Function at 0x10015a04
Capabilities:
Create process on windows
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x10fc]
mov eax, 0x10fc
call fcn.10050990
push 0xffffffffffffffff
push 0x1007313a
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x1008dd90]
xor eax, ebp
mov dword [ebp + 0x10f8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x34], 7
call fcn.1000187c
cmp dword [ebp + 0x1108], ebx
mov edi, dword [ebp + 0x1104]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x4b
jl 0x10015ba8
jg 0x10015a7f
cmp edi, 1
jb 0x10015ba8
cmp dword [ebp + 0x1108], ebx
jg 0x10015ba8
mov ecx, 0x800000
jl 0x10015a9a
cmp edi, ecx
ja 0x10015ba8
mov eax, 0x400
cmp edi, eax
jg 0x10015ce4
je 0x10015c8b
cmp edi, 0x20
jg 0x10015b7e
je 0x10015b70
mov eax, edi
dec eax
je 0x10015b39
dec eax
je 0x10015e23
dec eax
dec eax
je 0x10015e23
sub eax, 4
je 0x10015e23
sub eax, 8
jne 0x10015ba8
push 0x100780f0
lea ecx, [ebp + 0x1c]
call fcn.10012250
push 0x1008f90c
lea ecx, [ebp - 0x10]
call fcn.10002c90
push 0x100780f4
lea eax, [ebp - 0x10]
push 0x10078104
push eax
mov byte [ebp - 4], 5
call fcn.1000cf04
add esp, 0xc
push dword [ebp - 0x10]
lea ecx, [ebp + 0x1c]
call fcn.10012250
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10002890
push 0x1007810c
jmp 0x10015e47
push 0x10078114
lea ecx, [ebp + 0x1c]
call fcn.10012250
push 0x10078118
lea ecx, [ebp + 0x1c]
call fcn.10012250
push ebx
lea ecx, [esi + 0x38]
call fcn.10017818
cmp dword [eax + 0x18], 8
jb 0x10015b67
mov eax, dword [eax + 4]
jmp 0x10015b6a
add eax, 4
push eax
jmp 0x10015e13
push ebx
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.10015247
jmp 0x10015bba
cmp edi, 0x40
jl 0x10015ba8
cmp edi, 0x42
jle 0x10015c10
cmp edi, 0x80
je 0x10015c02
cmp edi, 0x100
je 0x10015bf4
cmp edi, 0x200
je 0x10015e30
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x1108]
mov ecx, esi
push edi
call fcn.10015322
cmp dword [ebp + 0x30], ebx
je 0x1001612f
push dword [ebp - 0x14]
lea eax, [ebp + 0xa58]
push 0x104
push eax
call fcn.10011744
add esp, 0xc
test eax, eax
je 0x1001612f
cmp dword [esi + 0x1c], 8
jb 0x100160cc
mov edi, dword [esi + 8]
jmp 0x100160cf
push ebx
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.10014f4e
jmp 0x10015bba
push ebx
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.10015035
jmp 0x10015bba
mov eax, dword [esi + 0x48]
sub eax, dword [esi + 0x44]
add edi, 0xffffffc0
push 0x1c
mov dword [ebp - 0x10], edi
cdq
pop edi
idiv edi
mov ecx, 0x10078120
mov dword [ebp + 0x10f4], ecx
test eax, eax
je 0x10015c60
lea ecx, [esi + 0x20]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
cdq
idiv edi
cmp dword [ebp - 0x10], eax
jge 0x10015c5a
push dword [ebp - 0x10]
call fcn.10017818
cmp dword [eax + 0x18], 8
jb 0x10015c55
mov ecx, dword [eax + 4]
jmp 0x10015c60
lea ecx, [eax + 4]
jmp 0x10015c60
mov ecx, dword [ebp + 0x10f4]
push ecx
push 0x104
lea eax, [ebp + 0xe68]
push eax
mov ecx, esi
call fcn.10013ffa
lea eax, [ebp + 0xe68]
push eax
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.10014e4f
jmp 0x10015bba
lea eax, [ebp + 0x1c]
push 0x54
push eax
call fcn.100147b9
pop ecx
pop ecx
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 7
call fcn.1000187c
push 2
lea eax, [ebp]
push eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.10014911
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x10015cc5
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.100148ad
pop ecx
pop ecx
lea ecx, [ebp]
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.1000166a
jmp 0x10015bba
mov eax, 0x80000
cmp edi, eax
jg 0x10015eaa
je 0x10015e66
cmp edi, 0x1000
je 0x10015e23
mov eax, 0x40000
cmp edi, 0x10000
je 0x10015d20
cmp edi, 0x20000
je 0x10015d20
cmp edi, eax
jne 0x10015ba8
mov dword [ebp - 0x14], 0x4d
cmp edi, eax
jne 0x10015d92
cmp dword [ebp + 0x1108], ebx
jne 0x10015d92
push 8
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.10014911
push ebx
lea ecx, [esi + 0x38]
call fcn.10017818
cmp dword [eax + 0x18], 8
jb 0x10015d54
mov eax, dword [eax + 4]
jmp 0x10015d57
add eax, 4
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.100148ad
pop ecx
pop ecx
push ebx
lea ecx, [esi + 4]
call fcn.10001ddf
movzx eax, word [eax]
push eax
push str._drv:_c
lea eax, [ebp + 0xc]
push 8
push eax
call fcn.10052141
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.100148ad
add esp, 0x18
jmp 0x10015d9f
push 4
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.10014911
mov eax, dword [0x100780c8]
mov dword [ebp + 0x10f0], eax
