Function at 0x403750
Capabilities:
Get common file path
Get disk information
Get disk size
Query environment variable
Read .ini file
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
mov eax, dword [0x55c92c]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x70], 0x72abd
mov dword [ebp - 0x6c], 0
movzx ecx, word [ebp - 0xac]
mov edx, dword [ebp - 0x10c]
lea eax, [ecx + edx - 0x1d5c2]
or eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
xor ecx, ecx
je 0x4037c8
mov edx, dword [ebp - 0x10c]
add edx, 0x2349d
and edx, dword [ebp - 0x10c]
movzx eax, byte [ebp - 0x81]
sub eax, dword [ebp - 0x10c]
and eax, 0x36eb2
or edx, eax
mov word [ebp - 0xac], dx
jmp 0x403831
mov esi, dword [ebp - 0x10c]
sub esi, 0x73662
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
and esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, 0x73161
sub ecx, eax
and ecx, 0x9a88
or esi, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [ebp - 0x10c]
add edx, 0xa8470
and eax, edx
or esi, eax
movzx eax, word [ebp - 0xac]
add eax, 0x3564b
or esi, eax
mov dword [ebp - 0x10c], esi
xor ecx, ecx
jne 0x403857
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp esi, eax
je 0x403857
xor edx, edx
je 0x4038b3
mov ebx, dword [ebp - 0x10c]
add ebx, 0x3b5c2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
sub eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
and ebx, eax
mov eax, dword [ebp - 0x10c]
sub eax, 0x751da
or ebx, eax
mov ecx, dword [ebp - 0x10c]
add ecx, 0x1901d
or ebx, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
movzx edx, byte [ebp - 0x81]
sub eax, edx
or ebx, eax
mov byte [ebp - 0x81], bl
jmp 0x4038ce
movzx eax, word [ebp - 0xac]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
and eax, 0x6fda3
mov dword [ebp - 0x10c], eax
mov ebx, dword [ebp - 0x10c]
add ebx, 0x5b453
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
sub ebx, eax
or ebx, 0x2943e
mov edx, dword [ebp - 0x10c]
sub edx, 0x47f30
or ebx, edx
or ebx, 0x6747c
or ebx, 0x70089
mov byte [ebp - 0x81], bl
mov esi, 0x14561
sub esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
add esi, dword [ebp - 0x10c]
lea eax, [eax + esi + 0x3f713]
mov byte [ebp - 0x81], al
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea esi, [edx + ecx + 0x20f7e]
and esi, 0x2e9bf
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, dword [ebp - 0x10c]
and esi, eax
movzx eax, word [ebp - 0xac]
and eax, 0x449b
and eax, 0x2c9e9
xor esi, eax
movzx ecx, word [ebp - 0xac]
mov edx, dword [ebp - 0x10c]
lea eax, [ecx + edx + 0x275d6]
or esi, eax
mov dword [ebp - 0x10c], esi
xor ecx, ecx
jne 0x4039c4
cmp dword [ebp - 0x10c], 0x5356b
je 0x4039c4
cmp dword [ebp - 0x10c], 0x69563
jne 0x403a27
cmp dword [ebp - 0x70], 0x64813
jne 0x403a27
cmp dword [ebp - 0x6c], 0
jne 0x403a27
mov edx, 1
test edx, edx
je 0x403a27
movzx esi, word [ebp - 0xac]
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
sub eax, 0x3a194
and esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
movzx ecx, word [ebp - 0xac]
add eax, ecx
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x32b7
shr eax, cl
or esi, eax
movzx edx, word [ebp - 0xac]
sub edx, dword [ebp - 0x10c]
or esi, edx
mov word [ebp - 0xac], si
jmp 0x403a76
mov esi, dword [ebp - 0x10c]
add esi, 0x333f5
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
sub esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esi + eax + 0x164db]
or eax, 0x441c1
movzx ecx, word [ebp - 0xac]
sub ecx, 0x139d7
or eax, ecx
xor edx, edx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add eax, dword [ebp - 0x10c]
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
add eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
adc edx, ecx
mov ecx, dword [ebp - 0x10c]
call fcn.0043dfd0
and ebx, eax
and esi, edx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
xor edx, edx
and ebx, eax
and esi, edx
mov eax, dword [ebp - 0x10c]
xor ecx, ecx
or ebx, eax
or esi, ecx
mov byte [ebp - 0x81], bl
mov edx, 0x50c3b
sub edx, dword [ebp - 0x10c]
mov ecx, edx
xor esi, esi
mov edi, 0x7fbdc
sub edi, dword [ebp - 0x70]
mov ebx, 0
sbb ebx, dword [ebp - 0x6c]
movzx eax, byte [ebp - 0x81]
cdq
add edi, eax
adc ebx, edx
and ecx, edi
and esi, ebx
xor ecx, 0x6a55
xor esi, 0
mov edx, 0x1467e
sub edx, dword [ebp - 0x10c]
xor eax, eax
or ecx, edx
or esi, eax
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], esi
movzx ecx, word [ebp - 0xac]
mov edx, dword [ebp - 0x10c]
lea eax, [ecx + edx + 0x326dc]
and eax, dword [ebp - 0x10c]
or eax, dword [ebp - 0x10c]
mov esi, eax
xor edi, edi
mov ebx, dword [ebp - 0x10c]
xor eax, eax
sub ebx, dword [ebp - 0x70]
sbb eax, dword [ebp - 0x6c]
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax - 0x33c3c]
xor eax, eax
and ebx, edx
mov ecx, dword [ebp - 0x14c]
and ecx, eax
or esi, ebx
or edi, ecx
mov dword [ebp - 0x10c], esi
mov esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
add esi, dword [ebp - 0x10c]
add eax, esi
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx - 0x69da2]
sub edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
or edx, 0x3ac4f
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea esi, [ecx + eax + 0x655c4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
sub esi, eax
sub esi, 0x56a1b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edx, 0x44955
sub edx, eax
add edx, 0x68504
and edx, 0x53ae8
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
and edx, eax
or esi, edx
mov dword [ebp - 0x10c], esi
mov ebx, dword [ebp - 0x10c]
sub ebx, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
movzx edx, word [ebp - 0xac]
add ecx, edx
sub ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
movzx eax, word [ebp - 0xac]
add eax, dword [ebp - 0x10c]
and ecx, eax
or ebx, ecx
mov byte [ebp - 0x81], bl
movzx esi, word [ebp - 0xac]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
cmp esi, eax
jne 0x403c8a
mov ecx, 1
test ecx, ecx
je 0x403cca
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
mov ebx, eax
sub ebx, 0x131034
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
sub ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add ebx, eax
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x70be5
shr ebx, cl
or ebx, 0x5a9de
mov byte [ebp - 0x81], bl
jmp 0x403d1f
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
add esi, dword [ebp - 0x10c]
and esi, dword [ebp - 0x10c]
mov edi, dword [ebp - 0x10c]
add edi, 0x918de
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
sub edi, eax
add edi, 0x6abe8
and esi, edi
or esi, 0x77bdb
mov word [ebp - 0xac], si
mov al, byte [ebp - 0x81]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18