Function at 0x4c49f0
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1170
call fcn.004f18a0
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xa
xor edi, edi
push edi
mov dword [ebp - 0x1134], ecx
push edi
lea ecx, [ebp - 0x10e4]
push ecx
mov dword [ebp - 0x1144], eax
mov dword [ebp - 0x10e4], 0x4d36e967
mov dword [ebp - 0x10e0], 0x11cee325
mov dword [ebp - 0x10dc], 0x8c1bf
mov dword [ebp - 0x10d8], 0x1803e12b
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov ebx, eax
mov dword [ebp - 0x114c], ebx
cmp ebx, edi
je 0x4c4e2c
xor eax, eax
lea edx, [ebp - 0x1118]
push edx
push edi
push ebx
mov dword [ebp - 0x1114], eax
mov dword [ebp - 0x1110], eax
mov dword [ebp - 0x110c], eax
mov dword [ebp - 0x1108], eax
mov dword [ebp - 0x1104], eax
mov dword [ebp - 0x1100], eax
mov dword [ebp - 0x1118], 0x1c
mov dword [ebp - 0x1124], edi
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x4c4e25
push 0xfe
lea ecx, [ebp - 0x142]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x144], ax
call fcn.004e7d90
mov esi, dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
add esp, 0xc
push edi
push 0x7f
lea edx, [ebp - 0x144]
push edx
push edi
push 0xc
lea eax, [ebp - 0x1118]
push eax
push ebx
call esi
test eax, eax
jne 0x4c4b06
push edi
push 0x7f
lea ecx, [ebp - 0x144]
push ecx
push edi
push edi
lea edx, [ebp - 0x1118]
push edx
push ebx
call esi
push 0x1fe
lea ecx, [ebp - 0x10d2]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x10d4], ax
call fcn.004e7d90
add esp, 0xc
push edi
push pe_nt_image_headers32
lea edx, [ebp - 0x10d4]
push edx
lea eax, [ebp - 0x1118]
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
jne 0x4c4b4e
inc dword [ebp - 0x1124]
jmp 0x4c4e08
push 0x7e
lea edx, [ebp - 0x1c2]
xor ecx, ecx
push edi
push edx
mov word [ebp - 0x1c4], cx
call fcn.004e7d90
lea eax, [ebp - 0x10d4]
push eax
lea ecx, [ebp - 0x1c4]
push ecx
lea ecx, [ebp - 0x1128]
mov dword [ebp - 0x1128], edi
call fcn.004c47c0
add esp, 0x14
xor ebx, ebx
test eax, eax
je 0x4c4e3d
lea edi, [ebp - 0x1c4]
mov edx, edi
push 9
push edx
mov dword [ebp - 0x116c], ebx
mov dword [ebp - 0x1168], ebx
mov dword [ebp - 0x1154], ebx
mov dword [ebp - 0x1150], ebx
mov dword [ebp - 0x115c], ebx
mov dword [ebp - 0x1164], ebx
mov dword [ebp - 0x1160], ebx
call fcn.004e46a9
mov esi, eax
add esp, 8
test esi, esi
je 0x4c4c43
mov ecx, esi
sub ecx, edi
sar ecx, 1
add ecx, ecx
xor eax, eax
push ecx
lea edx, [ebp - 0x20]
push edi
push edx
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
call fcn.004eaf30
add esp, 0xc
lea eax, [ebp - 0x1164]
push eax
lea ecx, [ebp - 0x1154]
push ecx
lea edx, [ebp - 0x116c]
push edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, dword [ebp - 0x1154]
add dword [ebp - 0x115c], ecx
lea edi, [esi + 2]
push 9
adc ebx, dword [ebp - 0x1150]
push edi
call fcn.004e46a9
mov esi, eax
add esp, 8
test esi, esi
jne 0x4c4bd5
mov eax, dword [ebp - 0x115c]
mov ecx, eax
or ecx, ebx
je 0x4c4dfa
shl ebx, 0x16
shr eax, 0xa
add ebx, eax
xor eax, eax
ja 0x4c4d11
jb 0x4c4c71
cmp ebx, 0x800
jae 0x4c4d11
push eax
push ebx
lea edx, [ebp - 0xccc]
push 0x527730
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xccc]
add esp, 0x10
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c4c91
mov ecx, dword [0x5287a8]
mov dx, word [0x5287ac]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [ebp - 0x144]
mov edx, eax
jmp 0x4c4cc0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c4cc0
lea edi, [ebp - 0xccc]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4c4cd6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xccc]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x4c4d00
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c4d00
jmp 0x4c4db1
shrd ebx, eax, 0xa
shr eax, 0xa
push eax
push ebx
lea eax, [ebp - 0xccc]
push 0x527740
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xccc]
add esp, 0x10
add eax, 0xfffffffe
jmp 0x4c4d40
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c4d40
mov ecx, dword [0x5287a8]
mov dx, word [0x5287ac]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [ebp - 0x144]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c4d67
lea edi, [ebp - 0xccc]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4c4d80
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xccc]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c4da5
mov ecx, dword [0x5287b0]
mov dx, word [0x5287b4]
mov dword [eax], ecx
mov word [eax + 4], dx
mov eax, dword [ebp - 0x1128]
cmp eax, 2
jne 0x4c4dd6
push 0xd5
jmp 0x4c4de0
cmp eax, 3
jne 0x4c4dfa
push 0xd8
mov esi, dword [ebp - 0x1134]
mov ebx, dword [ebp - 0x1144]
lea edi, [ebp - 0xccc]
call fcn.004c0b90
add esp, 4
inc dword [ebp - 0x1124]
mov ebx, dword [ebp - 0x114c]
xor edi, edi
mov edx, dword [ebp - 0x1124]
lea ecx, [ebp - 0x1118]
push ecx
push edx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x4c4ab1
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x112c]
push ecx
xor eax, eax
push 0x201
push edi
push str.SYSTEMCurrentControlSet_servicesDiskEnum
push reloc.WS2_32.dll_bind
mov word [ebp - 0x40], ax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov word [ebp - 0x22], ax
xor esi, esi
mov dword [ebp - 0x112c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c5129
xor edx, edx
push 0x206
push edx
lea ecx, [ebp - 0xed2]
push ecx
mov word [ebp - 0x10], dx
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov word [ebp - 0xed4], ax
call fcn.004e7d90
mov ecx, dword [ebp - 0x112c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea edx, [ebp - 0x111c]
push edx
lea eax, [ebp - 0x1128]
push eax
push esi
push esi
push str.Count
push ecx
mov dword [ebp - 0x1128], ebx
mov dword [ebp - 0x111c], 4
call edi
mov dword [ebp - 0x1120], ebx
cmp dword [ebp - 0x1128], ebx
jle 0x4c511a
xor eax, eax
push 0x208
push eax
lea edx, [ebp - 0xed4]
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call fcn.004e7d90
mov ecx, dword [ebp - 0x1120]
push 0xa
lea eax, [ebp - 0x10]
push eax
push ecx
call fcn.004e45ff
add esp, 0x18
lea edx, [ebp - 0x111c]
push edx
mov edx, dword [ebp - 0x112c]
lea eax, [ebp - 0xed4]
push eax
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
push edx
mov dword [ebp - 0x111c], 0x104
call edi
test eax, eax
jne 0x4c507d
push 0x206
push eax
lea ecx, [ebp - 0x4ca]
push ecx
mov word [ebp - 0x4cc], ax
call fcn.004e7d90
lea edx, [ebp - 0xed4]
push edx
lea eax, [ebp - 0x4cc]
push str.SYSTEMCurrentControlSetEnum_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [ebp - 0x1148]
push ecx
push 0x201
push 0
lea edx, [ebp - 0x4cc]
push edx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x1148], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c507d
push 0xfe
push eax
lea ecx, [ebp - 0x2c2]
push ecx
mov dword [ebp - 0x111c], 0x80
mov word [ebp - 0x2c4], ax
call fcn.004e7d90
mov ecx, dword [ebp - 0x1148]
add esp, 0xc
lea edx, [ebp - 0x111c]
push edx
lea eax, [ebp - 0x2c4]
push eax
push 0
push 0
push str.FriendlyName
push ecx
call edi
lea eax, [ebp - 0x2c4]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c5010
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x2c4]
push edx
lea eax, [ebp - 0x144]
push eax
call fcn.004e4207
add esp, 0xc
test eax, eax
jne 0x4c5070
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x10fc]
mov dword [ebp - 0x10fc], eax
mov dword [ebp - 0x10f8], eax
mov dword [ebp - 0x10f4], eax
mov dword [ebp - 0x10f0], eax
mov dword [ebp - 0x10ec], eax
mov dword [ebp - 0x10e8], eax
call fcn.004c5500
test eax, eax
jne 0x4c509b
mov ecx, dword [ebp - 0x1148]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1120]
inc eax
mov dword [ebp - 0x1120], eax
cmp eax, dword [ebp - 0x1128]
jl 0x4c4ef8
jmp 0x4c511a
push 3
lea edx, [ebp - 0x490]
push 0x526880
push edx
call fcn.004e4207
add esp, 0xc
test eax, eax
je 0x4c50cf
push 7
lea eax, [ebp - 0x490]
push str.USBSTOR
push eax
call fcn.004e4207
add esp, 0xc
test eax, eax
jne 0x4c50e5
xor eax, eax
movzx ecx, word [eax + 0x526880]
mov word [ebp + eax - 0x40], cx
add eax, 2
test cx, cx
jne 0x4c50d1
mov eax, dword [ebp - 0x10e8]
mul dword [ebp - 0x10ec]
mov ecx, dword [ebp - 0x10f0]
push 0
push ecx
push edx
push eax
call fcn.004f1060
mov ecx, dword [ebp - 0x10f8]
push ecx
mov ecx, dword [ebp - 0x10fc]
push ecx
push edx
push eax
call fcn.004f1060
mov ebx, eax
mov esi, edx
mov edx, dword [ebp - 0x112c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov eax, ebx
or eax, esi
jne 0x4c5360
mov eax, dword [0x536cc8]
mov esi, dword [eax + 0x20]
cmp dword [eax + 0x18], edi
jbe 0x4c4dfa
test esi, esi
je 0x4c4dfa
xor ebx, ebx
cmp dword [eax + 0x2c], ebx
jle 0x4c4dfa
xor edi, edi
lea esp, [esp]
mov ecx, dword [esi + 0x14]
lea edx, [ebp - 0x1140]
push edx
add ecx, esi
mov dword [esi + 0x20], ecx
push 0x90
push esi
mov dword [ebp - 0x1140], edi
mov dword [ebp - 0x1138], edi
mov dword [ebp - 0x1130], edi
call dword [0x539384]
lea eax, [ebp - 0x1138]
push eax
push 0x80
push esi
call dword [0x539384]
lea ecx, [ebp - 0x1130]
push ecx
push 0xa0
push esi
call dword [0x539384]
add esp, 0x24
cmp dword [ebp - 0x1140], edi
jbe 0x4c5251
mov eax, dword [ebp - 0x1138]
cmp eax, edi
jbe 0x4c5251
cmp dword [ebp - 0x1130], edi
jbe 0x4c5251
push eax
lea edx, [ebp - 0x1120]
push edx
mov dword [ebp - 0x1120], edi
call dword [0x5393b0]
mov eax, dword [ebp - 0x1120]
push eax
push 0x80
push esi
call dword [0x539388]
lea eax, [ebp - 0x144]
add esp, 0x14
lea edx, [eax + 2]
jmp 0x4c5210
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4c5210
sub eax, edx
mov edx, dword [ebp - 0x1120]
sar eax, 1
push eax
lea ecx, [ebp - 0x144]
push ecx
push edx
call fcn.004e4207
add esp, 0xc
test eax, eax
je 0x4c5269
mov eax, dword [ebp - 0x1138]
push eax
lea ecx, [ebp - 0x1120]
push ecx
call dword [0x5393b8]
add esp, 8
mov edx, dword [0x536cc8]
add esi, dword [esi + 0x10]
inc ebx
cmp ebx, dword [edx + 0x2c]
jl 0x4c5160
jmp 0x4c4dfa
mov eax, dword [ebp - 0x1140]
push eax
lea ecx, [ebp - 0x111c]
push ecx
mov dword [ebp - 0x111c], edi
call dword [0x5393b0]
mov edx, dword [ebp - 0x111c]
push edx
push 0x90
push esi
call dword [0x539388]
mov eax, dword [ebp - 0x111c]
push 3
push 0x526880
push eax
call fcn.004e4207
add esp, 0x20
test eax, eax
je 0x4c52ca
mov ecx, dword [ebp - 0x111c]
push 7
push str.USBSTOR
push ecx
call fcn.004e4207
add esp, 0xc
test eax, eax
jne 0x4c52e4
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x526880]
mov word [ebp + eax - 0x40], cx
add eax, 2
cmp cx, di
jne 0x4c52d0
mov edx, dword [ebp - 0x1130]
push edx
lea eax, [ebp - 0x113c]
push eax
mov dword [ebp - 0x113c], edi
call dword [0x5393b0]
mov ecx, dword [ebp - 0x113c]
push ecx
push 0xa0
push esi
call dword [0x539388]
mov edx, dword [ebp - 0x113c]
push edx
call fcn.004e4435
mov ebx, eax
mov eax, dword [ebp - 0x1140]
push eax
lea ecx, [ebp - 0x111c]
push ecx
mov esi, edx
call dword [0x5393b8]
mov edx, dword [ebp - 0x1130]
push edx
lea eax, [ebp - 0x113c]
push eax
call dword [0x5393b8]
mov ecx, dword [ebp - 0x1138]
push ecx
lea edx, [ebp - 0x1120]
push edx
call dword [0x5393b8]
add esp, 0x30
cmp esi, edi
ja 0x4c5426
cmp ebx, edi
jbe 0x4c4dfa
xor edi, edi
cmp esi, edi
ja 0x4c5426
jb 0x4c5388
cmp ebx, 0x800
jae 0x4c5426
shrd ebx, esi, 0xa
shr esi, 0xa
push esi
push ebx
lea eax, [ebp - 0xccc]
push 0x527730
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xccc]
add esp, 0x10
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x4c53b0
mov ecx, dword [0x5287a8]
mov dx, word [0x5287ac]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [ebp - 0x144]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4c53d7
lea edi, [ebp - 0xccc]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4c53f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xccc]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c5415
jmp 0x4c54c1
shrd ebx, esi, 0x14
shr esi, 0x14
push esi
push ebx
lea eax, [ebp - 0xccc]
push 0x527740
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xccc]
add esp, 0x10
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x4c5450
mov ecx, dword [0x5287a8]
mov dx, word [0x5287ac]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [ebp - 0x144]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4c5477
lea edi, [ebp - 0xccc]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4c5490
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0xccc]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4c54b5
mov ecx, dword [0x5287b0]
mov dx, word [0x5287b4]
mov dword [eax], ecx
push 3
mov word [eax + 4], dx
lea eax, [ebp - 0x40]
push 0x526880
push eax
call fcn.004e4207
add esp, 0xc
test eax, eax
jne 0x4c4ddb
push 0xd5
jmp 0x4c4de0