0x459881
mov dword [ebp - 0x85c], 0
lea ecx, [ebp - 0x8c8]
call sub.mfc120.dll_Ordinal_2838
push 0
push 0x1002
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_1656]
push eax
lea ecx, [ebp - 0x8b4]
call sub.mfc120.dll_Ordinal_11782
test eax, eax
jne 0x459904
mov dword [ebp - 0x880], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8c8]
call sub.mfc120.dll_Ordinal_1137
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8b4]
call sub.mfc120.dll_Ordinal_1137
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8f0]
call sub.mfc120.dll_Ordinal_1139
mov eax, dword [ebp - 0x880]
jmp 0x459eb9
lea eax, [ebp - 0x8f8]
push eax
call fcn.00414020
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x894], ecx
mov dword [ebp - 0x890], edx
lea ecx, [ebp - 0x894]
call fcn.00413fd0
push eax
call dword [sym.imp.MSVCR120.dll_srand]
add esp, 4
mov dword [ebp - 0x848], 0
jmp 0x459951
mov eax, dword [ebp - 0x848]
add eax, 1
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 0x3f
jge 0x45996f
call dword [sym.imp.MSVCR120.dll_rand]
mov ecx, dword [ebp - 0x848]
mov dword [ebp + ecx*4 - 0x514], eax
jmp 0x459942
call dword [sym.imp.MSVCR120.dll_rand]
push eax
call dword [sym.imp.MSVCR120.dll_srand]
add esp, 4
mov dword [ebp - 0x848], 0
jmp 0x45999a
mov edx, dword [ebp - 0x848]
add edx, 1
mov dword [ebp - 0x848], edx
cmp dword [ebp - 0x848], 0x1f
jge 0x4599b8
call dword [sym.imp.MSVCR120.dll_rand]
mov ecx, dword [ebp - 0x848]
mov dword [ebp + ecx*4 - 0x410], eax
jmp 0x45998b
call dword [sym.imp.MSVCR120.dll_rand]
push eax
call dword [sym.imp.MSVCR120.dll_srand]
add esp, 4
mov dword [ebp - 0x848], 0
jmp 0x4599e3
mov edx, dword [ebp - 0x848]
add edx, 1
mov dword [ebp - 0x848], edx
cmp dword [ebp - 0x848], 0x1f
jge 0x459a01
call dword [sym.imp.MSVCR120.dll_rand]
mov ecx, dword [ebp - 0x848]
mov dword [ebp + ecx*4 - 0x388], eax
jmp 0x4599d4
mov edx, dword [ebp - 0x860]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
xor eax, 0x5555
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp - 0x860]
and edx, 0xffff
movzx eax, dx
xor eax, 0xaaaa
and eax, 0xffff
movzx edx, ax
shl edx, 0x10
or ecx, edx
mov dword [ebp - 0x418], ecx
lea ecx, [ebp - 0x83c]
call fcn.00413480
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x8b4]
call sub.mfc120.dll_Ordinal_6821
lea ecx, [ebp - 0x83c]
call fcn.00414040
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x390], edx
mov ecx, dword [ebp - 0x85c]
add ecx, 1
mov dword [ebp - 0x414], ecx
mov edx, dword [ebp - 0x85c]
add edx, 1
mov dword [ebp - 0x38c], edx
call fcn.00413c40
mov dword [ebp - 0x868], eax
push 0
push 0x4aec58
push 0x4aec64
lea eax, [ebp - 0x858]
push eax
mov ecx, dword [ebp - 0x868]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x868]
mov eax, dword [edx + 0x8c]
call eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x858]
call dword [sym.imp.mfc120.dll_Ordinal_5764]
test eax, eax
jle 0x459ba8
lea ecx, [ebp - 0x858]
call dword [sym.imp.mfc120.dll_Ordinal_1656]
push eax
call dword [sym.imp.MSVCR120.dll_atol]
add esp, 4
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
xor ecx, 0x55aa
mov dword [ebp - 0x850], ecx
cmp dword [ebp - 0x850], 0x258
jbe 0x459b35
mov dword [ebp - 0x414], 0x381
mov dword [ebp - 0x38c], 0x230b
jmp 0x459ba6
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x850], edx
mov eax, dword [ebp - 0x850]
xor eax, 0x55aa
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
push ecx
push 0x4aec6c
lea edx, [ebp - 0x858]
push edx
call dword [sym.imp.mfc120.dll_Ordinal_4764]
add esp, 0xc
call fcn.00413c40
mov dword [ebp - 0x870], eax
lea ecx, [ebp - 0x858]
call dword [sym.imp.mfc120.dll_Ordinal_1656]
push eax
push 0x4aec7c
push 0x4aec88
mov eax, dword [ebp - 0x870]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x870]
mov eax, dword [edx + 0x90]
call eax
jmp 0x459c1a
mov ecx, dword [ebp - 0x414]
mov dword [ebp - 0x850], ecx
mov edx, dword [ebp - 0x850]
xor edx, 0x55aa
mov dword [ebp - 0x850], edx
mov eax, dword [ebp - 0x850]
push eax
push 0x4aec90
lea ecx, [ebp - 0x858]
push ecx
call dword [sym.imp.mfc120.dll_Ordinal_4764]
add esp, 0xc
call fcn.00413c40
mov dword [ebp - 0x864], eax
lea ecx, [ebp - 0x858]
call dword [sym.imp.mfc120.dll_Ordinal_1656]
push eax
push str.CREATETIME
push 0x4aeca0
mov edx, dword [ebp - 0x864]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x864]
mov edx, dword [eax + 0x90]
call edx
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + ecx - 0x514]
and edx, 0xff
movzx eax, dl
mov ecx, 4
imul edx, ecx, 7
mov ecx, dword [ebp + edx - 0x514]
and ecx, 0xff
movzx edx, cl
shl edx, 8
or eax, edx
mov word [ebp - 0x840], ax
mov eax, 4
imul ecx, eax, 0x13
mov edx, dword [ebp + ecx - 0x514]
and edx, 0xff
movzx eax, dl
mov ecx, 4
imul edx, ecx, 0xd
mov ecx, dword [ebp + edx - 0x514]
and ecx, 0xff
movzx edx, cl
shl edx, 8
or eax, edx
mov word [ebp - 0x844], ax
movzx eax, word [ebp - 0x840]
and eax, 0xffff
movzx ecx, ax
movzx edx, word [ebp - 0x844]
and edx, 0xffff
movzx eax, dx
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x854], ecx
mov ecx, dword [ebp - 0x854]
xor edx, edx
xor ecx, dword [ebp - 0x394]
xor edx, dword [ebp - 0x390]
mov dword [ebp - 0x394], ecx
mov dword [ebp - 0x390], edx
mov eax, 4
imul ecx, eax, 0xe
mov edx, dword [ebp + ecx - 0x410]
and edx, 0xff
movzx eax, dl
mov ecx, 4
imul edx, ecx, 6
mov ecx, dword [ebp + edx - 0x410]
and ecx, 0xff
movzx edx, cl
shl edx, 8
or eax, edx
mov word [ebp - 0x840], ax
mov eax, 4
imul ecx, eax, 6
mov edx, dword [ebp + ecx - 0x410]
and edx, 0xff
movzx eax, dl
mov ecx, 4
imul edx, ecx, 0x16
mov ecx, dword [ebp + edx - 0x410]
and ecx, 0xff
movzx edx, cl
shl edx, 8
or eax, edx
mov word [ebp - 0x844], ax
movzx eax, word [ebp - 0x840]
and eax, 0xffff
movzx ecx, ax
movzx edx, word [ebp - 0x844]
and edx, 0xffff
movzx eax, dx
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x854], ecx
mov ecx, dword [ebp - 0x414]
xor ecx, dword [ebp - 0x854]
mov dword [ebp - 0x414], ecx
mov edx, 4
imul eax, edx, 0x18
mov ecx, dword [ebp + eax - 0x410]
and ecx, 0xff
movzx edx, cl
mov eax, 4
imul ecx, eax, 3
mov eax, dword [ebp + ecx - 0x410]
and eax, 0xff
movzx ecx, al
shl ecx, 8
or edx, ecx
mov word [ebp - 0x840], dx
mov edx, 4
imul eax, edx, 0x17
mov ecx, dword [ebp + eax - 0x410]
and ecx, 0xff
movzx edx, cl
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + eax - 0x410]
and ecx, 0xff
movzx eax, cl
shl eax, 8
or edx, eax
mov word [ebp - 0x844], dx
movzx ecx, word [ebp - 0x840]
and ecx, 0xffff
movzx edx, cx
movzx eax, word [ebp - 0x844]
and eax, 0xffff
movzx ecx, ax
shl ecx, 0x10
or edx, ecx
mov dword [ebp - 0x854], edx
mov edx, dword [ebp - 0x38c]
xor edx, dword [ebp - 0x854]
mov dword [ebp - 0x38c], edx
push 0x404
lea eax, [ebp - 0x714]
push eax
lea ecx, [ebp - 0x8b4]
call sub.mfc120.dll_Ordinal_14379
mov dword [ebp - 0x888], 1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x858]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8c8]
call sub.mfc120.dll_Ordinal_1137
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8b4]
call sub.mfc120.dll_Ordinal_1137
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x84c]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8f0]
call sub.mfc120.dll_Ordinal_1139
mov eax, dword [ebp - 0x888]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499036
mov esp, ebp
pop ebp
ret