Function at 0x8e320c
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0x8e3214
push ecx
push ebx
push esi
push edi
mov eax, 0x8e3174
nop
nop
nop
nop
nop
xor eax, eax
push ebp
push 0x8e3ec0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x8e6778]
add eax, 5
mov dword [0x8e76bc], eax
mov dword [0x8e76c0], 0xd
call fcn.008e14d8
cmp dword [0x8e667c], 0x407e7e21
jne 0x8e32d9
cmp dword [0x8e66e8], 0x33435243
jne 0x8e32d9
cmp dword [0x8e66f4], 0x7e7e4032
jne 0x8e32d9
cmp dword [0x8e66fc], 0x407e7e21
jne 0x8e32d9
cmp dword [0x8e6704], 0x33435243
jne 0x8e32d9
cmp dword [0x8e6710], 0x7e7e4032
jne 0x8e32d9
cmp dword [0x8e6774], 0x407e7e21
jne 0x8e32d9
cmp dword [0x8e6784], 0x33435243
jne 0x8e32d9
push 0x10
push 0
lea edx, [ebp - 0x10]
mov eax, 0x8e3ed8
call fcn.008e0e20
mov eax, dword [ebp - 0x10]
call fcn.008d47f4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x8e3e98
call fcn.008e0e60
mov eax, dword [0x8e67c4]
cmp eax, 0x7e7e4032
je 0x8e335a
cmp eax, dword [0x8e6778]
jne 0x8e3380
push 0x30
lea edx, [ebp - 0x14]
mov eax, 0x8e3ef4
call fcn.008e0e20
mov eax, dword [ebp - 0x14]
call fcn.008d47f4
push eax
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.008d3790
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.008d7e04
push dword [ebp - 0x1c]
push 0x8e3f08
lea edx, [ebp - 0x24]
mov eax, 0x8e3f14
call fcn.008e0e20
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.008d4700
mov eax, dword [ebp - 0x18]
call fcn.008d47f4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x8e3380
push 0x10
push 0
lea edx, [ebp - 0x28]
mov eax, 0x8e3ed8
call fcn.008e0e20
mov eax, dword [ebp - 0x28]
call fcn.008d47f4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x8e3e98
call fcn.008e12fc
mov eax, dword [0x8e66f8]
mov dword [0x8e769c], eax
mov eax, dword [0x8e76bc]
sub eax, 2
xor eax, dword [0x8e6778]
mov dword [0x8e76ac], eax
je 0x8e33c4
push dword [0x8e7af8]
call fcn.008e169c
lea ecx, [0x8e7af8]
cmp eax, dword [ecx]
jne 0x8e34af
call fcn.008e12fc
pop ecx
pop edx
push 0x8e7ad4
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [0x8e769c]
mov dword [0x8e76a0], eax
mov eax, dword [0x8e769c]
mov dword [0x8e7664], eax
call fcn.008e1120
call fcn.008ddf18
mov dword [0x8e76a8], eax
push dword [0x8e7664]
call fcn.008e0fe0
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e3496
mov bl, 0x43
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.008d458c
lea eax, [ebp - 0x2c]
mov edx, 0x8e3f34
call fcn.008d4648
mov eax, dword [ebp - 0x2c]
call fcn.008d47f4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x8e348c
mov eax, 0x8e7c10
xor ecx, ecx
mov edx, 0x400
call fcn.008d386c
mov byte [0x8e7c10], bl
push 0
push 0
push 0x8e76ac
push 0x8e76ac
push 0x8e7c11
push 0
push 0
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.008d458c
lea eax, [ebp - 0x30]
mov edx, 0x8e3f34
call fcn.008d4648
mov eax, dword [ebp - 0x30]
call fcn.008d47f4
push eax
call sub.kernel32.dll_GetVolumeInformationA
inc ebx
cmp bl, 0x5b
jne 0x8e340f
mov eax, dword [0x8e76bc]
mov dword [0x8e767c], eax
pop ecx
lea eax, [0x8e76a0]
cmp dword [eax], ecx
jne 0x8e33a2
mov eax, dword [0x8e677c]
call fcn.008e169c
mov dword [0x8e7668], eax
mov eax, dword [0x8e7668]
mov ecx, 1
mov edx, dword [0x8e6780]
call fcn.008dde8c
mov ebx, eax
lea edx, [ebp - 0x38]
mov eax, 0x8e3f40
call fcn.008e0e20
mov eax, dword [ebp - 0x38]
push eax
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.008d3790
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x34]
pop edx
call fcn.008d7cdc
mov edx, dword [ebp - 0x34]
mov eax, 0x8e76e8
call fcn.008d4438
mov dword [0x8e7680], ebx
mov eax, dword [0x8e76e8]
call fcn.008d7bac
test al, al
jne 0x8e35a5
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e35a5
lea eax, [ebp - 0x40]
call fcn.008d7eb0
mov edx, dword [ebp - 0x40]
mov eax, 0x8e8014
call fcn.008d4438
mov eax, dword [0x8e8014]
call fcn.008d4640
mov edx, dword [0x8e8014]
cmp byte [edx + eax - 1], 0x5c
je 0x8e3569
mov eax, 0x8e8014
mov edx, 0x8e3f50
call fcn.008d4648
lea edx, [ebp - 0x44]
mov eax, dword [0x8e76e8]
call fcn.008d7e04
mov ecx, dword [ebp - 0x44]
mov eax, 0x8e76e8
mov edx, dword [0x8e8014]
call fcn.008d468c
mov eax, dword [0x8e76e8]
call fcn.008d7bac
test al, al
jne 0x8e35a5
xor edx, edx
mov al, 1
call fcn.008e16f8
jmp 0x8e3e98
call fcn.008e12fc
mov dword [0x8e7684], ebx
mov eax, 0x8e76ec
xor ecx, ecx
mov edx, 0x3e8
call fcn.008d386c
mov eax, dword [0x8e76bc]
inc eax
mov dword [0x8e7688], eax
call fcn.008e1120
call fcn.008e2c44
test al, al
jne 0x8e35e8
xor edx, edx
mov al, 2
call fcn.008e16f8
jmp 0x8e3e98
xor eax, eax
mov dword [0x8e76b4], eax
call fcn.008d8878
call fcn.008d3834
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fstp qword [0x8e8018]
wait
fld qword [0x8e7a20]
call fcn.008d3834
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fstp qword [0x8e8020]
wait
fld qword [0x8e8020]
fcomp dword [0x8e3f54]
fnstsw ax
sahf
jne 0x8e364d
mov eax, dword [0x8e8018]
mov dword [0x8e8020], eax
mov eax, dword [0x8e801c]
mov dword [0x8e8024], eax
call fcn.008e14d8
fld qword [0x8e8020]
fcomp qword [0x8e8018]
fnstsw ax
sahf
ja 0x8e3693
mov eax, dword [0x8e8018]
mov dword [0x8e7a20], eax
mov eax, dword [0x8e801c]
mov dword [0x8e7a24], eax
mov dword [0x8e76c4], 0xffffffff
mov dword [0x8e76c8], 0xffffffff
xor ebx, ebx
jmp 0x8e36bb
mov eax, dword [0x8e7a20]
mov dword [0x8e8018], eax
mov eax, dword [0x8e7a24]
mov dword [0x8e801c], eax
xor eax, eax
mov dword [0x8e76c4], eax
xor eax, eax
mov dword [0x8e76c8], eax
mov bl, 1
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e3722
fld qword [0x8e76f0]
fcomp dword [0x8e3f54]
fnstsw ax
sahf
je 0x8e3722
fld qword [0x8e76f0]
call fcn.008d3834
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fcomp qword [0x8e8018]
fnstsw ax
sahf
jbe 0x8e3722
cmp dword [0x8e6798], 1
je 0x8e3714
call fcn.008e2d80
mov dl, 1
mov al, 3
call fcn.008e16f8
jmp 0x8e3e98
or dword [0x8e76b4], 8
xor eax, eax
mov dword [0x8e76c4], eax
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e37bc
fld qword [0x8e76f8]
fcomp dword [0x8e3f54]
fnstsw ax
sahf
je 0x8e37bc
fld qword [0x8e76f8]
call fcn.008d3834
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fcomp qword [0x8e8018]
fnstsw ax
sahf
setb al
or al, bl
je 0x8e3794
cmp dword [0x8e6798], 1
je 0x8e3784
call fcn.008e2d80
mov dl, 1
mov al, 4
call fcn.008e16f8
jmp 0x8e3e98
or dword [0x8e76b4], 0x10
xor eax, eax
mov dword [0x8e76c4], eax
jmp 0x8e37bc
fld qword [0x8e76f8]
call fcn.008d3834
mov esi, eax
fld qword [0x8e8018]
call fcn.008d3834
sub esi, eax
cmp esi, dword [0x8e76c4]
jae 0x8e37bc
mov dword [0x8e76c4], esi
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e3819
cmp byte [0x8e7710], 0
je 0x8e3819
lea eax, [ebp - 0x50]
mov edx, 0x8e7710
call fcn.008d4608
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x54]
mov eax, 0x8e3f60
call fcn.008e1a0c
mov edx, dword [ebp - 0x54]
pop eax
call fcn.008d4750
je 0x8e3819
cmp dword [0x8e6798], 1
je 0x8e3812
mov dl, 1
mov al, 5
call fcn.008e16f8
jmp 0x8e3e98
or dword [0x8e76b4], 1
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e3876
cmp byte [0x8e7810], 0
je 0x8e3876
lea eax, [ebp - 0x58]
mov edx, 0x8e7810
call fcn.008d4608
mov eax, dword [ebp - 0x58]
push eax
lea edx, [ebp - 0x5c]
mov eax, 0x8e3f78
call fcn.008e1a0c
mov edx, dword [ebp - 0x5c]
pop eax
call fcn.008d4750
je 0x8e3876
cmp dword [0x8e6798], 1
je 0x8e386f
mov dl, 1
mov al, 6
call fcn.008e16f8
jmp 0x8e3e98
or dword [0x8e76b4], 2
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e38b7
cmp dword [0x8e7708], 0
je 0x8e38b7
mov eax, dword [0x8e7708]
cmp eax, dword [0x8e76a8]
je 0x8e38b7
cmp dword [0x8e6798], 1
je 0x8e38b0
mov dl, 1
mov al, 7
call fcn.008e16f8
jmp 0x8e3e98
or dword [0x8e76b4], 4
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e392f
mov eax, dword [0x8e69f0]
mov eax, dword [eax]
and eax, dword [0x8e7700]
je 0x8e392f
mov esi, dword [0x8e69f0]
mov esi, dword [esi]
not esi
and esi, dword [0x8e7700]
test esi, esi
jbe 0x8e3905
dec esi
cmp esi, dword [0x8e76c8]
jae 0x8e38f6
mov dword [0x8e76c8], esi
mov eax, dword [0x8e69f0]
or esi, dword [eax]
mov dword [0x8e7700], esi
jmp 0x8e392f
cmp dword [0x8e6798], 1
je 0x8e3921
call fcn.008e2d80
mov dl, 1
mov al, 4
call fcn.008e16f8
jmp 0x8e3e98
or dword [0x8e76b4], 0x20
xor eax, eax
mov dword [0x8e76c8], eax
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e3a12
mov eax, dword [0x8e69f0]
mov eax, dword [eax]
and eax, dword [0x8e7704]
je 0x8e3a12
mov esi, dword [0x8e69f0]
mov esi, dword [esi]
not esi
and esi, dword [0x8e7704]
test esi, esi
jbe 0x8e39df
test bl, bl
jne 0x8e39df
fld qword [0x8e8018]
fsub qword [0x8e8020]
fcomp dword [0x8e3f90]
fnstsw ax
sahf
jb 0x8e39c3
cmp dword [0x8e7aac], 1
jne 0x8e39c2
fld qword [0x8e8018]
fsub qword [0x8e8020]
mov dword [ebp - 0x4c], esi
xor eax, eax
mov dword [ebp - 0x48], eax
fild qword [ebp - 0x4c]
fcompp
fnstsw ax
sahf
jbe 0x8e39be
fld qword [0x8e8018]
fsub qword [0x8e8020]
call fcn.008d3834
sub esi, eax
jmp 0x8e39c3
xor esi, esi
jmp 0x8e39c3
dec esi
cmp esi, dword [0x8e76c4]
jae 0x8e39d1
mov dword [0x8e76c4], esi
mov eax, dword [0x8e69f0]
mov eax, dword [eax]
or eax, esi
mov dword [0x8e7704], eax
test esi, esi
setbe al
or bl, al
je 0x8e3a12
cmp dword [0x8e6798], 1
je 0x8e3a04
call fcn.008e2d80
mov dl, 1
mov al, 4
call fcn.008e16f8
jmp 0x8e3e98
or dword [0x8e76b4], 0x40
xor eax, eax
mov dword [0x8e76c4], eax
call fcn.008e12fc
call fcn.008e2d80
nop
nop
nop
nop
nop
call fcn.008e14d8
mov eax, dword [0x8e6700]
add dword [0x8e76a0], eax
mov eax, dword [0x8e66f8]
mov dword [0x8e769c], eax
mov eax, dword [0x8e769c]
mov dword [0x8e7664], eax
xor esi, esi
mov ebx, 0x8e6714
cmp dword [ebx], 0
je 0x8e3a58
mov eax, ebx
call fcn.008e18b8
inc esi
add ebx, 0xc
cmp esi, 8
jne 0x8e3a4c
mov eax, dword [0x8e7664]
mov edi, dword [eax + 0x3c]
add edi, dword [0x8e7664]
mov eax, dword [edi + 0x50]
mov dword [0x8e7698], eax
mov eax, dword [0x8e6688]
call fcn.008e169c
mov ebx, eax
mov eax, ebx
call fcn.008e3038
test al, al
je 0x8e3e98
call fcn.008e14d8
mov eax, dword [0x8e6690]
call fcn.008e169c
mov ebx, eax
cmp dword [0x8e68d8], 0
jbe 0x8e3ab3
mov eax, ebx
call fcn.008e2f0c
mov eax, dword [0x8e6694]
cmp dword [0x8e68dc], 0
jbe 0x8e3af1
mov edx, ebx
mov ecx, 1
xchg edx, eax
call fcn.008dde8c
and eax, 0xffff
mov edx, dword [0x8e68dc]
and edx, 0xffff
cmp eax, edx
je 0x8e3af1
xor edx, edx
mov al, 8
call fcn.008e16f8
jmp 0x8e3e98
call fcn.008e14d8
sub dword [0x8e76a0], 0x800
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e3c26
cmp dword [0x8e6798], 1
jne 0x8e3c26
mov eax, dword [0x8e67a4]
call fcn.008e169c
mov edx, eax
mov eax, 0x8e7a10
mov ecx, 0x10
call fcn.008d36d8
mov eax, dword [0x8e67b0]
call fcn.008e169c
mov ebx, eax
lea eax, [ebp - 0x60]
mov edx, 0x8e7a2c
call fcn.008d4608
mov edx, dword [ebp - 0x60]
mov eax, ebx
call fcn.008d7f9c
mov eax, dword [0x8e679c]
call fcn.008e169c
mov dword [0x8e766c], eax
mov eax, dword [0x8e766c]
mov edx, dword [0x8e76b4]
mov dword [eax], edx
mov eax, dword [0x8e67a0]
call fcn.008e169c
mov edx, dword [0x8e76a8]
mov dword [eax], edx
mov eax, dword [0x8e67a8]
call fcn.008e169c
mov edx, dword [0x8e76c4]
mov dword [eax], edx
mov eax, dword [0x8e67ac]
call fcn.008e169c
mov edx, dword [0x8e76c8]
mov dword [eax], edx
mov eax, dword [0x8e67b4]
call fcn.008e169c
mov edx, dword [0x8e76d0]
mov dword [eax], edx
mov edx, dword [0x8e76d4]
mov dword [eax + 4], edx
mov eax, dword [0x8e67b8]
call fcn.008e169c
mov dword [0x8e7670], eax
mov eax, dword [0x8e7670]
mov edx, dword [0x8e76d8]
mov dword [eax], edx
mov edx, dword [0x8e76dc]
mov dword [eax + 4], edx
mov eax, dword [0x8e67bc]
call fcn.008e169c
mov dword [0x8e7674], eax
mov eax, dword [0x8e7674]
mov edx, dword [0x8e76e0]
mov dword [eax], edx
mov eax, dword [0x8e67c0]
call fcn.008e169c
mov dword [0x8e7678], eax
mov eax, dword [0x8e7678]
mov edx, dword [0x8e76e4]
mov dword [eax], edx
call sub.kernel32.dll_GetCurrentProcess
mov dword [0x8e768c], eax
mov dword [0x8e7694], 0x138
push 0x8e76a4
push 4
mov eax, dword [0x8e7694]
push eax
mov eax, dword [0x8e7664]
push eax
mov eax, dword [0x8e768c]
push eax
call sub.kernel32.dll_VirtualProtectEx
test eax, eax
je 0x8e3ca2
xor esi, esi
mov ebx, 0x8e6680
cmp esi, 0xb
je 0x8e3c75
mov eax, dword [ebx]
mov dword [edi + esi*8 + 0x78], eax
mov eax, dword [ebx + 4]
mov dword [edi + esi*8 + 0x7c], eax
inc esi
add ebx, 8
cmp esi, 0xd
jne 0x8e3c63
push 0x8e76a4
mov eax, dword [0x8e76a4]
push eax
mov eax, dword [0x8e7694]
push eax
mov eax, dword [0x8e7664]
push eax
mov eax, dword [0x8e768c]
push eax
call sub.kernel32.dll_VirtualProtectEx
jmp 0x8e3cae
xor eax, eax
call fcn.008e16a4
jmp 0x8e3e98
call fcn.008e14d8
mov eax, dword [0x8e677c]
call fcn.008e169c
mov dword [0x8e7668], eax
mov eax, dword [0x8e7668]
mov ecx, 1
mov edx, dword [0x8e6780]
call fcn.008dde8c
mov ebx, eax
mov eax, dword [0x8e76bc]
add eax, 8
cmp ebx, eax
jne 0x8e3d22
mov eax, dword [0x8e76c0]
add dword [0x8e76a0], eax
xor eax, eax
push ebp
push 0x8e3d0f
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x8e76a0]
ret
mov eax, dword [0x8e76bc]
add dword [0x8e76a0], eax
xor eax, eax
push ebp
push 0x8e3d4b
push dword fs:[eax]
mov dword fs:[eax], esp
call dword [0x8e76a0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8e3d5c
xor edx, edx
mov al, 8
call fcn.008e16f8
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e3d8c
mov eax, dword [0x8e66f8]
mov dword [0x8e769c], eax
mov eax, dword [0x8e6700]
add eax, dword [0x8e769c]
mov dword [0x8e76a0], eax
mov ebx, dword [0x8e6710]
call fcn.008e0e60
cmp ebx, dword [0x8e76bc]
je 0x8e3e42
cmp dword [0x8e7708], 0
je 0x8e3e42
mov eax, dword [0x8e7708]
cmp eax, dword [0x8e76a8]
je 0x8e3e42
or dword [0x8e76b4], 4
cmp dword [0x8e6798], 1
je 0x8e3e42
push 0x10
lea edx, [ebp - 0x64]
mov eax, 0x8e3f9c
call fcn.008e0e20
mov eax, dword [ebp - 0x64]
call fcn.008d47f4
push eax
lea eax, [ebp - 0x6c]
mov edx, 0x8e7910
call fcn.008d4608
push dword [ebp - 0x6c]
push 0x8e3fb8
lea edx, [ebp - 0x70]
mov eax, 0x8e3fc4
call fcn.008e0e20
push dword [ebp - 0x70]
lea ecx, [ebp - 0x74]
mov eax, 0x8e76a8
mov edx, 4
call fcn.008ddcf8
push dword [ebp - 0x74]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.008d4700
mov eax, dword [ebp - 0x68]
call fcn.008d47f4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x8e3e98
mov eax, dword [0x8e76b4]
call fcn.008e169c
mov dword [0x8e7668], eax
mov eax, dword [0x8e7668]
mov ecx, 1
mov edx, dword [0x8e6780]
call fcn.008dde8c
mov ebx, eax
mov eax, ebx
call fcn.008e169c
mov dword [0x8e766c], eax
mov eax, dword [0x8e67c4]
cmp eax, dword [0x8e6778]
je 0x8e3e89
jmp dword [0x8e766c]
jmp dword [0x8e7668]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8e3ec7
lea eax, [ebp - 0x74]
mov edx, 0xa
call fcn.008d4408
lea eax, [ebp - 0x44]
mov edx, 0xe
call fcn.008d4408
ret