Function at 0x1000c9f0
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x19c], 0
mov dword [0x10021350], 0
mov byte [0x1002137e], 0
mov byte [0x10021588], 0
mov byte [0x1002158a], 0
mov byte [0x1002137f], 0
mov byte [0x1002137d], 0
mov byte [0x10021589], 0
mov byte [0x1002137c], 0
mov dword [0x10021798], 0
push 0x208
push 0
push 0x10021590
call dword [sym.imp.ntdll.dll_memset]
add esp, 0xc
push 0x208
push 0
push 0x10021380
call dword [sym.imp.ntdll.dll_memset]
add esp, 0xc
mov dword [ebp - 0x198], 0x114
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jge 0x1000caad
mov eax, dword [ebp - 0x19c]
jmp 0x1000ccc2
mov ecx, dword [ebp - 0x18c]
mov dword [0x10021378], ecx
push str.rpcrt4.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jne 0x1000cade
mov eax, dword [ebp - 0x19c]
jmp 0x1000ccc2
push str.I_RpcBindingInqLocalClientPID
mov edx, dword [ebp - 0x1a8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10021798], eax
push 0x104
push 0x10021380
push str._SystemRoot_System32
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1000cb19
mov eax, dword [ebp - 0x19c]
jmp 0x1000ccc2
mov eax, 2
shl eax, 1
mov cx, word [eax + 0x10021380]
mov word [ebp - 0x1a0], cx
mov edx, 2
shl edx, 1
mov dword [ebp - 0x1ac], edx
cmp dword [ebp - 0x1ac], 0x208
jae 0x1000cb49
jmp 0x1000cb4e
call fcn.1000134a
xor eax, eax
mov ecx, dword [ebp - 0x1ac]
mov word [ecx + 0x10021380], ax
push 0x40
lea edx, [ebp - 0x84]
push edx
push 0x10021380
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1000cb95
mov eax, 2
shl eax, 1
mov cx, word [ebp - 0x1a0]
mov word [eax + 0x10021380], cx
mov eax, dword [ebp - 0x19c]
jmp 0x1000ccc2
lea edx, [ebp - 0x84]
push edx
push 0x10021590
call dword [sym.imp.ntdll.dll_wcscpy]
add esp, 8
push 0x1001c764
push 0x10021590
call dword [sym.imp.ntdll.dll_wcscat]
add esp, 8
push 0x10021590
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
mov dword [ebp - 0x1b0], eax
push 0x10021386
mov eax, dword [ebp - 0x1b0]
lea ecx, [eax*2 + 0x10021590]
push ecx
call dword [sym.imp.ntdll.dll_wcscpy]
add esp, 8
mov edx, 2
shl edx, 1
mov ax, word [ebp - 0x1a0]
mov word [edx + 0x10021380], ax
call fcn.1000c6b0
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jge 0x1000cc21
mov eax, dword [ebp - 0x19c]
jmp 0x1000ccc2
call fcn.10013f70
test eax, eax
je 0x1000cc51
call fcn.10013a40
test eax, eax
je 0x1000cc49
mov dword [ebp - 0x19c], 1
mov cl, byte [ebp - 0x19c]
mov byte [0x1002137e], cl
mov eax, dword [ebp - 0x19c]
jmp 0x1000ccc2
call fcn.10010fd0
test eax, eax
je 0x1000cc81
call fcn.10011160
test eax, eax
je 0x1000cc79
mov dword [ebp - 0x19c], 1
mov dl, byte [ebp - 0x19c]
mov byte [0x10021588], dl
mov eax, dword [ebp - 0x19c]
jmp 0x1000ccc2
push 0x1001c768
call fcn.1000c700
add esp, 4
movzx eax, al
test eax, eax
je 0x1000ccbc
call fcn.1000b890
test eax, eax
je 0x1000ccb4
mov dword [ebp - 0x19c], 1
mov cl, byte [ebp - 0x19c]
mov byte [0x1002137c], cl
mov eax, dword [ebp - 0x19c]
jmp 0x1000ccc2
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001162
mov esp, ebp
pop ebp
ret