Function at 0x43a5d0
Capabilities:
Get disk information
Hash data with md5
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560902
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x370
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x34c], edi
xor eax, eax
mov dword [edi], 0
mov dword [edi + 0x4e4], 0
mov dword [edi + 0x4e8], 7
mov word [edi + 0x4d4], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x4fc], eax
mov dword [edi + 0x500], 7
mov word [edi + 0x4ec], ax
mov dword [edi + 0x504], eax
xor ecx, ecx
mov dword [edi + 0x518], eax
mov dword [edi + 0x51c], 7
mov word [edi + 0x508], cx
mov dword [edi + 0x530], ecx
mov dword [edi + 0x534], 7
mov word [edi + 0x520], ax
mov dword [edi + 0x548], ecx
mov dword [edi + 0x54c], 7
mov word [edi + 0x538], ax
mov dword [edi + 0x560], ecx
mov dword [edi + 0x564], 7
mov word [edi + 0x550], ax
mov dword [edi + 0x578], ecx
mov dword [edi + 0x57c], 7
mov word [edi + 0x568], ax
mov dword [edi + 0x590], ecx
mov dword [edi + 0x594], 7
mov word [edi + 0x580], ax
mov dword [edi + 0x5a8], ecx
mov dword [edi + 0x5ac], 7
mov word [edi + 0x598], ax
mov dword [edi + 0x5c0], ecx
mov dword [edi + 0x5c4], 7
mov word [edi + 0x5b0], ax
mov dword [edi + 0x5d8], ecx
mov dword [edi + 0x5dc], 7
mov word [edi + 0x5c8], ax
mov dword [edi + 0x5e0], ecx
mov dword [edi + 0x5e4], ecx
mov dword [edi + 0x5e8], ecx
mov dword [edi + 0x5ec], ecx
mov dword [edi + 0x5f0], ecx
mov dword [edi + 0x5f4], ecx
mov dword [edi + 0x5f8], ecx
mov dword [edi + 0x5fc], ecx
mov dword [edi + 0x600], ecx
mov dword [edi + 0x604], ecx
mov dword [edi + 0x608], 0xffffffff
mov dword [edi + 0x60c], 0xffffffff
mov dword [edi + 0x610], 1
mov dword [edi + 0x614], ecx
mov dword [edi + 0x618], ecx
mov dword [edi + 0x61c], ecx
mov dword [edi + 0x620], 1
mov dword [edi + 0x624], 1
mov dword [edi + 0x628], 1
mov dword [edi + 0x62c], ecx
mov dword [edi + 0x630], ecx
mov dword [edi + 0x634], ecx
mov dword [edi + 0x638], ecx
mov dword [edi + 0x63c], ecx
mov byte [ebp - 4], 0xe
mov dword [edi + 0x640], ecx
mov dword [edi + 0x9fc], ecx
sub esp, 8
lea ecx, [edi + 0xa08]
call fcn.0040bf40
mov dword [edi + 0xab8], 0
mov dword [edi + 0xabc], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0xf
mov byte [ebp - 0x284], 0
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 0x10
call fcn.00414280
movups xmm0, xmmword [ebp - 0x284]
mov byte [ebp - 0x284], 0
movups xmmword [ebp - 0x348], xmm0
movq xmm0, qword [ebp - 0x274]
movq qword [ebp - 0x338], xmm0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0xf
push 0x104
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x11
xorps xmm0, xmm0
push eax
push str.SystemDrive
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
push 0x104
lea eax, [ebp - 0x268]
mov byte [ebp - 0x32], 0x5c
push 0
push eax
call fcn.005219d0
add esp, 0xc
lea eax, [ebp - 0x160]
push 0x104
push 0
push eax
call fcn.005219d0
add esp, 0xc
lea eax, [ebp - 0x160]
push 0x104
push eax
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x26c]
push eax
push 0x104
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
je 0x43a93a
push dword [ebp - 0x26c]
xorps xmm0, xmm0
lea eax, [ebp - 0x54]
push str._08x
push 0x20
push eax
movups xmmword [ebp - 0x54], xmm0
movups xmmword [ebp - 0x44], xmm0
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x330]
push 0x58c2cc
push eax
call fcn.004135d0
add esp, 0x1c
jmp 0x43a967
push 0
push 0x58b228
lea ecx, [ebp - 0x330]
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x31c], 0xf
mov byte [ebp - 0x330], 0
call fcn.00406610
lea ecx, [ebp - 0x37c]
mov byte [ebp - 4], 0x12
call fcn.00414590
mov esi, eax
lea ecx, [ebp - 0x364]
mov byte [ebp - 4], 0x13
call fcn.00414770
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x348]
cmp dword [ebp - 0x334], 0x10
lea edx, [ebp - 0x330]
cmovae ecx, dword [ebp - 0x348]
cmp dword [ebp - 0x31c], 0x10
cmovae edx, dword [ebp - 0x330]
cmp dword [esi + 0x14], 0x10
jb 0x43a9bb
mov esi, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x43a9c3
mov eax, dword [eax]
push ecx
push edx
push esi
push eax
lea eax, [ebp - 0x29c]
push str._s_s_s_s
push eax
call fcn.004135d0
add esp, 0x18
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x350]
cmp edx, 0x10
jb 0x43aa19
mov ecx, dword [ebp - 0x364]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x43aa0f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ad10
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x350], 0xf
mov byte [ebp - 0x364], 0
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x368]
cmp edx, 0x10
jb 0x43aa72
mov ecx, dword [ebp - 0x37c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x43aa68
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ad15
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov dword [ebp - 0x36c], 0
mov dword [ebp - 0x368], 0xf
mov byte [ebp - 0x37c], 0
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x31c]
cmp edx, 0x10
jb 0x43aacb
mov ecx, dword [ebp - 0x330]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x43aac1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ad1a
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x31c], 0xf
mov byte [ebp - 0x330], 0
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x334]
cmp edx, 0x10
jb 0x43ab24
mov ecx, dword [ebp - 0x348]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x43ab1a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ad1f
push edx
push ecx
call fcn.00497cc1
add esp, 8
cmp dword [ebp - 0x288], 0x10
lea eax, [ebp - 0x29c]
push dword [ebp - 0x28c]
cmovae eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x318]
push eax
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x334], 0xf
mov byte [ebp - 0x348], 0
mov byte [ebp - 0x2b0], 0
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x318], 0x67452301
mov dword [ebp - 0x314], 0xefcdab89
mov dword [ebp - 0x310], 0x98badcfe
mov dword [ebp - 0x30c], 0x10325476
call fcn.004092b0
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x318]
call fcn.00409bc0
mov esi, eax
lea ecx, [edi + 0x508]
cmp ecx, esi
je 0x43abf5
call fcn.00407320
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi + 0x508], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x518], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x270]
cmp edx, 8
jb 0x43ac35
mov ecx, dword [ebp - 0x284]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43ac2b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ad24
push edx
push ecx
call fcn.00497cc1
add esp, 8
push 0x2c8
lea eax, [edi + 4]
push 0
push eax
call fcn.005219d0
add esp, 0xc
lea esi, [edi + 0x2cc]
push 0x208
push 0
push esi
call fcn.005219d0
add esp, 0xc
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
mov dword [edi + 0xac0], 0
xor esi, esi
mov dword [edi + 0xac4], 0
mov dword [edi + 0xac8], 0
mov dword [edi + 0xacc], 0
mov dword [edi + 0xad0], 0
push 0
push esi
push str.Status
call fcn.0043b040
inc esi
cmp esi, 0xc
jl 0x43aca7
mov edx, dword [ebp - 0x288]
cmp edx, 0x10
jb 0x43acf0
mov ecx, dword [ebp - 0x29c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x43ace6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ad29
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
int3