mov eax, dword [0x100780cc]
mov dword [ebp + 0x10f4], eax
mov dword [ebp - 0x10], 0x5a
mov ax, word [ebp - 0x10]
mov word [ebp + 0x10f0], ax
lea eax, [ebp + 0x10f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x10015de4
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x41
jge 0x10015dbc
jmp 0x10015df6
lea eax, [ebp + 0x10f0]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.100148ad
pop ecx
pop ecx
cmp edi, 0x20000
jne 0x10015bba
cmp dword [ebp + 0x1108], ebx
jne 0x10015bba
push str._drv:0
lea eax, [ebp + 0x1c]
push eax
call fcn.100148ad
pop ecx
pop ecx
jmp 0x10015bba
push 0x100780e0
lea ecx, [ebp + 0x1c]
call fcn.10012250
cmp dword [ebp + 0x30], ebx
jne 0x10015e42
push 0x100780e4
lea ecx, [ebp + 0x1c]
call fcn.10012250
push 0x100780e8
lea ecx, [ebp + 0x1c]
call fcn.10012250
push dword [ebp + 0x1108]
lea eax, [ebp + 0x1c]
push edi
push eax
mov ecx, esi
call fcn.10014c1d
jmp 0x10015bba
cmp dword [esi + 0x1c], 8
mov dword [ebp - 0x14], 0x4d
jb 0x10015e78
mov eax, dword [esi + 8]
jmp 0x10015e7b
lea eax, [esi + 8]
push eax
push 0x10078020
lea eax, [ebp + 0x10b0]
push 0x10078034
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x10b0]
add esp, 0x10
push eax
lea ecx, [ebp + 0x1c]
call fcn.10012250
jmp 0x10015bba
cmp edi, 0x100000
je 0x1001608b
cmp edi, 0x200000
je 0x10016053
cmp edi, 0x400000
je 0x10015fdb
cmp edi, ecx
jne 0x10015ba8
push 0x10078008
lea ecx, [ebp - 0xc0]
call fcn.100029e0
push eax
lea eax, [ebp - 0xa4]
push 0x1007800c
push eax
mov byte [ebp - 4], 1
call fcn.100182c6
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call fcn.100015d7
push ebx
push 1
lea ecx, [ebp - 0xa4]
call fcn.1000166a
push ebx
push 1
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], bl
call fcn.1000166a
lea edi, [esi + 0x38]
push ebx
mov ecx, edi
call fcn.10017818
cmp dword [eax + 0x18], 8
jb 0x10015f44
mov eax, dword [eax + 4]
jmp 0x10015f47
add eax, 4
push 0x10078014
push eax
call fcn.100503f0
pop ecx
pop ecx
test eax, eax
je 0x10015fc2
push 0x10078018
lea ecx, [ebp - 0x6c]
call fcn.100029e0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call fcn.10011da9
push ebx
push 1
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], bl
call fcn.1000166a
push ebx
mov ecx, edi
call fcn.10017818
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
call fcn.10011da9
push 0x1007801c
lea ecx, [ebp - 0x88]
call fcn.100029e0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 4
call fcn.10011da9
lea ecx, [ebp - 0x88]
jmp 0x10015cd4
push ebx
mov ecx, edi
call fcn.10017818
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
call fcn.10011da9
jmp 0x10015bba
cmp dword [esi + 0x1c], 8
mov dword [ebp - 0x14], 0x4d
jb 0x10015fed
mov eax, dword [esi + 8]
jmp 0x10015ff0
lea eax, [esi + 8]
push eax
lea eax, [ebp + 0xc60]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
lea ecx, [esi + 0x38]
call fcn.10017818
cmp dword [eax + 0x18], 8
jb 0x10016012
mov eax, dword [eax + 4]
jmp 0x10016015
add eax, 4
push eax
lea eax, [ebp + 0xc60]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0xc60]
push eax
push str._unmount
lea eax, [ebp + 0x38]
push str._s___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.100148ad
add esp, 0x18
jmp 0x10015bba
cmp dword [esi + 0x1c], 8
mov dword [ebp - 0x14], 0x4d
jb 0x10016065
mov eax, dword [esi + 8]
jmp 0x10016068
lea eax, [esi + 8]
push eax
push str._eject
lea eax, [ebp + 0x1070]
push str.__s___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x1070]
jmp 0x10015e99
push 0x4d
pop edi
lea eax, [ebp + 0x1c]
push edi
push eax
call fcn.100147b9
pop ecx
pop ecx
push ebx
lea ecx, [esi + 4]
mov dword [ebp - 0x14], edi
call fcn.10001ddf
movzx eax, word [eax]
push eax
push str._insertimage:
lea eax, [ebp + 0x858]
push str._s_C
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x858]
jmp 0x10016041
lea edi, [esi + 8]
add esi, 0x9c
cmp word [esi], bx
je 0x100160dc
mov edi, esi
push 0x38
lea eax, [ebp - 0x4c]
push ebx
push eax
mov dword [ebp - 0x50], 0x3c
call fcn.10050bb0
lea eax, [ebp + 0xa58]
add esp, 0xc
cmp dword [ebp + 0x34], 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x38], edi
jae 0x10016111
lea eax, [ebp + 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push ebx
push 1
lea ecx, [ebp + 0x1c]
mov esi, eax
call fcn.1000166a
mov eax, esi
jmp 0x1001613c
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.1000166a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10f8]
xor ecx, ebp
call fcn.1005097c
add ebp, 0x10fc
leave
ret 8