Function at 0x471ee0
Capabilities:
Get common file path
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x4ed6bf
mov eax, dword fs:[0]
push eax
sub esp, 0xe1c
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0xe18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0xe30]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0xe38], esi
mov ebp, dword [esp + 0xe40]
mov dword [esp + 0x28], esi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
mov dword [esp + 0x28], ebp
call edi
lea ecx, [esp + 0x20]
mov ebx, eax
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0xe38], 1
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_316]
push 0x1ff
lea eax, [esp + 0x831]
push esi
push eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x24], esi
mov byte [esp + 0x838], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x200
lea ecx, [esp + 0x830]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx edx, byte [esp + 0x82c]
push edx
push str._c:_
push ebp
call dword [sym.imp.mfc90.dll_Ordinal_2539]
mov ebp, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add esp, 0xc
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push eax
mov dword [esp + 0x38], 0
call ebp
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x471ffe
mov eax, dword [esp + 0x24]
lea edx, [esi + 0x63]
push edx
push str._c:_
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
inc esi
add esp, 0xc
cmp esi, 5
jl 0x471fb7
push ebx
call edi
cmp dword [esp + 0x1c], 0
jne 0x4723cf
push 0x1ff
lea ecx, [esp + 0x631]
push 0
push ecx
mov dword [esp + 0x24], 0
mov byte [esp + 0x638], 0
call sub.MSVCR90.dll_memset
push 0x10da2e0
lea edx, [esp + 0x63c]
push str._a__c_WMIC.exe_memorychip_GET_SERIALNUMBER_____sLogMC.txt_
push edx
call dword [sym.imp.MSVCR90.dll_sprintf]
push 0
push 0
lea eax, [esp + 0x64c]
push eax
push str.cmd.exe
push str.open
push 0
call fcn.004986e0
add esp, 0x30
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1ff
lea ecx, [esp + 0x31]
push 0
push ecx
mov byte [esp + 0x38], 0
call sub.MSVCR90.dll_memset
xor edx, edx
push 0x3fe
push edx
lea eax, [esp + 0x242]
push eax
mov word [esp + 0x244], dx
call sub.MSVCR90.dll_memset
add esp, 0x18
lea ecx, [esp + 0x14]
xor bl, bl
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov byte [esp + 0xe38], 2
push 0x10da2e0
lea ecx, [esp + 0x18]
push str._sLogMC.txt
push ecx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
mov edx, dword [esp + 0x20]
push 0x40
push 0x502a9c
push edx
call dword [sym.imp.MSVCR90.dll__fsopen]
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4723bd
push 0x3ff
lea eax, [esp + 0xa31]
push 0
push eax
mov byte [esp + 0xa38], bl
call sub.MSVCR90.dll_memset
mov ebp, dword [sym.imp.MSVCR90.dll_fgets]
push edi
lea ecx, [esp + 0x3c]
push 0x200
push ecx
call ebp
add esp, 0x18
test eax, eax
jbe 0x47220f
lea eax, [esp + 0x2c]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x472130
sub eax, edx
cmp eax, 2
jbe 0x47220f
push str.SerialNumber
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x4721f3
cmp byte [esp + 0x2c], 0xff
jne 0x47216c
cmp byte [esp + 0x2d], 0xfe
je 0x47220d
lea eax, [esp + 0x2c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x472173
lea ecx, [esp + 0x2c]
sub eax, edx
dec ecx
cmp byte [ecx + eax], 0xd
jne 0x47219c
lea eax, [esp + 0x2c]
lea esi, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x472190
sub eax, esi
mov byte [ecx + eax], dl
lea eax, [esp + 0x2c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4721a3
lea ecx, [esp + 0x2c]
sub eax, edx
sub ecx, 2
cmp byte [ecx + eax], 0xd
jne 0x4721cc
lea eax, [esp + 0x2c]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4721c0
sub eax, esi
mov byte [ecx + eax], dl
push 0x10
lea eax, [esp + 0x30]
push 0
push eax
call dword [sym.imp.MSVCR90.dll_strtol]
add dword [esp + 0x24], eax
push 0x200
lea ecx, [esp + 0x3c]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0x18
push edi
lea edx, [esp + 0x30]
push 0x200
push edx
call ebp
add esp, 0xc
test eax, eax
ja 0x472127
jmp 0x47220f
mov bl, 1
push edi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
push 0x40
push str.r__ccsUTF_8
push eax
call dword [sym.imp.MSVCR90.dll__fsopen]
add esp, 0xc
mov ebp, eax
mov dword [esp + 0x18], 0
test bl, bl
je 0x4723b3
mov ebx, dword [sym.imp.MSVCR90.dll_fgetws]
mov esi, dword [sym.imp.MSVCR90.dll_strncpy]
jmp 0x472260
push ebp
lea ecx, [esp + 0x230]
push 0x400
push ecx
call ebx
add esp, 0xc
test eax, eax
jbe 0x4723b3
lea eax, [esp + 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x472285
sub eax, edx
sar eax, 1
cmp eax, 2
jbe 0x4723b3
push 0x512c24
lea edx, [esp + 0x230]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x472260
lea eax, [esp + 0x22c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4722c0
sub eax, edx
sar eax, 1
mov edi, 0xd
cmp word [esp + eax*2 + 0x22a], di
jne 0x472309
lea eax, [esp + 0x22c]
lea edx, [eax + 2]
jmp 0x4722f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4722f0
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x22a], cx
lea eax, [esp + 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x472313
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x228], di
jne 0x47234f
lea eax, [esp + 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x472336
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x228], dx
push 0
push 0
push 0x400
lea eax, [esp + 0xa38]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x240]
push ecx
push 0
push 0
call fcn.004dece0
push 8
lea edx, [esp + 0xa50]
push edx
lea eax, [esp + 0x54]
push eax
call esi
push 0x10
lea ecx, [esp + 0x5c]
push 0
push ecx
call dword [sym.imp.MSVCR90.dll_strtol]
add dword [esp + 0x50], eax
push 0x400
lea edx, [esp + 0x268]
push 0
push edx
call sub.MSVCR90.dll_memset
add esp, 0x44
jmp 0x472260
push ebp
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov byte [esp + 0xe38], 1
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push str._08x
push ecx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
mov esi, dword [esp + 0x30]
add esp, 0xc
push 0x5116d8
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_820]
cmp dword [esp + 0x1c], 0
je 0x472406
push str.HD_00_
jmp 0x472459
cmp dword [esp + 0x18], 0
jne 0x472454
push str.HD_TT_
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_945]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, eax
push edi
call dword [sym.imp.MSVCR90.dll_srand]
call dword [sym.imp.MSVCR90.dll_rand]
xor edx, edx
or ecx, 0xffffffff
div ecx
push edx
lea edx, [esp + 0x28]
push str._08x
push edx
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0x10
jmp 0x472461
push str.HD_MM_
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_945]
push 2
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_4392]
mov bl, 3
mov byte [esp + 0xe38], bl
push 0x502aa0
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0xe38], 4
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0xe38], bl
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xe38], 1
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 2
push 2
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_4507]
mov byte [esp + 0xe38], 5
push 0x502aa0
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0xe38], 6
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0xe38], 5
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xe38], 1
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 2
push 4
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_4507]
mov bl, 7
mov byte [esp + 0xe38], bl
push 0x502aa0
push eax
lea edx, [esp + 0x24]
push edx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0xe38], 8
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0xe38], bl
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0xe38], 1
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 2
push 6
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_4507]
mov byte [esp + 0xe38], 9
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_941]
mov byte [esp + 0xe38], 1
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esi]
push eax
push str.tc_MAC_NEW
push str.SOFTWARETrojanCut_tc_Env
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491e90
add esp, 0x10
mov byte [esp + 0xe38], 0
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, esi
mov ecx, dword [esp + 0xe30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xe18]
xor ecx, esp
call fcn.004e0148
add esp, 0xe28
ret