Function at 0x40a303
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x20a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x222]
push ebx
sub esp, 0x2ec
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x2ad], 0x726f7475
rep stosb byte es:[edi], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2b5], 0x5c3a23
mov dword [ebp - 0x2b1], 0x615c3a23
mov dword [eax], str.NO_LABEL
mov dword [ebp - 0x2aa], 0x2e6e7572
mov dword [ebp - 0x2a6], 0x666e69
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040a050
test eax, eax
je 0x40a6b2
mov al, byte [esi]
test al, al
jne 0x40a462
xor eax, eax
lea ebx, [ebp - 0x222]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040993e
mov dword [esp + 0x1c], 0x40
mov esi, eax
lea eax, [ebp - 0x2a2]
mov dword [esp + 8], 0x40
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x2bc]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2c0]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x2c4]
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationByHandleW]
sub esp, 0x20
test eax, eax
je 0x40a447
xor edi, edi
xor eax, eax
mov dword [esp + 0x14], 0x105
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 0x4dfc40
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov edx, 0x4dfc40
mov eax, str.NO_LABEL
sub esp, 0x20
cmp byte [0x4dfc40], 0
cmovne eax, edx
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
lea eax, [esi - 1]
cmp eax, 0xfffffffd
ja 0x40a674
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
jmp 0x40a674
mov byte [ebp - 0x2b1], al
mov byte [ebp - 0x2b5], al
xor eax, eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040835f
xor edx, edx
mov dword [esp + 4], 0x2d4800
mov dword [esp + 0x1c], edx
mov edi, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
sub esp, 0x20
test eax, eax
je 0x40a4e1
lea eax, [ebp - 0x2b1]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], str.label
call fcn.00426ea9
mov ebx, eax
jmp 0x40a514
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x15
jne 0x40a4f2
cmp dword [ebp + 0x14], 0
je 0x40a4f6
xor ebx, ebx
jmp 0x40a514
movsx eax, byte [esi]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_toupper]
mov dword [esp], str.Ignoring_autorun.inf_label_for_drive__c:_No_media
mov dword [esp + 4], eax
call fcn.0043d9e0
jmp 0x40a4f2
lea eax, [edi - 1]
cmp eax, 0xfffffffd
ja 0x40a526
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
test ebx, ebx
je 0x40a57a
cmp dword [ebp + 0x14], 0
jne 0x40a550
movsx eax, byte [esi]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_toupper]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], str.Using_autorun.inf_label_for_drive__c:__s
call fcn.0043d9e0
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov ecx, ebx
mov edx, 0x105
inc eax
mov dword [esp], eax
mov eax, 0x4dfc40
call fcn.0040735c
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x40a66b
lea eax, [ebp - 0x2b5]
call fcn.00407736
mov dword [esp + 4], 2
mov dword [esp], 0x105
mov esi, eax
call sub.msvcrt.dll_calloc
mov dword [esp + 8], 0x105
mov ebx, eax
xor eax, eax
mov dword [esp], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
sub esp, 0x20
mov dword [ebp - 0x2d0], eax
call eax
mov dword [ebp - 0x2cc], eax
test edi, edi
je 0x40a634
xor eax, eax
mov dword [esp + 0x14], 0x105
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 0x4dfc40
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
test eax, eax
jne 0x40a634
mov eax, dword [ebp - 0x2d0]
xor edi, edi
call eax
mov dword [ebp - 0x2cc], eax
test ebx, ebx
je 0x40a640
mov dword [esp], ebx
call sub.msvcrt.dll_free
test esi, esi
je 0x40a64c
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x2cc]
mov ebx, dword [sym.imp.KERNEL32.DLL_SetLastError]
mov dword [esp], eax
call ebx
push ecx
test edi, edi
je 0x40a67b
cmp byte [0x4dfc40], 0
je 0x40a67b
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x4dfc40
mov eax, 1
jmp 0x40a6b2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor edx, edx
mov dword [esp + 4], edx
mov esi, eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00413a61
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x40a674
mov dword [esp], esi
call ebx
push eax
mov eax, dword [ebp + 0x10]
mov dword [eax], str.NO_LABEL
jmp 0x40a674
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret