Function at 0x1004bad
Capabilities:
Generate random numbers via winapi
Get common file path
Get disk information
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x52c]
sub esp, 0x5a8
mov eax, dword [0x100a028]
push ebx
xor ebx, ebx
cmp byte [0x100ad60], bl
mov dword [ebp + 0x528], eax
lea eax, [ebp + 0x514]
mov dword [ebp - 0x10], 0x5c3a63
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0x12], 0x63
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x60], 0xc
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x38], ebx
je 0x1004c21
push ebx
push ebx
push 0x100ad60
call fcn.010042af
test eax, eax
jne 0x1005074
mov byte [0x100ad60], al
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.01003a05
test eax, eax
jne 0x1004c3d
push 0xffffffffffffffff
jmp 0x10050b1
push esi
push edi
push 1
lea eax, [ebp + 0x514]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1004ccf
push 2
push 0x100
lea eax, [ebp + 0x3f4]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x1004ccf
push dword [ebp - 0x50]
mov esi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
mov edi, 0x10000000
push edi
push 2
lea eax, [ebp + 0x3f4]
push eax
call esi
test eax, eax
je 0x1004ccf
push dword [ebp - 0x2c]
lea eax, [ebp + 0x3f4]
push edi
push 2
push eax
call esi
test eax, eax
je 0x1004ccf
push dword [ebp - 0x34]
lea eax, [ebp + 0x3f4]
push edi
push 2
push eax
call esi
test eax, eax
je 0x1004ccf
push ebx
lea eax, [ebp + 0x3f4]
push eax
push 1
lea eax, [ebp + 0x514]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1004ccf
lea eax, [ebp - 0x60]
mov dword [ebp - 0x38], eax
cmp dword [0x101b0c0], ebx
jne 0x1004cf4
cmp dword [0x100a18c], ebx
je 0x1004cf4
push 0x100ad60
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
jmp 0x1004fea
push pe_overlay
push 0x100b0c0
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov bl, byte [0x100b0c0]
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
or bl, 0x20
call fcn.01002858
mov cl, 0x61
mov byte [ebp - 0x19], al
mov byte [ebp - 0x10], cl
cmp cl, byte [ebp - 0x19]
je 0x1004e1b
push 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0xe], 0
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
test eax, eax
mov byte [ebp - 0xe], 0x5c
je 0x1004e18
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll__strlwr]
mov esi, dword [sym.imp.msvcrt.dll_strstr]
lea eax, [ebp - 0xc]
mov dword [esp], 0x1002520
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1004d86
lea eax, [ebp - 0xc]
push 0x1002518
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x1004e18
push dword [ebp - 0x10]
call fcn.01002975
mov edi, eax
test edi, edi
je 0x1004e18
lea eax, [ebp - 0x10]
push eax
call fcn.01002789
test eax, eax
je 0x1004e18
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x1004e18
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x54]
mul dword [ebp - 0x4c]
mov cl, byte [ebp - 0x10]
cmp cl, bl
mov dword [ebp - 0x28], 1
mov esi, edx
jne 0x1004de5
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
jmp 0x1004e1b
cmp edi, 2
jne 0x1004e01
cmp esi, dword [ebp - 0x3c]
jb 0x1004e01
ja 0x1004df6
cmp eax, dword [ebp - 0x40]
jbe 0x1004e01
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x12], cl
jmp 0x1004e1b
cmp esi, dword [ebp - 0x20]
jb 0x1004e1b
ja 0x1004e0d
cmp eax, dword [ebp - 0x24]
jbe 0x1004e1b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x11], cl
jmp 0x1004e1b
mov cl, byte [ebp - 0x10]
inc cl
cmp cl, 0x7a
mov byte [ebp - 0x10], cl
jle 0x1004d22
xor esi, esi
cmp dword [ebp - 0x28], esi
jne 0x1004e3a
push 0x20000008
jmp 0x10050b1
mov eax, dword [0x100a020]
cmp eax, 0xcab00eee
je 0x1004e54
xor ecx, ecx
cmp dword [ebp - 0x20], ecx
ja 0x1004e6e
jb 0x1004e54
cmp dword [ebp - 0x24], eax
jae 0x1004e6e
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x20], eax
ja 0x1004e6e
jb 0x1004e66
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x30]
jae 0x1004e6e
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
jmp 0x1004e74
mov bl, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x24]
mov eax, dword [0x100a018]
push 3
pop edx
mul edx
cmp dword [ebp - 0x20], edx
jb 0x1004e8e
ja 0x1004e89
cmp ecx, eax
jb 0x1004e8e
mov byte [ebp - 0x10], bl
jmp 0x1004ea8
cmp dword [ebp - 0x3c], edx
jb 0x10050ac
ja 0x1004ea2
cmp dword [ebp - 0x40], eax
jb 0x10050ac
mov al, byte [ebp - 0x12]
mov byte [ebp - 0x10], al
push 0xf0000000
push 1
push esi
push esi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1004f8b
mov edi, dword [sym.imp.msvcrt.dll_sprintf]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov ebx, 0x100ad60
lea eax, [ebp + 0x4f4]
push eax
push 0x10
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1004f38
lea eax, [ebp - 0x10]
push eax
push 0x1002514
push ebx
call edi
xor ecx, ecx
mov cl, byte [ebp + 0x4f4]
add esp, 0xc
push 0
pop esi
and ecx, 7
add ecx, 9
mov dword [ebp - 0x20], ecx
je 0x1004f38
lea eax, [eax + 0x100ad60]
mov dword [ebp - 0x34], eax
movzx eax, byte [ebp + esi + 0x4f4]
push eax
push 0x100250c
push dword [ebp - 0x34]
call edi
add dword [ebp - 0x34], 2
add esp, 0xc
inc esi
cmp esi, dword [ebp - 0x20]
jb 0x1004f18
cmp byte [0x100ad60], 0
je 0x1004f57
xor esi, esi
inc esi
push esi
push dword [ebp - 0x38]
push ebx
call fcn.010042af
test eax, eax
je 0x1004f5e
mov dword [ebp - 0x18], esi
jmp 0x1004f5e
mov dword [ebp - 0x2c], 1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x18], 0
jne 0x1004f7a
cmp dword [ebp - 0x2c], 0
jne 0x1004f7a
cmp dword [ebp - 0x28], 0x2710
jb 0x1004ed4
push 0
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x18], 0
jne 0x1004fea
mov esi, 0x100ad60
push esi
push 0x1002500
lea eax, [ebp - 0x10]
push eax
call fcn.01002a1f
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
mov eax, dword [ebp - 0x68]
imul eax, dword [0x100a018]
push edi
and eax, 0xffff
push eax
call fcn.01002ae7
xor edi, edi
inc edi
push edi
push dword [ebp - 0x38]
push esi
call fcn.010042af
test eax, eax
jne 0x1004fe7
push 0x52
jmp 0x10050b1
mov dword [ebp - 0x18], edi
xor ebx, ebx
cmp dword [0x101b0c0], ebx
jne 0x100508f
cmp dword [0x100a18c], ebx
je 0x100508f
mov edi, 0x100ad60
push ebx
push 0x1003b66
push dword [0x100aae4]
push 0x6b
push dword [0x100a05c]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
je 0x1004c36
cmp eax, ebx
je 0x1005088
cmp byte [eax], 0
je 0x1005088
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100503a
sub ecx, esi
inc ecx
cmp ecx, 0x104
jae 0x1004fe0
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1005050
push ebx
push ebx
push edi
call fcn.010042af
test eax, eax
je 0x100506d
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], ebx
je 0x1005009
pop edi
pop esi
mov ecx, dword [ebp + 0x528]
pop ebx
call fcn.01005d91
add ebp, 0x52c
leave
ret
push 0x4c7
jmp 0x10050b1
cmp dword [ebp - 0x18], ebx
jne 0x1005072
push 1
push dword [ebp - 0x38]
push 0x100ad60
call fcn.010042af
test eax, eax
jne 0x1005072
jmp 0x1004fe0
push 0x20000009
call fcn.010035e6
int3