Function at 0xa63420
Capabilities:
Get common file path
Get disk information
Get mac address on windows
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x628
xor eax, eax
push esi
mov dword [esp + 0x11], eax
mov esi, ecx
mov dword [esp + 0x15], eax
lea ecx, [esp + 4]
mov dword [esp + 0x19], eax
push ecx
mov word [esp + 0x21], ax
mov dword [esp + 0xc], esi
push eax
mov byte [esp + 0x18], 0
mov byte [esp + 0x27], al
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0xa6349a
mov eax, dword [esp + 4]
test eax, eax
jbe 0xa6349a
push eax
call fcn.00a70e58
add esp, 4
lea edx, [esp + 4]
mov dword [esp + 0xc], eax
push edx
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0xa6349a
mov eax, dword [esp + 0xc]
push eax
call fcn.00a70d6f
add esp, 4
mov dword [esp + 0xc], 0
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0xa63556
push ebx
push ebp
cmp dword [edi + 0x1a0], 6
jne 0xa6353d
mov cl, byte [edi + 0x194]
lea eax, [edi + 0x194]
cmp cl, 0x44
mov bl, 1
jne 0xa634fa
cmp byte [edi + 0x195], 0x45
jne 0xa634fa
cmp byte [edi + 0x196], 0x53
jne 0xa634fa
cmp byte [edi + 0x197], 0x54
jne 0xa634fa
mov cl, byte [edi + 0x198]
test cl, cl
jne 0xa634fa
mov cl, byte [edi + 0x199]
test cl, cl
jne 0xa634fa
xor bl, bl
mov ebp, 0xfffffe6c
lea esi, [esp + 0x1c]
sub ebp, edi
test bl, bl
je 0xa63539
mov cl, byte [eax]
mov dl, byte [esi]
cmp cl, dl
ja 0xa6351f
jae 0xa63515
xor bl, bl
inc eax
inc esi
lea ecx, [eax + ebp]
cmp ecx, 6
jb 0xa63505
test bl, bl
je 0xa63539
mov edx, dword [edi + 0x194]
mov ax, word [edi + 0x198]
mov dword [esp + 0x1c], edx
mov word [esp + 0x20], ax
mov esi, dword [esp + 0x14]
mov edi, dword [edi]
test edi, edi
jne 0xa634a9
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00a70d6f
add esp, 4
pop ebp
pop ebx
lea edx, [esp + 0x30]
push 0x200
push edx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x230]
push 0x200
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
lea ecx, [esp + 0x444]
push 0x200
lea edx, [esp + 0x48]
push ecx
push edx
mov byte [esp + 0x53], 0
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
cmp eax, 1
jne 0xa635ac
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1a], eax
xor edx, edx
xor eax, eax
lea ecx, [esp + 0x14]
lea edi, [eax + 3]
imul di, word [ecx]
add edx, edi
inc eax
add ecx, 2
cmp eax, 6
jb 0xa635b4
mov eax, dword [esp + 0x18]
mov word [esp + 0x22], dx
mov edx, dword [esp + 0x14]
lea ecx, [esi + 0x14]
mov dword [esi + 0x14], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x20]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea ecx, [esp + 8]
push ecx
push 3
push 0
push 0xba5270
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 8]
pop edi
test eax, eax
jne 0xa6362c
mov ecx, 0xfffffffc
lea eax, [esi + 4]
sub ecx, esi
mov dl, byte [eax + 0x10]
mov byte [eax], dl
inc eax
lea edx, [ecx + eax]
cmp edx, 0x10
jl 0xa63616
pop esi
add esp, 0x628
ret
lea ecx, [esp + 8]
lea edx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x28]
push edx
push ecx
push 0
push 0xbd4608
push eax
mov dword [esp + 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xa6368d
cmp dword [esp + 8], 0x10
jne 0xa6368d
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
add esi, 4
mov dword [esi], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov ecx, dword [esp + 4]
push ecx
mov dword [esi + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x628
ret
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x10]
push 0x10
push ecx
push 3
push 0
push 0xbd4608
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esi, 4
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 4]
push ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x628
ret