Function at 0x100053e0
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1270
call fcn.10008510
mov eax, dword [0x100180ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 1
push 0
push 0
push 0
push str.SystemMountedDevices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100056f5
cmp dword [ebp - 8], 2
jne 0x100056eb
mov byte [ebp - 0x79], 0x41
jmp 0x10005441
mov dl, byte [ebp - 0x79]
add dl, 1
mov byte [ebp - 0x79], dl
movsx eax, byte [ebp - 0x79]
cmp eax, 0x5a
jg 0x100056eb
cmp dword [ebp - 4], 0
jne 0x100056eb
mov dword [ebp - 0x994], 0x400
mov dword [ebp - 0xd9c], 1
movsx ecx, byte [ebp - 0x79]
push ecx
push str.DosDevices_c:
push 0x64
lea edx, [ebp - 0x78]
push edx
call fcn.100084e6
add esp, 0x10
movsx eax, byte [ebp - 0x79]
push eax
push 0x100142f4
push 5
lea ecx, [ebp - 0x990]
push ecx
call fcn.100084e6
add esp, 0x10
push 0x104
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x990]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x100054c1
jmp 0x10005438
push str.CdRom
lea ecx, [ebp - 0x188]
push ecx
call fcn.10008460
add esp, 8
test eax, eax
jne 0x100054de
jmp 0x10005438
lea edx, [ebp - 0x994]
push edx
lea eax, [ebp - 0x988]
push eax
lea ecx, [ebp - 0xd9c]
push ecx
push 0
lea edx, [ebp - 0x78]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100056e6
mov ecx, dword [ebp - 0x994]
shr ecx, 1
xor edx, edx
mov word [ebp + ecx*2 - 0x988], dx
push 0x400
lea eax, [ebp - 0x988]
push eax
push 0x400
lea ecx, [ebp - 0xd98]
push ecx
push 0
call fcn.10008440
add esp, 0x14
push 4
push str.___
lea edx, [ebp - 0xd98]
push edx
call fcn.10007ffd
add esp, 0xc
test eax, eax
jne 0x100055a0
push 0x7b
lea eax, [ebp - 0xd98]
push eax
call fcn.10007fd0
add esp, 8
mov dword [ebp - 0x11a8], eax
cmp dword [ebp - 0x11a8], 0
je 0x100055a0
lea ecx, [ebp - 0xd94]
push ecx
mov edx, dword [ebp - 0x11a8]
push edx
push str.SystemCurrentControlSetControlDeviceClasses_s__s
push 0x400
lea eax, [ebp - 0x11a0]
push eax
call fcn.100084e6
add esp, 0x14
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x11a4]
push edx
push 0
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x11a0]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10005641
cmp dword [ebp - 8], 2
jne 0x10005632
mov dword [ebp - 0x994], 0x400
mov dword [ebp - 0xd9c], 1
lea ecx, [ebp - 0x994]
push ecx
lea edx, [ebp - 0xd98]
push edx
lea eax, [ebp - 0xd9c]
push eax
push 0
push str.DeviceInstance
mov ecx, dword [ebp - 0x11a4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10005632
lea edx, [ebp - 0xd98]
push edx
push str.SystemCurrentControlSetEnum_s
push 0x400
lea eax, [ebp - 0x11a0]
push eax
call fcn.100084e6
add esp, 0x10
mov ecx, dword [ebp - 0x11a4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10005646
jmp 0x10005438
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x11a4]
push eax
push 0
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x11a0]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100056e6
cmp dword [ebp - 8], 2
jne 0x100056d9
mov dword [ebp - 0x994], 0x64
mov dword [ebp - 0xd9c], 1
lea edx, [ebp - 0x994]
push edx
lea eax, [ebp - 0x1270]
push eax
lea ecx, [ebp - 0xd9c]
push ecx
push 0
push str.Driver
mov edx, dword [ebp - 0x11a4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100056d9
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x1270]
push ecx
call fcn.10007f98
add esp, 8
test eax, eax
jne 0x100056d9
movsx edx, byte [ebp - 0x79]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x11a4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10005438
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10006f5c
mov esp, ebp
pop ebp
ret