Function at 0x4245f7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
push esi
push ebx
mov eax, 0x2a5c
call fcn.00444b80
sub esp, eax
mov ebx, dword [esp + 0x2a70]
mov esi, dword [esp + 0x2a74]
mov dword [esp + 4], 0x3a
mov eax, dword [esp + 0x2a78]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x424650
mov dword [0x44764c], str.volume_name_may_not_contain_colons
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x16
mov eax, 0xffffffff
jmp 0x425162
mov edi, dword [esp + 0x2a78]
mov eax, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 2]
cmp eax, 0x1a
jbe 0x42468d
mov dword [0x44764c], str.volume_name_must_be_1_27_chars
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x16
mov eax, 0xffffffff
jmp 0x425162
mov dword [esp + 0x222c], 0
mov dword [esp + 0x2234], esi
mov dword [esp + 0x2238], 0
mov dword [esp + 0x223c], 0
mov dword [esp + 0x2240], 0
lea eax, [esp + 0x228]
mov dword [esp + 0x22f4], eax
mov dword [esp + 0x2a38], 2
mov dword [esp + 0x2a3c], 0
mov dword [esp + 0x2a40], 0
mov dword [esp + 0x2a44], 0
mov dword [esp + 0x2a48], 0
mov dword [esp + 0x2a4c], 0
test esi, esi
jle 0x424740
lea eax, [esp + 0x2228]
mov dword [esp], eax
call fcn.004274d2
test eax, eax
jns 0x42474a
mov eax, dword [esp + 0x2228]
mov dword [esp], eax
call sub.msvcrt.dll__close
mov eax, 0xffffffff
jmp 0x425162
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x223c], eax
mov ebp, dword [esp + 0x223c]
cmp ebp, 0x63f
ja 0x424779
mov dword [0x44764c], str.volume_size_must_be___800K
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x16
mov eax, 0xffffffff
jmp 0x425162
mov eax, dword [ebx + 0x28]
lea esi, [eax + 0x1ff]
test eax, eax
cmovns esi, eax
sar esi, 9
mov dword [esp + 0x2240], esi
mov word [esp + 0x2244], 0x4244
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__time64]
mov dword [esp], eax
call fcn.0042413a
mov dword [esp + 0x2248], eax
mov dword [esp + 0x224c], eax
mov word [esp + 0x2250], 0
mov word [esp + 0x2252], 0
mov word [esp + 0x2254], 3
mov word [esp + 0x2256], 0
mov eax, dword [esp + 0x223c]
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x2240]
mov eax, edi
shl eax, 9
mov dword [esp + 0x225c], eax
mov eax, edi
shl eax, 0xb
mov dword [esp + 0x2260], eax
mov ecx, dword [ebx + 0x10]
mov eax, ebp
mov edx, 0
div esi
add eax, 0xfff
shr eax, 0xc
add eax, 3
movzx eax, ax
add eax, ecx
lea eax, [edi + eax - 1]
mov edx, 0
div edi
imul eax, edi
sub eax, ecx
mov word [esp + 0x2264], ax
mov dword [esp + 0x2268], 2
mov ecx, dword [esp + 0x2a78]
mov dword [esp + 4], ecx
lea esi, [esp + 0x2228]
lea eax, [esp + 0x226e]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 0x228c], 0
mov word [esp + 0x2290], 0
mov dword [esp + 0x2294], 0
mov eax, dword [ebx + 0x2c]
mov dword [esp + 0x2298], eax
imul eax, dword [ebx + 0x34]
mov dword [esp + 0x229c], eax
mov eax, dword [esp + 0x1c]
mov edx, 0
div edi
sub eax, 1
mov word [esp + 0x226c], ax
mov word [esp + 0x2258], ax
mov word [esp + 0x22a0], 0
mov dword [esp + 0x22a4], 0
mov dword [esp + 0x22a8], 0xffffffff
lea eax, [esp + 0x22ac]
lea edx, [esp + 0x22cc]
mov dword [eax], 0
add eax, 4
cmp eax, edx
jne 0x4248f1
mov word [esp + 0x22cc], 0
mov word [esp + 0x22ce], 0
mov word [esp + 0x22d0], 0
mov dword [esp + 0x22d4], 0
mov dword [esp + 0x22e4], 0
lea eax, [esp + 0x22d8]
lea edx, [esi + 0xbc]
mov word [eax], 0
mov word [eax + 2], 0
mov word [eax + 0x10], 0
mov word [eax + 0x12], 0
add eax, 4
cmp eax, edx
jne 0x42493f
mov edi, dword [esp + 0x22f4]
mov edx, 0x2000
test edi, 1
je 0x42497b
mov byte [edi], 0
add edi, 1
mov dx, 0x1fff
test edi, 2
je 0x42498e
mov word [edi], 0
add edi, 2
sub edx, 2
mov ecx, edx
shr ecx, 2
mov eax, 0
rep stosd dword es:[edi], eax
test dl, 2
je 0x4249a7
mov word [edi], 0
add edi, 2
test dl, 1
je 0x4249af
mov byte [edi], 0
movzx eax, word [esp + 0x2264]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x229c]
add eax, dword [esp + 0x2298]
mov dword [ebx], eax
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4249d9
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x225c]
add eax, dword [esp + 0x2260]
add eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x424a03
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 4]
add eax, dword [ebx + 0x10]
shl eax, 9
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x18], 0
je 0x424a26
mov ebp, 0
test eax, eax
jne 0x424a41
mov dword [0x44764c], 0
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xc
mov ebp, 0xffffffff
mov eax, dword [ebx + 0x10]
shl eax, 9
add eax, dword [ebx + 0x24]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx]
lea edx, [eax + 0x1ff]
test eax, eax
cmovs eax, edx
sar eax, 9
mov dword [ebx], eax
mov edx, dword [esp + 0x2260]
shr edx, 9
mov dword [ebx + 8], edx
add eax, edx
mov edx, eax
shl edx, 9
add edx, dword [ebx + 0x18]
mov dword [ebx + 0x20], edx
add eax, dword [esp + 0x2240]
mov dword [ebx + 0xc], eax
mov dword [esp + 0x2230], ebx
lea eax, [esp + 0x2228]
mov dword [esp + 0x22f8], eax
mov dword [esp + 0x22fc], 0
mov dword [esp + 0x2300], 0x65747865
mov dword [esp + 0x2304], 0x2073746e
mov dword [esp + 0x2308], 0x7265766f
mov dword [esp + 0x230c], 0x776f6c66
mov byte [esp + 0x2310], 0
mov byte [esp + 0x2320], 2
mov byte [esp + 0x2324], 0
mov byte [esp + 0x2325], 0
mov dword [esp + 0x2338], 3
mov word [esp + 0x233c], 0
mov dword [esp + 0x2340], 0
mov dword [esp + 0x2344], 0
mov word [esp + 0x2348], 0
mov dword [esp + 0x234c], 0
mov dword [esp + 0x2350], 0
mov eax, dword [esp + 0x2248]
mov dword [esp + 0x2354], eax
mov eax, dword [esp + 0x224c]
mov dword [esp + 0x2358], eax
mov dword [esp + 0x235c], 0
mov word [esp + 0x2370], 0
lea eax, [esp + 0x2372]
lea edx, [esi + 0x156]
mov word [eax], 0
mov word [eax + 2], 0
mov word [eax + 0xc], 0
mov word [eax + 0xe], 0
add eax, 4
cmp eax, edx
jne 0x424b78
mov dword [esp + 4], 0
lea ebx, [esp + 0x22f8]
mov dword [esp], ebx
call fcn.00428420
mov eax, dword [esp + 0x2298]
mov dword [esp + 0x23a8], eax
mov dword [esp + 0x23ac], 0
mov dword [esp + 0x23b4], 0
mov dword [esp + 0x23b0], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
lea eax, [esp + 0x23b8]
mov dword [esp], eax
call fcn.0042a200
mov dword [esp + 0x23bc], 0
mov word [esp + 0x23ca], 3
mov word [esp + 0x23d6], 0x78
mov word [esp + 0x23d8], 0xf8
mov word [esp + 0x23da], 0x1f8
lea edx, [esp + 0x2494]
mov ecx, 0x20
mov eax, 0
mov edi, edx
rep stosd dword es:[edi], eax
mov word [esp + 0x261c], 0
mov dword [esp + 0x2620], 0
mov dword [esp + 0x2624], 0
mov dword [esp + 0x2628], 0
mov dword [esp + 0x262c], 0
mov word [esp + 0x2630], 0x200
mov word [esp + 0x2632], 7
mov dword [esp + 0x2634], 0
mov dword [esp + 0x2638], 0
lea eax, [esp + 0x263c]
lea edx, [esi + 0x460]
mov byte [eax], 0
add eax, 1
cmp eax, edx
jne 0x424cb4
mov dword [esp], 0x100
call sub.msvcrt.dll_malloc
mov edx, eax
test eax, eax
jne 0x424cf8
test ebp, ebp
jne 0x425041
mov dword [0x44764c], 0
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xc
mov ebp, 0xffffffff
jmp 0x425041
mov ecx, 0x40
mov eax, 0
mov edi, edx
rep stosd dword es:[edi], eax
or byte [edx], 0x80
mov dword [esp + 0x2688], edx
mov dword [esp + 0x268c], 0x100
mov dword [esp + 0x2690], 1
mov dword [esp + 0x2694], 0x42ad86
test ebp, ebp
jne 0x424d51
mov dword [esp + 4], 1
lea eax, [esp + 0x22f8]
mov dword [esp], eax
call fcn.004297dd
sar eax, 0x1f
mov ebp, eax
sub dword [esp + 0x2638], 1
lea eax, [esp + 0x2228]
mov dword [esp + 0x2698], eax
mov dword [esp + 0x269c], 0
mov dword [esp + 0x26a0], 0x61746163
mov dword [esp + 0x26a4], 0x676f6c
mov byte [esp + 0x26c0], 2
mov byte [esp + 0x26c4], 0
mov byte [esp + 0x26c5], 0
mov dword [esp + 0x26d8], 4
mov word [esp + 0x26dc], 0
mov dword [esp + 0x26e0], 0
mov dword [esp + 0x26e4], 0
mov word [esp + 0x26e8], 0
mov dword [esp + 0x26ec], 0
mov dword [esp + 0x26f0], 0
mov eax, dword [esp + 0x2248]
mov dword [esp + 0x26f4], eax
mov eax, dword [esp + 0x224c]
mov dword [esp + 0x26f8], eax
mov dword [esp + 0x26fc], 0
mov word [esp + 0x2710], 0
lea eax, [esp + 0x2712]
lea edx, [esi + 0x4f6]
mov word [eax], 0
mov word [eax + 2], 0
mov word [eax + 0xc], 0
mov word [eax + 0xe], 0
add eax, 4
cmp eax, edx
jne 0x424e29
mov dword [esp + 4], 0
lea ebx, [esp + 0x2698]
mov dword [esp], ebx
call fcn.00428420
mov eax, dword [esp + 0x229c]
mov dword [esp + 0x2748], eax
mov dword [esp + 0x274c], 0
mov dword [esp + 0x2754], 0
mov dword [esp + 0x2750], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
lea eax, [esp + 0x2758]
mov dword [esp], eax
call fcn.0042a200
mov dword [esp + 0x275c], 0
mov word [esp + 0x276a], 3
mov word [esp + 0x2776], 0x78
mov word [esp + 0x2778], 0xf8
mov word [esp + 0x277a], 0x1f8
lea edx, [esp + 0x2834]
mov ecx, 0x20
mov eax, 0
mov edi, edx
rep stosd dword es:[edi], eax
mov word [esp + 0x29bc], 0
mov dword [esp + 0x29c0], 0
mov dword [esp + 0x29c4], 0
mov dword [esp + 0x29c8], 0
mov dword [esp + 0x29cc], 0
mov word [esp + 0x29d0], 0x200
mov word [esp + 0x29d2], 0x25
mov dword [esp + 0x29d4], 0
mov dword [esp + 0x29d8], 0
lea eax, [esp + 0x29dc]
add esi, 0x800
mov byte [eax], 0
add eax, 1
cmp eax, esi
jne 0x424f65
mov dword [esp], 0x100
call sub.msvcrt.dll_malloc
mov edx, eax
test eax, eax
jne 0x424fa9
test ebp, ebp
jne 0x425072
mov dword [0x44764c], 0
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xc
mov ebp, 0xffffffff
jmp 0x425072
mov ecx, 0x40
mov eax, 0
mov edi, edx
rep stosd dword es:[edi], eax
or byte [edx], 0x80
mov dword [esp + 0x2a28], edx
mov dword [esp + 0x2a2c], 0x100
mov dword [esp + 0x2a30], 1
mov dword [esp + 0x2a34], 0x42ad35
test ebp, ebp
jne 0x4250d5
mov dword [esp + 4], 1
lea eax, [esp + 0x2698]
mov dword [esp], eax
call fcn.004297dd
test eax, eax
jns 0x4250a0
jmp 0x4250d0
mov eax, dword [esp + 0x2688]
test eax, eax
je 0x425021
mov dword [esp], eax
call sub.msvcrt.dll_free
mov edx, dword [esp + 0x2a28]
mov eax, ebp
test edx, edx
je 0x425162
mov dword [esp], edx
call sub.msvcrt.dll_free
mov eax, ebp
jmp 0x425162
mov dword [esp + 0x2688], 0
mov dword [esp + 0x268c], 0x100
mov dword [esp + 0x2690], 1
mov dword [esp + 0x2694], 0x42ad86
jmp 0x424d51
mov dword [esp + 0x2a28], 0
mov dword [esp + 0x2a2c], 0x100
mov dword [esp + 0x2a30], 1
mov dword [esp + 0x2a34], 0x42ad35
jmp 0x4250d5
sub dword [esp + 0x29d8], 1
mov eax, dword [esp + 0x2a78]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [esp + 0x2228]
mov dword [esp], eax
call fcn.0042c7bd
test eax, eax
jns 0x4250df
jmp 0x42514d
mov ebp, 0xffffffff
sub dword [esp + 0x29d8], 1
jmp 0x425152
mov dword [esp + 0x2268], 0x10
lea ebx, [esp + 0x28]
mov ecx, pe_nt_image_headers32
mov eax, 0
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
lea esi, [esp + 0x2228]
mov dword [esp], esi
call fcn.004272d8
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.004272d8
or dword [esp + 0x222c], 0x70
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.0042c5f3
sar eax, 0x1f
mov ebp, eax
jmp 0x42500e
mov ebp, 0xffffffff
mov dword [esp + 0x2268], 0x10
jmp 0x42500e
add esp, 0x2a5c
pop ebx
pop esi
pop edi
pop ebp
ret