Function at 0x403000
Capabilities:
Access peb ldr_data
Get disk information
Get number of processors
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
xor eax, eax
add eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x428ea4], eax
mov esi, dword [sym.imp.GDI32.dll_AbortPath]
mov edi, dword [0x428ea8]
xor ebx, ebx
push ebx
call esi
and eax, 0x541e3183
or eax, 0x30
xor edx, edx
mov ecx, 0x643d3efd
div ecx
mov ecx, 0x56c1bae
push 0x5d
mov eax, edx
imul eax, edi
xor edx, edx
div ecx
mov ecx, 0xeb9b6d37
mov eax, edx
xor edx, edx
div ecx
mov eax, 0xb8
mov ecx, edx
or ecx, 0x9a4b248a
xor edx, edx
div ecx
xor edx, edx
mov ecx, eax
xor ecx, 0x4542
or ecx, 0xc4563ab9
pop eax
div ecx
mov eax, 0xdd
push ebx
mov ecx, edx
and ecx, 0x5802
xor ecx, 0x5203
or ecx, 0x49c85bc
xor edx, edx
div ecx
xor edx, edx
mov ecx, 0x1b4d
sub eax, 0x6e4af79d
xor eax, 0xf3
sub ecx, eax
or ecx, 0x48f57e16
mov eax, 0x8c
div ecx
xor edx, edx
mov ecx, eax
mov dword [0x428ea8], ecx
or ecx, 0xd5686c68
mov eax, 0xfe
div ecx
xor edx, edx
mov ecx, eax
or ecx, 0x7e7cc619
mov eax, 0x28c00003
div ecx
mov edi, eax
call esi
and eax, 0x67c4
imul eax, edi
mov dword [0x428ea8], eax
call fcn.00403837
mov dword [0x428ea8], eax
call fcn.00403845
mov dword [0x428ea8], eax
call fcn.0040385a
mov ecx, eax
xor ecx, 0x81
add ecx, 0xf83d2e2
push 0x44
or ecx, 0x10a7c915
pop eax
xor edx, edx
div ecx
mov ecx, eax
or ecx, 0x97818165
xor edx, edx
mov eax, 0x75b60b1
div ecx
mov dword [0x428ea8], eax
call fcn.00403865
lea ecx, [eax + 0x1f44eada]
xor edx, edx
or ecx, 0x8ea40362
mov eax, 0xb1
div ecx
xor edx, edx
mov ecx, 0x4f63
push ebx
xor eax, 0x119ffc13
mov dword [0x428ea8], eax
div ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and eax, 0x25
add eax, esi
and eax, 0x6b
xor eax, 0x37
imul eax, eax, 0x13
mov edi, 0x80
xor eax, edi
or eax, 0x15
xor edx, edx
mov ecx, 0x45e62ebd
div ecx
mov dword [0x428ea8], edx
call fcn.0040387c
xor edx, edx
mov ecx, 0x4669ffdd
div ecx
xor edx, 0x41
add edx, 0xd0
or edx, 0x4576cade
mov dword [0x428ea8], edx
call fcn.0040389f
mov dword [0x428ea8], eax
call fcn.004037db
mov dword [0x428ea8], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
and dword [0x428ea8], 2
mov esi, dword [eax + 0xc]
call fcn.004037ec
mov dword [0x428ea8], eax
jmp 0x403255
call fcn.004037fb
push 0x64
pop ecx
sub ecx, eax
push 0x32
or ecx, 0xdff46728
xor edx, edx
pop eax
div ecx
mov dword [0x428ea8], eax
cmp dword [esi + 0x18], ebx
je 0x403259
lea ecx, [eax - 0x1fd5]
or ecx, 0x98b82c36
push 0x51
xor edx, edx
pop eax
div ecx
mov ecx, dword [esi + 0x18]
mov dword [0x428ea8], eax
mov eax, 0x428ea0
cmp ecx, eax
ja 0x403240
mov edx, dword [esi + 0x20]
add edx, ecx
cmp edx, eax
ja 0x4032ef
mov esi, dword [esi]
call fcn.0040381f
push 0x6b
pop ecx
sub ecx, eax
or ecx, 0x3a
mov dword [0x428ea8], ecx
cmp esi, ebx
jne 0x4031ee
xor esi, esi
push 0x104
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x428ea8]
xor edx, edx
mov ecx, 0x412b22d6
div ecx
lea eax, [ebp - 0x104]
xor edx, 0xa2
cmp byte [ebp - 0x104], bl
je 0x403295
inc eax
cmp byte [eax], bl
jne 0x403290
mov esi, str..txt
sub esi, eax
mov cl, byte [esi + eax]
mov byte [eax], cl
inc eax
cmp cl, bl
jne 0x40329c
push ebx
push edi
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x104]
add edx, 0x2b
push eax
mov dword [0x428ea8], edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [0x428ea8]
or eax, 0x2c4bd8d6
imul eax, eax, 0x2d
mov dword [0x428ea0], ecx
mov dword [0x428ea8], eax
cmp ecx, 0xffffffff
jne 0x4032f6
push 0x17
call dword [sym.imp.msvcrt.dll_exit]
mov esi, ecx
jmp 0x40325b
and eax, 0x60d6e85e
xor edx, edx
mov esi, 0x3fe4bfdf
div esi
push ecx
mov dword [0x428ea8], edx
call dword [0x428ea4]
mov eax, dword [0x428ea8]
xor edx, edx
mov ecx, 0x6a417ffa
div ecx
push 0x2b
pop eax
pop edi
pop esi
pop ebx
sub eax, edx
mov dword [0x428ea8], eax
xor eax, eax
inc eax
leave
ret