Function at 0x40a898
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x20a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x222]
push ebx
sub esp, 0x2ec
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x2af], 0x726f7475
rep stosb byte es:[edi], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2b7], 0x5c3a23
mov dword [ebp - 0x2b3], 0x615c3a23
mov dword [eax], str.NO_LABEL
mov dword [ebp - 0x2ac], 0x2e6e7572
mov dword [ebp - 0x2a8], 0x666e69
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040a5e5
test eax, eax
je 0x40ac73
mov al, byte [esi]
test al, al
jne 0x40a9f7
xor eax, eax
lea ebx, [ebp - 0x222]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00409f06
mov dword [esp + 0x1c], 0x40
mov esi, eax
lea eax, [ebp - 0x2a4]
mov dword [esp + 8], 0x40
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x2bc]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2c0]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x2c4]
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationByHandleW]
sub esp, 0x20
test eax, eax
je 0x40a9dc
xor edi, edi
xor eax, eax
mov dword [esp + 0x14], 0x105
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 0x4e27c0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov edx, 0x4e27c0
mov eax, str.NO_LABEL
sub esp, 0x20
cmp byte [0x4e27c0], 0
cmovne eax, edx
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
lea eax, [esi - 1]
cmp eax, 0xfffffffd
ja 0x40ac35
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
jmp 0x40ac35
mov byte [ebp - 0x2b3], al
mov byte [ebp - 0x2b7], al
xor eax, eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00408902
xor ecx, ecx
xor edx, edx
mov dword [esp + 4], 0x2d4800
mov edi, eax
lea eax, [ebp - 0x2a4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
sub esp, 0x20
test eax, eax
je 0x40aa7e
lea eax, [ebp - 0x2b3]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], str.label
call fcn.00427fbf
mov ebx, eax
jmp 0x40aab1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [ebp + 0x14], 0
jne 0x40aa8f
cmp eax, 0x15
je 0x40aa93
xor ebx, ebx
jmp 0x40aab1
movsx eax, byte [esi]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_toupper]
mov dword [esp], str.Ignoring_autorun.inf_label_for_drive__c:_No_media
mov dword [esp + 4], eax
call fcn.0043efa9
jmp 0x40aa8f
lea eax, [edi - 1]
cmp eax, 0xfffffffd
ja 0x40aac3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
test ebx, ebx
je 0x40ab3b
cmp dword [ebp + 0x14], 0
jne 0x40aaed
movsx eax, byte [esi]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_toupper]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], str.Using_autorun.inf_label_for_drive__c:__s
call fcn.0043efa9
mov dword [esp], ebx
mov esi, ebx
call sub.msvcrt.dll_strlen
mov edx, 0x4e27c0
lea ecx, [eax + 1]
mov eax, 0x105
mov edi, edx
cmp ecx, eax
cmova ecx, eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, 0x4e28c4
lea ecx, [eax + 1]
cmp ecx, 0x104
ja 0x40ab2b
lea edx, [eax + 0x4e27c0]
mov byte [edx], 0
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x40ac2c
lea eax, [ebp - 0x2b7]
call fcn.00407c6a
mov dword [esp + 4], 2
mov dword [esp], 0x105
mov esi, eax
call sub.msvcrt.dll_calloc
mov dword [esp + 8], 0x105
mov ebx, eax
xor eax, eax
mov dword [esp], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
sub esp, 0x20
mov dword [ebp - 0x2d0], eax
call eax
mov dword [ebp - 0x2cc], eax
test edi, edi
je 0x40abf5
xor eax, eax
mov dword [esp + 0x14], 0x105
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 0x4e27c0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
test eax, eax
jne 0x40abf5
mov eax, dword [ebp - 0x2d0]
xor edi, edi
call eax
mov dword [ebp - 0x2cc], eax
test ebx, ebx
je 0x40ac01
mov dword [esp], ebx
call sub.msvcrt.dll_free
test esi, esi
je 0x40ac0d
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x2cc]
mov ebx, dword [sym.imp.KERNEL32.DLL_SetLastError]
mov dword [esp], eax
call ebx
push ecx
test edi, edi
je 0x40ac3c
cmp byte [0x4e27c0], 0
je 0x40ac3c
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x4e27c0
mov eax, 1
jmp 0x40ac73
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor edx, edx
mov dword [esp + 4], edx
mov esi, eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041410d
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
test eax, eax
jne 0x40ac35
mov dword [esp], esi
call ebx
push eax
mov eax, dword [ebp + 0x10]
mov dword [eax], str.NO_LABEL
jmp 0x40ac35
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret