Function at 0x3004c890
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x3021ae88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov al, 0x41
mov dword [ebp - 0x11c], 0
push esi
mov word [ebp - 0x117], 0x3a
mov byte [ebp - 0x10d], al
push edi
mov byte [ebp - 0x118], al
lea eax, [ebp - 0x108]
push 0x104
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x3004ca31
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004c8f1
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004c90e
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004c917
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
mov dword [ebp - 0x10c], edx
test ecx, ecx
je 0x3004c94b
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3004c94b
push ebx
popfd
test edx, edx
je 0x3004c97b
lea ecx, [ebp - 0x118]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004c958
sub ecx, esi
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x118]
push eax
push edx
call fcn.3016a610
mov edx, dword [ebp - 0x10c]
add esp, 0xc
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x108]
mov dword [eax*4 + 0x302455d0], edx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004c991
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004c9b3
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004c9bc
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004c9ef
mov dword [eax + 0x34], esi
mov dword [eax + 0xbf4], edi
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x3004c9ef
push eax
popfd
test ebx, ebx
je 0x3004ca1d
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004ca00
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.3016a610
add esp, 0xc
mov esi, dword [ebp - 0x11c]
mov dword [esi*4 + 0x30245558], ebx
inc esi
mov dword [ebp - 0x11c], esi
mov al, byte [ebp - 0x10d]
inc al
mov byte [ebp - 0x10d], al
cmp al, 0x5a
jle 0x3004c8c1
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x3004ca7b
push str.specialname_map_init:_Unable_to_query_Windows_directory
call fcn.30009b00
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004ca94
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004ca9d
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push 0xc
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004cace
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x3004cace
push eax
popfd
test esi, esi
je 0x3004cae2
push 0xc
push str._systemroot
push esi
call fcn.3016a610
add esp, 0xc
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov dword [eax*4 + 0x30245558], esi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004caf8
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004cb1a
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004cb23
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov ebx, eax
test ecx, ecx
je 0x3004cb57
mov eax, dword [ebp - 0x10c]
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test eax, eax
je 0x3004cb57
push eax
popfd
test ebx, ebx
je 0x3004cb81
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004cb64
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.3016a610
add esp, 0xc
mov eax, dword [ebp - 0x11c]
lea esi, [ebp - 0x108]
lea ecx, [esi + 1]
mov dword [eax*4 + 0x302455d0], ebx
inc eax
mov dword [ebp - 0x11c], eax
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x3004cba0
sub esi, ecx
lea ecx, [esi + 9]
mov dword [ebp - 0x114], ecx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004cbcb
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004cbd4
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
test ecx, ecx
je 0x3004cc08
mov eax, dword [ebp - 0x10c]
mov dword [ecx + 0x34], edi
mov dword [ecx + 0xbf4], ebx
test eax, eax
je 0x3004cc08
push eax
popfd
mov dword [0x302455cc], edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004cc27
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004cc30
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [esi*2 + 0x14]
push eax
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004cc67
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x3004cc67
push eax
popfd
mov ecx, dword [0x302455cc]
lea edi, [ebp - 0x108]
mov ebx, ecx
mov dword [0x302455c4], edx
mov eax, edi
sub ebx, eax
nop
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [ebx + edi - 1], al
test al, al
jne 0x3004cc80
dec ecx
mov edi, edi
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x3004cc90
mov eax, dword [0x302073d0]
mov dword [ecx], eax
mov eax, dword [0x302073d4]
mov dword [ecx + 4], eax
mov ax, word [0x302073d8]
mov word [ecx + 8], ax
xor ecx, ecx
test esi, esi
je 0x3004ccd2
lea esp, [esp]
movsx ax, byte [ebp + ecx - 0x108]
mov word [edx + ecx*2], ax
inc ecx
cmp ecx, esi
jb 0x3004ccc0
add edx, 0xfffffffe
mov ax, word [edx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x3004ccd5
mov eax, dword [str._system32]
lea esi, [ebp - 0x108]
mov dword [edx], eax
lea ecx, [esi + 1]
mov eax, dword [0x302073e0]
mov dword [edx + 4], eax
mov eax, dword [0x302073e4]
mov dword [edx + 8], eax
mov eax, dword [0x302073e8]
mov dword [edx + 0xc], eax
mov eax, dword [0x302073ec]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x114]
mov dword [0x3024563c], eax
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x3004cd20
sub esi, ecx
lea ecx, [esi + 0xa]
mov dword [ebp - 0x10c], ecx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x114]
test eax, eax
jne 0x3004cd4b
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004cd54
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
test ecx, ecx
je 0x3004cd88
mov eax, dword [ebp - 0x114]
mov dword [ecx + 0x34], edi
mov dword [ecx + 0xbf4], ebx
test eax, eax
je 0x3004cd88
push eax
popfd
mov dword [0x302456b4], edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x114]
test eax, eax
jne 0x3004cda7
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004cdb0
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [esi*2 + 0x16]
push eax
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004cde7
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x3004cde7
push eax
popfd
mov edx, dword [0x302456b4]
lea edi, [ebp - 0x108]
mov ebx, edx
mov dword [0x302456c8], ecx
mov eax, edi
sub ebx, eax
nop
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [ebx + edi - 1], al
test al, al
jne 0x3004ce00
dec edx
mov edi, edi
mov al, byte [edx + 1]
lea edx, [edx + 1]
test al, al
jne 0x3004ce10
mov eax, dword [0x302073f0]
mov dword [edx], eax
mov eax, dword [0x302073f4]
mov dword [edx + 4], eax
mov ax, word [0x302073f8]
mov word [edx + 8], ax
mov al, byte [0x302073fa]
mov byte [edx + 0xa], al
xor edx, edx
test esi, esi
je 0x3004ce53
movsx ax, byte [ebp + edx - 0x108]
mov word [ecx + edx*2], ax
inc edx
cmp edx, esi
jb 0x3004ce41
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x3004ce56
mov eax, dword [str._sysnative]
xor esi, esi
mov dword [ecx], eax
mov eax, dword [0x30207400]
mov dword [ecx + 4], eax
mov eax, dword [0x30207404]
mov dword [ecx + 8], eax
mov eax, dword [0x30207408]
mov dword [ecx + 0xc], eax
mov eax, dword [0x3020740c]
mov dword [ecx + 0x10], eax
mov ax, word [0x30207410]
mov word [ecx + 0x14], ax
mov eax, dword [ebp - 0x10c]
mov dword [0x302455c8], eax
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x3004d02d
mov edi, edi
mov ecx, dword [esi*4 + 0x302455d0]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004cec0
sub ecx, edx
lea edi, [ecx + 1]
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x114]
test eax, eax
jne 0x3004ceec
or ebx, 0xffffffff
mov dword [ebp - 0x10c], 0xffffffff
jmp 0x3004cefb
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x10c], eax
lea eax, [edi + edi]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x120], eax
test edx, edx
je 0x3004cf39
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x10c]
mov dword [edx + 0x34], ebx
mov dword [edx + 0xbf4], ecx
test eax, eax
je 0x3004cf39
push eax
popfd
mov eax, dword [ebp - 0x120]
xor edx, edx
mov dword [esi*4 + 0x302456d0], eax
test edi, edi
je 0x3004cf6c
lea esp, [esp]
mov eax, dword [esi*4 + 0x302455d0]
movsx cx, byte [eax + edx]
mov eax, dword [esi*4 + 0x302456d0]
mov word [eax + edx*2], cx
inc edx
cmp edx, edi
jb 0x3004cf50
mov ecx, dword [esi*4 + 0x30245558]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004cf76
sub ecx, edx
lea edi, [ecx + 1]
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x120]
test eax, eax
jne 0x3004cfa2
or ebx, 0xffffffff
mov dword [ebp - 0x10c], 0xffffffff
jmp 0x3004cfb1
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x10c], eax
lea eax, [edi + edi]
push eax
push 0
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x114], eax
test edx, edx
je 0x3004cfef
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x10c]
mov dword [edx + 0x34], ebx
mov dword [edx + 0xbf4], ecx
test eax, eax
je 0x3004cfef
push eax
popfd
mov eax, dword [ebp - 0x114]
xor edx, edx
mov dword [esi*4 + 0x30245648], eax
test edi, edi
je 0x3004d01e
mov eax, dword [esi*4 + 0x30245558]
movsx cx, byte [eax + edx]
mov eax, dword [esi*4 + 0x30245648]
mov word [eax + edx*2], cx
inc edx
cmp edx, edi
jb 0x3004d002
mov eax, dword [ebp - 0x11c]
inc esi
cmp esi, eax
jb 0x3004ceb0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x302456bc], eax
pop ebx
call fcn.3015dd6d
mov esp, ebp
pop ebp
ret