Function at 0x405e50
Capabilities:
Contain obfuscated stackstrings
Get disk size
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x1012c
call fcn.00414cb0
push ebx
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xd1]
mov byte [esp + 0xd0], 0
mov esi, dword [0x442a50]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [esi - 8]
lea edi, [esp + 0xd0]
mov eax, ecx
push 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov cl, byte [0x43d27c]
lea edx, [esp + 0xdc]
push ecx
push edx
call sub.api2xxx_dll_M.dll_Ordinal_2
test eax, eax
mov dword [0x442c90], eax
je 0x4064d9
cmp eax, 0xffffffff
je 0x4064d9
push ebp
push 0
push eax
call sub.api2xxx_dll_M.dll_Ordinal_24
push 0
push 0x200
push edx
push eax
call fcn.004151f0
mov dword [0x442a70], eax
mov eax, dword [0x442c90]
push 1
push eax
call sub.api2xxx_dll_M.dll_Ordinal_24
push 0
push 0x200
push edx
push eax
call fcn.004151f0
mov ecx, dword [0x442c90]
push 2
push ecx
mov dword [0x442a74], eax
call sub.api2xxx_dll_M.dll_Ordinal_24
push 0
push 0x200
push edx
push eax
call fcn.004151f0
mov edx, dword [0x442c90]
push 3
push edx
mov dword [0x442a78], eax
call sub.api2xxx_dll_M.dll_Ordinal_24
push 0
push 0x200
push edx
push eax
call fcn.004151f0
mov ebx, dword [0x442a78]
mov ebp, dword [0x442a74]
mov esi, eax
mov eax, dword [0x442a70]
mov ecx, 0x10
lea edi, [esp + 0xf5]
lea edx, [esi + ebx]
mov byte [esp + 0xf4], 0
add edx, ebp
mov dword [0x442a7c], esi
add edx, eax
xor eax, eax
push edx
push esi
rep stosd dword es:[edi], eax
mov eax, dword [0x442a70]
push ebx
push ebp
push eax
lea ecx, [esp + 0x108]
push str.__d__d__d__d__d_
push ecx
mov dword [0x442a80], edx
call fcn.00414f4e
mov edx, dword [0x442c90]
add esp, 0x1c
push 0x64
push edx
call sub.api2xxx_dll_M.dll_Ordinal_27
push eax
push 0x442c94
call fcn.00414f4e
xor eax, eax
mov byte [esp + 0x9c], 0
mov dword [esp + 0x9d], eax
push str..Y:
mov dword [esp + 0xa5], eax
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa9], eax
mov dword [esp + 0xad], eax
mov word [esp + 0xb1], ax
mov byte [esp + 0xb3], al
push ecx
call fcn.00414f4e
add esp, 0x10
mov dl, byte [0x442c94]
lea eax, [esp + 0x94]
mov byte [esp + 0x98], dl
push 0
push 0x20000080
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
lea edx, [esp + 0xb0]
mov dword [esp + 0xa8], ecx
mov esi, eax
push ecx
push edx
lea eax, [esp + 0xb0]
push 8
push eax
push ecx
push ecx
push 0x7405c
push esi
mov dword [esp + 0xcc], ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x442c90]
mov ecx, 0x4000
xor eax, eax
lea edi, [esp + 0x139]
mov byte [esp + 0x138], 0
push 2
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x13c]
push 0x80
push ecx
push 0xa
push edx
call sub.api2xxx_dll_M.dll_Ordinal_8
test eax, eax
pop ebp
je 0x4064ce
mov dl, 0x41
mov cl, 0x56
mov al, 0xd1
mov bl, 0x58
mov byte [esp + 0x14], dl
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], al
mov byte [esp + 0x1c], dl
mov byte [esp + 0x29], cl
mov byte [esp + 0x2c], al
mov dl, 0xf1
mov cl, 0x52
mov al, 0xe2
mov byte [esp + 0x13], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], bl
mov byte [esp + 0xc], 0xb2
mov byte [esp + 0xd], 0xa2
mov byte [esp + 0xe], 0x17
mov byte [esp + 0xf], 0xc5
mov byte [esp + 0x10], 0x23
mov byte [esp + 0x11], 7
mov byte [esp + 0x12], 0x31
mov byte [esp + 0x15], 0xc2
mov byte [esp + 0x16], 0xb1
mov byte [esp + 0x17], 0x13
mov byte [esp + 0x18], 0xc1
mov byte [esp + 0x1b], 0x87
mov byte [esp + 0x1d], 0xc2
mov byte [esp + 0x1e], 0x63
mov byte [esp + 0x1f], 0x85
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], 0x17
mov byte [esp + 0x23], 0xf6
mov byte [esp + 0x24], 3
mov byte [esp + 0x25], 0xa4
mov byte [esp + 0x26], 0x13
mov byte [esp + 0x27], 0xac
mov byte [esp + 0x28], 0x48
mov byte [esp + 0x2a], 4
mov byte [esp + 0x2b], 0xa3
mov byte [esp + 0x2d], 0x36
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], 0x8a
mov byte [esp + 0x30], 0x64
mov byte [esp + 0x31], 0x7b
mov byte [esp + 0x32], 0x74
mov byte [esp + 0x33], 0x55
mov byte [esp + 0x34], 0xaa
mov byte [esp + 0x35], 0x30
mov byte [esp + 0x36], 0xba
mov byte [esp + 0x37], cl
mov byte [esp + 0x38], 0xca
mov byte [esp + 0x39], 0xcc
mov byte [esp + 0x3a], 0xda
mov byte [esp + 0x3b], 0xdd
