Function at 0x1050eb0
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
sub esp, 0x2f8
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x2f4], eax
push ebx
push ebp
mov ebp, dword [esp + 0x304]
push esi
push edi
push ebx
call 0x1050ed5
jmp 0x1050eda
pushal
call 0x1050ee0
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
call fcn.01068650
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x1050f29
push str.__atl_condVal
push ebx
push 0xe2
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.01090630
add esp, 0x14
cmp eax, 1
jne 0x1050f1f
int3
push 0x80004005
call fcn.010012f0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
push ebx
call 0x1050f3f
jmp 0x1050f44
pushal
call 0x1050f4a
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x1050f5d
jmp 0x1050f62
pushal
call 0x1050f68
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea esi, [esp + 0x44]
call fcn.010504f0
test eax, eax
je 0x1050fbd
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1050f87
sub eax, edx
push eax
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x48]
call fcn.010079c0
push ebx
call 0x1050fa5
jmp 0x1050faa
pushal
call 0x1050fb0
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea ecx, [esp + 0x2c]
call fcn.01067570
push ebx
call 0x1050fcc
jmp 0x1050fd1
pushal
call 0x1050fd7
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea edx, [esp + 0x2c]
push edx
call fcn.010505f0
add esp, 4
push ebx
call 0x1050ff7
jmp 0x1050ffc
pushal
call 0x1051002
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
cmp eax, ebx
jle 0x105104b
push ebx
lea ecx, [esp + 0x30]
call fcn.01067200
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.010518c0
push ebx
call 0x1051033
jmp 0x1051038
pushal
call 0x105103e
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push 0x103
lea edx, [esp + 0x195]
push ebx
push edx
mov byte [esp + 0x19c], bl
call fcn.0109a300
add esp, 0xc
push ebx
call 0x105106e
jmp 0x1051073
pushal
call 0x1051079
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0x190]
push eax
call fcn.01050930
add esp, 4
push ebx
call 0x105109c
jmp 0x10510a1
pushal
call 0x10510a7
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
cmp eax, ebx
jne 0x10510fb
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10510c2
sub eax, edx
push eax
lea ecx, [esp + 0x194]
push ecx
lea ecx, [esp + 0x48]
call fcn.010518c0
push ebx
call 0x10510e3
jmp 0x10510e8
pushal
call 0x10510ee
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push 0x63
lea edx, [esp + 0x5d]
push ebx
push edx
mov byte [esp + 0x64], bl
call fcn.0109a300
add esp, 0xc
push 0x63
lea eax, [esp + 0x12d]
push ebx
push eax
mov byte [esp + 0x134], bl
call fcn.0109a300
add esp, 0xc
push ebx
call 0x105112f
jmp 0x1051134
pushal
call 0x105113a
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x105114d
jmp 0x1051152
pushal
call 0x1051158
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push 0x64
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0x64
lea edx, [esp + 0x70]
push edx
push 0x10ec184
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push ebx
call 0x1051196
jmp 0x105119b
pushal
call 0x10511a1
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x5c]
push 0x10dbc30
push ecx
call fcn.01094420
add esp, 0xc
push ebx
call 0x10511cb
jmp 0x10511d0
pushal
call 0x10511d6
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0x58]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10511f0
sub eax, edx
push eax
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0x48]
call fcn.010518c0
push ebx
call 0x105120e
jmp 0x1051213
pushal
call 0x1051219
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x105122c
jmp 0x1051231
pushal
call 0x1051237
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0x14]
push eax
push 0xf003f
push ebx
push str.HARDWAREDESCRIPTIONSystem
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
call 0x1051265
jmp 0x105126a
pushal
call 0x1051270
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
cmp eax, ebx
jne 0x105141c
mov dword [esp + 0x28], 7
push ebx
call 0x1051293
jmp 0x1051298
pushal
call 0x105129e
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push 0x63
lea ecx, [esp + 0x29d]
push ebx
push ecx
mov byte [esp + 0x2a4], bl
call fcn.0109a300
add esp, 0xc
push ebx
call 0x10512cb
jmp 0x10512d0
pushal
call 0x10512d6
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov dword [esp + 0x24], 0x64
push ebx
call 0x10512f1
jmp 0x10512f6
pushal
call 0x10512fc
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x105130f
jmp 0x1051314
pushal
call 0x105131a
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x29c]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push str.SystemBiosVersion
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
call 0x1051350
jmp 0x1051355
pushal
call 0x105135b
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
cmp eax, ebx
jne 0x10513b0
mov ecx, dword [esp + 0x24]
xor eax, eax
add ecx, 0xffffffff
je 0x10513b0
cmp byte [esp + eax + 0x298], bl
jne 0x10513a6
mov byte [esp + eax + 0x298], 0x20
push ebx
call 0x105138e
jmp 0x1051393
pushal
call 0x1051399
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov edx, dword [esp + 0x24]
inc eax
dec edx
cmp eax, edx
jb 0x1051377
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call 0x10513c1
jmp 0x10513c6
pushal
call 0x10513cc
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0x298]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10513e3
sub eax, edx
push eax
lea ecx, [esp + 0x29c]
push ecx
lea ecx, [esp + 0x48]
call fcn.010518c0
push ebx
call 0x1051404
jmp 0x1051409
pushal
call 0x105140f
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea edx, [esp + 0x40]
push edx
call fcn.01051690
push ebx
call 0x105142c
jmp 0x1051431
pushal
call 0x1051437
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push 0x63
lea eax, [esp + 0xc5]
push ebx
push eax
mov byte [esp + 0xcc], bl
call fcn.0109a300
add esp, 0xc
push ebx
call 0x1051464
jmp 0x1051469
pushal
call 0x105146f
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov esi, dword [esp + 0x40]
mov eax, dword [esi - 0xc]
cmp eax, 0x50
mov edi, 0x50
jg 0x105148f
mov edi, eax
mov ecx, 1
sub ecx, dword [esi - 4]
or ecx, dword [esi - 8]
jge 0x10514aa
push ebx
lea ecx, [esp + 0x44]
call fcn.01007a70
mov esi, dword [esp + 0x40]
push edi
lea edx, [esp + 0xc4]
push esi
push edx
call fcn.0109e820
add esp, 0xc
push ebx
call 0x10514c2
jmp 0x10514c7
pushal
call 0x10514cd
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0xc0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10514e4
sub eax, edx
push eax
lea eax, [esp + 0xc4]
push eax
mov ecx, ebp
call fcn.010079c0
push ebx
call 0x1051503
jmp 0x1051508
pushal
call 0x105150e
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x1051521
jmp 0x1051526
pushal
call 0x105152c
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea ecx, [esp + 0x2c]
call fcn.010675f0
add esi, 0xfffffff0
cmp dword [esi + 0xc], ebx
lea edi, [esi + 0xc]
jne 0x105156a
push str.nRefs___0
push ebx
push 0x6b
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VC_atlmfcinclude_atlsimpstr.h
push 2
call fcn.01090630
add esp, 0x14
cmp eax, 1
jne 0x105156a
int3
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x1051580
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x304]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.01090090
add esp, 0x2f8
ret 4