Function at 0x401000
Capabilities:
Get common file path
Get disk information
Get file attributes
Read process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
movzx ax, byte [0x55c8eb]
mov word [ebp - 0xac], ax
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea esi, [edx + ecx + 0x2e7be]
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
add eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx - 0x23564]
add edx, dword [ebp - 0x10c]
and esi, edx
mov dword [ebp - 0x10c], esi
movzx esi, byte [ebp - 0x81]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
sub esi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
add esi, eax
sub esi, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea ecx, [esi + eax + 0x53289]
sub ecx, dword [ebp - 0x10c]
sub ecx, 0x4aea8
mov word [ebp - 0xac], cx
mov esi, dword [ebp - 0x10c]
add esi, dword [ebp - 0x10c]
mov edi, dword [ebp - 0x10c]
sub edi, 0x293fa
and edi, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
mov eax, dword [ebp - 0x10c]
lea ebx, [edx + eax + 0x3c9c1]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
sub ebx, eax
add ebx, 0x41828
sub ebx, dword [ebp - 0x10c]
sub ebx, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add ebx, eax
and edi, ebx
or esi, edi
mov dword [ebp - 0x10c], esi
cmp dword [ebp - 0x70], 0x1223a
jne 0x40112f
cmp dword [ebp - 0x6c], 0
je 0x4011aa
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x10c]
jne 0x4011aa
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, eax
add esi, 0x7f863
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
sub esi, eax
movzx edx, word [ebp - 0xac]
sub esi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
sub esi, eax
add esi, 0x4aa6b
mov edi, dword [ebp - 0x10c]
sub edi, dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
add eax, dword [ebp - 0x10c]
and edi, eax
or esi, edi
mov dword [ebp - 0x10c], esi
jmp 0x4011fc
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
add eax, 0x33e57
sub eax, dword [ebp - 0x10c]
mov edx, 0x8841
mov ecx, eax
shl edx, cl
shl edx, 0x77
mov eax, dword [ebp - 0x10c]
add eax, 0x336f4
and edx, eax
mov ecx, dword [ebp - 0x10c]
add ecx, 0x6af37
or edx, ecx
or edx, dword [ebp - 0x10c]
xor eax, eax
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x10c], 0x39d5a
jne 0x401255
xor ecx, ecx
je 0x401255
movzx edx, byte [ebp - 0x81]
add edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
add eax, 0x2e11d
mov ecx, dword [ebp - 0x10c]
add ecx, dword [ebp - 0x10c]
mov esi, dword [ebp - 0x10c]
lea ecx, [ecx + esi - 0x3a89c]
and eax, ecx
or edx, eax
or edx, dword [ebp - 0x10c]
or edx, 0x76d9d
mov byte [ebp - 0x81], dl
jmp 0x40126f
movzx edx, byte [ebp - 0x81]
mov eax, dword [ebp - 0x10c]
lea ecx, [eax + edx - 0x22835]
mov dword [ebp - 0x10c], ecx
xor edx, edx
jne 0x401286
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
cmp eax, 0x328bc
jne 0x4012a7
mov eax, dword [ebp - 0x10c]
add eax, 0xabd2e
and eax, 0x54110
movzx ecx, byte [ebp - 0x81]
and eax, ecx
mov dword [ebp - 0x10c], eax
jmp 0x4012da
movzx edx, word [ebp - 0xac]
movzx eax, word [ebp - 0xac]
add edx, dword [ebp - 0x10c]
lea ecx, [eax + edx - 0x21538]
sub ecx, dword [ebp - 0x10c]
and ecx, 0x5d6ec
or ecx, dword [ebp - 0x10c]
mov byte [ebp - 0x81], cl
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
xor edi, edi
mov edx, dword [ebp - 0x10c]
xor eax, eax
and edx, dword [ebp - 0x70]
and eax, dword [ebp - 0x6c]
or esi, edx
or edi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor ecx, ecx
add eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
adc edx, ecx
and eax, 0xfffdf092
or esi, eax
or edi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov ebx, eax
add ebx, dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and ebx, eax
mov eax, dword [ebp - 0x10c]
add eax, 0x1f13d
and ebx, eax
xor ecx, ecx
or esi, ebx
or edi, ecx
mov dword [ebp - 0x10c], esi
mov esi, dword [ebp - 0x10c]
sub esi, 0x78058
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub esi, eax
movzx edx, word [ebp - 0xac]
add esi, edx
push 0
push 0
push 0
push 0
push 0
call sub.KERNEL32.dll_Toolhelp32ReadProcessMemory
sub esi, eax
add esi, 0x5062b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
and eax, 0x23e6c
or esi, eax
mov dword [ebp - 0x10c], esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
mov ecx, 0x1cadb
sub ecx, eax
mov edx, dword [ebp - 0x10c]
lea esi, [ecx + edx + 0xfc24]
or esi, 0x35a09
or esi, dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov edi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
add edi, eax
and edi, dword [ebp - 0x10c]
or esi, edi
or esi, 0xfffd3edc
mov dword [ebp - 0x10c], esi
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14