Function at 0x448aa0
Capabilities:
Contain obfuscated stackstrings
Get disk information
Get disk size
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x930
mov eax, dword [0x52f8b0]
xor eax, ebp
mov dword [ebp - 4], eax
movq xmm0, qword [0x5107e0]
mov eax, ecx
push ebx
movq qword [eax], xmm0
movq xmm0, qword [0x5107e8]
push esi
push edi
mov dword [ebp - 0x91c], eax
movq qword [eax + 8], xmm0
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x10], ax
mov word [ebp - 0x18], ax
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push eax
mov dword [ebp - 0x14], 0x3a0020
mov dword [ebp - 0xc], 0x3a0020
mov dword [ebp - 8], 0x5c
mov dword [ebp - 0x24], 0x5c005c
mov dword [ebp - 0x20], 0x5c003f
mov dword [ebp - 0x1c], 0x3a0020
call fcn.0041f040
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
push 0xc8
lea eax, [ebp - 0x8ec]
xorps xmm0, xmm0
push 0
push eax
mov dword [ebp - 0x910], edi
movlpd qword [ebp - 0x8f4], xmm0
call fcn.0041f040
xor edx, edx
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 0x904], edx
lea esi, [edx + 0x41]
mov dword [ebp - 0x908], ebx
mov ecx, 1
mov edi, edi
mov eax, ecx
mov ecx, ebx
shl eax, cl
test edi, eax
je 0x448d23
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x448d1d
push 0x800
lea eax, [ebp - 0x824]
push 0
push eax
mov word [ebp - 0x14], si
call fcn.0041f040
add esp, 0xc
lea eax, [ebp - 0x824]
push 0x400
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x448be5
lea eax, [ebp - 0x824]
push 0x5107f0
push eax
call fcn.0041b41e
add esp, 8
test eax, eax
je 0x448d1d
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push edi
lea eax, [ebp - 0x24]
push eax
mov word [ebp - 0x1c], si
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x90c], eax
cmp eax, 0xffffffff
je 0x448c85
push 0x227
mov dword [ebp - 0x900], edi
mov dword [ebp - 0x8fc], edi
call fcn.0041b301
add esp, 4
mov ebx, eax
push edi
lea eax, [ebp - 0x930]
push eax
push 0x227
push ebx
push 0xc
lea eax, [ebp - 0x900]
push eax
push 0x2d1400
push dword [ebp - 0x90c]
mov dword [ebx + 4], 0x227
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x448c62
cmp dword [ebx + 0x1c], 7
mov eax, 1
cmove edi, eax
push ebx
call fcn.0041a777
add esp, 4
push dword [ebp - 0x90c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x908]
test edi, edi
jne 0x448d0f
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x924]
push eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x924], 0
mov dword [ebp - 0x920], 0
mov dword [ebp - 0x918], 0
mov dword [ebp - 0x914], 0
mov dword [ebp - 0x92c], 0
mov dword [ebp - 0x928], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, dword [ebp - 0x904]
mov eax, dword [ebp - 0x918]
mov edi, dword [ebp - 0x910]
mov dword [ebp + edx*8 - 0x8f4], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp + edx*8 - 0x8f0], eax
inc edx
mov dword [ebp - 0x904], edx
jmp 0x448d23
mov edx, dword [ebp - 0x904]
mov edi, dword [ebp - 0x910]
jmp 0x448d23
mov edx, dword [ebp - 0x904]
inc esi
inc ebx
mov dword [ebp - 0x908], ebx
mov ecx, 1
cmp si, 0x5a
jbe 0x448b70
mov esi, dword [ebp - 0x91c]
lea ecx, [edx*8]
push ecx
lea eax, [ebp - 0x8f4]
push eax
push esi
call fcn.00447c00
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a77c
mov esp, ebp
pop ebp
ret