Function at 0x43bada
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475b80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x930
mov dword [ebp - 0x91c], ecx
push 0x100
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x175], 0
push 0x80
lea ecx, [ebp - 0x334]
push ecx
lea edx, [ebp - 0x3bc]
push edx
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x188]
push ecx
push 0x80
lea edx, [ebp - 0x3b4]
push edx
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x1b4]
call fcn.00471b8e
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x198]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 2
push 0x80
lea ecx, [ebp - 0x2b4]
push ecx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov byte [ebp - 0xf8], 0x57
mov byte [ebp - 0xf7], 0x54
mov byte [ebp - 0xf6], 0x43
mov byte [ebp - 0xf5], 0x59
mov byte [ebp - 0xf4], 0x39
mov byte [ebp - 0xf3], 0x38
mov byte [ebp - 0xf2], 0x35
mov byte [ebp - 0xf1], 0x33
mov byte [ebp - 0xf0], 0x2e
mov byte [ebp - 0xef], 0x64
mov byte [ebp - 0xee], 0x72
mov byte [ebp - 0xed], 0x76
mov byte [ebp - 0xec], 0
push 0x100
lea edx, [ebp - 0x2b4]
push edx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x3b8]
call fcn.004070a0
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x3b8]
call fcn.004070e0
movsx edx, al
cmp edx, 0x5c
jne 0x43bc8a
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x3b8]
push ecx
lea edx, [ebp - 0x8fc]
push edx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x924], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x924]
push ecx
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8fc]
call sub.MFC42.DLL_CString::CString
jmp 0x43bce8
push 0x5c
lea ecx, [ebp - 0x3b8]
call fcn.00471b88
lea edx, [ebp - 0xf8]
push edx
lea eax, [ebp - 0x3b8]
push eax
lea ecx, [ebp - 0x900]
push ecx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x928], eax
mov edx, dword [ebp - 0x928]
mov dword [ebp - 0x92c], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x92c]
push eax
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x900]
call sub.MFC42.DLL_CString::CString
push 0
lea ecx, [ebp - 0x3b8]
call fcn.00407160
push eax
lea ecx, [ebp - 0x1b4]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x43be61
mov byte [ebp - 0xf8], 0x57
mov byte [ebp - 0xf7], 0x54
mov byte [ebp - 0xf6], 0x43
mov byte [ebp - 0xf5], 0x59
mov byte [ebp - 0xf4], 0x39
mov byte [ebp - 0xf3], 0x38
mov byte [ebp - 0xf2], 0x35
mov byte [ebp - 0xf1], 0x33
mov byte [ebp - 0xf0], 0x2e
mov byte [ebp - 0xef], 0x64
mov byte [ebp - 0xee], 0x61
mov byte [ebp - 0xed], 0x74
mov byte [ebp - 0xec], 0
lea ecx, [ebp - 0x2b4]
push ecx
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::operator_2
lea edx, [ebp - 0x2b4]
push edx
lea ecx, [ebp - 0x198]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x3b8]
call fcn.004070a0
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
sub eax, 1
push eax
lea ecx, [ebp - 0x3b8]
call fcn.004070e0
movsx ecx, al
cmp ecx, 0x5c
jne 0x43be03
lea edx, [ebp - 0xf8]
push edx
lea eax, [ebp - 0x3b8]
push eax
lea ecx, [ebp - 0x904]
push ecx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x930], eax
mov edx, dword [ebp - 0x930]
mov dword [ebp - 0x934], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x934]
push eax
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x904]
call sub.MFC42.DLL_CString::CString
jmp 0x43be61
push 0x5c
lea ecx, [ebp - 0x3b8]
call fcn.00471b88
lea ecx, [ebp - 0xf8]
push ecx
lea edx, [ebp - 0x3b8]
push edx
lea eax, [ebp - 0x908]
push eax
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x938], eax
mov ecx, dword [ebp - 0x938]
mov dword [ebp - 0x93c], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x93c]
push edx
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x908]
call sub.MFC42.DLL_CString::CString
push 0
lea ecx, [ebp - 0x3b8]
call fcn.00407160
push eax
lea ecx, [ebp - 0x1b4]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x43c277
lea ecx, [ebp - 0x4f0]
call fcn.00471ac8
mov byte [ebp - 4], 7
mov dword [ebp - 0x3c0], 0
push 0
push 2
lea ecx, [ebp - 0x3b8]
call fcn.00407160
push eax
lea ecx, [ebp - 0x4f0]
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x43bf29
lea ecx, [ebp - 0x3b8]
call fcn.00407160
push eax
call sub.MFC42.DLL_CFile::Remove
mov dword [ebp - 0x3c0], 1
mov dword [ebp - 0x90c], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4f0]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x198]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x90c]
jmp 0x43c455
push 0x400
lea eax, [ebp - 0x8f8]
push eax
lea ecx, [ebp - 0x4f0]
call sub.MFC42.DLL_CFile::Read
lea ecx, [ebp - 0x3c4]
call fcn.00407100
mov ecx, dword [ebp - 0x6ec]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x6dc]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x4f8], cx
mov eax, dword [ebp - 0x6ac]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x6c4]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x3c8], ax
mov edx, dword [ebp - 0x4f8]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
mov eax, dword [ebp - 0x3c8]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
shl eax, 0x10
or edx, eax
mov dword [ebp - 0x4f4], edx
mov ecx, dword [ebp - 0x578]
xor ecx, dword [ebp - 0x4f4]
mov dword [ebp - 0x578], ecx
mov edx, dword [ebp - 0x5bc]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x5dc]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x4f8], dx
mov ecx, dword [ebp - 0x5dc]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x59c]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x3c8], cx
mov eax, dword [ebp - 0x4f8]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
mov ecx, dword [ebp - 0x3c8]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x4f4], eax
mov edx, dword [ebp - 0x5f8]
xor edx, dword [ebp - 0x4f4]
mov dword [ebp - 0x5f8], edx
mov eax, dword [ebp - 0x594]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x5e8]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x4f8], ax
mov edx, dword [ebp - 0x598]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x5ec]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x3c8], dx
mov ecx, dword [ebp - 0x4f8]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
mov edx, dword [ebp - 0x3c8]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
shl edx, 0x10
or ecx, edx
mov dword [ebp - 0x4f4], ecx
mov eax, dword [ebp - 0x574]
xor eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x574], eax
mov ecx, dword [ebp - 0x5f8]
cmp ecx, dword [ebp - 0x574]
je 0x43c15c
mov dword [ebp - 0x3c0], 1
mov edx, dword [ebp - 0x188]
shr edx, 0x10
and edx, 0xffff
xor edx, 0x5555
and edx, 0xffff
and edx, 0xffff
mov eax, dword [ebp - 0x188]
and eax, 0xffff
and eax, 0xffff
xor eax, 0xaaaa
and eax, 0xffff
and eax, 0xffff
shl eax, 0x10
or edx, eax
cmp dword [ebp - 0x5fc], edx
je 0x43c1b3
mov dword [ebp - 0x3c0], 1
lea ecx, [ebp - 0x4e0]
call fcn.00407110
lea ecx, [ebp - 0x4e0]
push ecx
lea ecx, [ebp - 0x4f0]
call sub.MFC42.DLL_CFile::GetStatus_1
lea ecx, [ebp - 0x4e0]
call fcn.00407160
cmp dword [ebp - 0x578], eax
je 0x43c1ed
mov dword [ebp - 0x3c0], 1
cmp dword [ebp - 0x5f8], 0x77
jne 0x43c200
mov dword [ebp - 0x3c0], 1
lea ecx, [ebp - 0x4f0]
call sub.MFC42.DLL_CFile::Close
cmp dword [ebp - 0x3c0], 0
jne 0x43c268
mov dword [ebp - 0x910], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4f0]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x198]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x910]
jmp 0x43c455
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4f0]
call sub.MFC42.DLL_CFile::CFile
push 0
push 0
push 0x468
mov ecx, dword [ebp - 0x91c]
call fcn.004076a0
mov dword [ebp - 0x70], 0xc
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 1
mov word [ebp - 0x34], 0xa
mov word [ebp - 0x32], 0
mov dword [ebp - 0x30], 0
call dword [sym.imp.kernel32.dll_GetLogicalDrives]
mov dword [ebp - 0x10], eax
push 0x48a7f0
lea edx, [ebp - 0x184]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov dword [ebp - 0x18c], 1
mov dword [ebp - 0x194], 0
jmp 0x43c335
mov eax, dword [ebp - 0x194]
add eax, 1
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0x20
jge 0x43c3ca
mov edx, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x194]
shl edx, cl
mov eax, dword [ebp - 0x10]
and eax, edx
test eax, eax
je 0x43c3c5
mov ecx, dword [ebp - 0x194]
add ecx, 0x41
mov byte [ebp - 0x184], cl
lea edx, [ebp - 0x184]
push edx
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 5
jne 0x43c3c5
mov al, byte [ebp - 0x184]
push eax
lea ecx, [ebp - 0x198]
call fcn.00472284
push 0x48a7f4
lea ecx, [ebp - 0x198]
call fcn.00471ab0
push 0
lea ecx, [ebp - 0x198]
call fcn.00407160
push eax
lea ecx, [ebp - 0x1b4]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x43c3c5
jmp 0x43c3ca
jmp 0x43c326
cmp dword [ebp - 0x194], 0x20
jne 0x43c415
mov dword [ebp - 0x914], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x198]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x914]
jmp 0x43c455
mov dword [ebp - 0x918], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x198]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3b8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x918]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret