Function at 0x4065f0
Capabilities:
Contain obfuscated stackstrings
Get disk information
Get disk information via ioctl
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12e4
call fcn.00492020
mov eax, dword [0x4f22ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x12dc], 0x5c3a53
push 0x1000
lea eax, [ebp - 0x1088]
mov dword [ebp - 0x12c4], ebx
mov edi, ecx
or esi, 0xffffffff
push ebx
push eax
mov dword [ebp - 0x12e4], edi
mov dword [ebp - 0x12c8], esi
call fcn.00493600
add esp, 0xc
mov dword [ebp - 0x12cc], ebx
cmp dword [0x52b880], 0xa0
mov dword [ebp - 0x12ac], 0x5441460b
mov dword [ebp - 0x12a8], 0x20202020
mov dword [ebp - 0x12a4], 0x41460120
mov dword [ebp - 0x12a0], 0x20323154
mov dword [ebp - 0x129c], 0x460e2020
mov dword [ebp - 0x1298], 0x36315441
mov dword [ebp - 0x1294], 0xc202020
mov dword [ebp - 0x1290], 0x33544146
mov dword [ebp - 0x128c], 0x20202032
jae 0x4066ce
push str.ESP_toggling_is_only_available_for_Windows_10_or_later
call fcn.004407e0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491940
mov esp, ebp
pop ebp
ret
push 1
push 1
xor edx, edx
mov ecx, edi
call fcn.00404180
add esp, 8
mov dword [ebp - 0x12d4], eax
cmp eax, 0xffffffff
je 0x4066bb
push 0
lea ecx, [ebp - 0x12d0]
push ecx
push 0x1000
lea ecx, [ebp - 0x1088]
push ecx
push 0
push 0
push 0x70050
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x406cd8
cmp dword [ebp - 0x12d0], ebx
jbe 0x406cd8
xor ebx, ebx
cmp dword [ebp - 0x1084], ebx
jle 0x406792
mov eax, dword [ebp - 0x1088]
lea edi, [ebp - 0x1038]
test eax, eax
jne 0x406745
cmp byte [edi], 0xef
je 0x406876
cmp eax, 1
jne 0x406780
test edi, edi
je 0x406780
mov ecx, edi
lea esi, [eax + 0xb]
mov edx, 0x4cf6a8
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x406770
add ecx, 4
add edx, 4
sub esi, 4
jae 0x406758
mov eax, 1
jmp 0x406772
xor eax, eax
test eax, eax
mov eax, dword [ebp - 0x1088]
jne 0x406876
inc ebx
add edi, 0x90
cmp ebx, dword [ebp - 0x1084]
jl 0x406738
or esi, 0xffffffff
mov eax, dword [ebp - 0x12c4]
mov ecx, 1
mov dword [ebp - 0x12d8], ecx
mov dword [ebp - 0x12c0], eax
lea esp, [esp]
test esi, esi
jns 0x406b36
movzx eax, cl
push eax
push str.ToggleEsp_02u
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.00403820
add esp, 0x10
mov byte [ebp - 5], 0
lea ecx, [ebp - 0x14]
call fcn.00403bb0
test eax, eax
je 0x406af4
push 0x53de67
push 0x53de66
push 0x53de65
push 0x53de64
push 0x53de63
push 0x53de62
push 0x53de61
push 0x53de60
push 0x53de5e
push 0x53de5c
push 0x53de58
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.00401fb0
add esp, 0x34
cmp eax, 0xb
jne 0x406af4
xor ebx, ebx
mov dword [ebp - 0x12c0], ebx
cmp dword [ebp - 0x1084], ebx
jle 0x406afa
mov ebx, dword [ebp - 0x1088]
lea edi, [ebp - 0x1038]
mov eax, dword [ebp - 0x12c0]
test esi, esi
jns 0x406af4
cmp ebx, 1
jne 0x406a0d
lea edx, [edi + 0x10]
mov dword [ebp - 0x12cc], edx
