Function at 0x4404a6
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476020
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x898
mov dword [ebp - 0x894], ecx
push 0x100
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x111], 0
push 0x80
lea ecx, [ebp - 0x2b8]
push ecx
lea edx, [ebp - 0x340]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x118]
push ecx
push 0x80
lea edx, [ebp - 0x338]
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x138]
call fcn.00471b8e
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11c]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 2
push 0x100
push 0
lea ecx, [ebp - 0x238]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x238]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp - 0x94], 0x57
mov byte [ebp - 0x93], 0x54
mov byte [ebp - 0x92], 0x43
mov byte [ebp - 0x91], 0x59
mov byte [ebp - 0x90], 0x30
mov byte [ebp - 0x8f], 0x30
mov byte [ebp - 0x8e], 0x30
mov byte [ebp - 0x8d], 0x31
mov byte [ebp - 0x8c], 0x2e
mov byte [ebp - 0x8b], 0x62
mov byte [ebp - 0x8a], 0x69
mov byte [ebp - 0x89], 0x6e
mov byte [ebp - 0x88], 0
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x33c]
call fcn.004070a0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x33c]
call fcn.004070e0
movsx edx, al
cmp edx, 0x5c
jne 0x44065a
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x880]
push edx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x89c], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x89c]
push ecx
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x880]
call sub.MFC42.DLL_CString::CString
jmp 0x4406b8
push 0x5c
lea ecx, [ebp - 0x33c]
call fcn.00471b88
lea edx, [ebp - 0x94]
push edx
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x884]
push ecx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x8a0], eax
mov edx, dword [ebp - 0x8a0]
mov dword [ebp - 0x8a4], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x8a4]
push eax
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x884]
call sub.MFC42.DLL_CString::CString
push 0
lea ecx, [ebp - 0x33c]
call fcn.00407160
push eax
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x440a98
lea ecx, [ebp - 0x474]
call fcn.00471ac8
mov byte [ebp - 4], 5
mov dword [ebp - 0x344], 0
push 0
push 2
lea ecx, [ebp - 0x33c]
call fcn.00407160
push eax
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x440780
lea ecx, [ebp - 0x33c]
call fcn.00407160
push eax
call sub.MFC42.DLL_CFile::Remove
mov dword [ebp - 0x344], 1
mov dword [ebp - 0x888], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x888]
jmp 0x440ad8
push 0x400
lea ecx, [ebp - 0x87c]
push ecx
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::Read
lea ecx, [ebp - 0x348]
call fcn.00407100
mov edx, dword [ebp - 0x670]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x660]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x47c], dx
mov ecx, dword [ebp - 0x630]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x648]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x34c], cx
mov eax, dword [ebp - 0x47c]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
mov ecx, dword [ebp - 0x34c]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x478], eax
mov edx, dword [ebp - 0x4fc]
xor edx, dword [ebp - 0x478]
mov dword [ebp - 0x4fc], edx
mov eax, dword [ebp - 0x540]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x560]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x47c], ax
mov edx, dword [ebp - 0x560]
and edx, 0xff
and edx, 0xff
mov eax, dword [ebp - 0x520]
and eax, 0xff
and eax, 0xff
shl eax, 8
or edx, eax
mov word [ebp - 0x34c], dx
mov ecx, dword [ebp - 0x47c]
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0xffff
mov edx, dword [ebp - 0x34c]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
shl edx, 0x10
or ecx, edx
mov dword [ebp - 0x478], ecx
mov eax, dword [ebp - 0x57c]
xor eax, dword [ebp - 0x478]
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp - 0x518]
and ecx, 0xff
and ecx, 0xff
mov edx, dword [ebp - 0x56c]
and edx, 0xff
and edx, 0xff
shl edx, 8
or ecx, edx
mov word [ebp - 0x47c], cx
mov eax, dword [ebp - 0x51c]
and eax, 0xff
and eax, 0xff
mov ecx, dword [ebp - 0x570]
and ecx, 0xff
and ecx, 0xff
shl ecx, 8
or eax, ecx
mov word [ebp - 0x34c], ax
mov edx, dword [ebp - 0x47c]
and edx, 0xffff
and edx, 0xffff
and edx, 0xffff
mov eax, dword [ebp - 0x34c]
and eax, 0xffff
and eax, 0xffff
and eax, 0xffff
shl eax, 0x10
or edx, eax
mov dword [ebp - 0x478], edx
mov ecx, dword [ebp - 0x4f8]
xor ecx, dword [ebp - 0x478]
mov dword [ebp - 0x4f8], ecx
mov edx, dword [ebp - 0x57c]
cmp edx, dword [ebp - 0x4f8]
je 0x4409b3
mov dword [ebp - 0x344], 1
mov eax, dword [ebp - 0x118]
shr eax, 0x10
and eax, 0xffff
xor eax, 0x5555
and eax, 0xffff
and eax, 0xffff
mov ecx, dword [ebp - 0x118]
and ecx, 0xffff
and ecx, 0xffff
xor ecx, 0xaaaa
and ecx, 0xffff
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
cmp dword [ebp - 0x580], eax
je 0x440a0b
mov dword [ebp - 0x344], 1
lea ecx, [ebp - 0x464]
call fcn.00407110
lea edx, [ebp - 0x464]
push edx
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::GetStatus_1
lea ecx, [ebp - 0x464]
call fcn.00407160
cmp dword [ebp - 0x4fc], eax
je 0x440a45
mov dword [ebp - 0x344], 1
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x88c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x474]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x88c]
jmp 0x440ad8
mov dword [ebp - 0x890], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x33c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CFileFind::CFileFind
mov eax, dword [ebp - 0x890]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret