Function at 0x408820
Capabilities:
Contain obfuscated stackstrings
Get disk information
Get disk information via ioctl
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12e4
call fcn.004a99b0
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x12dc], 0x5c3a53
push 0x1000
lea eax, [ebp - 0x1088]
mov dword [ebp - 0x12c4], ebx
mov edi, ecx
or esi, 0xffffffff
push ebx
push eax
mov dword [ebp - 0x12e4], edi
mov dword [ebp - 0x12c8], esi
call fcn.004ab0f0
add esp, 0xc
mov dword [ebp - 0x12cc], ebx
cmp dword [0x58b260], 0xa0
mov dword [ebp - 0x12ac], 0x5441460b
mov dword [ebp - 0x12a8], 0x20202020
mov dword [ebp - 0x12a4], 0x41460120
mov dword [ebp - 0x12a0], 0x20323154
mov dword [ebp - 0x129c], 0x460e2020
mov dword [ebp - 0x1298], 0x36315441
mov dword [ebp - 0x1294], 0xc202020
mov dword [ebp - 0x1290], 0x33544146
mov dword [ebp - 0x128c], 0x20202032
jae 0x4088fe
push str.ESP_toggling_is_only_available_for_Windows_10_or_later
call fcn.0044b0b0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
push 1
push 1
xor edx, edx
mov ecx, edi
call fcn.00405fd0
add esp, 8
mov dword [ebp - 0x12d4], eax
cmp eax, 0xffffffff
je 0x4088eb
push 0
lea ecx, [ebp - 0x12d0]
push ecx
push 0x1000
lea ecx, [ebp - 0x1088]
push ecx
push 0
push 0
push 0x70050
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x408ed8
cmp dword [ebp - 0x12d0], ebx
jbe 0x408ed8
xor ebx, ebx
cmp dword [ebp - 0x1084], ebx
jle 0x4089c2
mov eax, dword [ebp - 0x1088]
lea edi, [ebp - 0x1038]
test eax, eax
jne 0x408975
cmp byte [edi], 0xef
je 0x408aaf
cmp eax, 1
jne 0x4089b0
test edi, edi
je 0x4089b0
mov ecx, edi
lea esi, [eax + 0xb]
mov edx, 0x52c018
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4089a0
add ecx, 4
add edx, 4
sub esi, 4
jae 0x408988
mov eax, 1
jmp 0x4089a2
xor eax, eax
test eax, eax
mov eax, dword [ebp - 0x1088]
jne 0x408aaf
inc ebx
add edi, 0x90
cmp ebx, dword [ebp - 0x1084]
jl 0x408968
or esi, 0xffffffff
mov eax, dword [ebp - 0x12c4]
mov ecx, 1
mov dword [ebp - 0x12d8], ecx
mov dword [ebp - 0x12c0], eax
nop dword [eax]
test esi, esi
jns 0x408d36
movzx eax, cl
push eax
push str.ToggleEsp_02u
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004050d0
add esp, 0x10
mov byte [ebp - 5], 0
lea ecx, [ebp - 0x14]
call fcn.004058c0
test eax, eax
je 0x408cf4
push 0x59d81b
push 0x59d81a
push 0x59d819
push 0x59d818
push 0x59d817
push 0x59d816
push 0x59d815
push 0x59d814
push 0x59d812
push 0x59d810
push 0x59d80c
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.00403450
add esp, 0x34
cmp eax, 0xb
jne 0x408cf4
xor ebx, ebx
mov dword [ebp - 0x12c0], ebx
cmp dword [ebp - 0x1084], ebx
jle 0x408cfa
movups xmm0, xmmword [0x52c018]
mov edi, dword [ebp - 0x1088]
lea ebx, [ebp - 0x1038]
mov eax, dword [ebp - 0x12c0]
nop
test esi, esi
jns 0x408cf4
cmp edi, 1
jne 0x408c2d
lea edx, [ebx + 0x10]
mov dword [ebp - 0x12cc], edx
jmp 0x408c6b
mov esi, ebx
mov dword [ebp - 0x12c8], esi
test ebx, ebx
js 0x4089c2
lea edi, [ebx + ebx*8]
shl edi, 4
lea esi, [ebp - 0x1050]
add esi, edi
cmp eax, 1
jne 0x408af2
lea eax, [ebp - 0x1010]
add eax, edi
push eax
push str.ESP_name:__S
call fcn.0044b0b0
lea ecx, [ebp - 0x1028]
add esp, 8
add ecx, edi
jmp 0x408b1d
mov eax, dword [ebp - 0x1080]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x12bc], eax
xor eax, eax
mov dword [ebp - 0x12b8], eax
mov eax, dword [esi]
mov dword [ebp - 0x12b0], ecx
lea ecx, [ebp - 0x12bc]
mov dword [ebp - 0x12b4], eax
call fcn.004085b0
test eax, eax
jne 0x408b3a
push str.ESP_toggling_data_could_not_be_stored
call fcn.0044b0b0
add esp, 4
xor ebx, ebx
jmp 0x408eec
mov eax, dword [ebp - 0x1088]
cmp eax, 1
jne 0x408b65
movups xmm0, xmmword [0x52c5e8]
mov ebx, dword [ebp - 0x12c4]
mov esi, dword [ebp - 0x12c8]
movups xmmword [ebp + edi - 0x1038], xmm0
jmp 0x408d3c
test eax, eax
jne 0x408c1c
mov ebx, dword [ebp - 0x12d4]
push eax
push eax
push dword [esi + 4]
mov byte [ebp + edi - 0x1038], 0xb
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x408c1c
push 0
lea eax, [ebp - 0x12e0]
push eax
push 0x200
lea eax, [ebp - 0x1288]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408c1c
cmp dword [ebp - 0x12e0], 0x200
jne 0x408c1c
mov esi, 0x36
nop dword [eax]
nop word [eax + eax]
xor edx, edx
lea ecx, [ebp - 0x12ab]
nop dword [eax + eax]
mov eax, dword [ebp + esi - 0x1288]
cmp eax, dword [ecx]
jne 0x408bf7
mov eax, dword [ebp + esi - 0x1284]
cmp eax, dword [ecx + 4]
je 0x408c02
inc edx
add ecx, 9
cmp edx, 4
jb 0x408be0
jmp 0x408c14
lea eax, [ebp - 0x12ac]
add eax, edx
mov al, byte [eax + edx*8]
mov byte [ebp + edi - 0x1038], al
add esi, 0x1c
cmp esi, 0x52
jbe 0x408bd0
mov ebx, dword [ebp - 0x12c4]
mov esi, dword [ebp - 0x12c8]
jmp 0x408d3c
test edi, edi
jne 0x408c65
mov eax, dword [ebp - 0x1080]
lea edx, [ebp - 0x12bc]
mov ecx, dword [ebx - 0x14]
mov dword [ebp - 0x12bc], eax
xor eax, eax
mov dword [ebp - 0x12b8], eax
mov eax, dword [ebx - 0x18]
mov dword [ebp - 0x12b4], eax
mov dword [ebp - 0x12b0], ecx
mov dword [ebp - 0x12cc], edx
jmp 0x408c6f
mov edx, dword [ebp - 0x12cc]
test edx, edx
je 0x408cdb
mov ecx, 0x59d80c
mov esi, 0xc
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x408c98
add ecx, 4
add edx, 4
sub esi, 4
jae 0x408c80
mov eax, 1
jmp 0x408c9a
xor eax, eax
test eax, eax
mov eax, dword [ebp - 0x12c0]
je 0x408cd5
mov dword [ebp - 0x12c4], 1
mov esi, eax
mov dword [ebp - 0x12c8], esi
cmp edi, 1
jne 0x408cc6
movups xmmword [ebx], xmm0
mov edi, dword [ebp - 0x1088]
jmp 0x408cdb
test edi, edi
jne 0x408cdb
mov byte [ebx], 0xef
mov edi, dword [ebp - 0x1088]
jmp 0x408cdb
mov esi, dword [ebp - 0x12c8]
inc eax
add ebx, 0x90
mov dword [ebp - 0x12c0], eax
cmp eax, dword [ebp - 0x1084]
jl 0x408a90
mov ebx, dword [ebp - 0x12c0]
mov ecx, dword [ebp - 0x12d8]
mov eax, esi
inc ecx
mov dword [ebp - 0x12d8], ecx
cmp ecx, 8
jle 0x4089e0
mov ecx, dword [ebp - 0x12c4]
mov dword [ebp - 0x12c4], ecx
test eax, eax
jns 0x408d3c
push str.No_partition_to_toggle
call fcn.0044b0b0
add esp, 4
xor ebx, ebx
jmp 0x408eec
mov ebx, dword [ebp - 0x12c0]
push 0
lea eax, [ebp - 0x12d0]
push eax
push 0
push 0
push dword [ebp - 0x12d0]
lea edi, [esi + esi*8]
mov esi, dword [ebp - 0x12d4]
lea eax, [ebp - 0x1088]
add edi, edi
push eax
push 0x7c054
push esi
mov byte [ebp + edi*8 - 0x103c], 1
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x408d93
call fcn.0044b6b0
push eax
push str.Could_not_set_drive_layout:__s
call fcn.0044b0b0
add esp, 8
xor ebx, ebx
jmp 0x408eec
push 0
lea eax, [ebp - 0x12d8]
push eax
push 0
push 0
push 0
push 0
push 0x70140
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x408dc7
call fcn.0044b6b0
push eax
push str.Could_not_refresh_drive_layout:__s
call fcn.0044b0b0
add esp, 8
cmp dword [ebp - 0x12c4], 0
je 0x408e02
movzx eax, bl
push eax
push str.ToggleEsp_02u
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004050d0
add esp, 0x10
mov byte [ebp - 5], 0
mov edx, 0x52ad5a
lea ecx, [ebp - 0x14]
call fcn.00405990
mov ebx, 1
jmp 0x408eec
mov bl, byte [ebp - 0x12dc]
lea eax, [ebp - 0x88]
push eax
push 0x69
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x408e38
call fcn.0044b6b0
push eax
push str.GetLogicalDriveStrings_failed:__s
call fcn.0044b0b0
add esp, 8
mov ebx, 1
jmp 0x408eec
cmp eax, 0x69
jbe 0x408e57
push 0x69
push eax
push str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
call fcn.0044b0b0
add esp, 0xc
mov ebx, 1
jmp 0x408eec
mov al, byte [ebp - 0x88]
lea esi, [ebp - 0x88]
test al, al
je 0x408e96
movsx eax, al
push eax
call fcn.004e01e0
add esp, 4
cmp bl, al
je 0x408ed1
test esi, esi
jne 0x408e7f
xor ecx, ecx
jmp 0x408e8d
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408e84
sub ecx, edx
inc esi
add esi, ecx
mov al, byte [esi]
test al, al
jne 0x408e67
mov ecx, dword [ebp - 0x12e4]
mov edx, 1
push 0
push dword [ebp + edi*8 - 0x104c]
push dword [ebp + edi*8 - 0x1050]
call fcn.00406080
add esp, 0xc
lea ecx, [ebp - 0x12dc]
mov esi, eax
mov edx, esi
call fcn.0040a0d0
push esi
call fcn.004d1211
add esp, 4
mov ebx, 1
jmp 0x408eec
call fcn.0044b6b0
push eax
push edi
push str.Could_not_get_layout_for_drive_0x_02x:__s
call fcn.0044b0b0
add esp, 0xc
mov eax, dword [ebp - 0x12d4]
test eax, eax
je 0x408efd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret