Function at 0x4633ea
Capabilities:
Get disk information
Terminate process

Disassembly:
mov eax, 0x4afe69
call fcn.004af1c8
sub esp, 0xb4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x18], 0xffffffff
push 2
lea ecx, [ebp - 0x70]
call fcn.00409f19
mov dword [ebp - 0x24], 0xfffffffd
xor ebx, ebx
mov dword [ebp - 0x18], ebx
jmp 0x463435
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], 0x6432a276
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x463425
mov dword [ebp - 0x18], 0xfffffff9
xor edi, edi
inc edi
cmp dword [ebp - 0x18], 0xf
jl 0x463547
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x28], 0xfffd
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x46353c
mov dword [ebp - 0x1c], ebx
push 3
lea ecx, [ebp - 0x54]
call fcn.00409f19
mov dword [ebp - 0x1c], ebx
jmp 0x463488
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x46347b
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ebx
jl 0x463528
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0xac9d73df
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
cmp dword [eax + ecx*4], 0xfffffff7
je 0x4634bd
cmp dword [ebp - 0x14], ebx
mov edx, edi
jne 0x4634bf
mov edx, ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x18]
sub edx, eax
mov dword [ebp - 0x30], edx
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ecx + esi*4]
setg dl
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setg cl
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, ecx
setle dl
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
je 0x46350b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], ebx
jne 0x463519
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [eax + 4], edi
dec dword [ebp - 0x1c]
jns 0x4634a0
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x54]
call fcn.00409fc5
dec dword [ebp - 0x14]
jns 0x463469
dec dword [ebp - 0x28]
inc dword [ebp - 0x18]
jmp 0x463445
lea ecx, [ebp - 0x70]
call fcn.00409fc5
mov dword [ebp - 0x1c], 0x7a98815c
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 0xfc4b03e3
mov dword [ebp - 0x14], ebx
jmp 0x463573
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34], 0x3dda37bb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x463565
mov dword [ebp - 0x14], ebx
jmp 0x46358e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x46357d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], 0xffff17d4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0x4365
setle cl
mov dword [ebp - 0x90], ecx
push 3
lea ecx, [ebp - 0x64]
call fcn.00409f19
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x14], 0x6f29
cmp dword [ebp - 0x14], 0x6fe2
jle 0x463642
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov eax, esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x1f78
mov esi, dword [ebp - 0x18]
cdq
push edx
push eax
mov ecx, 0xae33d8
call fcn.00409bc4
mov eax, dword [ebp - 0x28]
add eax, esi
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x24]
jne 0x46360d
dec esi
mov dword [ebp - 0x18], esi
cmp esi, 0xffffa491
mov esi, dword [ebp - 0x1c]
jg 0x4635fe
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x498f
jl 0x4635fb
push 4
lea ecx, [ebp - 0x88]
call fcn.00409f19
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0x6c03
jge 0x46366a
mov edx, str.hyhujqe_qmnaq_wvhirul_zpvigvg_umvpaso
mov ecx, 0xae33d8
call fcn.0040c802
or dword [ebp - 4], 0xffffffff
jmp 0x463693
mov dword [ebp - 0x14], ebx
jmp 0x4636a8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], 0x4778
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x463698
mov dword [ebp - 0x14], ebx
jmp 0x4636c6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x88]
mov dword [eax + ecx*4], 0x7ddbf4df
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x4636b3
mov dword [ebp - 0x1c], ebx
jmp 0x4637a5
mov dword [ebp - 0x14], 0x70ade216
mov dword [ebp - 0x14], ebx
jmp 0x463798
mov dword [ebp - 0x30], 0x2dd78f4f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffff7
jg 0x463795
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x24], 0xac3d
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0x24]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x14]
sub eax, 3
neg eax
sbb eax, eax
inc eax
xor ecx, ecx
cmp eax, dword [edx + esi*4]
setle cl
mov edx, dword [ebp - 0x14]
add edx, 0x336d
imul edx, dword [ebp - 0x24]
add edx, ecx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x28]
neg eax
xor edx, edx
cmp eax, dword [ecx + esi*4]
setge dl
mov eax, dword [ebp - 0x2c]
add eax, edx
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 8], eax
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x463788
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff7
jle 0x46370c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x4636e3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x4636d4
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x4637c1
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea ecx, [ebp - 0x88]
call fcn.00409fc5
lea ecx, [ebp - 0x64]
call fcn.00409fc5
mov dword [ebp - 0x30], 0x564a
cmp dword [ebp - 0x30], 0x57aa
jle 0x46383f
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
mov eax, esi
sar eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0xa8]
call fcn.00401a71
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x463807
mov eax, dword [eax]
push eax
call fcn.00499a27
pop ecx
push ebx
push edi
lea ecx, [ebp - 0xa8]
call fcn.0040a55c
mov ecx, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x4620
jl 0x4637eb
inc esi
cmp esi, 0x4fb5
jl 0x4637e6
push 0xa5e
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x28], 0xd39
cmp dword [ebp - 0x28], 0xf40
jle 0x4638aa
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
mov eax, esi
shl eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0xc0]
call fcn.00401a71
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x463872
mov eax, dword [eax]
push eax
call fcn.00499a27
pop ecx
push ebx
push edi
lea ecx, [ebp - 0xc0]
call fcn.0040a55c
mov ecx, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x6094
jl 0x463856
inc esi
cmp esi, 0x5a7c
jl 0x463851
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x9c7
jge 0x4638c5
push str.fqpwomgds_ahfslbl_svbpp_ssxelwta
call fcn.00499a27
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x4638ee
push edi
lea ecx, [ebp - 0x7c]
call fcn.00409f19
mov dword [ebp - 0x1c], 0xd4f2887c
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x2c], 0x2df3d37a
mov dword [ebp - 0x24], 2
push edi
lea ecx, [ebp - 0x44]
call fcn.00409f19
mov dword [ebp - 0x28], 0x99da9727
mov dword [ebp - 0x14], ebx
jmp 0x463934
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0xdf37
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x463924
mov dword [ebp - 0x14], ebx
jmp 0x46394b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x44]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x46393e
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
imul eax, dword [ebp - 0x18], 0xafe3
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x46c2
setge cl
mov eax, dword [ebp - 0x7c]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
mov dword [eax], ecx
test ecx, ecx
je 0x4639d7
mov dword [ebp - 0x1c], ebx
jmp 0x4639ca
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x4639a7
push ebx
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov dword [ebp - 0x18], ebx
jmp 0x4639c1
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x4639be
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xe
jg 0x4639ac
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe2
je 0x463997
mov eax, dword [ebp - 0x44]
mov dword [eax], edi
jmp 0x4639e7
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x4639e7
push ebx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov dword [eax], edi
lea ecx, [ebp - 0x44]
call fcn.00409fc5
lea ecx, [ebp - 0x7c]
call fcn.00409fc5
mov dword [ebp - 4], 4
cmp dword [ebp - 0x30], 0x55c5
jge 0x463a20
push str.aiilrf_gjmssq_vxbxtrq_eywos_vob_ssawwitt
call fcn.00499a27
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x463a49
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [edx]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax + ecx*4], 0xfffffff7
je 0x463a61
cmp dword [edx], ebx
mov ecx, edi
jne 0x463a63
mov ecx, ebx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov edi, dword [ebp + 0x14]
mov dword [edi], eax
mov esi, dword [edx]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebx]
sub ecx, eax
mov dword [ebp + 8], ecx
xor ecx, ecx
mov eax, dword [ebp + 8]
cmp eax, dword [edx + esi*4]
setg cl
mov eax, dword [edi]
xor edx, edx
cmp eax, ecx
setg dl
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
xor ecx, ecx
cmp eax, edx
setle cl
mov esi, dword [ebp + 0xc]
mov edx, dword [esi]
imul edx, ecx
mov eax, dword [ebx]
xor ecx, ecx
cmp edx, eax
setne cl
mov eax, dword [ebp - 0x38]
mov dword [eax], ecx
cmp dword [eax], 0
je 0x463abb
mov eax, dword [esi]
mov eax, dword [edi]
mov eax, dword [esi]
cmp dword [edi], 0
jne 0x463ac6
mov eax, dword [edi]
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov dword [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret