Function at 0x439f47
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46205c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6b0
mov dword [ebp - 0x6ac], ecx
push 0x100
push 0
lea eax, [ebp - 0x57c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x119], 0
push 0x80
lea edx, [ebp - 0x5fc]
push edx
lea eax, [ebp - 0x694]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x128]
push edx
push 0x80
lea eax, [ebp - 0x67c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x47c]
call fcn.0045ecce
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x680]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
lea edx, [ebp - 0x57c]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp - 0x9c], 0x57
mov byte [ebp - 0x9b], 0x54
mov byte [ebp - 0x9a], 0x43
mov byte [ebp - 0x99], 0x59
mov byte [ebp - 0x98], 0x30
mov byte [ebp - 0x97], 0x30
mov byte [ebp - 0x96], 0x30
mov byte [ebp - 0x95], 0x31
mov byte [ebp - 0x94], 0x2e
mov byte [ebp - 0x93], 0x62
mov byte [ebp - 0x92], 0x69
mov byte [ebp - 0x91], 0x6e
mov byte [ebp - 0x90], 0
lea eax, [ebp - 0x57c]
push eax
lea ecx, [ebp - 0x680]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x680]
call fcn.00405cd0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x680]
call fcn.00405d10
movsx edx, al
cmp edx, 0x5c
jne 0x43a0ec
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x680]
push ecx
lea edx, [ebp - 0x698]
push edx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x6b4], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x6b4]
push ecx
lea ecx, [ebp - 0x680]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x698]
call sub.MFC42.DLL_CString::CString
jmp 0x43a14a
push 0x5c
lea ecx, [ebp - 0x680]
call fcn.0045ecc8
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0x680]
push eax
lea ecx, [ebp - 0x69c]
push ecx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x6b8], eax
mov edx, dword [ebp - 0x6b8]
mov dword [ebp - 0x6bc], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x6bc]
push eax
lea ecx, [ebp - 0x680]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x69c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x250]
call fcn.0045ec0e
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x690]
call fcn.0045ec0e
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x120]
call fcn.00440170
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x680]
call fcn.00405d30
push eax
lea ecx, [ebp - 0x47c]
call sub.MFC42.DLL_CFileFind::FindFile
cmp eax, 1
jne 0x43a2f8
push 0
push 2
lea ecx, [ebp - 0x680]
call fcn.00405d30
push eax
lea ecx, [ebp - 0x690]
call sub.MFC42.DLL_CFile::Open
cmp eax, 1
jne 0x43a2ed
push 0x200
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x690]
call sub.MFC42.DLL_CFile::Read
mov edx, dword [ebp - 0x324]
and edx, 0xff
mov eax, dword [ebp - 0x344]
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x25c], dx
mov ecx, dword [ebp - 0x344]
and ecx, 0xff
mov edx, dword [ebp - 0x304]
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x124], cx
mov eax, dword [ebp - 0x25c]
and eax, 0xffff
mov ecx, dword [ebp - 0x124]
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x254], eax
mov edx, dword [ebp - 0x360]
xor edx, dword [ebp - 0x254]
mov dword [ebp - 0x360], edx
mov eax, dword [ebp - 0x2fc]
and eax, 0xff
mov ecx, dword [ebp - 0x350]
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x25c], ax
mov edx, dword [ebp - 0x300]
and edx, 0xff
mov eax, dword [ebp - 0x354]
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x124], dx
mov ecx, dword [ebp - 0x25c]
and ecx, 0xffff
mov edx, dword [ebp - 0x124]
and edx, 0xffff
shl edx, 0x10
or ecx, edx
mov dword [ebp - 0x254], ecx
mov eax, dword [ebp - 0x2dc]
xor eax, dword [ebp - 0x254]
mov dword [ebp - 0x2dc], eax
mov ecx, dword [ebp - 0x360]
cmp ecx, dword [ebp - 0x2dc]
jne 0x43a2e6
mov edx, dword [ebp - 0x360]
mov dword [ebp - 0x1c], edx
jmp 0x43a2ed
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x690]
call sub.MFC42.DLL_CFile::Close
push 0
push 0x1002
lea ecx, [ebp - 0x680]
call fcn.00405d30
push eax
lea ecx, [ebp - 0x250]
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x43a36e
mov dword [ebp - 0x6a0], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x690]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x250]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x680]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x47c]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x6a0]
jmp 0x43a7ec
lea eax, [ebp - 0x6a4]
push eax
call sub.MFC42.DLL_CTime::GetTickCount
push eax
lea ecx, [ebp - 0x120]
call fcn.00405d90
lea ecx, [ebp - 0x120]
call fcn.00405d40
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov dword [ebp - 0x260], 0
jmp 0x43a3b6
mov ecx, dword [ebp - 0x260]
add ecx, 1
mov dword [ebp - 0x260], ecx
