Function at 0x3004df80
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x3021be88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov al, 0x41
mov dword [ebp - 0x11c], 0
push esi
mov word [ebp - 0x117], 0x3a
mov byte [ebp - 0x10d], al
push edi
mov byte [ebp - 0x118], al
lea eax, [ebp - 0x108]
push 0x104
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x3004e121
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004dfe1
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004dffe
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004e007
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
mov dword [ebp - 0x10c], edx
test ecx, ecx
je 0x3004e03b
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3004e03b
push ebx
popfd
test edx, edx
je 0x3004e06b
lea ecx, [ebp - 0x118]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004e048
sub ecx, esi
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x118]
push eax
push edx
call fcn.3016bc70
mov edx, dword [ebp - 0x10c]
add esp, 0xc
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x108]
mov dword [eax*4 + 0x30246680], edx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004e081
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004e0a3
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004e0ac
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004e0df
mov dword [eax + 0x34], esi
mov dword [eax + 0xbf4], edi
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x3004e0df
push eax
popfd
test ebx, ebx
je 0x3004e10d
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004e0f0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.3016bc70
add esp, 0xc
mov esi, dword [ebp - 0x11c]
mov dword [esi*4 + 0x30246608], ebx
inc esi
mov dword [ebp - 0x11c], esi
mov al, byte [ebp - 0x10d]
inc al
mov byte [ebp - 0x10d], al
cmp al, 0x5a
jle 0x3004dfb1
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x3004e16b
push str.specialname_map_init:_Unable_to_query_Windows_directory
call fcn.30009b40
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004e184
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004e18d
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push 0xc
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004e1be
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x3004e1be
push eax
popfd
test esi, esi
je 0x3004e1d2
push 0xc
push str._systemroot
push esi
call fcn.3016bc70
add esp, 0xc
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov dword [eax*4 + 0x30246608], esi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004e1e8
sub ecx, edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004e20a
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004e213
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov ebx, eax
test ecx, ecx
je 0x3004e247
mov eax, dword [ebp - 0x10c]
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test eax, eax
je 0x3004e247
push eax
popfd
test ebx, ebx
je 0x3004e271
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004e254
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.3016bc70
add esp, 0xc
mov eax, dword [ebp - 0x11c]
lea esi, [ebp - 0x108]
lea ecx, [esi + 1]
mov dword [eax*4 + 0x30246680], ebx
inc eax
mov dword [ebp - 0x11c], eax
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x3004e290
sub esi, ecx
lea ecx, [esi + 9]
mov dword [ebp - 0x114], ecx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004e2bb
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004e2c4
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
test ecx, ecx
je 0x3004e2f8
mov eax, dword [ebp - 0x10c]
mov dword [ecx + 0x34], edi
mov dword [ecx + 0xbf4], ebx
test eax, eax
je 0x3004e2f8
push eax
popfd
mov dword [0x3024667c], edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x10c]
test eax, eax
jne 0x3004e317
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004e320
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [esi*2 + 0x14]
push eax
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004e357
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x3004e357
push eax
popfd
mov ecx, dword [0x3024667c]
lea edi, [ebp - 0x108]
mov ebx, ecx
mov dword [0x30246674], edx
mov eax, edi
sub ebx, eax
nop
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [ebx + edi - 1], al
test al, al
jne 0x3004e370
dec ecx
mov edi, edi
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x3004e380
mov eax, dword [0x30208498]
mov dword [ecx], eax
mov eax, dword [0x3020849c]
mov dword [ecx + 4], eax
mov ax, word [0x302084a0]
mov word [ecx + 8], ax
xor ecx, ecx
test esi, esi
je 0x3004e3c2
lea esp, [esp]
movsx ax, byte [ebp + ecx - 0x108]
mov word [edx + ecx*2], ax
inc ecx
cmp ecx, esi
jb 0x3004e3b0
add edx, 0xfffffffe
mov ax, word [edx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x3004e3c5
mov eax, dword [str._system32]
lea esi, [ebp - 0x108]
mov dword [edx], eax
lea ecx, [esi + 1]
mov eax, dword [0x302084a8]
mov dword [edx + 4], eax
mov eax, dword [0x302084ac]
mov dword [edx + 8], eax
mov eax, dword [0x302084b0]
mov dword [edx + 0xc], eax
mov eax, dword [0x302084b4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x114]
mov dword [0x302466ec], eax
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x3004e410
sub esi, ecx
lea ecx, [esi + 0xa]
mov dword [ebp - 0x10c], ecx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x114]
test eax, eax
jne 0x3004e43b
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004e444
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [ecx + 1]
push eax
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
test ecx, ecx
je 0x3004e478
mov eax, dword [ebp - 0x114]
mov dword [ecx + 0x34], edi
mov dword [ecx + 0xbf4], ebx
test eax, eax
je 0x3004e478
push eax
popfd
mov dword [0x30246764], edx
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x114]
test eax, eax
jne 0x3004e497
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004e4a0
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
lea eax, [esi*2 + 0x16]
push eax
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004e4d7
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x3004e4d7
push eax
popfd
mov edx, dword [0x30246764]
lea edi, [ebp - 0x108]
mov ebx, edx
mov dword [0x30246778], ecx
mov eax, edi
sub ebx, eax
nop
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [ebx + edi - 1], al
test al, al
jne 0x3004e4f0
dec edx
mov edi, edi
mov al, byte [edx + 1]
lea edx, [edx + 1]
test al, al
jne 0x3004e500
mov eax, dword [0x302084b8]
mov dword [edx], eax
mov eax, dword [0x302084bc]
mov dword [edx + 4], eax
mov ax, word [0x302084c0]
mov word [edx + 8], ax
mov al, byte [0x302084c2]
mov byte [edx + 0xa], al
xor edx, edx
test esi, esi
je 0x3004e543
movsx ax, byte [ebp + edx - 0x108]
mov word [ecx + edx*2], ax
inc edx
cmp edx, esi
jb 0x3004e531
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x3004e546
mov eax, dword [str._sysnative]
xor esi, esi
mov dword [ecx], eax
mov eax, dword [0x302084c8]
mov dword [ecx + 4], eax
mov eax, dword [0x302084cc]
mov dword [ecx + 8], eax
mov eax, dword [0x302084d0]
mov dword [ecx + 0xc], eax
mov eax, dword [0x302084d4]
mov dword [ecx + 0x10], eax
mov ax, word [0x302084d8]
mov word [ecx + 0x14], ax
mov eax, dword [ebp - 0x10c]
mov dword [0x30246678], eax
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x3004e71d
mov edi, edi
mov ecx, dword [esi*4 + 0x30246680]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004e5b0
sub ecx, edx
lea edi, [ecx + 1]
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x114]
test eax, eax
jne 0x3004e5dc
or ebx, 0xffffffff
mov dword [ebp - 0x10c], 0xffffffff
jmp 0x3004e5eb
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x10c], eax
lea eax, [edi + edi]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x120], eax
test edx, edx
je 0x3004e629
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x10c]
mov dword [edx + 0x34], ebx
mov dword [edx + 0xbf4], ecx
test eax, eax
je 0x3004e629
push eax
popfd
mov eax, dword [ebp - 0x120]
xor edx, edx
mov dword [esi*4 + 0x30246780], eax
test edi, edi
je 0x3004e65c
lea esp, [esp]
mov eax, dword [esi*4 + 0x30246680]
movsx cx, byte [eax + edx]
mov eax, dword [esi*4 + 0x30246780]
mov word [eax + edx*2], cx
inc edx
cmp edx, edi
jb 0x3004e640
mov ecx, dword [esi*4 + 0x30246608]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3004e666
sub ecx, edx
lea edi, [ecx + 1]
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0x120]
test eax, eax
jne 0x3004e692
or ebx, 0xffffffff
mov dword [ebp - 0x10c], 0xffffffff
jmp 0x3004e6a1
mov ebx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 0x10c], eax
lea eax, [edi + edi]
push eax
push 0
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword fs:[0x18]
mov dword [ebp - 0x114], eax
test edx, edx
je 0x3004e6df
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x10c]
mov dword [edx + 0x34], ebx
mov dword [edx + 0xbf4], ecx
test eax, eax
je 0x3004e6df
push eax
popfd
mov eax, dword [ebp - 0x114]
xor edx, edx
mov dword [esi*4 + 0x302466f8], eax
test edi, edi
je 0x3004e70e
mov eax, dword [esi*4 + 0x30246608]
movsx cx, byte [eax + edx]
mov eax, dword [esi*4 + 0x302466f8]
mov word [eax + edx*2], cx
inc edx
cmp edx, edi
jb 0x3004e6f2
mov eax, dword [ebp - 0x11c]
inc esi
cmp esi, eax
jb 0x3004e5a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x3024676c], eax
pop ebx
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret