Function at 0x10010bd34
Capabilities:
Get disk size
Get memory capacity
Query environment variable
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5a8
mov rax, qword [0x100152198]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov rbp, r9
mov qword [rsp + 0x60], r9
mov r12, r8
mov qword [rsp + 0x68], r8
mov ebx, edx
mov rsi, rcx
call fcn.10010c6f0
xor r14d, r14d
cmp eax, r14d
je 0x10010be9e
mov rax, qword [0x100158bb0]
mov qword [rsp + 0x58], rax
mov rdi, rax
cmp rax, r14
jne 0x10010be65
cmp qword [0x100158ba0], r14
je 0x10010be9e
mov rax, qword [0x100158ba8]
cmp rax, r14
je 0x10010be9e
lea rdx, [0x10002ef68]
lea rcx, [rsp + 0xb0]
call rax
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x58]
mov edx, 0x100001
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], r14
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], r14
mov dword [rsp + 0x20], 7
call qword [0x100158ba0]
cmp eax, r14d
jl 0x10010be9e
mov rcx, qword [rsp + 0x58]
xor eax, eax
lock cmpxchg qword [0x100158bb0], rcx
mov rdi, rax
je 0x10010be60
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], rdi
jmp 0x10010be65
mov rdi, qword [rsp + 0x58]
mov eax, dword [rbp]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov r9d, ebx
mov r8, rsi
mov edx, 0x390008
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r14d
je 0x10010be9e
mov eax, 1
jmp 0x10010c6c3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, 0xe04
xor edx, edx
mov rcx, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
cmp rax, r14
jne 0x10010bec6
xor eax, eax
jmp 0x10010c6c3
mov rcx, rdi
cmp ebx, ecx
ja 0x10010c537
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea r11d, [rbx + 8]
mov r13d, 0xfffffff8
and r11d, r13d
mov rax, rdi
cmp r11d, eax
jbe 0x10010befc
mov edi, r14d
jmp 0x10010c537
mov ebx, r11d
sub edi, r11d
add rbx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx], eax
cmp edi, 8
jb 0x10010bef4
add edi, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 8], eax
cmp edi, 8
jb 0x10010bef4
add edi, r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x10], eax
cmp edi, 8
jb 0x10010bef4
add edi, r13d
add rbx, 0x18
cmp edi, 0x10
jb 0x10010c537
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, 0x18
cmp edi, esi
jb 0x10010bef4
add edi, 0xffffffe8
add rbx, rsi
cmp edi, 8
jb 0x10010c537
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp edi, 0x10
jb 0x10010bef4
add edi, 0xfffffff0
cmp edi, 0x38
jb 0x10010c537
lea rcx, [rbx + 0x10]
mov dword [rbx + 0x10], 0x38
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp edi, 0x40
jb 0x10010bef4
add edi, 0xffffffc0
add rbx, 0x50
cmp edi, 0x10
jb 0x10010c537
lea rax, [rbx + 0xc]
lea r9, [rbx + 8]
lea r8, [rbx + 4]
mov rdx, rbx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp edi, esi
jb 0x10010bef4
add rbx, rsi
add edi, 0xffffffe8
cmp dword [0x100155cbc], r14d
jne 0x10010c0bf
mov r13d, r14d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rsi, rax
cmp rax, r14
jne 0x10010c009
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov r13d, 1
mov rsi, rax
cmp rax, r14
je 0x10010c0aa
lea rcx, [rsp + 0xd0]
call fcn.1001201fc
mov r12, rsi
mov ebp, r14d
mov eax, ebp
test r13d, r13d
jne 0x10010c037
lea r12, [r12 + rax + 2]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
add ebp, ebp
jmp 0x10010c047
lea r12, [r12 + rax + 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
lea r8, [rsp + 0xd0]
mov edx, ebp
mov rcx, r12
call fcn.100120240
test ebp, ebp
jne 0x10010c01c
lea rdx, [rsp + 0x12c]
lea rcx, [rsp + 0xd0]
call fcn.1001204e4
lea rcx, [0x100155f58]
lea rdx, [rsp + 0x12c]
lea r8d, [rbp + 0x14]
call sub.msvcrt.dll_memcpy
mov rcx, rsi
cmp r13d, r14d
jne 0x10010c09a
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x10010c0a0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov dword [0x100155cbc], 1
mov esi, 0x18
mov r13d, 0xfffffff8
cmp edi, 0x14
jb 0x10010c537
mov rax, qword [0x100155f58]
mov qword [rbx], rax
mov rax, qword [0x100155f60]
mov qword [rbx + 8], rax
mov eax, dword [0x100155f68]
mov dword [rbx + 0x10], eax
cmp edi, esi
jb 0x10010bef4
add rbx, rsi
add edi, 0xffffffe8
call fcn.10010c6f0
cmp eax, r14d
je 0x10010c537
cmp edi, 0x40
jb 0x10010c537
mov rax, qword [0x100158b98]
cmp rax, r14
je 0x10010c537
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
lea ecx, [r9 + 5]
mov dword [rsp + 0x50], edi
call rax
cmp edi, 0x14
jb 0x10010c537
lea rcx, [rsp + 0x140]
call fcn.1001201fc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x140]
mov rcx, rbx
call fcn.100120240
lea rcx, [rsp + 0x140]
mov rdx, rbx
call fcn.1001204e4
cmp edi, esi
jb 0x10010bef4
add edi, 0xffffffe8
add rbx, rsi
cmp edi, 0x30
jb 0x10010c537
mov r8d, 0x30
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 - 0x2d]
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c1b5
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010bef4
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, esi
jb 0x10010c537
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, rbx
mov ecx, 7
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c1f1
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010bef4
mov eax, ecx
add rbx, rax
sub edi, ecx
mov r8d, 0xa8
cmp edi, r8d
jb 0x10010c537
lea r9, [rsp + 0x50]
lea ecx, [r8 - 0x58]
mov rdx, rbx
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c230
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010bef4
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, 0x40
jb 0x10010c537
mov r8d, 0x40
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 - 0x2b]
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c26f
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010bef4
mov eax, ecx
add rbx, rax
sub edi, ecx
mov r8d, 0x148
cmp edi, r8d
jb 0x10010c537
lea r9, [rsp + 0x50]
mov rdx, rbx
mov ecx, 2
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c2af
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010bef4
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, 0x10
jb 0x10010c537
mov r8d, 0x10
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 + 0x11]
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c2ee
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010bef4
mov eax, ecx
add rbx, rax
sub edi, ecx
cmp edi, 0x20
jb 0x10010c537
mov r8d, 0x20
lea r9, [rsp + 0x50]
mov rdx, rbx
lea ecx, [r8 + 0xd]
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c32d
mov ecx, dword [rsp + 0x50]
add ecx, 8
and ecx, r13d
cmp ecx, edi
ja 0x10010bef4
mov eax, ecx
add rbx, rax
sub edi, ecx
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 8
mov dword [rsp + 0x50], edi
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c39c
cmp edi, 0x14
jb 0x10010c537
lea rcx, [rsp + 0x290]
call fcn.1001201fc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x290]
mov rcx, rbx
call fcn.100120240
lea rcx, [rsp + 0x290]
mov rdx, rbx
call fcn.1001204e4
cmp edi, esi
jb 0x10010bef4
mov r13d, 0xffffffe8
add rbx, rsi
add edi, r13d
jmp 0x10010c3a2
mov r13d, 0xffffffe8
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x3d
mov dword [rsp + 0x50], edi
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c409
cmp edi, 0x14
jb 0x10010c537
lea rcx, [rsp + 0x1b0]
call fcn.1001201fc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x1b0]
mov rcx, rbx
call fcn.100120240
lea rcx, [rsp + 0x1b0]
mov rdx, rbx
call fcn.1001204e4
cmp edi, esi
jb 0x10010bef4
add rbx, rsi
add edi, r13d
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x12
mov dword [rsp + 0x50], edi
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c470
cmp edi, 0x14
jb 0x10010c537
lea rcx, [rsp + 0x220]
call fcn.1001201fc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x220]
mov rcx, rbx
call fcn.100120240
lea rcx, [rsp + 0x220]
mov rdx, rbx
call fcn.1001204e4
cmp edi, esi
jb 0x10010bef4
add rbx, rsi
add edi, r13d
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x17
mov dword [rsp + 0x50], edi
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c4d7
cmp edi, 0x14
jb 0x10010c537
lea rcx, [rsp + 0x300]
call fcn.1001201fc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x300]
mov rcx, rbx
call fcn.100120240
lea rcx, [rsp + 0x300]
mov rdx, rbx
call fcn.1001204e4
cmp edi, esi
jb 0x10010bef4
add rbx, rsi
add edi, r13d
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov ecx, 0x2a
mov dword [rsp + 0x50], edi
call qword [0x100158b98]
cmp eax, r14d
jl 0x10010c537
cmp edi, 0x14
jb 0x10010c537
lea rcx, [rsp + 0x370]
call fcn.1001201fc
mov edx, dword [rsp + 0x50]
lea r8, [rsp + 0x370]
mov rcx, rbx
call fcn.100120240
lea rcx, [rsp + 0x370]
mov rdx, rbx
call fcn.1001204e4
cmp edi, esi
jb 0x10010bef4
add edi, r13d
mov esi, 0x50
lea rcx, [rsp + 0x4f0]
lea rdx, [0x100156240]
mov r8, rsi
call sub.msvcrt.dll_memcpy
lea r8, [rsp + 0x4f0]
lea rcx, [rsp + 0x3e0]
mov edx, esi
call fcn.10011ff50
mov eax, 0xe04
lea r8, [rsp + 0x4f0]
mov edx, eax
mov rcx, r15
sub edx, edi
cmp edx, eax
cmova edx, eax
call fcn.10010c90c
lea rcx, [rsp + 0x540]
lea rdx, [rsp + 0x4f0]
mov r8, rsi
mov ebx, eax
call sub.msvcrt.dll_memcpy
lea rcx, [0x100156240]
lea rdx, [rsp + 0x4f0]
mov r8, rsi
call sub.msvcrt.dll_memcpy
lea r8, [rsp + 0x540]
lea rcx, [rsp + 0x3e0]
mov edx, esi
call fcn.1001201a0
lea rdx, [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
lea rdx, [0x10002eff0]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_RegCreateKeyExA]
cmp eax, r14d
jne 0x10010c64a
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x540]
lea r9d, [rsi - 0x4d]
lea rdx, [0x10002efe8]
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea rdi, [rsp + 0x540]
mov rcx, rsi
rep stosb byte [rdi], al
lea r8, [rsp + 0x4f0]
lea rcx, [rsp + 0x3e0]
mov edx, esi
call fcn.10011ff50
mov edx, dword [rbp]
xor eax, eax
lea rdi, [rsp + 0x4f0]
mov rcx, rsi
mov r8, r12
rep stosb byte [rdi], al
lea rcx, [rsp + 0x3e0]
call fcn.1001201a0
xor eax, eax
lea rdi, [rsp + 0x3e0]
mov ecx, 0x108
rep stosb byte [rdi], al
mov rdi, r15
mov ecx, 0xe04
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.10011be80
add rsp, 0x5a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret