Function at 0x1004c6d
Capabilities:
Generate random numbers via winapi
Get common file path
Get disk information
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x52c]
sub esp, 0x5a8
mov eax, dword [0x100a028]
push ebx
xor ebx, ebx
cmp byte [0x100ad60], bl
mov dword [ebp + 0x528], eax
lea eax, [ebp + 0x514]
mov dword [ebp - 0x10], 0x5c3a63
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0x12], 0x63
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x60], 0xc
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x38], ebx
je 0x1004ce1
push ebx
push ebx
push 0x100ad60
call fcn.0100436f
test eax, eax
jne 0x1005134
mov byte [0x100ad60], al
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.01003ac5
test eax, eax
jne 0x1004cfd
push 0xffffffffffffffff
jmp 0x1005171
push esi
push edi
push 1
lea eax, [ebp + 0x514]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1004d8f
push 2
push 0x100
lea eax, [ebp + 0x3f4]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x1004d8f
push dword [ebp - 0x50]
mov esi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
mov edi, 0x10000000
push edi
push 2
lea eax, [ebp + 0x3f4]
push eax
call esi
test eax, eax
je 0x1004d8f
push dword [ebp - 0x2c]
lea eax, [ebp + 0x3f4]
push edi
push 2
push eax
call esi
test eax, eax
je 0x1004d8f
push dword [ebp - 0x34]
lea eax, [ebp + 0x3f4]
push edi
push 2
push eax
call esi
test eax, eax
je 0x1004d8f
push ebx
lea eax, [ebp + 0x3f4]
push eax
push 1
lea eax, [ebp + 0x514]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1004d8f
lea eax, [ebp - 0x60]
mov dword [ebp - 0x38], eax
cmp dword [0x101b0c0], ebx
jne 0x1004db4
cmp dword [0x100a18c], ebx
je 0x1004db4
push 0x100ad60
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x10050aa
push 0xffff
push 0x100b0c0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov bl, byte [0x100b0c0]
mov al, 0
add dword [ebx - 0x7cff2f9b], eax
aam 0
or bl, 0x20
call fcn.010028f2
mov cl, 0x61
mov byte [ebp - 0x19], al
mov byte [ebp - 0x10], cl
cmp cl, byte [ebp - 0x19]
je 0x1004edb
push 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0xe], 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
mov byte [ebp - 0xe], 0x5c
je 0x1004ed8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll__strlwr]
mov esi, dword [sym.imp.msvcrt.dll_strstr]
lea eax, [ebp - 0xc]
mov dword [esp], 0x1002520
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1004e46
lea eax, [ebp - 0xc]
push 0x1002518
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x1004ed8
push dword [ebp - 0x10]
call fcn.01002a0f
mov edi, eax
test edi, edi
je 0x1004ed8
lea eax, [ebp - 0x10]
push eax
call fcn.01002823
test eax, eax
je 0x1004ed8
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x1004ed8
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x54]
mul dword [ebp - 0x4c]
mov cl, byte [ebp - 0x10]
cmp cl, bl
mov dword [ebp - 0x28], 1
mov esi, edx
jne 0x1004ea5
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
jmp 0x1004edb
cmp edi, 2
jne 0x1004ec1
cmp esi, dword [ebp - 0x3c]
jb 0x1004ec1
ja 0x1004eb6
cmp eax, dword [ebp - 0x40]
jbe 0x1004ec1
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x12], cl
jmp 0x1004edb
cmp esi, dword [ebp - 0x20]
jb 0x1004edb
ja 0x1004ecd
cmp eax, dword [ebp - 0x24]
jbe 0x1004edb
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x11], cl
jmp 0x1004edb
mov cl, byte [ebp - 0x10]
inc cl
cmp cl, 0x7a
mov byte [ebp - 0x10], cl
jle 0x1004de2
xor esi, esi
cmp dword [ebp - 0x28], esi
jne 0x1004efa
push 0x20000008
jmp 0x1005171
mov eax, dword [0x100a020]
cmp eax, 0xcab00eee
je 0x1004f14
xor ecx, ecx
cmp dword [ebp - 0x20], ecx
ja 0x1004f2e
jb 0x1004f14
cmp dword [ebp - 0x24], eax
jae 0x1004f2e
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x20], eax
ja 0x1004f2e
jb 0x1004f26
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x30]
jae 0x1004f2e
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
jmp 0x1004f34
mov bl, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x24]
mov eax, dword [0x100a018]
push 3
pop edx
mul edx
cmp dword [ebp - 0x20], edx
jb 0x1004f4e
ja 0x1004f49
cmp ecx, eax
jb 0x1004f4e
mov byte [ebp - 0x10], bl
jmp 0x1004f68
cmp dword [ebp - 0x3c], edx
jb 0x100516c
ja 0x1004f62
cmp dword [ebp - 0x40], eax
jb 0x100516c
mov al, byte [ebp - 0x12]
mov byte [ebp - 0x10], al
push 0xf0000000
push 1
push esi
push esi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100504b
mov edi, dword [sym.imp.msvcrt.dll_sprintf]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov ebx, 0x100ad60
lea eax, [ebp + 0x4f4]
push eax
push 0x10
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1004ff8
lea eax, [ebp - 0x10]
push eax
push 0x1002514
push ebx
call edi
xor ecx, ecx
mov cl, byte [ebp + 0x4f4]
add esp, 0xc
push 0
pop esi
and ecx, 7
add ecx, 9
mov dword [ebp - 0x20], ecx
je 0x1004ff8
lea eax, [eax + 0x100ad60]
mov dword [ebp - 0x34], eax
movzx eax, byte [ebp + esi + 0x4f4]
push eax
push 0x100250c
push dword [ebp - 0x34]
call edi
add dword [ebp - 0x34], 2
add esp, 0xc
inc esi
cmp esi, dword [ebp - 0x20]
jb 0x1004fd8
cmp byte [0x100ad60], 0
je 0x1005017
xor esi, esi
inc esi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.0100436f
test eax, eax
je 0x100501e
mov dword [ebp - 0x18], esi
jmp 0x100501e
mov dword [ebp - 0x2c], 1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x18], 0
jne 0x100503a
cmp dword [ebp - 0x2c], 0
jne 0x100503a
cmp dword [ebp - 0x28], 0x2710
jb 0x1004f94
push 0
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x18], 0
jne 0x10050aa
mov esi, 0x100ad60
push esi
push 0x1002500
lea eax, [ebp - 0x10]
push eax
call fcn.01002ab9
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x68]
imul eax, dword [0x100a018]
push edi
and eax, 0xffff
push eax
call fcn.01002b81
xor edi, edi
inc edi
push edi
push dword [ebp - 0x38]
push esi
call fcn.0100436f
test eax, eax
jne 0x10050a7
push 0x52
jmp 0x1005171
mov dword [ebp - 0x18], edi
xor ebx, ebx
cmp dword [0x101b0c0], ebx
jne 0x100514f
cmp dword [0x100a18c], ebx
je 0x100514f
mov edi, 0x100ad60
push ebx
push 0x1003c26
push dword [0x100aae4]
push 0x6b
push dword [0x100a05c]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
je 0x1004cf6
cmp eax, ebx
je 0x1005148
cmp byte [eax], 0
je 0x1005148
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10050fa
sub ecx, esi
inc ecx
cmp ecx, 0x104
jae 0x10050a0
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1005110
push ebx
push ebx
push edi
call fcn.0100436f
test eax, eax
je 0x100512d
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], ebx
je 0x10050c9
pop edi
pop esi
mov ecx, dword [ebp + 0x528]
pop ebx
call fcn.01005e64
add ebp, 0x52c
leave
ret
push 0x4c7
jmp 0x1005171
cmp dword [ebp - 0x18], ebx
jne 0x1005132
push 1
push dword [ebp - 0x38]
push 0x100ad60
call fcn.0100436f
test eax, eax
jne 0x1005132
jmp 0x10050a0
push 0x20000009
call fcn.010036a7
int3