Function at 0x49a188
Capabilities:
Get disk information
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x574], ecx
mov dword [ebp - 0x570], ecx
mov ebx, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x49a63b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x16c]
call fcn.00499fd8
test bl, bl
je 0x49a323
test byte [ebp - 1], 1
je 0x49a479
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x49a64c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x49a276
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x49a678
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x49a26d
mov bl, 1
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0049a020
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x49a688
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x49a26d
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0049a020
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
test bl, bl
jne 0x49a479
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x49a6a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x49a479
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x49a678
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x49a315
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0049a020
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x49a688
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x49a315
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0049a020
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x49a479
test byte [ebp - 1], 1
je 0x49a479
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x49a64c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x49a3d1
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x49a678
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x49a3c8
mov bl, 1
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0049a020
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x49a688
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x49a3c8
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0049a020
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
test bl, bl
jne 0x49a479
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x49a6a0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x49a479
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x49a678
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x49a470
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0049a020
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56c]
push eax
push 0
push 0
push 0x49a688
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x49a470
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 0xc]
call fcn.0049a020
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
test byte [ebp - 1], 2
je 0x49a4b4
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetSystemInfo
lea eax, [ebp - 0x56c]
mov edx, dword [ebp - 0x54]
mov dword [eax], edx
lea eax, [ebp - 0x568]
mov edx, dword [ebp - 0x3c]
mov dword [eax], edx
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, 8
call fcn.0049a020
test byte [ebp - 1], 4
je 0x49a54e
lea eax, [ebp - 0x20]
push eax
call sub.ole32.dll_CoCreateGuid
lea eax, [ebp - 0x30]
push eax
call sub.ole32.dll_CoCreateGuid
push 0x49a6d0
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x49a505
push 0x49a6dc
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
mov esi, edi
test edi, edi
je 0x49a4ff
lea eax, [ebp - 0x20]
push eax
call esi
lea eax, [ebp - 0x30]
push eax
call esi
push ebx
call sub.kernel32.dll_FreeLibrary
movzx eax, byte [ebp - 0x16]
cmp al, byte [ebp - 0x26]
jne 0x49a54e
movzx eax, byte [ebp - 0x15]
cmp al, byte [ebp - 0x25]
jne 0x49a54e
movzx eax, byte [ebp - 0x14]
cmp al, byte [ebp - 0x24]
jne 0x49a54e
movzx eax, byte [ebp - 0x13]
cmp al, byte [ebp - 0x23]
jne 0x49a54e
movzx eax, byte [ebp - 0x12]
cmp al, byte [ebp - 0x22]
jne 0x49a54e
movzx eax, byte [ebp - 0x11]
cmp al, byte [ebp - 0x21]
jne 0x49a54e
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16c]
mov ecx, 6
call fcn.0049a020
test byte [ebp - 1], 8
je 0x49a60a
mov bl, 0x43
lea eax, [ebp - 0x570]
mov edx, ebx
call fcn.00404e48
lea eax, [ebp - 0x570]
mov edx, 0x49a6fc
call fcn.00404f2c
mov eax, dword [ebp - 0x570]
call fcn.004050f0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x49a600
lea eax, [ebp - 0x56c]
xor ecx, ecx
mov edx, 0x400
call fcn.00403598
mov byte [ebp - 0x56c], bl
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x56b]
push eax
push 0
push 0
lea eax, [ebp - 0x574]
mov edx, ebx
call fcn.00404e48
lea eax, [ebp - 0x574]
mov edx, 0x49a6fc
call fcn.00404f2c
mov eax, dword [ebp - 0x574]
call fcn.004050f0
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea edx, [ebp - 0x56c]
lea eax, [ebp - 0x16c]
mov ecx, 5
call fcn.0049a020
inc ebx
cmp bl, 0x5b
jne 0x49a55a
lea edx, [ebp - 8]
lea eax, [ebp - 0x16c]
mov ecx, 4
call fcn.0049a128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a642
lea eax, [ebp - 0x574]
mov edx, 2
call fcn.00404c84
ret