Function at 0x43f37c
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475f63
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8b0
mov dword [ebp - 0x8ac], ecx
push 0x100
push 0
lea eax, [ebp - 0x77c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x119], 0
push 0x80
lea edx, [ebp - 0x7fc]
push edx
lea eax, [ebp - 0x894]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x128]
push edx
push 0x80
lea eax, [ebp - 0x87c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x67c]
call fcn.00471b8e
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x880]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
lea edx, [ebp - 0x77c]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp - 0x9c], 0x57
mov byte [ebp - 0x9b], 0x54
mov byte [ebp - 0x9a], 0x43
mov byte [ebp - 0x99], 0x59
mov byte [ebp - 0x98], 0x30
mov byte [ebp - 0x97], 0x30
mov byte [ebp - 0x96], 0x30
mov byte [ebp - 0x95], 0x31
mov byte [ebp - 0x94], 0x2e
mov byte [ebp - 0x93], 0x62
mov byte [ebp - 0x92], 0x69
mov byte [ebp - 0x91], 0x6e
mov byte [ebp - 0x90], 0
lea eax, [ebp - 0x77c]
push eax
lea ecx, [ebp - 0x880]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x880]
call fcn.004070a0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x880]
call fcn.004070e0
movsx edx, al
cmp edx, 0x5c
jne 0x43f521
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x880]
push ecx
lea edx, [ebp - 0x898]
push edx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x8b4], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x8b4]
push ecx
lea ecx, [ebp - 0x880]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x898]
call sub.MFC42.DLL_CString::CString
jmp 0x43f57f
push 0x5c
lea ecx, [ebp - 0x880]
call fcn.00471b88
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x89c]
push ecx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x8b8], eax
mov edx, dword [ebp - 0x8b8]
mov dword [ebp - 0x8bc], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x8bc]
push eax
lea ecx, [ebp - 0x880]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x89c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x250]
call fcn.00471ac8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x890]
call fcn.00471ac8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x120]
call fcn.00407100
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x880]
call fcn.00407160
push eax
lea ecx, [ebp - 0x67c]
call sub.MFC42.DLL_CFileFind::FindFile
cmp eax, 1
jne 0x43f788
push 0
push 2
lea ecx, [ebp - 0x880]
call fcn.00407160
push eax
lea ecx, [ebp - 0x890]
call sub.MFC42.DLL_CFile::Open
cmp eax, 1
jne 0x43f77d
push 0x400
lea ecx, [ebp - 0x660]
push ecx
lea ecx, [ebp - 0x890]
call sub.MFC42.DLL_CFile::Read
mov edx, dword [ebp - 0x324]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x344]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x25c], dx
mov ecx, dword [ebp - 0x344]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x304]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x124], cx
mov eax, dword [ebp - 0x25c]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
mov ecx, dword [ebp - 0x124]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x254], eax
mov edx, dword [ebp - 0x360]
xor edx, dword [ebp - 0x254]
mov dword [ebp - 0x360], edx
mov eax, dword [ebp - 0x2fc]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x350]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x25c], ax
mov edx, dword [ebp - 0x300]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x354]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x124], dx
mov ecx, dword [ebp - 0x25c]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
mov edx, dword [ebp - 0x124]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
shl edx, 0x10
or ecx, edx
mov dword [ebp - 0x254], ecx
mov eax, dword [ebp - 0x2dc]
xor eax, dword [ebp - 0x254]
mov dword [ebp - 0x2dc], eax
mov ecx, dword [ebp - 0x360]
cmp ecx, dword [ebp - 0x2dc]
jne 0x43f776
mov edx, dword [ebp - 0x360]
mov dword [ebp - 0x1c], edx
jmp 0x43f77d
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x890]
call sub.MFC42.DLL_CFile::Close
push 0
push 0x1002
lea ecx, [ebp - 0x880]
call fcn.00407160
push eax
lea ecx, [ebp - 0x250]
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x43f7fe
mov dword [ebp - 0x8a0], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x890]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x250]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x880]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x67c]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x8a0]
jmp 0x43fd0e
lea eax, [ebp - 0x8a4]
push eax
call sub.MFC42.DLL_CTime::GetTickCount
push eax
lea ecx, [ebp - 0x120]
call fcn.00407140
lea ecx, [ebp - 0x120]
call fcn.00407170
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov dword [ebp - 0x260], 0
jmp 0x43f846
mov ecx, dword [ebp - 0x260]
add ecx, 1
mov dword [ebp - 0x260], ecx
cmp dword [ebp - 0x260], 0x3f
jge 0x43f864
call dword [sym.imp.MSVCRT.dll_rand]
mov edx, dword [ebp - 0x260]
