Function at 0x4fef30
Capabilities:
Get disk information
Read file on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov ecx, dword [0x62b5d8]
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push ecx
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
test eax, eax
jne 0x4fef6b
mov eax, dword [0x62b674]
mov ecx, dword [ebp - 8]
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push eax
push ecx
mov esi, eax
mov edi, ecx
mov dword [ebp - 0x14], 4
call ebx
test eax, eax
je 0x4fe990
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push esi
push edi
mov dword [ebp - 0x10], 1
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cb38
lea eax, [ebp - 0xc]
push eax
mov dword [0x67d8dc], ecx
mov ecx, dword [0x62b5e4]
push 0
push ecx
mov esi, 4
push edx
mov dword [ebp - 4], esi
call ebx
test eax, eax
je 0x4fe9ea
xor eax, eax
mov ecx, 0x35
mov edi, 0x67cb30
rep stosd dword es:[edi], eax
call fcn.004fe640
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
call fcn.004fef80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x62b5e4]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67cb38
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
mov ecx, dword [0x62b5e8]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cb3c
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call ebx
mov edx, dword [0x62b610]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67cb40
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
mov eax, dword [0x62b614]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67cb44
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
mov ecx, dword [0x62b5dc]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cb34
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call ebx
mov edx, dword [0x62b5e0]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67cb30
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
mov eax, dword [0x62b5f0]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67cb4c
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
lea edx, [ebp - 4]
push edx
push 0x67cb50
lea eax, [ebp - 0xc]
mov ecx, dword [0x62b5f4]
mov edx, dword [ebp - 8]
push eax
push 0
push ecx
push edx
call ebx
mov edx, dword [0x62b5f8]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67cb54
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
mov eax, dword [0x62b5fc]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67cb58
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
mov ecx, dword [0x62b600]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cb5c
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call ebx
mov edx, dword [0x62b604]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67cb60
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
mov eax, dword [0x62b608]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67cb64
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
mov ecx, dword [0x62b60c]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cb68
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call ebx
mov edx, dword [0x62b61c]
lea eax, [ebp - 4]
push eax
push 0x67db54
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
mov eax, dword [ebp - 8]
push eax
call ebx
mov eax, dword [0x62b620]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67db58
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
mov ecx, dword [0x62b624]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67db5c
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call ebx
mov edx, dword [0x62b628]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67db60
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
mov eax, dword [0x62b618]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67cb80
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
mov ecx, dword [0x62b670]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cbc0
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
mov dword [ebp - 4], esi
call ebx
mov edx, dword [0x62b654]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67cbef
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
mov byte [0x67cbc3], 0
mov dword [ebp - 4], 0x1f
call ebx
mov eax, dword [0x62b5ec]
lea ecx, [ebp - 4]
push ecx
push 0x67cb48
lea edx, [ebp - 0xc]
push edx
push 0
mov dword [ebp - 4], esi
push eax
mov ecx, dword [ebp - 8]
push ecx
call ebx
mov ecx, dword [0x62b62c]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cb94
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call ebx
mov edx, dword [0x62b630]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67cb98
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
mov eax, dword [0x62b634]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67cb9c
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
mov ecx, dword [0x62b638]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cba0
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call ebx
mov edx, dword [0x62b640]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67cb6c
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
mov eax, dword [0x62b644]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67cb70
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
mov ecx, dword [0x62b648]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cb74
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call ebx
lea eax, [ebp - 4]
mov edx, dword [0x62b64c]
push eax
mov eax, dword [ebp - 8]
push 0x67cb78
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
mov eax, dword [0x62b650]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67cb7c
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
mov ecx, dword [0x62b63c]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cbc4
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call ebx
mov edx, dword [0x62b658]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67cb84
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
mov eax, dword [0x62b65c]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push 0x67cb88
lea edx, [ebp - 0xc]
push edx
push 0
push eax
push ecx
call ebx
mov ecx, dword [0x62b660]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67cb8c
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
call ebx
mov edx, dword [0x62b664]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67cb90
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
lea ecx, [ebp - 0x118]
push 0x104
push ecx
mov dword [ebp - 4], 0x15e
call fcn.00605887
or ecx, 0xffffffff
add esp, 8
xor eax, eax
mov edi, 0x65da1c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
lea edx, [ebp - 0x118]
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [0x62b668]
and ecx, 3
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x67b974
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
push eax
call ebx
test eax, eax
jne 0x4fee65
lea ecx, [ebp - 0x118]
push ecx
push 0x67b974
call fcn.00606760
add esp, 8
test eax, eax
je 0x4feeb1
or ecx, 0xffffffff
xor eax, eax
lea edi, [ebp - 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
shr ecx, 2
mov esi, edi
mov edi, 0x67b974
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x67b974
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [ebp - 8]
push 0x67b974
push 1
push eax
mov eax, dword [0x62b668]
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov ecx, dword [0x62b66c]
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push 0x67bad4
lea eax, [ebp - 0xc]
push eax
push 0
push ecx
push edx
mov dword [ebp - 4], 0x15e
call ebx
test eax, eax
je 0x4feefd
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x676080
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x67bad4
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
call fcn.005eed10
mov ecx, dword [0x67cb88]
sub eax, 0x320
cmp ecx, eax
jle 0x4fef2a
call fcn.005eed10
sub eax, 0x320
mov dword [0x67cb88], eax
call fcn.005eed20
mov edx, eax
mov eax, dword [0x67cb8c]
sub edx, 0x258
cmp eax, edx
jle 0x4fef4f
call fcn.005eed20
sub eax, 0x258
mov dword [0x67cb8c], eax
mov edx, dword [0x67cb88]
xor ecx, ecx
cmp edx, ecx
jge 0x4fef61
mov dword [0x67cb88], ecx
cmp eax, ecx
jge 0x4fef6b
mov dword [0x67cb8c], ecx
call fcn.004fe3d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret