Function at 0x1089cbb
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x10de03c]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [edx]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push edi
xor edi, edi
sub eax, edi
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x21c], 0x889573d2
mov word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], 0x8d67
mov word [ebp - reloc.ADVAPI32.dll_RegDeleteValueW], 0x4e91
mov byte [ebp - 0x214], 0xbe
mov byte [ebp - 0x213], 0x9f
mov byte [ebp - 0x212], 0xf1
mov byte [ebp - 0x211], reloc.KERNEL32.dll_ReadFile
mov byte [ebp - 0x210], 0x44
mov byte [ebp - 0x20f], 0x7e
mov byte [ebp - 0x20e], 0xe9
mov byte [ebp - 0x20d], 0x4d
je 0x108a192
dec eax
je 0x108a12e
dec eax
je 0x108a037
dec eax
je 0x1089f3d
dec eax
je 0x1089ef6
dec eax
je 0x1089ec8
dec eax
jne 0x108a630
cmp ebx, edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x238], edi
je 0x108a630
mov eax, dword [ebx]
jmp 0x1089db5
cmp dword [eax + 0x214], edi
je 0x1089da5
inc dword [ebp - 0x230]
mov ecx, dword [eax + 0x210]
mov word [ecx + 0x32], di
mov eax, dword [eax + 0x218]
cmp eax, edi
jne 0x1089d97
mov eax, dword [ebx + 0x40]
cmp eax, edi
je 0x1089df1
cmp dword [ebp - 0x230], edi
jle 0x1089df1
mov ecx, dword [eax]
lea edx, [ebp - 0x22c]
push edx
lea edx, [ebp - 0x248]
push edx
push 0
push 2
sub esp, 0x10
mov edi, esp
lea esi, [ebx + 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x90]
xor edi, edi
mov eax, dword [ebx + 0x40]
cmp eax, edi
je 0x1089dfe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebx + 0x44]
cmp eax, edi
je 0x1089e0b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x230]
shl eax, 2
push 1
push eax
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
call dword [sym.imp.msvcrt.dll_calloc]
cmp eax, edi
pop ecx
pop ecx
mov dword [ebx + 0x3c], eax
jne 0x1089e35
or ax, reloc.ADVAPI32.dll_RegDeleteValueW
jmp 0x108a633
mov eax, dword [ebx]
xor edx, edx
jmp 0x1089e5d
mov ecx, dword [eax + 0x214]
cmp ecx, edi
je 0x1089e57
cmp edx, dword [ebp - 0x230]
jg 0x1089e57
mov esi, dword [ebx + 0x3c]
add ecx, 4
mov dword [esi + edx*4], ecx
inc edx
mov eax, dword [eax + 0x218]
cmp eax, edi
jne 0x1089e3b
cmp byte [ebx + 0x1c], 0
je 0x1089e71
mov dword [ebp - 0x238], 1
lea eax, [ebx + 0x44]
push eax
push dword [ebx + 0x3c]
lea esi, [ebp - 0x21c]
push dword [ebp - 0x230]
push dword [ebp - 0x238]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.010cb484
test eax, eax
jge 0x1089eb8
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebp - 0x230], eax
jne 0x1089f85
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x20], eax
jmp 0x108a630
and dword [ebx + 0x38], 0
mov dword [ebx + 0x20], 1
jmp 0x108a630
cmp ebx, edi
je 0x108a630
mov eax, dword [ebx + 0x44]
cmp eax, edi
mov dword [ebx + 0x30], edi
je 0x1089ee0
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ebx, dword [ebx + 0x40]
cmp ebx, edi
je 0x1089eed
mov eax, dword [ebx]
push ebx
call dword [eax + 0x38]
push 2
push edi
push edi
jmp 0x1089fee
cmp ebx, edi
je 0x108a630
mov eax, dword [ebx + 0x30]
cmp eax, edi
jge 0x108a630
mov ebx, dword [ebx + 0x38]
cmp ebx, edi
push edi
jge 0x1089f27
push 0x23d
push ebx
push edi
push edi
call fcn.010892e6
mov ax, 0xfe40
jmp 0x108a633
push 0x23e
push eax
push edi
push edi
call fcn.010892e6
mov ax, 0xfe3f
jmp 0x108a633
cmp ebx, edi
je 0x1089f85
cmp dword [ebx + 0x20], edi
mov eax, dword [ebx + 0x44]
je 0x1089f8e
mov ecx, dword [eax]
lea edx, [ebp - 0x24c]
push edx
lea esi, [ebx + 0x38]
push esi
push eax
call dword [ecx + 0x14]
cmp eax, edi
jge 0x1089f63
mov dword [ebx + 0x30], eax
jmp 0x1089f6f
cmp dword [esi], 0x42309
je 0x108a630
mov eax, dword [ebx + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebx + 0x30], edi
mov dword [ebx + 0x44], edi
jl 0x1089f85
mov eax, dword [esi]
mov dword [ebx + 0x30], eax
mov ax, 1
jmp 0x108a633
cmp eax, edi
je 0x108a026
lea esi, [ebx + 0x30]
cmp dword [esi], edi
jl 0x1089fb1
mov ecx, dword [eax]
lea edx, [ebp - 0x24c]
push edx
push esi
push eax
call dword [ecx + 0x14]
cmp eax, edi
jge 0x1089fb1
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, 0x42309
je 0x108a630
cmp dword [ebx + 0x14], edi
jne 0x1089ffe
cmp eax, edi
jl 0x1089ffe
cmp dword [ebx + 0x18], edi
je 0x108a630
mov eax, dword [ebx + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi], edi
mov dword [ebx + 0x44], edi
jl 0x1089f85
push 1
push dword [ebp - 0x238]
push dword [ebp - 0x240]
push dword [ebp - 0x23c]
call fcn.01089cbb
jmp 0x108a630
mov eax, dword [ebx + 0x44]
cmp eax, edi
je 0x108a00e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx + 0x44], edi
push dword [ebp - 0x23c]
call fcn.01089625
xor eax, eax
cmp dword [ebx + 0x20], edi
sete al
jmp 0x108a633
cmp dword [ebx + 0x14], edi
jne 0x108a034
cmp dword [ebx + 0x30], edi
jge 0x1089f85
push edx
jmp 0x108a014
cmp ebx, edi
je 0x108a630
mov eax, dword [ebx + 0x40]
cmp eax, edi
je 0x108a06f
mov ecx, dword [eax]
lea edx, [ebp - 0x22c]
push edx
lea edx, [ebp - 0x238]
push edx
push 1
push 2
sub esp, 0x10
mov edi, esp
lea esi, [ebx + 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x90]
jmp 0x108a08c
cmp dword [ebx + 0x20], edi
je 0x108a08e
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x21c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.010cb478
and dword [ebx + 0x20], 0
xor edi, edi
cmp dword [ebx], edi
je 0x108a0f0
mov edi, dword [ebx]
lea esi, [edi + 0x210]
mov eax, dword [esi]
mov dword [ebp - 0x234], edi
call fcn.01089294
mov eax, dword [esi]
and word [eax + 0x32], 0
mov eax, dword [esi]
and dword [eax + 0x3c], 0
lea eax, [edi + 0x200]
push 4
pop ecx
mov edi, 0x1012f88
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x108a0d5
mov esi, 0x1012f88
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax + 0x218]
push eax
mov dword [ebx], ecx
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebx], 0
pop ecx
jne 0x108a092
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x108a0fd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x108a10a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebx + 8]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
push dword [ebx + 0x3c]
call esi
push ebx
call esi
mov eax, dword [ebp - 0x23c]
add esp, 0xc
and dword [eax], 0
jmp 0x108a630
cmp ebx, edi
je 0x108a630
mov eax, dword [ebx + 0x40]
cmp eax, edi
je 0x108a630
cmp dword [ebx + 0x18], edi
jne 0x108a16e
mov ecx, dword [eax]
xor edx, edx
mov dl, byte [ebx + 0x1c]
push edi
xor esi, esi
inc esi
push esi
push edx
push edi
push eax
call dword [ecx + 0x18]
cmp eax, edi
jl 0x108a18a
mov eax, dword [ebx + 0x40]
mov ecx, dword [eax]
lea edx, [ebx + 0x44]
push edx
push eax
call dword [ecx + 0x34]
mov dword [ebx + 0x18], esi
jmp 0x108a182
lea edx, [ebx + 0x44]
push edx
mov dword [ebx + 0x14], 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x8c]
cmp eax, edi
jge 0x108a630
mov dword [ebx + 0x30], eax
jmp 0x108a630
cmp esi, edi
mov dword [ebp - 0x238], edi
je 0x108a630
mov al, byte [esi + 0x30]
cmp al, 6
jne 0x108a1f2
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x1010890
mov dword [ebp - 0x248], esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x240]
push eax
push 1
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x240]
push dword [eax + 0x14]
call fcn.01084401
mov esi, dword [ebp - 0x240]
cmp esi, edi
je 0x108a630
jmp 0x108a20b
cmp ecx, edi
je 0x108a203
test byte [ecx + 0x9f], 4
je 0x108a630
cmp al, 1
jne 0x108a630
cmp word [reloc.ADVAPI32.dll_RegDeleteValueW], di
je 0x108a630
cmp word [reloc.ADVAPI32.dll_RegDeleteValueW], di
je 0x108a630
test byte [esi + 0x60], 0x84
jne 0x108a630
mov eax, dword [esi + 0x34]
cmp word [eax + 2], 0x3a
jne 0x108a630
call fcn.01089258
cmp ebx, edi
jne 0x108a30f
push 1
push 0x58
call dword [sym.imp.msvcrt.dll_calloc]
mov ebx, eax
cmp ebx, edi
pop ecx
pop ecx
je 0x1089e2c
cmp dword [ebp - 0x248], edi
mov eax, dword [ebp - 0x23c]
mov dword [eax], ebx
je 0x108a274
mov byte [ebx + 0x1c], 1
lea esi, [ebx + 0x40]
push esi
mov dword [ebp - 0x244], esi
call fcn.010cb46c
cmp eax, edi
mov dword [ebp - 0x230], eax
jl 0x108a357
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
cmp eax, edi
mov dword [ebp - 0x230], eax
jl 0x108a357
mov eax, dword [esi]
cmp eax, edi
je 0x108a307
lea edx, [ebp - 0x234]
push edx
mov dword [ebp - 0x234], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
cmp eax, edi
mov dword [ebp - 0x230], eax
jl 0x108a357
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax]
push eax
call dword [ecx + reloc.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x234]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x230], edi
jl 0x108a357
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebx + 0x2c]
push edx
push eax
call dword [ecx + reloc.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], edi
jl 0x108a357
lea esi, [ebx + 0x40]
mov eax, dword [esi]
cmp eax, edi
mov dword [ebp - 0x244], esi
je 0x108a36e
cmp dword [ebx + 0x10], edi
jne 0x108a36e
mov ecx, dword [eax]
lea edx, [ebx + 0x48]
push edx
push eax
call dword [ecx + 0x84]
cmp eax, 0x80042301
mov dword [ebp - 0x230], eax
jne 0x108a346
mov ax, 0xfe41
jmp 0x108a633
cmp dword [ebp - 0x230], edi
jl 0x108a357
mov dword [ebx + 0x10], 1
jmp 0x108a36e
mov eax, dword [ebp - 0x230]
mov dword [ebx + 0x30], eax
mov eax, dword [esi]
cmp eax, edi
je 0x108a36c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], edi
mov esi, dword [ebp - 0x240]
mov eax, dword [esi + 0x5c]
mov eax, dword [eax + 0x54]
cmp eax, edi
mov dword [ebp - 0x230], eax
jne 0x108a39b
call fcn.01089258
mov eax, dword [ebp - 0x240]
mov eax, dword [eax + 0x5c]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x248], edi
je 0x108a3a7
mov byte [ebx + 0x1c], 1
cmp eax, edi
je 0x108a5dd
mov ecx, dword [ebp - 0x230]
add ecx, 4
je 0x108a432
mov eax, dword [ebp - 0x244]
mov eax, dword [eax]
test eax, eax
je 0x108a432
cmp dword [ebx], 0
jne 0x108a432
and dword [ebp - 0x234], 0
mov edx, dword [eax]
lea esi, [ebp - 0x234]
push esi
push ecx
sub esp, 0x10
mov edi, esp
mov esi, 0x1012f88
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [edx + 0xa8]
cmp byte [ebx + 0x1c], 1
mov edi, eax
je 0x108a432
test edi, edi
jl 0x108a406
cmp dword [ebp - 0x234], 0
jne 0x108a432
mov eax, dword [ebp - 0x240]
call fcn.01089294
mov esi, dword [ebp - 0x244]
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x23c]
and dword [esi], 0
mov dword [ebx + 0x30], edi
mov dword [eax], ebx
jmp 0x108a630
mov edi, dword [ebp - 0x230]
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x108a5c9
cmp eax, 2
je 0x108a5c9
mov esi, dword [ebx]
test esi, esi
je 0x108a48c
mov eax, dword [esi + 0x214]
test eax, eax
je 0x108a478
add eax, 4
push eax
lea eax, [edi + 4]
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x108a482
mov esi, dword [esi + 0x218]
test esi, esi
jne 0x108a45a
test esi, esi
je 0x108a48c
mov dword [ebp - 0x238], esi
push 1
push 0x220
call dword [sym.imp.msvcrt.dll_calloc]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x234], eax
je 0x1089e2c
cmp dword [ebp - 0x238], 0
jne 0x108a569
mov eax, dword [ebp - 0x244]
mov eax, dword [eax]
test eax, eax
je 0x108a58e
and dword [ebp - 0x23c], 0
mov edx, dword [eax]
lea ecx, [ebp - 0x23c]
push ecx
mov ecx, dword [ebp - 0x230]
add ecx, 4
push ecx
sub esp, 0x10
mov edi, esp
mov esi, 0x1012f88
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [edx + 0xa8]
cmp byte [ebx + 0x1c], 1
je 0x108a508
test eax, eax
jl 0x108a556
cmp dword [ebp - 0x23c], 0
je 0x108a556
mov ecx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x244]
mov eax, dword [eax]
mov edx, dword [eax]
add ecx, 0x200
push ecx
mov ecx, dword [ebp - 0x230]
sub esp, 0x10
mov edi, esp
mov esi, 0x1012f88
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add ecx, 4
push ecx
push eax
movsd dword es:[edi], dword [esi]
call dword [edx + 0x88]
test eax, eax
jge 0x108a58e
cmp eax, 0x80042308
jne 0x108a564
push dword [ebp - 0x234]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp - 0x230]
mov eax, dword [eax + 0x404]
jmp 0x108a5cf
mov dword [ebx + 0x30], eax
jmp 0x108a58e
mov eax, dword [ebp - 0x234]
mov esi, dword [ebp - 0x238]
add esi, 0x200
lea edi, [eax + 0x200]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [eax + reloc.ADVAPI32.dll_RegDeleteValueW], 1
mov ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x234]
mov dword [eax + 0x210], ecx
mov ecx, dword [ebp - 0x230]
mov dword [eax + 0x214], ecx
cmp dword [ebx], 0
jne 0x108a5b5
mov dword [ebx], eax
jmp 0x108a5be
mov edx, dword [ebx + 4]
mov dword [edx + 0x218], eax
mov dword [ebx + 4], eax
mov eax, dword [ecx + 0x404]
jmp 0x108a5cf
mov eax, dword [edi + 0x404]
test eax, eax
mov dword [ebp - 0x230], eax
jne 0x108a432
xor edi, edi
cmp dword [ebx + 4], edi
je 0x108a617
mov esi, dword [ebp - 0x248]
cmp esi, edi
je 0x108a617
push 1
push 0x220
call dword [sym.imp.msvcrt.dll_calloc]
cmp eax, edi
pop ecx
pop ecx
je 0x1089e2c
mov dword [eax + 0x210], esi
mov ecx, dword [ebx + 4]
mov dword [ecx + 0x218], eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0x30], edi
jge 0x108a630
mov esi, dword [ebp - 0x244]
mov eax, dword [esi]
cmp eax, edi
je 0x108a62e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], edi
xor ax, ax
mov ecx, dword [ebp - 4]
call fcn.01075aef
pop edi
pop esi
pop ebx
leave
ret 0x10