Function at 0x3004f450
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x30215e88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov al, 0x41
mov dword [ebp - 0x11c], 0
push esi
mov word [ebp - 0x117], 0x3a
mov byte [ebp - 0x10d], al
push edi
mov byte [ebp - 0x118], al
lea eax, [ebp - 0x108]
push 0x104
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x3004f5f1
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004f4b1
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004f4ce
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004f4d7
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
mov dword [ebp - 0x10c], edx
test ecx, ecx
je 0x3004f50b
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3004f50b
push ebx
popfd
test edx, edx
je 0x3004f53b
lea ecx, [ebp - 0x118]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004f518
sub ecx, esi
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x118]
push eax
push edx
call fcn.301664c0
mov edx, dword [ebp - 0x10c]
add esp, 0xc
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x108]
mov dword [eax*4 + 0x302409d8], edx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004f551
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004f573
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004f57c
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004f5af
mov dword [eax + 0x34], esi
mov dword [eax + 0xbf4], edi
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x3004f5af
push eax
popfd
test ebx, ebx
je 0x3004f5dd
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004f5c0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.301664c0
add esp, 0xc
mov esi, dword [ebp - 0x11c]
mov dword [esi*4 + 0x30240960], ebx
inc esi
mov dword [ebp - 0x11c], esi
mov al, byte [ebp - 0x10d]
inc al
mov byte [ebp - 0x10d], al
cmp al, 0x5a
jle 0x3004f481
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x3004f63b
push str.specialname_map_init:_Unable_to_query_Windows_directory
call fcn.3000a0d0
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004f654
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004f65d
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push 0xc
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004f68e
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x3004f68e
push eax
popfd
test esi, esi
je 0x3004f6a2
push 0xc
push str._systemroot
push esi
call fcn.301664c0
add esp, 0xc
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov dword [eax*4 + 0x30240960], esi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004f6b8
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004f6da
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004f6e3
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov ebx, eax
test ecx, ecx
je 0x3004f717
mov eax, dword [ebp - 0x10c]
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test eax, eax
je 0x3004f717
push eax
popfd
test ebx, ebx
je 0x3004f741
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004f724
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.301664c0
add esp, 0xc
mov eax, dword [ebp - 0x11c]
lea esi, [ebp - 0x108]
lea ecx, [esi + 1]
mov dword [eax*4 + 0x302409d8], ebx
inc eax
mov dword [ebp - 0x11c], eax
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x3004f760
sub esi, ecx
lea ecx, [esi + 9]
mov dword [ebp - 0x114], ecx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004f78b
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004f794
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
test ecx, ecx
je 0x3004f7c8
mov eax, dword [ebp - 0x10c]
mov dword [ecx + 0x34], edi
mov dword [ecx + 0xbf4], ebx
test eax, eax
je 0x3004f7c8
push eax
popfd
mov dword [0x302409d4], edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004f7e7
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004f7f0
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [esi*2 + 0x14]
push eax
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004f827
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x3004f827
push eax
popfd
mov ecx, dword [0x302409d4]
lea edi, [ebp - 0x108]
mov ebx, ecx
mov dword [0x302409cc], edx
mov eax, edi
sub ebx, eax
nop
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [ebx + edi - 1], al
test al, al
jne 0x3004f840
dec ecx
mov edi, edi
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x3004f850
mov eax, dword [0x302037c0]
mov dword [ecx], eax
mov eax, dword [0x302037c4]
mov dword [ecx + 4], eax
mov ax, word [0x302037c8]
mov word [ecx + 8], ax
xor ecx, ecx
test esi, esi
je 0x3004f892
lea esp, [esp]
movsx ax, byte [ebp + ecx - 0x108]
mov word [edx + ecx*2], ax
inc ecx
cmp ecx, esi
jb 0x3004f880
add edx, 0xfffffffe
mov ax, word [edx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x3004f895
mov eax, dword [str._system32]
lea esi, [ebp - 0x108]
mov dword [edx], eax
lea ecx, [esi + 1]
mov eax, dword [0x302037d0]
mov dword [edx + 4], eax
mov eax, dword [0x302037d4]
mov dword [edx + 8], eax
mov eax, dword [0x302037d8]
mov dword [edx + 0xc], eax
mov eax, dword [0x302037dc]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x114]
mov dword [0x30240a44], eax
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x3004f8e0
sub esi, ecx
lea ecx, [esi + 0xa]
mov dword [ebp - 0x10c], ecx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x114]
test eax, eax
jne 0x3004f90b
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004f914
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
test ecx, ecx
je 0x3004f948
mov eax, dword [ebp - 0x114]
mov dword [ecx + 0x34], edi
mov dword [ecx + 0xbf4], ebx
test eax, eax
je 0x3004f948
push eax
popfd
mov dword [0x30240abc], edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x114]
test eax, eax
jne 0x3004f967
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004f970
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [esi*2 + 0x16]
push eax
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004f9a7
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x3004f9a7
push eax
popfd
mov edx, dword [0x30240abc]
lea edi, [ebp - 0x108]
mov ebx, edx
mov dword [0x30240ad0], ecx
mov eax, edi
sub ebx, eax
nop
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [ebx + edi - 1], al
test al, al
jne 0x3004f9c0
dec edx
mov edi, edi
mov al, byte [edx + 1]
lea edx, [edx + 1]
test al, al
jne 0x3004f9d0
mov eax, dword [0x302037e0]
mov dword [edx], eax
mov eax, dword [0x302037e4]
mov dword [edx + 4], eax
mov ax, word [0x302037e8]
mov word [edx + 8], ax
mov al, byte [0x302037ea]
mov byte [edx + 0xa], al
xor edx, edx
test esi, esi
je 0x3004fa13
movsx ax, byte [ebp + edx - 0x108]
mov word [ecx + edx*2], ax
inc edx
cmp edx, esi
jb 0x3004fa01
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x3004fa16
mov eax, dword [str._sysnative]
xor esi, esi
mov dword [ecx], eax
mov eax, dword [0x302037f0]
mov dword [ecx + 4], eax
mov eax, dword [0x302037f4]
mov dword [ecx + 8], eax
mov eax, dword [0x302037f8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x302037fc]
mov dword [ecx + 0x10], eax
mov ax, word [0x30203800]
mov word [ecx + 0x14], ax
mov eax, dword [ebp - 0x10c]
mov dword [0x302409d0], eax
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x3004fbed
mov edi, edi
mov ecx, dword [esi*4 + 0x302409d8]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004fa80
sub ecx, edx
lea edi, [ecx + 1]
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x114]
test eax, eax
jne 0x3004faac
or ebx, 0xffffffff
mov dword [ebp - 0x10c], 0xffffffff
jmp 0x3004fabb
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x10c], eax
lea eax, [edi + edi]
push eax
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x120], eax
test edx, edx
je 0x3004faf9
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x10c]
mov dword [edx + 0x34], ebx
mov dword [edx + 0xbf4], ecx
test eax, eax
je 0x3004faf9
push eax
popfd
mov eax, dword [ebp - 0x120]
xor edx, edx
mov dword [esi*4 + 0x30240ad8], eax
test edi, edi
je 0x3004fb2c
lea esp, [esp]
mov eax, dword [esi*4 + 0x302409d8]
movsx cx, byte [eax + edx]
mov eax, dword [esi*4 + 0x30240ad8]
mov word [eax + edx*2], cx
inc edx
cmp edx, edi
jb 0x3004fb10
mov ecx, dword [esi*4 + 0x30240960]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004fb36
sub ecx, edx
lea edi, [ecx + 1]
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x120]
test eax, eax
jne 0x3004fb62
or ebx, 0xffffffff
mov dword [ebp - 0x10c], 0xffffffff
jmp 0x3004fb71
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x10c], eax
lea eax, [edi + edi]
push eax
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x114], eax
test edx, edx
je 0x3004fbaf
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x10c]
mov dword [edx + 0x34], ebx
mov dword [edx + 0xbf4], ecx
test eax, eax
je 0x3004fbaf
push eax
popfd
mov eax, dword [ebp - 0x114]
xor edx, edx
mov dword [esi*4 + 0x30240a50], eax
test edi, edi
je 0x3004fbde
mov eax, dword [esi*4 + 0x30240960]
movsx cx, byte [eax + edx]
mov eax, dword [esi*4 + 0x30240a50]
mov word [eax + edx*2], cx
inc edx
cmp edx, edi
jb 0x3004fbc2
mov eax, dword [ebp - 0x11c]
inc esi
cmp esi, eax
jb 0x3004fa70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x30240ac4], eax
pop ebx
call fcn.30159c2d
mov esp, ebp
pop ebp
ret