mov dword [ebp + edx*4 - 0x460], eax
jmp 0x43f837
call dword [sym.imp.MSVCRT.dll_rand]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov dword [ebp - 0x260], 0
jmp 0x43f88f
mov eax, dword [ebp - 0x260]
add eax, 1
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x1f
jge 0x43f8ad
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [ebp - 0x260]
mov dword [ebp + ecx*4 - 0x35c], eax
jmp 0x43f880
call dword [sym.imp.MSVCRT.dll_rand]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov dword [ebp - 0x260], 0
jmp 0x43f8d8
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
cmp dword [ebp - 0x260], 0x1f
jge 0x43f8f6
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [ebp - 0x260]
mov dword [ebp + ecx*4 - 0x2d8], eax
jmp 0x43f8c9
mov edx, dword [ebp - 0x128]
shr edx, 0x10
and edx, 0xffff
xor edx, 0x5555
and edx, 0xffff
and edx, 0xffff
mov eax, dword [ebp - 0x128]
and eax, 0xffff
and eax, 0xffff
xor eax, 0xaaaa
and eax, 0xffff
and eax, 0xffff
shl eax, 0x10
or edx, eax
mov dword [ebp - 0x364], edx
lea ecx, [ebp - 0x240]
call fcn.00407110
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x250]
call sub.MFC42.DLL_CFile::GetStatus_1
lea ecx, [ebp - 0x240]
call fcn.00407160
mov dword [ebp - 0x2e0], eax
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x360], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x2dc], eax
push 0
push 0x48a8ec
push 0x48a8f8
lea ecx, [ebp - 0x258]
push ecx
call fcn.00407290
mov ecx, eax
call sub.MFC42.DLL_CWinApp::GetProfileStringA
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x258]
call fcn.004070a0
test eax, eax
jle 0x43fa51
lea ecx, [ebp - 0x258]
call fcn.00407160
push eax
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
xor edx, 0x55aa
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x258
jbe 0x43fa00
mov dword [ebp - 0x360], 0x381
mov dword [ebp - 0x2dc], 0x230b
jmp 0x43fa4f
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
xor ecx, 0x55aa
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x48a900
lea eax, [ebp - 0x258]
push eax
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
lea ecx, [ebp - 0x258]
call fcn.00407160
push eax
push 0x48a904
push 0x48a910
call fcn.00407290
mov ecx, eax
call sub.MFC42.DLL_CWinApp::WriteProfileStringA
jmp 0x43faa0
mov ecx, dword [ebp - 0x360]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
xor edx, 0x55aa
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
push 0x48a918
lea ecx, [ebp - 0x258]
push ecx
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
lea ecx, [ebp - 0x258]
call fcn.00407160
push eax
push str.CREATETIME
push 0x48a928
call fcn.00407290
mov ecx, eax
call sub.MFC42.DLL_CWinApp::WriteProfileStringA
mov edx, dword [ebp - 0x454]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x444]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x25c], dx
mov ecx, dword [ebp - 0x414]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x42c]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x124], cx
mov eax, dword [ebp - 0x25c]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
mov ecx, dword [ebp - 0x124]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x254], eax
mov edx, dword [ebp - 0x2e0]
xor edx, dword [ebp - 0x254]
mov dword [ebp - 0x2e0], edx
mov eax, dword [ebp - 0x324]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x344]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x25c], ax
mov edx, dword [ebp - 0x344]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x304]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x124], dx
mov ecx, dword [ebp - 0x25c]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
mov edx, dword [ebp - 0x124]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
shl edx, 0x10
or ecx, edx
mov dword [ebp - 0x254], ecx
mov eax, dword [ebp - 0x360]
xor eax, dword [ebp - 0x254]
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x2fc]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x350]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x25c], cx
mov eax, dword [ebp - 0x300]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x354]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x124], ax
mov edx, dword [ebp - 0x25c]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
mov eax, dword [ebp - 0x124]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
shl eax, 0x10
or edx, eax
mov dword [ebp - 0x254], edx
mov ecx, dword [ebp - 0x2dc]
xor ecx, dword [ebp - 0x254]
mov dword [ebp - 0x2dc], ecx
push 0x400
lea edx, [ebp - 0x660]
push edx
lea ecx, [ebp - 0x250]
call sub.MFC42.DLL_CFile::Write
mov dword [ebp - 0x8a8], 1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x258]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x890]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x250]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x880]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x67c]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x8a8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret