Function at 0x104d4d0
Capabilities:
Get disk information
Get hostname
Query or enumerate registry value

Disassembly:
sub esp, 0x1b8
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x1b4], eax
push ebx
push ebx
call 0x104d4eb
jmp 0x104d4f0
pushal
call 0x104d4f6
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
xor ebx, ebx
push 0x7f
lea eax, [esp + 0xfd]
push ebx
push eax
mov byte [esp + 0x104], bl
call fcn.0109a300
add esp, 0xc
push ebx
call 0x104d525
jmp 0x104d52a
pushal
call 0x104d530
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104d543
jmp 0x104d548
pushal
call 0x104d54e
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push 0x63
lea ecx, [esp + 0x99]
push ebx
push ecx
mov byte [esp + 0xa0], bl
call fcn.0109a300
push 0x63
lea edx, [esp + 0x41]
push ebx
push edx
mov byte [esp + 0x48], bl
call fcn.0109a300
add esp, 0x18
push ebx
call 0x104d58c
jmp 0x104d591
pushal
call 0x104d597
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104d5aa
jmp 0x104d5af
pushal
call 0x104d5b5
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push 0x64
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x64
lea ecx, [esp + 0xac]
push ecx
push 0x10ec184
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push ebx
call 0x104d5f3
jmp 0x104d5f8
pushal
call 0x104d5fe
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x104d615
sub eax, edx
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + eax + 0xfc]
push 0x10dbc30
push eax
call fcn.01094420
add esp, 0xc
push ebx
call 0x104d63e
jmp 0x104d643
pushal
call 0x104d649
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104d65c
jmp 0x104d661
pushal
call 0x104d667
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov dword [esp + 8], 0x10
push ebx
call 0x104d682
jmp 0x104d687
pushal
call 0x104d68d
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x104d6f9
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x104d6b8
lea ecx, [esp + 0x20]
push ecx
sub eax, edx
lea edx, [esp + eax + 0xfc]
push 0x10ec188
push edx
call fcn.01094420
add esp, 0xc
push ebx
call 0x104d6e1
jmp 0x104d6e6
pushal
call 0x104d6ec
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104d6ff
jmp 0x104d704
pushal
call 0x104d70a
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 4]
push eax
push 1
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
call 0x104d735
jmp 0x104d73a
pushal
call 0x104d740
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
cmp eax, ebx
jne 0x104d895
mov dword [esp + 0x18], 1
push ebx
call 0x104d763
jmp 0x104d768
pushal
call 0x104d76e
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push 0x3f
lea ecx, [esp + 0x17d]
push ebx
push ecx
mov byte [esp + 0x184], bl
call fcn.0109a300
add esp, 0xc
push ebx
call 0x104d79b
jmp 0x104d7a0
pushal
call 0x104d7a6
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov dword [esp + 0x1c], 0x40
push ebx
call 0x104d7c1
jmp 0x104d7c6
pushal
call 0x104d7cc
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
push str.ProductId
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
call 0x104d802
jmp 0x104d807
pushal
call 0x104d80d
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
cmp eax, ebx
jne 0x104d86c
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x104d828
lea ecx, [esp + 0x178]
push ecx
sub eax, edx
lea edx, [esp + eax + 0xfc]
push 0x10ec188
push edx
call fcn.01094420
add esp, 0xc
push ebx
call 0x104d854
jmp 0x104d859
pushal
call 0x104d85f
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call 0x104d87d
jmp 0x104d882
pushal
call 0x104d888
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x104d8a0
sub eax, edx
cmp eax, 0x32
jae 0x104d8dd
lea ecx, [esp + 0xf8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call 0x104d8c3
jmp 0x104d8c8
pushal
call 0x104d8ce
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
jmp 0x104d92f
push 0x31
lea edx, [esp + 0xfc]
push edx
push esi
call fcn.01095f70
add esp, 0xc
push ebx
call 0x104d8f6
jmp 0x104d8fb
pushal
call 0x104d901
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov byte [esi + 0x31], bl
push ebx
call 0x104d917
jmp 0x104d91c
pushal
call 0x104d922
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104d935
jmp 0x104d93a
pushal
call 0x104d940
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov ecx, dword [esp + 0x1b8]
pop ebx
xor ecx, esp
call fcn.01090090
add esp, 0x1b8
ret