Function at 0x438150
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x2b502554
mov dword [esp + 0xc], 0x2f44294e
mov dword [esp + 0x10], 0x331e2d42
mov dword [esp + 0x14], 0x375c3156
mov dword [esp + 0x18], 0x3b34355a
mov dword [esp + 0x1c], 0
mov word [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x19
ja 0x4381eb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x583ae25
add eax, 0x583ae25
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0xfd
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1a
jb 0x4381b0
lea esi, [esp + 8]
push esi
call fcn.00439d20
add esp, 4
mov ecx, eax
mov dword [0x44f478], eax
xor edx, edx
test eax, eax
sete dl
xor eax, eax
jmp dword [edx*4 + 0x4450b4]
jmp dword [0x4450bc]
push 0xde118a15
push ecx
call fcn.0043a440
add esp, 8
mov dword [0x44f480], eax
push 0x9b1cb500
push dword [0x44f478]
call fcn.0043a440
add esp, 8
mov dword [0x44f484], eax
push 0xb3a80508
push dword [0x44f478]
call fcn.0043a440
add esp, 8
mov dword [0x44f488], eax
push 0x1f488771
push dword [0x44f478]
call fcn.0043a440
add esp, 8
mov dword [0x44745c], eax
mov dword [esp + 8], 0x6327612b
mov dword [esp + 0xc], 0x67286516
mov dword [esp + 0x10], 0x6b26692d
mov dword [esp + 0x14], 0x6f3c6d3f
mov dword [esp + 0x18], 0x93d691be
mov dword [esp + 0x1c], 0x97da95d8
mov word [esp + 0x20], 0x9998
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x43832a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0x70]
and edx, ecx
mov edi, 0xac20ef8f
sub edi, eax
or edi, ecx
not edi
add edi, ecx
sub edi, edx
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
mov ecx, eax
or ecx, 0xef
and eax, 0xef
add eax, ecx
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x4382e0
push esi
call fcn.00439d20
add esp, 4
mov dword [0x447454], eax
jmp dword [0x4450c8]
push 0xde118a15
push dword [0x44f478]
call fcn.0043a440
add esp, 8
mov dword [0x44f480], eax
push 0x9b1cb500
push dword [0x44f478]
call fcn.0043a440
add esp, 8
mov dword [0x44f484], eax
push 0xb3a80508
push dword [0x44f478]
call fcn.0043a440
add esp, 8
mov dword [0x44f488], eax
push 0x1f488771
push dword [0x44f478]
call fcn.0043a440
add esp, 8
mov dword [0x44745c], eax
mov dword [esp + 8], 0x6327612b
mov dword [esp + 0xc], 0x67286516
mov dword [esp + 0x10], 0x6b26692d
mov dword [esp + 0x14], 0x6f3c6d3f
mov dword [esp + 0x18], 0x93d691be
mov dword [esp + 0x1c], 0x97da95d8
mov word [esp + 0x20], 0x9998
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x43845a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0x70]
and edx, ecx
mov edi, 0xac20ef8f
sub edi, eax
or edi, ecx
not edi
add edi, ecx
sub edi, edx
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
mov ecx, eax
or ecx, 0xef
and eax, 0xef
add eax, ecx
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x438410
push esi
call fcn.00439d20
add esp, 4
mov dword [0x447454], eax
mov ecx, dword [0x44f478]
jmp case.0x438208.2
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x4450cc]
push 0x2df68b61
push eax
call fcn.0043a440
add esp, 8
mov dword [0x446148], eax
push 0xd4ed4ea7
push dword [0x447454]
call fcn.0043a440
add esp, 8
mov dword [0x44624c], eax
push 0xe174828e
push dword [0x447454]
call fcn.0043a440
add esp, 8
mov dword [0x447474], eax
call fcn.004387a0
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x4450e4]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call fcn.00432700
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x4450ec]
mov eax, dword [0x446148]
mov dword [esp + 8], 0xb33ab52b
mov dword [esp + 0xc], 0xaf20b135
mov dword [esp + 0x10], 0xab61ad22
mov dword [esp + 0x14], 0xa77aa964
mov dword [esp + 0x18], 0xa330a53a
mov dword [esp + 0x1c], 0x9fa0a136
mov word [esp + 0x20], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x19
ja 0x43857c
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx - 0x5795fc37]
and edi, edx
add ecx, edx
add ecx, 0xa86a03c9
add edi, edi
sub ecx, edi
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x81
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x1a
jb 0x438540
push 0x800
push 0
push esi
call eax
test eax, eax
je 0x43858f
mov dword [0x44746c], eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4450f4]
xor eax, eax
jmp dword [0x445108]
mov ecx, dword [case.0x438208.1]
xor eax, eax
jmp ecx
mov ecx, dword [case.0x438208.21]
nop
nop
nop
nop
nop
nop
nop
nop
mov al, 1
jmp ecx
mov ecx, dword [case.0x438208.15]
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [case.0x438208.1]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [0x445144]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx