Function at 0x1002930d
Capabilities:
Create process on windows
Get disk information

Disassembly:
mov eax, 0x10052ecb
call fcn.10052218
sub esp, 0x84
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ecx
push esi
mov dword [ebp - 0x20], ebx
mov esi, edx
mov dword [ebp - 0x14], 0xfffffffc
push edi
mov dword [ebp - 0x18], ebx
jmp 0x10029344
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x4c], 0xdc7555b7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10029336
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1002935a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0xfffffffffffffffb
mov dword [ebp - 0x14], 0xfffffff3
pop edi
jmp 0x100293a1
mov dword [ebp - 0x34], 0x72fd
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x18], ebx
jmp 0x10029386
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002937c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1002939b
push ebx
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
inc dword [ebp - 0x54]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jg 0x10029366
call fcn.100263ca
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.1002966d
mov dword [ebp - 4], ebx
add esi, 0xffffe829
mov edx, dword [ebp - 0x40]
mov ecx, edx
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x100293f1
cmp dword [eax + 0x10], esi
jge 0x100293d6
mov eax, dword [eax + 8]
jmp 0x100293da
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x100293cc
cmp ecx, edx
je 0x100293f1
cmp esi, dword [ecx + 0x10]
jl 0x100293f1
mov dword [ebp - 0x24], ecx
lea esi, [ebp - 0x24]
jmp 0x100293f7
mov dword [ebp - 0x28], edx
lea esi, [ebp - 0x28]
mov esi, dword [esi]
mov dword [ebp - 0x14], 0xd5e48d32
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
mov dword [ebp - 0x34], esi
je 0x10029419
push 0x20fc
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x14], 6
jmp 0x10029467
mov dword [ebp - 0x18], 0x665683c8
mov dword [ebp - 0x18], ebx
jmp 0x1002945e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002945b
push 0xa26
push ebx
push 0x940
push 0x1107
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x16
jge 0x1002942e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
jne 0x10029422
mov eax, dword [0x1006b618]
test al, 1
jne 0x100294a1
or eax, 1
mov dword [0x1006b630], 7
mov dword [0x1006b618], eax
xor eax, eax
push 0x10053623
mov dword [0x1006b62c], ebx
mov word [0x1006b61c], ax
call fcn.10039fec
pop ecx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x100294c9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100294c6
push 0xeb4
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
je 0x100294b1
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x14], ebx
jmp 0x1002955d
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x100294f7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2c], 0x250e6da5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x100294e9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10029517
push ebx
push ebx
push 0x25f5
push ebx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1002955a
mov dword [ebp - 0x18], 0xc9e53e58
mov dword [ebp - 0x18], ebx
jmp 0x10029550
mov dword [ebp - 0x30], 0xfffffffa
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2c]
sub ecx, eax
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1002954d
push ebx
call edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002952b
dec dword [ebp - 0x1c]
jns 0x1002951f
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff3
je 0x100294dd
mov dword [ebp - 0x30], 0x7003
cmp dword [ebp - 0x30], 0x73e1
jle 0x100295b4
push ebx
call edi
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], 0x6aab
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x1006a318
cdq
push edx
push eax
call fcn.10001c75
add esi, edi
dec dword [ebp - 0x1c]
jne 0x10029585
inc edi
cmp edi, 0x4d16
jl 0x1002957c
inc ebx
cmp ebx, 0x51b7
jl 0x1002957a
mov esi, dword [ebp - 0x34]
cmp esi, dword [ebp - 0x40]
je 0x100295d4
push dword [esi + 0x18]
mov edx, dword [esi + 0x14]
lea ecx, [ebp - 0x8c]
call fcn.10023bde
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 1
inc ebx
jmp 0x100295e7
push 0x1006b61c
lea ecx, [ebp - 0x74]
call fcn.100054d9
push 2
pop ebx
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x38]
mov ecx, esi
push eax
mov dword [ebp - 0x20], ebx
call fcn.100054d9
or ebx, 4
test bl, 2
je 0x1002960c
push 0
push 1
lea ecx, [ebp - 0x74]
and ebx, 0xfffffffd
call fcn.10005a02
test bl, 1
je 0x10029620
push 0
push 1
lea ecx, [ebp - 0x8c]
call fcn.10005a02
lea ecx, [ebp - 0x40]
call fcn.1002963b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret