Function at 0x404fbf
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473155
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x95c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8fc], eax
push 0x100
lea ecx, [ebp - 0x7f4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x111], 0
push 0x80
lea eax, [ebp - 0x874]
push eax
lea ecx, [ebp - 0x914]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1a0]
push eax
push 0x80
lea ecx, [ebp - 0x8f4]
push ecx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x6f4]
call fcn.00471b8e
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
mov byte [ebp - 0x94], 0x57
mov byte [ebp - 0x93], 0x54
mov byte [ebp - 0x92], 0x43
mov byte [ebp - 0x91], 0x59
mov byte [ebp - 0x90], 0x39
mov byte [ebp - 0x8f], 0x38
mov byte [ebp - 0x8e], 0x35
mov byte [ebp - 0x8d], 0x33
mov byte [ebp - 0x8c], 0x2e
mov byte [ebp - 0x8b], 0x64
mov byte [ebp - 0x8a], 0x72
mov byte [ebp - 0x89], 0x76
mov byte [ebp - 0x88], 0
lea eax, [ebp - 0x7f4]
push eax
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x8f8]
call fcn.004070a0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x8f8]
call fcn.004070e0
movsx edx, al
cmp edx, 0x5c
jne 0x405151
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x8f8]
push ecx
lea edx, [ebp - 0x918]
push edx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x94c], eax
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x950], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x950]
push ecx
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x918]
call sub.MFC42.DLL_CString::CString
jmp 0x4051af
push 0x5c
lea ecx, [ebp - 0x8f8]
call fcn.00471b88
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x8f8]
push eax
lea ecx, [ebp - 0x91c]
push ecx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x954], eax
mov edx, dword [ebp - 0x954]
mov dword [ebp - 0x958], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x958]
push eax
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x91c]
call sub.MFC42.DLL_CString::CString
push 0
lea ecx, [ebp - 0x8f8]
call fcn.00407160
push eax
lea ecx, [ebp - 0x6f4]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x405316
mov byte [ebp - 0x94], 0x57
mov byte [ebp - 0x93], 0x54
mov byte [ebp - 0x92], 0x43
mov byte [ebp - 0x91], 0x59
mov byte [ebp - 0x90], 0x39
mov byte [ebp - 0x8f], 0x38
mov byte [ebp - 0x8e], 0x35
mov byte [ebp - 0x8d], 0x33
mov byte [ebp - 0x8c], 0x2e
mov byte [ebp - 0x8b], 0x64
mov byte [ebp - 0x8a], 0x61
mov byte [ebp - 0x89], 0x74
mov byte [ebp - 0x88], 0
lea ecx, [ebp - 0x7f4]
push ecx
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x8f8]
call fcn.004070a0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 1
push edx
lea ecx, [ebp - 0x8f8]
call fcn.004070e0
movsx eax, al
cmp eax, 0x5c
jne 0x4052b8
lea ecx, [ebp - 0x94]
push ecx
lea edx, [ebp - 0x8f8]
push edx
lea eax, [ebp - 0x920]
push eax
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x95c], eax
mov ecx, dword [ebp - 0x95c]
mov dword [ebp - 0x960], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x960]
push edx
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x920]
call sub.MFC42.DLL_CString::CString
jmp 0x405316
push 0x5c
lea ecx, [ebp - 0x8f8]
call fcn.00471b88
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x8f8]
push ecx
lea edx, [ebp - 0x924]
push edx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x964], eax
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x968], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x968]
push ecx
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x924]
call sub.MFC42.DLL_CString::CString
push 0
lea ecx, [ebp - 0x8f8]
call fcn.00407160
push eax
lea ecx, [ebp - 0x6f4]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x405375
mov edx, dword [ebp - 0x8fc]
mov dword [edx], 0
mov dword [ebp - 0x928], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x928]
jmp 0x405ce1
lea ecx, [ebp - 0x2c8]
call fcn.00471ac8
mov byte [ebp - 4], 6
push 0
push 2
lea ecx, [ebp - 0x8f8]
call fcn.00407160
push eax
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x405405
lea ecx, [ebp - 0x8f8]
call fcn.00407160
push eax
call sub.MFC42.DLL_CFile::Remove
mov eax, dword [ebp - 0x8fc]
mov dword [eax], 0
mov dword [ebp - 0x92c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x92c]
jmp 0x405ce1
lea ecx, [ebp - 0x2b8]
call fcn.00407110
lea ecx, [ebp - 0x2b8]
push ecx
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::GetStatus_1
push 0x400
lea edx, [ebp - 0x6d4]
push edx
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::Read
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::Close
lea ecx, [ebp - 0x198]
call fcn.00407100
mov eax, dword [ebp - 0x1a0]
shr eax, 0x10
and eax, 0xffff
xor eax, 0x5555
and eax, 0xffff
and eax, 0xffff
mov ecx, dword [ebp - 0x1a0]
and ecx, 0xffff
and ecx, 0xffff
xor ecx, 0xaaaa
and ecx, 0xffff
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
cmp dword [ebp - 0x3d8], eax
je 0x4054ff
lea ecx, [ebp - 0x8f8]
call fcn.00407160
push eax
call sub.MFC42.DLL_CFile::Remove
mov edx, dword [ebp - 0x8fc]
mov dword [edx], 0
mov dword [ebp - 0x930], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x930]
jmp 0x405ce1
mov eax, dword [ebp - 0x4c8]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x4b8]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x2d4], ax
mov edx, dword [ebp - 0x488]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x4a0]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x19c], dx
mov ecx, dword [ebp - 0x2d4]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
mov edx, dword [ebp - 0x19c]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
shl edx, 0x10
or ecx, edx
mov dword [ebp - 0x2cc], ecx
mov eax, dword [ebp - 0x354]
xor eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x354], eax
mov ecx, dword [ebp - 0x398]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x3b8]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x2d4], cx
mov eax, dword [ebp - 0x3b8]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x378]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x19c], ax
mov edx, dword [ebp - 0x2d4]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
mov eax, dword [ebp - 0x19c]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
shl eax, 0x10
or edx, eax
mov dword [ebp - 0x2cc], edx
mov ecx, dword [ebp - 0x3d4]
xor ecx, dword [ebp - 0x2cc]
mov dword [ebp - 0x3d4], ecx
mov edx, dword [ebp - 0x370]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x3c4]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x2d4], dx
mov ecx, dword [ebp - 0x374]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x3c8]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x19c], cx
mov eax, dword [ebp - 0x2d4]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
mov ecx, dword [ebp - 0x19c]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x2cc], eax
mov edx, dword [ebp - 0x350]
xor edx, dword [ebp - 0x2cc]
mov dword [ebp - 0x350], edx
mov eax, dword [ebp - 0x3d4]
cmp eax, dword [ebp - 0x350]
je 0x405768
lea ecx, [ebp - 0x8f8]
call fcn.00407160
push eax
call sub.MFC42.DLL_CFile::Remove
mov ecx, dword [ebp - 0x8fc]
mov dword [ecx], 0
mov dword [ebp - 0x934], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x934]
jmp 0x405ce1
lea ecx, [ebp - 0x2b8]
call fcn.00407160
cmp dword [ebp - 0x354], eax
je 0x4057dd
lea ecx, [ebp - 0x8f8]
call fcn.00407160
push eax
call sub.MFC42.DLL_CFile::Remove
mov edx, dword [ebp - 0x8fc]
mov dword [edx], 0
mov dword [ebp - 0x938], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x938]
jmp 0x405ce1
lea ecx, [ebp - 0x910]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x6d8], 0x77
je 0x40580a
cmp dword [ebp - 0x6d8], 0
jg 0x40586e
mov ecx, dword [ebp - 0x8fc]
mov edx, dword [ebp - 0x6d8]
mov dword [ecx], edx
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x93c], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x910]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x93c]
jmp 0x405ce1
mov ecx, dword [ebp - 0x3d4]
add ecx, 1
push ecx
push 0x487260
lea edx, [ebp - 0x194]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x194]
push eax
push str.USERUSER
push str.ARTCUT
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
mov ecx, dword [ebp - 0x3d4]
add ecx, 1
mov dword [ebp - 0x3d4], ecx
lea edx, [ebp - 0x940]
push edx
call sub.MFC42.DLL_CTime::GetTickCount
push eax
lea ecx, [ebp - 0x198]
call fcn.00407140
lea ecx, [ebp - 0x198]
call fcn.00407170
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov dword [ebp - 0x2d0], 0
jmp 0x4058fb
mov eax, dword [ebp - 0x2d0]
add eax, 1
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0x3f
jge 0x405919
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + ecx*4 - 0x4d4], eax
jmp 0x4058ec
call dword [sym.imp.MSVCRT.dll_rand]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov dword [ebp - 0x2d0], 0
jmp 0x405944
mov edx, dword [ebp - 0x2d0]
add edx, 1
mov dword [ebp - 0x2d0], edx
cmp dword [ebp - 0x2d0], 0x1f
jge 0x405962
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + ecx*4 - 0x3d0], eax
jmp 0x405935
call dword [sym.imp.MSVCRT.dll_rand]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov dword [ebp - 0x2d0], 0
jmp 0x40598d
mov edx, dword [ebp - 0x2d0]
add edx, 1
mov dword [ebp - 0x2d0], edx
cmp dword [ebp - 0x2d0], 0x1f
jge 0x4059ab
call dword [sym.imp.MSVCRT.dll_rand]
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + ecx*4 - 0x34c], eax
jmp 0x40597e
mov edx, dword [ebp - 0x4c8]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x4b8]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x2d4], dx
mov ecx, dword [ebp - 0x488]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x4a0]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x19c], cx
mov eax, dword [ebp - 0x2d4]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
mov ecx, dword [ebp - 0x19c]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x2cc], eax
mov edx, dword [ebp - 0x354]
xor edx, dword [ebp - 0x2cc]
mov dword [ebp - 0x354], edx
mov eax, dword [ebp - 0x398]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x3b8]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x2d4], ax
mov edx, dword [ebp - 0x3b8]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x378]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x19c], dx
mov ecx, dword [ebp - 0x2d4]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
mov edx, dword [ebp - 0x19c]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
shl edx, 0x10
or ecx, edx
mov dword [ebp - 0x2cc], ecx
mov eax, dword [ebp - 0x3d4]
xor eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x3d4], eax
mov ecx, dword [ebp - 0x370]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x3c4]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x2d4], cx
mov eax, dword [ebp - 0x374]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x3c8]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x19c], ax
mov edx, dword [ebp - 0x2d4]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
mov eax, dword [ebp - 0x19c]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
shl eax, 0x10
or edx, eax
mov dword [ebp - 0x2cc], edx
mov ecx, dword [ebp - 0x350]
add ecx, 1
mov dword [ebp - 0x350], ecx
mov edx, dword [ebp - 0x350]
xor edx, dword [ebp - 0x2cc]
mov dword [ebp - 0x350], edx
lea ecx, [ebp - 0x90c]
call fcn.00471ac8
mov byte [ebp - 4], 8
push 0
push 0x1002
lea ecx, [ebp - 0x8f8]
call fcn.00407160
push eax
lea ecx, [ebp - 0x90c]
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x405c53
mov eax, dword [ebp - 0x8fc]
mov dword [eax], 0
mov dword [ebp - 0x944], 0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x90c]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x910]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x944]
jmp 0x405ce1
push 0x400
lea ecx, [ebp - 0x6d4]
push ecx
lea ecx, [ebp - 0x90c]
call sub.MFC42.DLL_CFile::Write
mov edx, dword [ebp - 0x8fc]
mov eax, dword [ebp - 0x6d8]
mov dword [edx], eax
lea ecx, [ebp - 0x90c]
call sub.MFC42.DLL_CFile::Close
mov dword [ebp - 0x948], 1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x90c]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x910]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c8]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8f8]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x948]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret