Function at 0x459ee0
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e1c3
mov eax, dword fs:[0]
push eax
sub esp, 0x8c8
mov eax, dword [0x4e2e58]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8ac], ecx
push 0x100
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 1
imul edx, ecx, 3
mov dword [ebp - 0x860], edx
cmp dword [ebp - 0x860], 0x80
jae 0x459f3f
jmp 0x459f44
call fcn.00498f50
mov eax, dword [ebp - 0x860]
mov byte [ebp + eax - 0x110], 0
push 0x80
lea ecx, [ebp - 0x290]
push ecx
lea edx, [ebp - 0x8a8]
push edx
lea eax, [ebp - 0x8b0]
push eax
lea ecx, [ebp - 0x85c]
push ecx
push 0x80
lea edx, [ebp - 0x310]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x8cc]
call sub.mfc120.dll_Ordinal_503
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_316]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x854]
call dword [sym.imp.mfc120.dll_Ordinal_316]
mov byte [ebp - 4], 2
push 0x100
push 0
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x90], 0x57
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x90], 0x54
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x90], 0x43
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x90], 0x59
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x90], 0x30
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x90], 0x30
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x90], 0x30
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x90], 0x31
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x90], 0x2e
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x90], 0x62
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x90], 0x69
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x90], 0x6e
mov edx, 1
imul eax, edx, 0xc
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 0x80
jae 0x45a0c1
jmp 0x45a0c6
call fcn.00498f50
mov ecx, dword [ebp - 0x858]
mov byte [ebp + ecx - 0x90], 0
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1524]
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_5764]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x88c]
sub eax, 1
push eax
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1645]
movsx ecx, al
cmp ecx, 0x5c
jne 0x45a16f
lea edx, [ebp - 0x90]
push edx
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0x874]
push ecx
call fcn.00413a60
add esp, 0xc
mov dword [ebp - 0x868], eax
mov edx, dword [ebp - 0x868]
mov dword [ebp - 0x86c], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1521]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x874]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
jmp 0x45a1d3
push 0x5c
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1688]
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x840]
push edx
lea eax, [ebp - 0x890]
push eax
call fcn.00413a60
add esp, 0xc
mov dword [ebp - 0x87c], eax
mov ecx, dword [ebp - 0x87c]
mov dword [ebp - 0x888], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x888]
push edx
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1521]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x890]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
push 0
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1656]
push eax
lea ecx, [ebp - 0x8cc]
call sub.mfc120.dll_Ordinal_4662
test eax, eax
je 0x45a603
lea ecx, [ebp - 0x8a4]
call sub.mfc120.dll_Ordinal_500
mov byte [ebp - 4], 5
mov dword [ebp - 0x850], 0
push 0
push 2
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1656]
push eax
lea ecx, [ebp - 0x8a4]
call sub.mfc120.dll_Ordinal_11782
test eax, eax
jne 0x45a2a2
push 0
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1656]
push eax
call sub.mfc120.dll_Ordinal_12400
mov dword [ebp - 0x850], 1
mov dword [ebp - 0x864], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8a4]
call sub.mfc120.dll_Ordinal_1137
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x854]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8cc]
call sub.mfc120.dll_Ordinal_1139
mov eax, dword [ebp - 0x864]
jmp 0x45a645
push 0x404
lea eax, [ebp - 0x714]
push eax
lea ecx, [ebp - 0x8a4]
call sub.mfc120.dll_Ordinal_12165
lea ecx, [ebp - 0x8d4]
call fcn.00413570
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + edx - 0x514]
and eax, 0xff
movzx ecx, al
mov edx, 4
imul eax, edx, 7
mov edx, dword [ebp + eax - 0x514]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
mov word [ebp - 0x848], cx
mov ecx, 4
imul edx, ecx, 0x13
mov eax, dword [ebp + edx - 0x514]
and eax, 0xff
movzx ecx, al
mov edx, 4
imul eax, edx, 0xd
mov edx, dword [ebp + eax - 0x514]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
mov word [ebp - 0x844], cx
movzx ecx, word [ebp - 0x848]
and ecx, 0xffff
movzx edx, cx
movzx eax, word [ebp - 0x844]
and eax, 0xffff
movzx ecx, ax
shl ecx, 0x10
or edx, ecx
mov dword [ebp - 0x84c], edx
mov edx, dword [ebp - 0x84c]
xor eax, eax
xor edx, dword [ebp - 0x394]
xor eax, dword [ebp - 0x390]
mov dword [ebp - 0x394], edx
mov dword [ebp - 0x390], eax
mov ecx, 4
imul edx, ecx, 0xe
mov eax, dword [ebp + edx - 0x410]
and eax, 0xff
movzx ecx, al
mov edx, 4
imul eax, edx, 6
mov edx, dword [ebp + eax - 0x410]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
mov word [ebp - 0x848], cx
mov ecx, 4
imul edx, ecx, 6
mov eax, dword [ebp + edx - 0x410]
and eax, 0xff
movzx ecx, al
mov edx, 4
imul eax, edx, 0x16
mov edx, dword [ebp + eax - 0x410]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
mov word [ebp - 0x844], cx
movzx ecx, word [ebp - 0x848]
and ecx, 0xffff
movzx edx, cx
movzx eax, word [ebp - 0x844]
and eax, 0xffff
movzx ecx, ax
shl ecx, 0x10
or edx, ecx
mov dword [ebp - 0x84c], edx
mov edx, dword [ebp - 0x414]
xor edx, dword [ebp - 0x84c]
mov dword [ebp - 0x414], edx
mov eax, 4
imul ecx, eax, 0x18
mov edx, dword [ebp + ecx - 0x410]
and edx, 0xff
movzx eax, dl
mov ecx, 4
imul edx, ecx, 3
mov ecx, dword [ebp + edx - 0x410]
and ecx, 0xff
movzx edx, cl
shl edx, 8
or eax, edx
mov word [ebp - 0x848], ax
mov eax, 4
imul ecx, eax, 0x17
mov edx, dword [ebp + ecx - 0x410]
and edx, 0xff
movzx eax, dl
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + ecx - 0x410]
and edx, 0xff
movzx ecx, dl
shl ecx, 8
or eax, ecx
mov word [ebp - 0x844], ax
movzx edx, word [ebp - 0x848]
and edx, 0xffff
movzx eax, dx
movzx ecx, word [ebp - 0x844]
and ecx, 0xffff
movzx edx, cx
shl edx, 0x10
or eax, edx
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x38c]
xor eax, dword [ebp - 0x84c]
mov dword [ebp - 0x38c], eax
mov ecx, dword [ebp - 0x414]
cmp ecx, dword [ebp - 0x38c]
je 0x45a502
mov dword [ebp - 0x850], 1
mov edx, dword [ebp - 0x85c]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
xor eax, 0x5555
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp - 0x85c]
and edx, 0xffff
movzx eax, dx
xor eax, 0xaaaa
and eax, 0xffff
movzx edx, ax
shl edx, 0x10
or ecx, edx
cmp dword [ebp - 0x418], ecx
je 0x45a554
mov dword [ebp - 0x850], 1
lea ecx, [ebp - 0x83c]
call fcn.00413480
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x8a4]
call sub.mfc120.dll_Ordinal_6821
lea ecx, [ebp - 0x83c]
call fcn.00414040
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x880], edx
mov ecx, dword [ebp - 0x394]
cmp ecx, dword [ebp - 0x884]
jne 0x45a5a4
mov edx, dword [ebp - 0x390]
cmp edx, dword [ebp - 0x880]
je 0x45a5ae
mov dword [ebp - 0x850], 1
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x878], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8a4]
call sub.mfc120.dll_Ordinal_1137
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x854]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8cc]
call sub.mfc120.dll_Ordinal_1139
mov eax, dword [ebp - 0x878]
jmp 0x45a645
mov dword [ebp - 0x870], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x854]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x840]
call dword [sym.imp.mfc120.dll_Ordinal_1041]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8cc]
call sub.mfc120.dll_Ordinal_1139
mov eax, dword [ebp - 0x870]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499036
mov esp, ebp
pop ebp
ret