Function at 0x1000a970
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa9c
mov eax, dword [0x1009cbc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xe
mov ebx, ecx
mov esi, edx
push str.DeviceSerial
push ebx
mov dword [ebp - 0xa98], esi
call fcn.1005385b
add esp, 0xc
test eax, eax
je 0x1000ab60
push 0xe
push str.DeviceUsbSer
push ebx
call fcn.1005385b
add esp, 0xc
test eax, eax
je 0x1000ab60
push 0x19
push str.DeviceLanmanRedirector_
push ebx
call fcn.1005385b
add esp, 0xc
test eax, eax
jne 0x1000aa07
push 0x100879ec
push 0x104
push esi
call fcn.10053320
lea eax, [ebx + 0x32]
push eax
push 0x104
push esi
call fcn.10051f45
add esp, 0x18
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
push 0xc
push str.DeviceMup_
push ebx
call fcn.1005385b
add esp, 0xc
test eax, eax
jne 0x1000aa30
push 0x100879ec
push 0x104
push esi
call fcn.10053320
lea eax, [ebx + 0x18]
jmp 0x1000a9e6
lea eax, [ebp - 0x2c0]
push eax
push 0x12c
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x1000aa5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
cmp word [ebp - 0x2c0], 0
push edi
lea edi, [ebp - 0x2c0]
je 0x1000aafc
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000aa76
sub ecx, edx
sar ecx, 1
push 0x3e8
lea eax, [ecx + 1]
lea eax, [edi + eax*2]
mov dword [ebp - 0xa94], eax
xor eax, eax
mov word [edi + 4], ax
mov word [ebp - 0xa90], ax
lea eax, [ebp - 0xa90]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1000ab49
lea esi, [ebp - 0xa90]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1000aac2
sub esi, ecx
sar esi, 1
test esi, esi
jle 0x1000aaea
push esi
lea eax, [ebp - 0xa90]
push eax
push ebx
call fcn.1005385b
add esp, 0xc
test eax, eax
je 0x1000ab12
mov eax, dword [ebp - 0xa94]
mov edi, eax
cmp word [eax], 0
jne 0x1000aa71
mov eax, 0xa1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp - 0xa98]
push 0x104
push edi
call fcn.10053320
lea eax, [ebx + esi*2]
push eax
push 0x104
push edi
call fcn.10051f45
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xa94]
push eax
push 0x101
push 0
push str.HardwareDeviceMapSerialComm
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000ab02
lea eax, [ebp - 0xa98]
mov dword [ebp - 0xa98], 0x64
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xa9c]
push eax
push 0
push ebx
push dword [ebp - 0xa94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1000abd2
push dword [ebp - 0xa94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 0x704
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x68]
push eax
push 0x104
push esi
call fcn.10053320
add esp, 0xc
push dword [ebp - 0xa94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1005132c
mov esp, ebp
pop ebp
ret