Function at 0x10003be0
Capabilities:
Contain obfuscated stackstrings
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072807
mov eax, dword fs:[0]
push eax
sub esp, 0x4b8
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1044be70]
mov ecx, dword [0x1044be74]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x4bc], edi
mov dword [ebp - 0x4c4], esi
cmp eax, ecx
je 0x10003c43
nop
cmp dword [eax], esi
je 0x10003c3b
add eax, 4
cmp eax, ecx
jne 0x10003c30
cmp eax, ecx
jne 0x100042d6
mov eax, dword [0x1044be88]
mov ecx, dword [0x1044be8c]
cmp eax, ecx
je 0x10003c65
cmp dword [eax], esi
je 0x10003c5d
add eax, 4
cmp eax, ecx
jne 0x10003c52
cmp eax, ecx
jne 0x100042d6
push 0x104
lea eax, [ebp - 0x114]
push eax
push edi
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
test eax, eax
je 0x10003cc3
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x444], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x440], 0xf
mov byte [ebp - 0x454], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003cb0
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
jmp 0x10003d3a
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.1004f110
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
push edi
call sub.KERNEL32.dll_K32GetModuleFileNameExA
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0xf
mov byte [ebp - 0x454], 0
test eax, eax
je 0x10003d33
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003d20
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
jmp 0x10003d3a
push 0
push 0x10078104
lea ecx, [ebp - 0x454]
call fcn.10005040
cmp dword [ebp - 0x444], 0
mov dword [ebp - 4], 0
je 0x10004274
cmp dword [ebp - 0x440], 0x10
lea eax, [ebp - 0x454]
mov dword [ebp - 0x438], 0
cmovae eax, dword [ebp - 0x454]
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
mov byte [ebp - 4], 1
mov byte [ebp - 0x218], 0
test eax, eax
je 0x10003f12
mov ecx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003db0
sub ecx, edx
je 0x10003f12
lea eax, [ebp - 0x218]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x10003f12
mov ax, word [0x10078108]
lea edi, [ebp - 0x218]
mov word [ebp - 0x43c], ax
mov al, byte [0x1007810a]
mov byte [ebp - 0x43a], al
mov al, byte [ebp - 0x218]
mov dword [ebp - 0x4b8], 0
nop word [eax + eax]
mov byte [ebp - 0x43c], al
lea eax, [ebp - 0x31c]
push 0x104
push eax
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x10003ecc
lea esi, [ebp - 0x31c]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003e40
sub esi, ecx
cmp esi, 0x104
jae 0x10003ecc
push esi
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x4c0]
lfence
call fcn.10052280
xor ecx, ecx
add esp, 0xc
test eax, eax
sete cl
mov dword [ebp - 0x4b8], ecx
test eax, eax
jne 0x10003ed2
mov eax, dword [ebp - 0x4c0]
add eax, esi
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x420]
push str._s_s
push eax
lfence
call fcn.10003480
lea ecx, [ebp - 0x420]
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003eb0
sub ecx, edx
lea eax, [ebp - 0x420]
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.10005040
mov ecx, dword [ebp - 0x4b8]
mov al, byte [edi]
inc edi
test al, al
jne 0x10003ed2
test ecx, ecx
jne 0x10003ee7
mov al, byte [edi]
test al, al
jne 0x10003e10
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x49c]
call fcn.100035c0
lea ecx, [ebp - 0x438]
call fcn.100037b0
mov esi, dword [ebp - 0x4c4]
mov edi, dword [ebp - 0x4bc]
jmp 0x10003f56
movups xmm0, xmmword [ebp - 0x438]
lea ecx, [ebp - 0x438]
mov byte [ebp - 0x438], 0
movups xmmword [ebp - 0x49c], xmm0
movq xmm0, qword [ebp - 0x428]
movq qword [ebp - 0x48c], xmm0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
call fcn.100037b0
sub esp, 0x18
mov byte [ebp - 4], 2
lea eax, [ebp - 0x49c]
mov ecx, esp
push eax
call fcn.10003610
lea eax, [ebp - 0x484]
push eax
call fcn.10005170
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 3
push eax
call fcn.100045d0
add esp, 8
mov byte [ebp - 4], 4
lea eax, [ebp - 0x4b4]
mov ecx, esp
push eax
call fcn.10003610
lea eax, [ebp - 0x46c]
push eax
call fcn.10005170
add esp, 0x1c
cmp dword [ebp - 0x458], 0x10
lea eax, [ebp - 0x46c]
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 5
cmovae eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x470], 0x10
cmovae ecx, dword [ebp - 0x484]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10003ff7
test dl, dl
je 0x10003ff3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10003ff7
add ecx, 2
add eax, 2
test dl, dl
jne 0x10003fd7
xor eax, eax
jmp 0x10003ffc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000402f
mov eax, dword [0x1044be8c]
cmp eax, dword [0x1044be90]
je 0x1000401b
mov dword [eax], esi
add dword [0x1044be8c], 4
jmp 0x10004213
lea ecx, [ebp + 8]
push ecx
push eax
mov ecx, 0x1044be88
call fcn.10003320
jmp 0x10004213
cmp dword [ebp - 0x440], 0x10
lea ecx, [ebp - 0x42c]
lea eax, [ebp - 0x454]
mov dword [ebp - 0x42c], 0x61636462
cmovae eax, dword [ebp - 0x454]
push ecx
push eax
mov dword [ebp - 0x428], 0x78652e6d
mov word [ebp - 0x424], 0x65
call fcn.1004e2d0
add esp, 8
test eax, eax
jne 0x10004205
cmp dword [ebp - 0x440], 0x10
lea ecx, [ebp - 0x42c]
lea eax, [ebp - 0x454]
mov dword [ebp - 0x42c], 0x3673626f
cmovae eax, dword [ebp - 0x454]
push ecx
push eax
mov dword [ebp - 0x428], 0x78652e34
mov word [ebp - 0x424], 0x65
call fcn.1004e2d0
add esp, 8
test eax, eax
jne 0x10004205
cmp dword [ebp - 0x440], 0x10
lea ecx, [ebp - 0x42c]
mov byte [ebp - 0x424], al
lea eax, [ebp - 0x454]
cmovae eax, dword [ebp - 0x454]
push ecx
push eax
mov dword [ebp - 0x42c], 0x6e726b65
mov dword [ebp - 0x428], 0x6578652e
call fcn.1004e2d0
add esp, 8
test eax, eax
jne 0x10004205
cmp dword [ebp - 0x440], 0x10
lea ecx, [ebp - 0x42c]
mov byte [ebp - 0x424], al
lea eax, [ebp - 0x454]
cmovae eax, dword [ebp - 0x454]
push ecx
push eax
mov dword [ebp - 0x42c], 0x69756765
mov dword [ebp - 0x428], 0x6578652e
call fcn.1004e2d0
add esp, 8
test eax, eax
jne 0x10004205
mov ecx, 0x29
xor edx, edx
mov al, byte [edx + 0x1007813c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x42c], al
and ecx, 0x800000ff
jns 0x10004174
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10004154
cmp dword [ebp - 0x440], 0x10
lea ecx, [ebp - 0x42c]
lea eax, [ebp - 0x454]
mov byte [ebp - 0x421], 0
cmovae eax, dword [ebp - 0x454]
push ecx
push eax
call fcn.1004e2d0
add esp, 8
test eax, eax
jne 0x10004205
mov ecx, 0x83
xor edx, edx
mov al, byte [edx + 0x10078148]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x42c], al
and ecx, 0x800000ff
jns 0x100041d0
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x100041b0
cmp dword [ebp - 0x440], 0x10
lea ecx, [ebp - 0x42c]
lea eax, [ebp - 0x454]
mov byte [ebp - 0x421], 0
cmovae eax, dword [ebp - 0x454]
push ecx
push eax
call fcn.1004e2d0
add esp, 8
test eax, eax
je 0x10004244
lea eax, [ebp + 8]
mov ecx, 0x1044be88
push eax
call fcn.10005140
lea ecx, [ebp - 0x46c]
call fcn.100037b0
lea ecx, [ebp - 0x4b4]
call fcn.100037b0
lea ecx, [ebp - 0x484]
call fcn.100037b0
lea ecx, [ebp - 0x49c]
call fcn.100037b0
jmp 0x100042cb
lea ecx, [ebp - 0x46c]
call fcn.100037b0
lea ecx, [ebp - 0x4b4]
call fcn.100037b0
lea ecx, [ebp - 0x484]
call fcn.100037b0
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 0
call fcn.100037b0
push edi
call fcn.10003b10
add esp, 4
test al, al
jne 0x100042a4
mov eax, dword [0x1044be74]
cmp eax, dword [0x1044be78]
je 0x10004299
mov dword [eax], esi
add dword [0x1044be74], 4
jmp 0x100042cb
lea ecx, [ebp + 8]
push ecx
mov ecx, 0x1044be70
jmp 0x100042c5
mov eax, dword [0x1044be8c]
cmp eax, dword [0x1044be90]
je 0x100042bc
mov dword [eax], esi
add dword [0x1044be8c], 4
jmp 0x100042cb
lea ecx, [ebp + 8]
push ecx
mov ecx, 0x1044be88
push eax
call fcn.10003320
lea ecx, [ebp - 0x454]
call fcn.100037b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret