Function at 0x409a50
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x17c
mov eax, dword [0x448004]
mov dword [ebp - 0x154], 0x3a003f
mov dword [ebp - 0x150], 0x5c
mov dword [ebp - 0x160], 0xdeadbeef
mov edx, dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx + 0x4c]
sub esp, 0xc
mov ebx, eax
mov eax, 0x948
call fcn.00406da0
xor eax, eax
cmp ebx, 0x80004003
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.Unexpected_hr__lx._n
lea ebx, [ebp - 0x154]
mov dword [esp], eax
call fcn.004077c0
mov eax, 0x949
call fcn.00406da0
mov eax, dword [ebp - 0x160]
mov dword [esp + 4], str.got__p_n
cmp eax, 0xdeadbeef
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004077c0
mov eax, 0x41
mov esi, dword [sym.imp.kernel32.dll_GetDriveTypeW]
mov word [ebp - 0x154], ax
jmp 0x409b2b
movzx eax, word [ebp - 0x154]
add eax, 1
mov word [ebp - 0x154], ax
cmp ax, 0x5a
ja 0x40a0a8
mov dword [esp], ebx
call esi
sub esp, 4
cmp eax, 1
jne 0x409b10
cmp word [ebp - 0x154], 0x5a
ja 0x40a0a8
mov dword [esp], ebx
call dword [sym.imp.oleaut32.dll_SysAllocString]
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x160], 0xdeadbeef
mov ebx, eax
mov eax, dword [0x448004]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx + 0x4c]
sub esp, 0xc
mov esi, eax
mov eax, 0x955
call fcn.00406da0
xor eax, eax
cmp esi, 0x800a0044
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], str.Unexpected_hr__lx._n
mov dword [esp], eax
call fcn.004077c0
mov eax, 0x956
call fcn.00406da0
mov eax, dword [ebp - 0x160]
mov dword [esp + 4], str.got__p_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.004077c0
mov dword [esp], ebx
call dword [sym.imp.oleaut32.dll_SysFreeString]
sub esp, 4
call fcn.00408c40
test eax, eax
je 0x40a290
mov edx, dword [eax]
lea ecx, [ebp - 0x15c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x20]
sub esp, 8
mov ebx, eax
mov eax, 0x961
call fcn.00406da0
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.Unexpected_hr__lx._n
mov dword [esp], eax
call fcn.004077c0
test ebx, ebx
js 0x40a270
mov esi, dword [ebp - 0x15c]
movzx edi, word [esi]
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_toupper]
mov dword [esp], edi
lea edi, [ebp - 0x14c]
mov ebx, eax
call dword [sym.imp.msvcrt.dll_tolower]
mov ecx, 0x50
mov edx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, 0x3a
mov edi, 0x5c
mov eax, 0x5c
mov word [ebp - 0x14c], bx
mov word [ebp - 0x130], bx
mov word [ebp - 0x12c], bx
mov word [ebp - 0x12a], cx
mov word [ebp - 0x110], bx
mov word [ebp - 0x10c], bx
mov dword [ebp - 0x10a], 0x5c003a
mov word [ebp - 0xf0], bx
mov word [ebp - 0xec], dx
mov dword [ebp - 0xea], 0x5c003a
mov word [ebp - 0xd0], bx
mov word [ebp - 0xcc], bx
mov word [ebp - 0xca], di
mov dword [ebp - 0xb4], 0x80070057
mov word [ebp - 0xac], dx
mov word [ebp - 0xaa], ax
mov dword [ebp - 0x94], 0x80070057
mov dword [ebp - 0x8c], 0x3a0024
mov dword [ebp - 0x88], 0x5c
mov dword [ebp - 0x74], 0x80070057
mov dword [ebp - 0x6c], 0x68005c
mov dword [ebp - 0x68], 0x73006f
mov dword [ebp - 0x64], 0x5c0074
mov dword [ebp - 0x60], 0x680073
mov dword [ebp - 0x5c], 0x720061
mov dword [ebp - 0x58], 0x65
mov dword [ebp - 0x54], 0x80070057
mov dword [ebp - 0x4c], 0x6f0068
mov dword [ebp - 0x48], 0x740073
mov dword [ebp - 0x44], 0x73005c
mov dword [ebp - 0x40], 0x610068
mov dword [ebp - 0x3c], 0x650072
mov dword [ebp - 0x34], 0x80070057
test ebx, ebx
je 0x40a2ab
lea eax, [ebp - 0x130]
lea edi, [ebp - 0x14c]
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x160]
mov dword [ebp - 0x170], eax
mov eax, dword [sym.imp.oleaut32.dll_SysFreeString]
mov dword [ebp - 0x16c], eax
mov eax, dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [ebp - 0x174], eax
jmp 0x40a030
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x409dd6
mov eax, edi
call fcn.00406dc0
mov edx, dword [edi + 0x18]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], esi
cmp edx, esi
mov dword [esp + 0xc], edx
sete al
mov dword [esp + 4], str.Unexpected_hr__lx__expected__lx_for_drive_spec__s._n
mov dword [esp], eax
call fcn.004077c0
call fcn.00416600
mov dword [eax], 0x41b595
mov dword [eax + 4], 0x97c
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], str.GetDrive_modified_its_DriveSpec_argument_n
movzx eax, al
mov dword [esp], eax
call fcn.004077c0
mov dword [esp], ebx
mov eax, dword [ebp - 0x16c]
call eax
sub esp, 4
cmp word [edi + 0x1c], 0
je 0x40a0c8
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x158]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x20]
sub esp, 8
mov ebx, eax
call fcn.00416600
mov edx, dword [ebp - 0x164]
mov dword [eax], 0x41b595
mov dword [eax + 4], 0x982
test edx, edx
je 0x40a168
mov dword [esp + 4], 0xffffffff
mov esi, dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov dword [esp], edi
call esi
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x409eb4
mov eax, edi
call fcn.00406dc0
mov dword [esp + 0xc], eax
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Unexpected_hr__lx._for_drive_spec__s_n
mov dword [esp], eax
call fcn.004077c0
test ebx, ebx
js 0x409ff6
call fcn.00416600
mov dword [eax], 0x41b595
mov dword [eax + 4], 0x984
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call esi
mov esi, str._invalid_
sub esp, 8
test eax, eax
jne 0x409f0f
mov eax, edi
call fcn.00406dc0
mov esi, eax
mov eax, dword [ebp - 0x168]
shr eax, 0x10
je 0x40a1d5
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x168]
mov ebx, str._invalid_
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x409f4e
mov eax, dword [ebp - 0x168]
call fcn.00406dc0
mov ebx, eax
mov edx, dword [ebp - 0x158]
test edx, edx
je 0x40a1fb
mov eax, edx
shr eax, 0x10
je 0x40a230
mov dword [esp], edx
mov dword [esp + 4], 0xffffffff
mov dword [ebp - 0x164], edx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, dword [ebp - 0x164]
sub esp, 8
test eax, eax
jne 0x40a258
mov eax, edx
call fcn.00406dc0
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x164], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
sete al
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov ecx, dword [ebp - 0x164]
movzx eax, al
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], str.got__s__expected__s_for_drive_spec__s_n
call fcn.004077c0
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
mov eax, dword [ebp - 0x16c]
call eax
sub esp, 4
mov eax, dword [ebp - 0x160]
mov ecx, 0x989
mov edx, 0x41c9b8
add edi, 0x20
call fcn.004077e0
mov eax, dword [ebp - 0x160]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
add dword [ebp - 0x168], 0x20
sub esp, 4
cmp word [edi], 0
je 0x40a149
mov dword [esp], edi
call dword [sym.imp.oleaut32.dll_SysAllocString]
mov ecx, dword [ebp - 0x170]
mov dword [ebp - 0x160], 0xdeadbeef
mov ebx, eax
mov eax, dword [0x448004]
sub esp, 4
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx + 0x4c]
sub esp, 0xc
mov esi, eax
call fcn.00416600
mov dword [eax], 0x41b595
mov dword [eax + 4], 0x97a
mov eax, edi
shr eax, 0x10
mov dword [ebp - 0x164], eax
jne 0x409db0
movzx eax, di
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00406a40
jmp 0x409dd6
mov eax, 0x950
call fcn.00406da0
mov dword [esp], str.All_drive_letters_are_occupied__skipping_test_for_nonexisting_drive._n
call fcn.004072e0
jmp 0x409bdf
call fcn.00416600
mov dword [eax], 0x41b595
mov dword [eax + 4], 0x98c
mov eax, dword [ebp - 0x164]
test eax, eax
je 0x40a210
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
mov eax, dword [ebp - 0x174]
call eax
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x40a110
mov eax, edi
call fcn.00406dc0
mov edx, dword [ebp - 0x160]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], str.got__p_for_drive_spec__s_n
test edx, edx
mov dword [esp + 8], edx
sete al
add edi, 0x20
mov dword [esp], eax
call fcn.004077c0
add dword [ebp - 0x168], 0x20
cmp word [edi], 0
jne 0x40a030
mov esi, dword [ebp - 0x15c]
mov dword [esp], esi
mov eax, dword [ebp - 0x16c]
call eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx esi, di
mov dword [esp], str._04x
mov dword [esp + 4], esi
call fcn.00406a40
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 4], str.Unexpected_hr__lx._for_drive_spec__s_n
mov dword [esp], eax
call fcn.004077c0
test ebx, ebx
js 0x409ff6
call fcn.00416600
mov dword [eax], 0x41b595
mov dword [eax + 4], 0x984
mov dword [esp + 4], esi
mov dword [esp], str._04x
call fcn.00406a40
mov esi, eax
mov eax, dword [ebp - 0x168]
shr eax, 0x10
jne 0x409f1e
mov eax, dword [ebp - 0x168]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00406a40
mov edx, dword [ebp - 0x158]
mov ebx, eax
test edx, edx
jne 0x409f5c
mov dword [ebp - 0x164], str._null_
jmp 0x409fa2
movzx eax, di
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00406a40
jmp 0x40a110
movzx edx, dx
mov dword [esp], str._04x
mov dword [esp + 4], edx
call fcn.00406a40
mov edx, dword [ebp - 0x158]
mov dword [ebp - 0x164], eax
jmp 0x409fa2
mov dword [ebp - 0x164], str._invalid_
mov edx, dword [ebp - 0x158]
jmp 0x409fa2
mov eax, 0x964
call fcn.00406da0
mov dword [esp], str.Could_not_retrieve_drive_letter_of_fixed_drive__skipping_test._n
call fcn.004072e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x95c
call fcn.00406da0
mov dword [esp], str.No_fixed_drive_found__skipping_test._n
call fcn.004072e0
jmp 0x40a15d
mov eax, dword [sym.imp.oleaut32.dll_SysFreeString]
mov dword [ebp - 0x16c], eax
jmp 0x40a14f