jmp 0x406a4b
mov esi, ebx
mov dword [ebp - 0x12c8], esi
test ebx, ebx
js 0x406792
lea edi, [ebx + ebx*8]
shl edi, 4
lea esi, [ebp - 0x1050]
add esi, edi
cmp eax, 1
jne 0x4068b9
lea eax, [ebp - 0x1010]
add eax, edi
push eax
push str.ESP_name:__S
call fcn.004407e0
lea ecx, [ebp - 0x1028]
add esp, 8
add ecx, edi
jmp 0x4068e4
mov eax, dword [ebp - 0x1080]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x12bc], eax
xor eax, eax
mov dword [ebp - 0x12b8], eax
mov eax, dword [esi]
mov dword [ebp - 0x12b0], ecx
lea ecx, [ebp - 0x12bc]
mov dword [ebp - 0x12b4], eax
call fcn.00406480
test eax, eax
jne 0x406901
push str.ESP_toggling_data_could_not_be_stored
call fcn.004407e0
add esp, 4
xor ebx, ebx
jmp 0x406cec
mov eax, dword [ebp - 0x1088]
cmp eax, 1
jne 0x40694d
mov eax, dword [0x4cfb88]
mov ebx, dword [ebp - 0x12c4]
mov esi, dword [ebp - 0x12c8]
mov dword [ebp + edi - 0x1038], eax
mov eax, dword [0x4cfb8c]
mov dword [ebp + edi - 0x1034], eax
mov eax, dword [0x4cfb90]
mov dword [ebp + edi - 0x1030], eax
mov eax, dword [0x4cfb94]
mov dword [ebp + edi - 0x102c], eax
jmp 0x406b3c
test eax, eax
jne 0x4069fc
mov ebx, dword [ebp - 0x12d4]
push eax
push eax
push dword [esi + 4]
mov byte [ebp + edi - 0x1038], 0xb
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4069fc
push 0
lea eax, [ebp - 0x12e0]
push eax
push 0x200
lea eax, [ebp - 0x1288]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4069fc
cmp dword [ebp - 0x12e0], 0x200
jne 0x4069fc
mov esi, 0x36
lea ebx, [ebx]
xor edx, edx
lea ecx, [ebp - 0x12ab]
jmp 0x4069c0
mov eax, dword [ebp + esi - 0x1288]
cmp eax, dword [ecx]
jne 0x4069d7
mov eax, dword [ebp + esi - 0x1284]
cmp eax, dword [ecx + 4]
je 0x4069e2
inc edx
add ecx, 9
cmp edx, 4
jb 0x4069c0
jmp 0x4069f4
lea eax, [ebp - 0x12ac]
add eax, edx
mov al, byte [eax + edx*8]
mov byte [ebp + edi - 0x1038], al
add esi, 0x1c
cmp esi, 0x52
jbe 0x4069b0
mov ebx, dword [ebp - 0x12c4]
mov esi, dword [ebp - 0x12c8]
jmp 0x406b3c
test ebx, ebx
jne 0x406a45
mov eax, dword [ebp - 0x1080]
lea edx, [ebp - 0x12bc]
mov ecx, dword [edi - 0x14]
mov dword [ebp - 0x12bc], eax
xor eax, eax
mov dword [ebp - 0x12b8], eax
mov eax, dword [edi - 0x18]
mov dword [ebp - 0x12b4], eax
mov dword [ebp - 0x12b0], ecx
mov dword [ebp - 0x12cc], edx
jmp 0x406a53
mov edx, dword [ebp - 0x12cc]
test edx, edx
je 0x406adb
mov ecx, 0x53de58
mov esi, 0xc
lea ecx, [ecx]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x406a78
add ecx, 4
add edx, 4
sub esi, 4
jae 0x406a60
mov eax, 1
jmp 0x406a7a
xor eax, eax
test eax, eax
mov eax, dword [ebp - 0x12c0]
je 0x406ad5
mov dword [ebp - 0x12c4], 1
mov esi, eax
mov dword [ebp - 0x12c8], esi
cmp ebx, 1
jne 0x406ac6
mov ecx, dword [0x4cf6a8]
mov dword [edi], ecx
mov ecx, dword [0x4cf6ac]
mov dword [edi + 4], ecx
mov ecx, dword [0x4cf6b0]
mov dword [edi + 8], ecx
mov ecx, dword [0x4cf6b4]
mov dword [edi + 0xc], ecx
mov ebx, dword [ebp - 0x1088]
jmp 0x406adb
test ebx, ebx
jne 0x406adb
mov byte [edi], 0xef
mov ebx, dword [ebp - 0x1088]
jmp 0x406adb
mov esi, dword [ebp - 0x12c8]
inc eax
add edi, 0x90
mov dword [ebp - 0x12c0], eax
cmp eax, dword [ebp - 0x1084]
jl 0x406857
mov ebx, dword [ebp - 0x12c0]
mov ecx, dword [ebp - 0x12d8]
mov eax, esi
inc ecx
mov dword [ebp - 0x12d8], ecx
cmp ecx, 8
jle 0x4067b0
mov ecx, dword [ebp - 0x12c4]
mov dword [ebp - 0x12c4], ecx
test eax, eax
jns 0x406b3c
push str.No_partition_to_toggle
call fcn.004407e0
add esp, 4
xor ebx, ebx
jmp 0x406cec
mov ebx, dword [ebp - 0x12c0]
push 0
lea eax, [ebp - 0x12d0]
push eax
push 0
push 0
push dword [ebp - 0x12d0]
lea edi, [esi + esi*8]
mov esi, dword [ebp - 0x12d4]
lea eax, [ebp - 0x1088]
add edi, edi
push eax
push 0x7c054
push esi
mov byte [ebp + edi*8 - 0x103c], 1
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x406b93
call fcn.00440bb0
push eax
push str.Could_not_set_drive_layout:__s
call fcn.004407e0
add esp, 8
xor ebx, ebx
jmp 0x406cec
push 0
lea eax, [ebp - 0x12d8]
push eax
push 0
push 0
push 0
push 0
push 0x70140
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x406bc7
call fcn.00440bb0
push eax
push str.Could_not_refresh_drive_layout:__s
call fcn.004407e0
add esp, 8
cmp dword [ebp - 0x12c4], 0
je 0x406c02
movzx eax, bl
push eax
push str.ToggleEsp_02u
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.00403820
add esp, 0x10
mov byte [ebp - 5], 0
mov edx, 0x4ce59a
lea ecx, [ebp - 0x14]
call fcn.00403c80
mov ebx, 1
jmp 0x406cec
mov bl, byte [ebp - 0x12dc]
lea eax, [ebp - 0x88]
push eax
push 0x69
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x406c38
call fcn.00440bb0
push eax
push str.GetLogicalDriveStrings_failed:__s
call fcn.004407e0
add esp, 8
mov ebx, 1
jmp 0x406cec
cmp eax, 0x69
jbe 0x406c57
push 0x69
push eax
push str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
call fcn.004407e0
add esp, 0xc
mov ebx, 1
jmp 0x406cec
mov al, byte [ebp - 0x88]
lea esi, [ebp - 0x88]
test al, al
je 0x406c96
movsx eax, al
push eax
call fcn.0049f025
add esp, 4
cmp bl, al
je 0x406cd1
test esi, esi
jne 0x406c7f
xor ecx, ecx
jmp 0x406c8d
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406c84
sub ecx, edx
inc esi
add esi, ecx
mov al, byte [esi]
test al, al
jne 0x406c67
mov ecx, dword [ebp - 0x12e4]
mov edx, 1
push 0
push dword [ebp + edi*8 - 0x104c]
push dword [ebp + edi*8 - 0x1050]
call fcn.00404230
add esp, 0xc
lea ecx, [ebp - 0x12dc]
mov esi, eax
mov edx, esi
call fcn.00407de0
push esi
call fcn.004998ec
add esp, 4
mov ebx, 1
jmp 0x406cec
call fcn.00440bb0
push eax
push edi
push str.Could_not_get_layout_for_drive_0x_02x:__s
call fcn.004407e0
add esp, 0xc
mov eax, dword [ebp - 0x12d4]
test eax, eax
je 0x406cfd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00491940
mov esp, ebp
pop ebp
ret