Function at 0x4d16db
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information

Disassembly:
push 0x248
mov eax, 0x5add26
call fcn.00553bf3
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x248], eax
call fcn.004cd75c
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], edi
call fcn.0045082c
push eax
lea ecx, [ebp - 0x20]
call fcn.004c3be8
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004cddb7
test eax, eax
je 0x4d1756
mov dword [ebp - 0xe8], 9
mov dword [ebp - 0xe4], 0x34
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xec], 0x5d0d7c
push 0x5f1974
lea eax, [ebp - 0xec]
push eax
call fcn.00553b2b
mov dword [ebp - 0x1c], edi
call fcn.0045082c
push eax
lea ecx, [ebp - 0x1c]
call fcn.004c3be8
mov ebx, 0x105
mov byte [ebp - 4], 2
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004c3a23
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.004c318a
test esi, esi
jne 0x4d17ad
mov dword [ebp - 0xe8], 9
mov dword [ebp - 0xe4], 0x2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4d1735
mov ebx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
push ebx
mov dword [ebp - 0x2c], edi
call fcn.004c3491
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004d4f28
mov dword [ebp - 0x30], edi
call fcn.0045082c
push eax
lea ecx, [ebp - 0x30]
call fcn.004c3be8
mov byte [ebp - 4], 4
mov dword [ebp - 0x24], edi
call fcn.0045082c
push eax
lea ecx, [ebp - 0x24]
call fcn.004c3be8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x18]
push dword [ebp - 0x2c]
mov dword [ebp - 0x18], edi
call fcn.004c3491
mov edi, 0x105
mov byte [ebp - 4], 6
push edi
lea ecx, [ebp - 0x24]
call fcn.004c3a23
push edi
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.004c3a23
mov ecx, dword [ebp - 0x18]
mov edi, eax
cmp dword [ecx - 4], 1
jle 0x4d1836
push dword [ecx - 0xc]
lea ecx, [ebp - 0x18]
call fcn.004c3924
mov ecx, dword [ebp - 0x18]
mov edx, 0x105
lea eax, [ebp - 0x54]
push edx
push esi
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x38]
push eax
push edx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x4d186f
mov dword [ebp - 0xe8], 9
mov dword [ebp - 0xe4], 0x2f
jmp 0x4d17a5
push 0xffffffffffffffff
lea ecx, [ebp - 0x30]
call fcn.004c318a
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.004c318a
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004c318a
push dword [ebp - 0x40]
call fcn.005312f2
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x74], eax
mov ecx, dword [esi - 0xc]
lea ecx, [ecx*2 + 1]
push ecx
call fcn.005312f2
mov ecx, dword [esi - 0xc]
mov edi, eax
add ecx, ecx
mov dword [ebp - 0x78], edi
push ecx
push esi
push edi
call fcn.00553450
mov eax, dword [esi - 0xc]
lea ecx, [ebp - 0x4c]
add esp, 0x14
add eax, eax
push dword [ebp - 0x74]
push eax
push edi
call fcn.004cd633
push dword [ebp - 0x78]
mov edi, eax
call fcn.0054e4d7
pop ecx
test edi, edi
je 0x4d191a
push dword [ebp - 0x74]
call fcn.0054e4d7
and dword [ebp - 0xe0], 0
mov dword [ebp - 0xe8], 9
mov dword [ebp - 0xe4], 0x27
mov dword [ebp - 0xec], 0x5d0d7c
mov dword [esp], 0x5f1974
jmp 0x4d174a
xor edi, edi
mov dword [ebp - 0x244], 0x694d6a41
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x240], 0x7463534c
mov dword [ebp - 0x23c], 0x68557a4c
mov dword [ebp - 0x238], 0x776f5344
mov dword [ebp - 0x234], 0x33776a4c
mov dword [ebp - 0x230], 0x79454341
mov dword [ebp - 0x22c], 0x76515450
mov dword [ebp - 0x228], 0x676c7942
mov dword [ebp - 0x224], 0x49776d65
mov dword [ebp - 0x220], 0x6c737a4a
mov dword [ebp - 0x21c], 0x7259434e
mov dword [ebp - 0x218], 0x4a496e4b
mov dword [ebp - 0x214], 0x73497a4c
mov dword [ebp - 0x210], 0x4d494764
mov dword [ebp - 0x20c], 0x656b5463
mov dword [ebp - 0x208], 0x6f634348
mov dword [ebp - 0x204], 0x546f6847
mov dword [ebp - 0x200], 0x2b38534a
mov dword [ebp - 0x1fc], 0x47414345
mov dword [ebp - 0x1f8], 0x50346a45
mov dword [ebp - 0x1f4], 0x72497743
mov dword [ebp - 0x1f0], 0x4b457959
mov dword [ebp - 0x1ec], 0x4f414249
mov dword [ebp - 0x1e8], 0x7a64544f
mov dword [ebp - 0x1e4], 0x3577684e
mov dword [ebp - 0x1e0], 0x70567946
mov dword [ebp - 0x1dc], 0x2f495448
mov dword [ebp - 0x1d8], 0x4f674865
mov dword [ebp - 0x1d4], 0x6a41434d
mov dword [ebp - 0x1d0], 0x646b544f
mov dword [ebp - 0x1cc], 0x33347a41
mov dword [ebp - 0x1c8], 0x6e63574c
mov dword [ebp - 0x1c4], 0x62674844
mov dword [ebp - 0x1c0], 0x3638794f
mov dword [ebp - 0x1bc], 0x36307864
mov dword [ebp - 0x1b8], 0x5234684d
mov dword [ebp - 0x1b4], 0x53636d4c
mov dword [ebp - 0x1b0], 0x526f6a43
mov dword [ebp - 0x1ac], 0x65774448
mov dword [ebp - 0x1a8], 0x576f524f
mov dword [ebp - 0x1a4], 0x504d6849
mov dword [ebp - 0x1a0], 0x654d5741
mov dword [ebp - 0x19c], 0x7a645841
mov dword [ebp - 0x198], 0x31306950
mov dword [ebp - 0x194], 0x42417849
mov dword [ebp - 0x190], 0x496b414b
mov dword [ebp - 0x18c], 0x654d7741
mov dword [ebp - 0x188], 0x6a6b5347
mov dword [ebp - 0x184], 0x6663534b
mov dword [ebp - 0x180], 0x5a55524c
mov dword [ebp - 0x17c], 0x4e557a49
mov dword [ebp - 0x178], 0x7759414c
mov dword [ebp - 0x174], 0x48554465
mov dword [ebp - 0x170], 0x3046684b
mov dword [ebp - 0x16c], 0x6455534f
mov dword [ebp - 0x168], 0x3164414e
mov dword [ebp - 0x164], 0x6251435a
mov dword [ebp - 0x160], 0x70416941
mov dword [ebp - 0x15c], 0x52345850
mov dword [ebp - 0x158], 0x6b4e5747
mov dword [ebp - 0x154], 0x32737944
mov dword [ebp - 0x150], 0x71634448
mov dword [ebp - 0x14c], 0x79635143
mov dword [ebp - 0x148], 0x5959484c
mov dword [ebp - 0x144], 0x7a63514f
mov dword [ebp - 0x140], 0x7a565442
mov dword [ebp - 0x13c], 0x5134534c
mov dword [ebp - 0x138], 0x7577334a
mov dword [ebp - 0x134], 0x35426946
mov dword [ebp - 0x130], 0x50515142
mov dword [ebp - 0x12c], 0x50495363
mov dword [ebp - 0x128], 0x48516841
mov dword [ebp - 0x124], 0x3038514c
mov dword [ebp - 0x120], 0x4e30774f
mov dword [ebp - 0x11c], 0x6d4e4449
mov dword [ebp - 0x118], 0x75454848
mov dword [ebp - 0x114], 0x4751435a
mov dword [ebp - 0x110], 0x66497759
mov dword [ebp - 0x10c], 0x6467795a
push edi
sub esp, 0xc
mov dword [ebp - 0x108], 0x674e524c
mov ecx, esp
mov dword [ebp - 0x104], 0x57346a64
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x100], 0x344a4150
lea edx, [ebp - 0x244]
mov dword [ebp - 0xfc], 0x306b7846
push ecx
push eax
push edx
mov dword [ebp - 0xf8], 0x416b6947
mov dword [ebp - 0xf4], 0x53444141
call fcn.00450208
lea ecx, [ebp - 0x254]
call fcn.004d8ec6
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.00451547
push eax
lea ecx, [ebp - 0x34]
call fcn.004c2785
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 9
call fcn.004513e1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x7c], edi
mov edi, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
test eax, eax
je 0x4d1e36
mov esi, dword [ebp - 0x7c]
lea edx, [ebp - 0xdc]
lea ebx, [ebp - 0x7d]
movzx eax, byte [esi + edi]
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0xdc], 0x384a475a
mov ecx, esp
mov dword [ebp - 0xd8], 0x55596746
mov dword [ebp - 0xd4], 0x316f7750
mov dword [ebp - 0xd0], 0x58675347
push ecx
push ebx
push edx
mov dword [ebp - 0xcc], 0x30347a64
mov dword [ebp - 0xc8], 0x39597843
mov dword [ebp - 0xc4], 0x4338524a
mov dword [ebp - 0xc0], 0x34567859
mov dword [ebp - 0xbc], 0x6d556948
mov dword [ebp - 0xb8], 0x5a676a42
mov dword [ebp - 0xb4], 0x61386e4b
mov dword [ebp - 0xb0], 0x58734742
mov dword [ebp - 0xac], 0x4c63524b
mov dword [ebp - 0xa8], 0x3249584c
mov dword [ebp - 0xa4], 0x676b7944
mov dword [ebp - 0xa0], 0x38304149
mov dword [ebp - 0x9c], 0x6a554441
mov dword [ebp - 0x98], 0x61676941
mov dword [ebp - 0x94], 0x44347a5a
mov dword [ebp - 0x90], 0x32347942
mov dword [ebp - 0x8c], 0x365a514d
mov dword [ebp - 0x88], 0x324d5344
mov dword [ebp - 0x84], 0x41415142
mov word [ebp - 0x80], 0x4441
mov byte [ebp - 0x7e], 0x38
call fcn.00450208
lea ecx, [ebp - 0xe8]
call fcn.004d8ec6
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.00451547
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004d76c2
add esp, 0xc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xe8]
call fcn.004513e1
mov ebx, dword [ebp - 0x40]
lea edx, [ebp - 0xdc]
inc esi
mov dword [ebp - 0x78], ebx
cmp esi, ebx
lea ebx, [ebp - 0x7d]
jb 0x4d1cdc
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x78]
add eax, 5
push eax
call fcn.005312f2
mov dword [ebp - 0x74], eax
pop ecx
test eax, eax
jne 0x4d1e66
and dword [ebp - 0xe0], eax
mov dword [ebp - 0xe8], 9
mov dword [ebp - 0xe4], 0x22
jmp 0x4d173b
push dword [ebp - 0x40]
push edi
push eax
call fcn.0054d200
push edi
call fcn.0054e4d7
mov eax, dword [ebp - 0x38]
mov edx, eax
mov ecx, eax
shr edx, 0x18
shr eax, 8
mov byte [ebp - 0x26], al
mov eax, dword [ebp - 0x38]
mov byte [ebp - 0x25], al
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x74]
mov byte [ebp - 0x28], dl
lea edx, [ebp - 0x28]
push 4
push edx
shr ecx, 0x10
push eax
mov byte [ebp - 0x27], cl
call fcn.0054d200
add esp, 0x1c
lea edi, [ebp - 0x70]
xor eax, eax
push 7
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x70]
call fcn.004cdd05
mov byte [ebp - 4], 0xb
mov edi, dword [ebp - 0x78]
add edi, 4
push edi
call fcn.005312f2
mov ecx, dword [ebp - 0x78]
add ecx, 4
mov dword [ebp - 0x7c], eax
push ecx
push dword [ebp - 0x74]
push eax
call fcn.0054d200
add esp, 0x10
lea ecx, [ebp - 0x70]
push edi
mov edi, dword [ebp - 0x7c]
push edi
call fcn.004cdc61
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x78]
push edi
mov byte [ecx + edx + 4], al
call fcn.0054e4d7
mov edi, dword [ebp - 0x78]
add edi, 5
pop ecx
mov ecx, dword [ebp - 0x248]
lea eax, [edi + edi]
push eax
call fcn.004c3a23
and dword [ebp - 0x7c], 0
test edi, edi
je 0x4d206b
mov esi, dword [ebp - 0x74]
lea edx, [ebp - 0xd4]
mov ebx, dword [ebp - 0x7c]
movzx eax, byte [ebx + esi]
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0xd4], 0x384a475a
mov ecx, esp
mov dword [ebp - 0xd0], 0x4e386e46
lea eax, [ebp - 0x81]
mov dword [ebp - 0xcc], 0x6f517943
mov dword [ebp - 0xc8], 0x6b305341
push ecx
push eax
push edx
mov dword [ebp - 0xc4], 0x37775265
mov dword [ebp - 0xc0], 0x5459484d
mov dword [ebp - 0xbc], 0x704d5750
mov dword [ebp - 0xb8], 0x5a514849
mov dword [ebp - 0xb4], 0x35596a49
mov dword [ebp - 0xb0], 0x6b52434c
mov dword [ebp - 0xac], 0x36515364
mov dword [ebp - 0xa8], 0x4e775247
mov dword [ebp - 0xa4], 0x75494443
mov dword [ebp - 0xa0], 0x71306850
mov dword [ebp - 0x9c], 0x7a775264
mov dword [ebp - 0x98], 0x774d5446
mov dword [ebp - 0x94], 0x66346a4d
mov dword [ebp - 0x90], 0x63554441
mov dword [ebp - 0x8c], 0x6c63514a
mov dword [ebp - 0x88], 0x4141514b
mov word [ebp - 0x84], 0x4441
mov byte [ebp - 0x82], 0x59
call fcn.00450208
lea ecx, [ebp - 0xe8]
call fcn.004d90ca
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 0xc
call fcn.004ab6d2
push eax
push dword [ebp - 0x248]
call fcn.004c323e
add esp, 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xe8]
call fcn.004ab565
inc ebx
lea edx, [ebp - 0xd4]
cmp ebx, edi
jb 0x4d1f2d
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
push dword [ebp - 0x74]
call fcn.0054e4d7
pop ecx
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x70], 0x5d0e58
call fcn.004d50c1
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00450c0a
lea ecx, [ebx - 0x10]
call fcn.00450c0a
lea ecx, [esi - 0x10]
call fcn.00450c0a
call fcn.00553ba2
ret 4