mov byte [esp + 0x3c], dl
mov byte [esp + 0x3d], 8
mov byte [esp + 0x3e], 0xf3
mov byte [esp + 0x3f], cl
mov byte [esp + 0x40], 0xe0
mov byte [esp + 0x41], 0x8d
mov byte [esp + 0x42], al
mov byte [esp + 0x43], 0xa5
mov byte [esp + 0x44], dl
mov byte [esp + 0x45], 0x4b
mov byte [esp + 0x46], 0xc8
mov byte [esp + 0x47], 0x7c
mov byte [esp + 0x48], 0xe0
mov byte [esp + 0x49], 0x12
mov byte [esp + 0x4a], al
mov byte [esp + 0x4b], 0x36
mov byte [esp + 0x4e], 9
mov byte [esp + 0x4f], 0x6b
mov byte [esp + 0x50], 0x82
mov byte [esp + 0x51], 0xe1
mov byte [esp + 0x52], 0x62
mov byte [esp + 0x53], 0xe3
mov byte [esp + 0x54], 0xaf
mov bl, 0xf2
mov byte [esp + 0x62], al
mov byte [esp + 0x6a], al
mov al, 0x6f
mov byte [esp + 0x7d], cl
mov byte [esp + 0x70], al
mov byte [esp + 0x7a], al
mov al, 0x99
lea edi, [esp + 0xf0]
mov byte [esp + 0x80], al
mov byte [esp + 0x88], al
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov byte [esp + 0x64], dl
mov dl, 0x97
not ecx
dec ecx
mov byte [esp + 0x6e], dl
mov byte [esp + 0x86], dl
mov byte [esp + 0x55], bl
mov byte [esp + 0x5d], bl
mov edx, ecx
mov bl, 0x4d
lea esi, [esp + 0xf0]
lea edi, [esp + 0xc]
mov byte [esp + 0x56], 0x55
shr ecx, 2
mov byte [esp + 0x57], 0xf4
mov byte [esp + 0x58], 0x72
mov byte [esp + 0x59], 0xe1
mov byte [esp + 0x5a], 0x89
mov byte [esp + 0x5b], 0xe3
mov byte [esp + 0x5c], 0x1f
mov byte [esp + 0x5e], bl
mov byte [esp + 0x5f], 0x7f
mov byte [esp + 0x60], 0xe
mov byte [esp + 0x61], 0x42
mov byte [esp + 0x63], bl
mov byte [esp + 0x65], 0xcd
mov byte [esp + 0x66], 0xf3
mov byte [esp + 0x67], 0x5f
mov byte [esp + 0x68], 0xe0
mov byte [esp + 0x69], 0x1f
mov byte [esp + 0x6b], 0x3d
mov byte [esp + 0x6c], 0x87
mov byte [esp + 0x6d], 0xc1
mov byte [esp + 0x6f], 0xb3
mov byte [esp + 0x71], 0x89
mov byte [esp + 0x72], 0x72
mov byte [esp + 0x73], 0x53
mov byte [esp + 0x74], 0x87
mov byte [esp + 0x75], 0xc2
mov byte [esp + 0x76], 0xd7
mov byte [esp + 0x77], 0x98
mov byte [esp + 0x78], 0x9b
mov byte [esp + 0x79], 0x89
mov byte [esp + 0x7b], 0x69
mov byte [esp + 0x7c], 0xa4
mov byte [esp + 0x7e], 0x3c
mov byte [esp + 0x7f], 0x3b
mov byte [esp + 0x81], 0x9f
mov byte [esp + 0x82], 0xa5
mov byte [esp + 0x83], 2
mov byte [esp + 0x84], 0xf
mov byte [esp + 0x85], 0xbb
mov byte [esp + 0x87], 0x2c
mov byte [esp + 0x89], bl
mov byte [esp + 0x8a], 0x79
mov byte [esp + 0x8b], 0x90
mov byte [esp + 0x8c], 0
lea eax, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 8
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x20
lea esi, [esp + 0x14]
mov edi, 0x45cd7c
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x13c]
push 0x44cd58
push ecx
call fcn.004027a0
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xc1]
mov esi, dword [0x442a54]
mov byte [esp + 0xc0], 0
add esp, 0x10
rep stosd dword es:[edi], eax
mov ecx, dword [esi - 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, ecx
lea edi, [esp + 0xb0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, 0x44cd58
mov eax, ecx
mov edi, 0x45cd5c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x45cd5c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [0x45cd62]
lea esi, [esp + 0xb0]
mov byte [0x44cd55], cl
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x406440
test cl, cl
je 0x40643c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x406440
add eax, 2
add esi, 2
test cl, cl
jne 0x406418
xor eax, eax
jmp 0x406445
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4064ce
mov ecx, 0x80
mov esi, 0x44cf58
mov edi, 0x444d48
mov eax, dword [0x44cd70]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x80
mov esi, 0x44d358
mov edi, 0x446d4c
mov edx, dword [0x44cd6c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x200
mov esi, 0x44d558
mov edi, 0x448d50
mov dword [0x45df9c], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x80
mov esi, 0x44dd58
mov edi, 0x44ad54
mov dword [0x45df98], edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x44cd68]
pop edi
mov dword [0x45df94], ecx
mov ecx, dword [0x44cd74]
pop esi
mov dword [0x45dfa0], ecx
mov eax, 1
pop ebx
add esp, 0x1012c
ret
mov eax, dword [0x442c90]
push eax
call sub.api2xxx_dll_M.dll_Ordinal_3
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1012c
ret