Function at 0x1000ce70
Capabilities:
Get disk information
Get disk size
Get hostname

Disassembly:
sub esp, 0x4f0
push ebp
mov ebp, dword [esp + 0x4f8]
push esi
mov dword [esp + 0x10], ecx
push edi
mov ecx, 0x116
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2f5]
mov byte [esp + 0x2f4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x2f4]
push 0x104
push eax
push 0
mov word [ebp + 0x54], 0x70
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleBaseNameA
lea edi, [esp + 0x2f4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x28
jb 0x1000ceea
mov byte [esp + 0x31b], al
lea edi, [esp + 0x2f4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x3b2]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x1f4], 0
mov eax, ecx
mov esi, edi
mov edi, edx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [esp + 0x1f8]
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x3f
lea edi, [esp + 0x1f9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1f8]
mov ebx, 0x100
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x1000cf9e
mov edi, str.UNKNOWN
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1f8]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1f8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x1000cfa2
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x20
jbe 0x1000cfb0
mov ecx, 0x20
mov dword [esp + 0x1c], ecx
mov byte [esp + ecx + 0x1f8], 0
lea edi, [esp + 0x1f8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0xf8], al
mov edx, ecx
mov esi, edi
mov edi, ebp
push str.advapi32.dll
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x18], ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x3f
lea edi, [esp + 0xfd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xfc]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x1000d087
push str.GetUserNameA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d03c
lea ecx, [esp + 0x14]
lea edx, [esp + 0xf8]
push ecx
push edx
call eax
test eax, eax
jne 0x1000d07a
mov edi, str.UNKNOWN
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xf8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x14]
jmp 0x1000d0c5
mov edi, str.UNKNOWN
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xf8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0x20
jbe 0x1000d0d3
mov ecx, 0x20
mov dword [esp + 0x14], ecx
mov byte [esp + ecx + 0xf8], 0
lea edi, [esp + 0xf8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp + 0x20]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x5c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x50]
push ecx
push edx
mov ecx, esi
call fcn.1000d550
mov ecx, esi
mov edi, eax
call fcn.1000d430
test eax, eax
je 0x1000d12d
mov byte [ebp + 0x439], 1
jmp 0x1000d134
mov byte [ebp + 0x439], 0
xor ebx, ebx
cmp edi, ebx
je 0x1000d1f2
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov si, word [esp + 0xf4]
mov dword [ebp + 0x432], ecx
mov cl, byte [esp + 0xf6]
cmp eax, 5
mov dword [ebp + 0x42a], eax
mov dword [ebp + 0x42e], edx
mov byte [ebp + 0x438], cl
mov word [ebp + 0x436], si
jne 0x1000d197
cmp edx, 2
jne 0x1000d197
cmp cl, 1
je 0x1000d197
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov byte [ebp + 0x43a], al
jmp 0x1000d19e
mov byte [ebp + 0x43a], 0
lea edi, [esp + 0x70]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x1e
jbe 0x1000d1c9
lea edx, [esp + 0x70]
push 0x1e
lea eax, [ebp + 0x43b]
push edx
push eax
call fcn.10013e80
add esp, 0xc
jmp 0x1000d1f2
lea edi, [esp + 0x70]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x43b]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
cmp edi, ebx
jne 0x1000d216
mov dword [ebp + 0x40], ebx
jmp 0x1000d322
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [esp + 0x13], 1
mov dword [esp + 0x30], ebx
mov eax, edi
mov ecx, ebx
shr eax, cl
test eax, eax
je 0x1000d2d9
test al, 1
je 0x1000d2c8
mov cl, bl
lea edx, [esp + 0x34]
add cl, 0x41
push edx
mov byte [esp + 0x38], cl
mov byte [esp + 0x39], 0x3a
mov byte [esp + 0x3a], 0x5c
mov byte [esp + 0x3b], 0
call esi
cmp eax, 3
jne 0x1000d2c8
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x40]
or ecx, eax
lea eax, [esp + 0x54]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x48]
push ecx
push edx
lea ecx, [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x1000d2d4
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x44]
add ecx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x24]
adc ecx, eax
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x48]
add eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
adc eax, edx
mov dword [esp + 0x2c], eax
inc ebx
cmp ebx, 0x1a
jl 0x1000d225
jmp 0x1000d2d9
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x30]
mov dword [ebp + 0x40], eax
mov al, byte [esp + 0x13]
test al, al
je 0x1000d320
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push 0
push 0x40000000
push ecx
push edx
call fcn.10013f80
mov ecx, dword [esp + 0x28]
mov dword [ebp + 0x44], eax
mov eax, dword [esp + 0x2c]
push 0
push 0x40000000
push eax
push ecx
mov dword [ebp + 0x48], edx
call fcn.10013f80
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x50], edx
xor ebx, ebx
mov ecx, 0x10055f68
call fcn.1000a940
mov edi, 0x100560f6
lea esi, [ebp + 0x5c]
mov eax, dword [0x10055f6c]
cmp eax, 0xa
jl 0x1000d343
mov eax, 0xa
cmp ebx, eax
jge 0x1000d387
lea edx, [edi - 0x86]
lea eax, [esi - 6]
push esi
push edi
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [esp + 0x20]
mov dx, word [edx + 4]
mov word [eax + 4], dx
call fcn.1000d470
lea eax, [esi + 0x28]
lea ecx, [edi + 0x80]
push eax
push ecx
mov ecx, dword [esp + 0x20]
call fcn.1000d470
inc ebx
add esi, 0x56
add edi, 0x306
jmp 0x1000d334
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x3fd]
mov byte [esp + 0x3fc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x3fc]
push 0x104
push edx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x3fc]
push 0x5c
push eax
call fcn.10013240
add esp, 8
test eax, eax
pop ebx
je 0x1000d3d1
inc eax
jmp 0x1000d3d8
lea eax, [esp + 0x3f8]
push 0x27
push eax
lea eax, [ebp + 0x3b2]
push eax
call fcn.10013e80
mov esi, dword [esp + 0x20]
push 0x27
lea edx, [ebp + 0x3da]
mov byte [ebp + 0x3d9], 0
lea ecx, [esi + 4]
push ecx
push edx
call fcn.10013e80
add esi, 0x2c
push 0x27
add ebp, 0x402
push esi
push ebp
call fcn.10013e80
add esp, 0x24
pop edi
pop esi
pop ebp
add esp, 0x4f0
ret 4