Function at 0x6f24ad90
Capabilities:
Get disk information
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x13c
mov dword [esp + 0x2c], 0
test byte [0x6f266160], 8
jne 0x6f249808
test esi, esi
je 0x6f249840
test ebx, 0xc8fc
je 0x6f249740
test byte [0x6f266160], 1
jne 0x6f2498f0
xor edi, edi
mov word [esp + 0x30], di
test bh, 0x20
je 0x6f249780
mov eax, ebx
mov ecx, dword [esi + 8]
and eax, 0x1000
je 0x6f249858
lea eax, [ecx - 0x201]
cmp ax, 0xa
jbe 0x6f249930
add esp, 0x13c
mov edi, 0x10e
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
test bh, 2
je 0x6f249990
test byte [0x6f266160], 8
jne 0x6f2499b0
test bh, 8
jne 0x6f2498d0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x6f249840
cmp word [esp + 0x30], 0
je 0x6f249ad0
test bh, 4
je 0x6f2497cf
test byte [0x6f266160], 8
jne 0x6f249a58
mov eax, dword [esi + 0x10]
test eax, eax
je 0x6f249840
lea edx, [esp + 0x2c]
lea eax, [esp + 0x30]
call fcn.6f2491c0
mov edi, eax
test eax, eax
je 0x6f2499f0
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x6f249845
mov eax, ebp
call fcn.6f248a50
add esp, 0x13c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__08lX___p__n
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
test esi, esi
jne 0x6f24972b
lea esi, [esi]
mov edi, 0x129
add esp, 0x13c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esp + 0x30]
test ecx, ecx
je 0x6f249840
movzx edx, word [ecx + eax]
mov word [ebp + eax], dx
add eax, 2
test dx, dx
jne 0x6f249860
mov dword [esp + 4], 0x21
mov edi, ebx
mov dword [esp], ebp
and edi, 0x200
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
je 0x6f249968
movzx edx, byte [0x6f266160]
test edi, edi
jne 0x6f249b98
xor ecx, ecx
mov edi, ebx
add eax, 2
mov word [eax - 2], cx
or edi, 0x200
and edx, 8
mov dword [esi + 0xc], eax
jne 0x6f249c11
and bh, 8
mov ebx, edi
je 0x6f2497aa
lea esi, [esi]
test byte [0x6f266160], 1
jne 0x6f249be8
mov edi, 0x103
jmp 0x6f249845
mov dword [esp + 0x10], ebx
xor edi, edi
mov dword [esp + 0xc], str.Unsupported_yet_dwFlags_08lX_n
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp], 0
call fcn.6f2486f0
mov word [esp + 0x30], di
test bh, 0x20
je 0x6f249780
jmp 0x6f24974c
mov eax, dword [0x6f27af44]
lea ebp, [esp + 0x30]
movzx ecx, cx
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 8], ebp
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
sub esp, 0x10
test eax, eax
je 0x6f24976c
mov edi, ebx
and edi, 0x200
test byte [0x6f266160], 8
jne 0x6f249a90
test edi, edi
jne 0x6f249796
cmp word [esp + 0x30], 0
jne 0x6f2497b6
lea esi, [esi]
test byte [0x6f266160], 1
jne 0x6f249b28
add esp, 0x13c
mov edi, 0x107
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0xc]
call fcn.6f248400
mov dword [esp + 0xc], str.lpstrElementName_s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
test bh, 8
je 0x6f24979f
jmp 0x6f2498d0
mov ebp, dword [esp + 0x2c]
mov ecx, ebx
mov edx, esi
mov eax, ebp
call fcn.6f249520
mov edi, eax
test eax, eax
jne 0x6f249b58
test byte [0x6f266160], 8
je 0x6f249845
mov dword [esp + 0x18], 0
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [ebp]
mov dword [esp + 0xc], str.wDevID_04X_wDeviceID_d_dwRet_ld_n
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.6f2486f0
jmp 0x6f249845
mov eax, dword [esi + 0x10]
call fcn.6f248400
mov dword [esp + 0xc], str.Alias_s___n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
jmp 0x6f2497c8
mov eax, ebp
call fcn.6f248400
mov dword [esp + 0xc], str.devType_s___n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
test edi, edi
je 0x6f24997d
jmp 0x6f249789
lea ebp, [esp + 0x30]
mov edx, ebp
call fcn.6f248740
test eax, eax
je 0x6f24997d
mov eax, dword [esi + 0xc]
mov edi, 0x119
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
sub esp, 4
cmp eax, 5
jne 0x6f249845
xor eax, eax
lea esi, [esi]
movzx edx, word [eax + str.CDAUDIO]
mov word [ebp + eax], dx
add eax, 2
test dx, dx
jne 0x6f249b08
jmp 0x6f24997d
mov dword [esp + 0xc], str.Couldnt_load_driver_n
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp], 0
call fcn.6f2486f0
jmp 0x6f24999d
test byte [0x6f266160], 8
je 0x6f2497ea
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_open_driver__MCI_OPEN_DRIVER____08lx___closing_n
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
jmp 0x6f2497ea
and edx, 2
je 0x6f2498dd
mov eax, ebp
call fcn.6f248400
mov ebx, eax
mov eax, dword [esi + 0xc]
call fcn.6f248400
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Both_MCI_OPEN_ELEMENT__s__and__s_are_used_n
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp], 1
call fcn.6f2486f0
jmp 0x6f2498dd
mov dword [esp + 0xc], str.Unsupported_yet_flag_MCI_OPEN_ELEMENT_ID_n
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp], 0
call fcn.6f2486f0
jmp 0x6f2498dd
mov eax, ebp
mov ebx, edi
call fcn.6f248400
mov dword [esp + 0xc], str.devType_s___n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.MCI_Open
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
jmp 0x6f249789
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
lea eax, [edx - 0x803]
cmp ax, 0xf
ja case.0x6f24adb5.2
movzx eax, ax
jmp dword [eax*4 + 0x6f26a7f4]
cmp di, 0xffff
je 0x6f24af18
mov dword [esp + 0x30], esi
add esp, 0x20
mov ecx, ebx
mov eax, edi
pop ebx
movzx edx, dx
pop esi
pop edi
jmp fcn.6f249100
add esp, 0x20
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
jmp 0x6f249700
add esp, 0x20
mov ecx, esi
mov edx, ebx
mov eax, edi
pop ebx
pop esi
pop edi
jmp fcn.6f249c50
add esp, 0x20
mov ecx, esi
mov edx, ebx
mov eax, edi
pop ebx
pop esi
pop edi
jmp fcn.6f249e80
test esi, esi
je 0x6f24afe0
test byte [0x6f266160], 8
jne 0x6f24afa0
mov dword [esp], esi
mov ecx, ebx
mov edx, 0x811
mov eax, edi
call fcn.6f249100
test eax, eax
jne 0x6f24ae51
and ebx, 1
jne 0x6f24aea0
xor eax, eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
test bh, 1
je 0x6f24aed8
test esi, esi
je 0x6f24afe0
xor eax, eax
test bl, 2
mov dword [esp + 4], 0
sete al
add eax, 0x10000
mov dword [esp + 8], eax
mov eax, dword [esi + 4]
mov dword [esp], eax
call sym.winmm.dll_PlaySoundW
sub esp, 0xc
test eax, eax
jne 0x6f24ae4a
mov eax, 0x106
jmp 0x6f24ae51
mov ebx, dword [esi]
test byte [0x6f266160], 8
jne 0x6f24af60
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x3b9
mov dword [esp], ebx
call dword [sym.imp.user32.dll_PostMessageW]
sub esp, 0x10
jmp 0x6f24ae4f
xor eax, eax
test bl, 2
mov dword [esp + 4], 0
sete al
mov dword [esp], 0x4453
add eax, 0x110000
mov dword [esp + 8], eax
call sym.winmm.dll_PlaySoundW
sub esp, 0xc
test eax, eax
je 0x6f24ae98
test esi, esi
je 0x6f24ae4f
jmp 0x6f24ae4a
test byte [0x6f266160], 1
jne 0x6f24af30
mov eax, 0x117
jmp 0x6f24ae51
mov dword [esp + 0xc], str.unhandled_MCI_ALL_DEVICE_ID_n
mov dword [esp + 8], str.MCI_SendCommand
mov dword [esp + 4], 0x6f266160
mov dword [esp], 0
call fcn.6f2486f0
jmp 0x6f24af21
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p___04x___04X__n
mov dword [esp + 8], str.mciDriverNotify
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
jmp 0x6f24aeaf
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.__08x___08lX__vkey__04X__hwnd__p__n
mov dword [esp + 0x18], eax
mov dword [esp + 8], str.MCI_Break
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
call fcn.6f2486f0
jmp 0x6f24ae35
mov eax, 0x129
jmp 0x6f24ae51