Function at 0x439462
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461f66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x698
mov dword [ebp - 0x694], ecx
push 0x100
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x111], 0
push 0x80
lea ecx, [ebp - 0x2b8]
push ecx
lea edx, [ebp - 0x340]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x118]
push ecx
push 0x80
lea edx, [ebp - 0x338]
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x138]
call fcn.0045ecce
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11c]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 2
push 0x100
push 0
lea ecx, [ebp - 0x238]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x238]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp - 0x94], 0x57
mov byte [ebp - 0x93], 0x54
mov byte [ebp - 0x92], 0x43
mov byte [ebp - 0x91], 0x59
mov byte [ebp - 0x90], 0x30
mov byte [ebp - 0x8f], 0x30
mov byte [ebp - 0x8e], 0x30
mov byte [ebp - 0x8d], 0x31
mov byte [ebp - 0x8c], 0x2e
mov byte [ebp - 0x8b], 0x62
mov byte [ebp - 0x8a], 0x69
mov byte [ebp - 0x89], 0x6e
mov byte [ebp - 0x88], 0
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x33c]
call fcn.00405cd0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x33c]
call fcn.00405d10
movsx edx, al
cmp edx, 0x5c
jne 0x439616
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x680]
push edx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x698], eax
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x69c], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x69c]
push ecx
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x680]
call sub.MFC42.DLL_CString::CString
jmp 0x439674
push 0x5c
lea ecx, [ebp - 0x33c]
call fcn.0045ecc8
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x684]
push ecx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x6a0], eax
mov edx, dword [ebp - 0x6a0]
mov dword [ebp - 0x6a4], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x6a4]
push eax
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x684]
call sub.MFC42.DLL_CString::CString
push 0
lea ecx, [ebp - 0x33c]
call fcn.00405d30
push eax
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x4399ec
lea ecx, [ebp - 0x474]
call fcn.0045ec0e
mov byte [ebp - 4], 5
mov dword [ebp - 0x344], 0
push 0
push 2
lea ecx, [ebp - 0x33c]
call fcn.00405d30
push eax
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x43973c
lea ecx, [ebp - 0x33c]
call fcn.00405d30
push eax
call sub.MFC42.DLL_CFile::Remove
mov dword [ebp - 0x344], 1
mov dword [ebp - 0x688], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x688]
jmp 0x439a2c
push 0x200
lea ecx, [ebp - 0x67c]
push ecx
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::Read
lea ecx, [ebp - 0x348]
call fcn.00440170
mov edx, dword [ebp - 0x670]
and edx, 0xff
mov eax, dword [ebp - 0x660]
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x47c], dx
mov ecx, dword [ebp - 0x630]
and ecx, 0xff
mov edx, dword [ebp - 0x648]
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x34c], cx
mov eax, dword [ebp - 0x47c]
and eax, 0xffff
mov ecx, dword [ebp - 0x34c]
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x478], eax
mov edx, dword [ebp - 0x4fc]
xor edx, dword [ebp - 0x478]
mov dword [ebp - 0x4fc], edx
mov eax, dword [ebp - 0x540]
and eax, 0xff
mov ecx, dword [ebp - 0x560]
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x47c], ax
mov edx, dword [ebp - 0x560]
and edx, 0xff
mov eax, dword [ebp - 0x520]
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x34c], dx
mov ecx, dword [ebp - 0x47c]
and ecx, 0xffff
mov edx, dword [ebp - 0x34c]
and edx, 0xffff
shl edx, 0x10
or ecx, edx
mov dword [ebp - 0x478], ecx
mov eax, dword [ebp - 0x57c]
xor eax, dword [ebp - 0x478]
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp - 0x518]
and ecx, 0xff
mov edx, dword [ebp - 0x56c]
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x47c], cx
mov eax, dword [ebp - 0x51c]
and eax, 0xff
mov ecx, dword [ebp - 0x570]
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x34c], ax
mov edx, dword [ebp - 0x47c]
and edx, 0xffff
mov eax, dword [ebp - 0x34c]
and eax, 0xffff
shl eax, 0x10
or edx, eax
mov dword [ebp - 0x478], edx
mov ecx, dword [ebp - 0x4f8]
xor ecx, dword [ebp - 0x478]
mov dword [ebp - 0x4f8], ecx
mov edx, dword [ebp - 0x57c]
cmp edx, dword [ebp - 0x4f8]
je 0x4398e7
mov dword [ebp - 0x344], 1
mov eax, dword [ebp - 0x118]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
xor eax, 0x5555
and eax, 0xffff
mov ecx, dword [ebp - 0x118]
and ecx, 0xffff
xor ecx, 0xaaaa
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
cmp dword [ebp - 0x580], eax
je 0x439933
mov dword [ebp - 0x344], 1
lea ecx, [ebp - 0x464]
call fcn.00405db0
lea edx, [ebp - 0x464]
push edx
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::GetStatus_1
lea ecx, [ebp - 0x464]
call fcn.00405d30
cmp dword [ebp - 0x4fc], eax
je 0x43996d
mov dword [ebp - 0x344], 1
cmp dword [ebp - 0x57c], 0x12c
jne 0x439983
mov dword [ebp - 0x344], 1
cmp dword [ebp - 0x344], 0
jne 0x4399dd
mov dword [ebp - 0x68c], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x68c]
jmp 0x439a2c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::CFile
mov dword [ebp - 0x690], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x690]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret