Function at 0x46d1a0
Capabilities:
Contain obfuscated stackstrings
Create directory
Get common file path
Get disk information
Get disk size
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x698
mov eax, dword [0x6ddc7c]
xor eax, ebp
mov dword [ebp - 8], eax
movaps xmm0, xmmword [str.https:__ss.66ng.ws:__127.0.0.1:1]
push ebx
mov ebx, ecx
mov dword [ebp - 0x2c], 0x732f6e63
push esi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x698], ebx
push edi
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x28], 0x2f74666f
lea edx, [ecx + 1]
mov byte [ebp - 0x24], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d1e1
sub ecx, edx
lea eax, [ebp - 0x3c]
push ecx
push eax
lea ecx, [ebx + 0x58]
call fcn.0044e6d0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea eax, [ebp - 0x18]
push eax
push 0x6b4cfc
mov dword [ebp - 0x18], 0x6f577349
mov dword [ebp - 0x14], 0x50343677
mov dword [ebp - 0x10], 0x65636f72
mov word [ebp - 0xc], 0x7373
mov byte [ebp - 0xa], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x46d241
lea ecx, [ebx + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
movaps xmm0, xmmword [0x6bd860]
lea eax, [ebp - 0x54]
push eax
push str.ntdll
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x44], 0x65626d75
mov word [ebp - 0x40], 0x7372
mov byte [ebp - 0x3e], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46d28c
lea ecx, [ebx + 8]
push ecx
lea ecx, [ebx + 4]
push ecx
push ebx
call eax
xor eax, eax
mov word [ebx + 2], ax
mov word [ebx + 6], ax
mov word [ebx + 0xa], ax
push 0x20a
lea eax, [ebp - 0x474]
push 0
push eax
call fcn.00617280
add esp, 0xc
lea eax, [ebp - 0x474]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [ebp - 0x474]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d2e0
sub ecx, edx
lea eax, [ebp - 0x474]
sar ecx, 1
push ecx
push eax
lea ecx, [ebx + 0x40]
call fcn.0044e410
push 0x20a
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.00617280
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x264]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d340
sub ecx, edx
lea eax, [ebp - 0x264]
sar ecx, 1
push ecx
push eax
lea ecx, [ebx + 0x10]
call fcn.0044e410
push 0x20a
lea eax, [ebp - 0x684]
push 0
push eax
call fcn.00617280
add esp, 0xc
lea eax, [ebp - 0x684]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov di, word [ebp - 0x684]
mov esi, 0x5a
mov eax, esi
mov dword [ebp - 0x694], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x68c], xmm0
cmp ax, di
jb 0x46d44f
mov edi, dword [ebp - 0x688]
mov ebx, dword [ebp - 0x68c]
mov dword [ebp - 0x690], edi
jmp 0x46d3d6
mov edi, dword [ebp - 0x690]
lea eax, [ebp - 0x20]
mov word [ebp - 0x20], si
push eax
mov dword [ebp - 0x1e], 0x3a
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x46d437
lea eax, [ebp - 0x68c]
xorps xmm0, xmm0
push eax
push 0
push 0
lea eax, [ebp - 0x20]
movlpd qword [ebp - 0x68c], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 0x688]
cmp ecx, edi
jb 0x46d437
mov eax, dword [ebp - 0x68c]
ja 0x46d426
cmp eax, ebx
jbe 0x46d437
movzx edx, si
mov ebx, eax
mov dword [ebp - 0x694], edx
mov dword [ebp - 0x690], ecx
mov di, word [ebp - 0x684]
add esi, 0xffff
cmp si, di
jae 0x46d3d0
mov ebx, dword [ebp - 0x698]
push 0x20a
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.00617280
mov eax, dword [ebp - 0x694]
add esp, 0xc
cmp ax, di
jne 0x46d4b5
push 0x104
lea eax, [ebp - 0x264]
push eax
push str._USERPROFILE_Downloads
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x46d4c8
push 0x20a
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00617280
add esp, 0xc
lea eax, [ebp - 0x264]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x46d4c8
mov word [ebp - 0x264], ax
mov eax, 0x3a
mov word [ebp - 0x262], ax
push 0x6b3d04
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x264]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x264]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d501
sub ecx, edx
lea eax, [ebp - 0x264]
sar ecx, 1
push ecx
push eax
lea ecx, [ebx + 0x28]
call fcn.0044e410
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ff7bd
mov esp, ebp
pop ebp
ret 4