cmp dword [ebp - 0x260], 0x3f
jge 0x43a3d4
call dword [sym.imp.MSVCRT.dll_rand]
mov edx, dword [ebp - 0x260]
mov dword [ebp + edx*4 - 0x460], eax
jmp 0x43a3a7
call dword [sym.imp.MSVCRT.dll_rand]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov dword [ebp - 0x260], 0
jmp 0x43a3ff
mov eax, dword [ebp - 0x260]
add eax, 1
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x1f
jge 0x43a41d
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [ebp - 0x260]
mov dword [ebp + ecx*4 - 0x35c], eax
jmp 0x43a3f0
call dword [sym.imp.MSVCRT.dll_rand]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov dword [ebp - 0x260], 0
jmp 0x43a448
mov edx, dword [ebp - 0x260]
add edx, 1
mov dword [ebp - 0x260], edx
cmp dword [ebp - 0x260], 0x1f
jge 0x43a466
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [ebp - 0x260]
mov dword [ebp + ecx*4 - 0x2d8], eax
jmp 0x43a439
mov edx, dword [ebp - 0x128]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
xor edx, 0x5555
and edx, 0xffff
mov eax, dword [ebp - 0x128]
and eax, 0xffff
xor eax, 0xaaaa
and eax, 0xffff
shl eax, 0x10
or edx, eax
mov dword [ebp - 0x364], edx
lea ecx, [ebp - 0x240]
call fcn.00405db0
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x250]
call sub.MFC42.DLL_CFile::GetStatus_1
lea ecx, [ebp - 0x240]
call fcn.00405d30
mov dword [ebp - 0x2e0], eax
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x360], edx
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x2dc], eax
push 0
push 0x4741e0
push 0x4741ec
lea ecx, [ebp - 0x258]
push ecx
call fcn.00405de0
mov ecx, eax
call sub.MFC42.DLL_CWinApp::GetProfileStringA
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x258]
call fcn.00405cd0
test eax, eax
jle 0x43a5b7
lea ecx, [ebp - 0x258]
call fcn.00405d30
push eax
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
xor edx, 0x55aa
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x258
jbe 0x43a566
mov dword [ebp - 0x360], 0x381
mov dword [ebp - 0x2dc], 0x230b
jmp 0x43a5b5
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
xor ecx, 0x55aa
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x4741f4
lea eax, [ebp - 0x258]
push eax
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
lea ecx, [ebp - 0x258]
call fcn.00405d30
push eax
push 0x4741f8
push 0x474204
call fcn.00405de0
mov ecx, eax
call sub.MFC42.DLL_CWinApp::WriteProfileStringA
jmp 0x43a606
mov ecx, dword [ebp - 0x360]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
xor edx, 0x55aa
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
push 0x47420c
lea ecx, [ebp - 0x258]
push ecx
call sub.MFC42.DLL_CString::Format_1
add esp, 0xc
lea ecx, [ebp - 0x258]
call fcn.00405d30
push eax
push str.CREATETIME
push 0x47421c
call fcn.00405de0
mov ecx, eax
call sub.MFC42.DLL_CWinApp::WriteProfileStringA
mov edx, dword [ebp - 0x454]
and edx, 0xff
mov eax, dword [ebp - 0x444]
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x25c], dx
mov ecx, dword [ebp - 0x414]
and ecx, 0xff
mov edx, dword [ebp - 0x42c]
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x124], cx
mov eax, dword [ebp - 0x25c]
and eax, 0xffff
mov ecx, dword [ebp - 0x124]
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x254], eax
mov edx, dword [ebp - 0x2e0]
xor edx, dword [ebp - 0x254]
mov dword [ebp - 0x2e0], edx
mov eax, dword [ebp - 0x324]
and eax, 0xff
mov ecx, dword [ebp - 0x344]
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x25c], ax
mov edx, dword [ebp - 0x344]
and edx, 0xff
mov eax, dword [ebp - 0x304]
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x124], dx
mov ecx, dword [ebp - 0x25c]
and ecx, 0xffff
mov edx, dword [ebp - 0x124]
and edx, 0xffff
shl edx, 0x10
or ecx, edx
mov dword [ebp - 0x254], ecx
mov eax, dword [ebp - 0x360]
xor eax, dword [ebp - 0x254]
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x2fc]
and ecx, 0xff
mov edx, dword [ebp - 0x350]
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x25c], cx
mov eax, dword [ebp - 0x300]
and eax, 0xff
mov ecx, dword [ebp - 0x354]
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x124], ax
mov edx, dword [ebp - 0x25c]
and edx, 0xffff
mov eax, dword [ebp - 0x124]
and eax, 0xffff
shl eax, 0x10
or edx, eax
mov dword [ebp - 0x254], edx
mov ecx, dword [ebp - 0x2dc]
xor ecx, dword [ebp - 0x254]
mov dword [ebp - 0x2dc], ecx
push 0x200
lea edx, [ebp - 0x460]
push edx
lea ecx, [ebp - 0x250]
call sub.MFC42.DLL_CFile::Write
mov dword [ebp - 0x6a8], 1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x258]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x690]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x250]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x680]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x47c]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret