Function at 0x1000ee10
Capabilities:
Create process on windows
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x12bc]
mov eax, 0x12bc
call fcn.100135f0
push 0xffffffffffffffff
push 0x10028738
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x10032ba0]
xor eax, ebp
mov dword [ebp + 0x12b8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x34], 7
call fcn.100014c0
cmp dword [ebp + 0x12c8], ebx
mov edi, dword [ebp + 0x12c4]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x4b
jl 0x1000f45e
jg 0x1000ee8b
cmp edi, 1
jb 0x1000f45e
cmp dword [ebp + 0x12c8], ebx
jg 0x1000f45e
mov ecx, 0x800000
jl 0x1000eea6
cmp edi, ecx
ja 0x1000f45e
mov eax, 0x200
cmp edi, eax
jg 0x1000f060
je 0x1000eee2
cmp edi, 0x10
jg 0x1000ef87
je 0x1000ef35
mov eax, edi
dec eax
je 0x1000ef18
dec eax
je 0x1000eed5
dec eax
dec eax
je 0x1000eed5
sub eax, 4
jne 0x1000f45e
push 0x1002ae10
lea ecx, [ebp + 0x1c]
call fcn.1000a5fa
cmp dword [ebp + 0x30], ebx
jne 0x1000eef4
push 0x1002ae0c
lea ecx, [ebp + 0x1c]
call fcn.1000a5fa
push 0x1002ae04
lea ecx, [ebp + 0x1c]
call fcn.1000a5fa
push dword [ebp + 0x12c8]
lea eax, [ebp + 0x1c]
push edi
push eax
mov ecx, esi
call fcn.1000dd9a
jmp 0x1000f470
push ebx
lea ecx, [esi + 0x38]
call fcn.1000be6a
cmp dword [eax + 0x18], 8
jb 0x1000ef2c
mov eax, dword [eax + 4]
jmp 0x1000ef2f
add eax, 4
push eax
jmp 0x1000f18f
push 0x1002ae10
lea ecx, [ebp + 0x1c]
call fcn.1000a5fa
push 0x1003435c
lea ecx, [ebp - 0x10]
call fcn.10005472
push str._smart
lea eax, [ebp - 0x10]
push 0x1002aba0
push eax
mov byte [ebp - 4], 5
call fcn.100057f9
add esp, 0xc
push dword [ebp - 0x10]
lea ecx, [ebp + 0x1c]
call fcn.1000a5fa
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.100051b7
jmp 0x1000eef4
cmp edi, 0x20
je 0x1000f04f
cmp edi, 0x3f
jle 0x1000f45e
cmp edi, 0x42
jle 0x1000efd4
cmp edi, 0x80
je 0x1000efc3
cmp edi, 0x100
jne 0x1000f45e
push ebx
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.1000e06d
jmp 0x1000f470
push ebx
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.1000e154
jmp 0x1000f470
mov eax, dword [esi + 0x48]
sub eax, dword [esi + 0x44]
add edi, 0xffffffc0
push 0x1c
mov dword [ebp - 0x10], edi
cdq
pop edi
idiv edi
mov ecx, 0x100299ac
mov dword [ebp + 0x12b4], ecx
test eax, eax
je 0x1000f024
lea ecx, [esi + 0x20]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
cdq
idiv edi
cmp dword [ebp - 0x10], eax
jge 0x1000f01e
push dword [ebp - 0x10]
call fcn.1000be6a
cmp dword [eax + 0x18], 8
jb 0x1000f019
mov ecx, dword [eax + 4]
jmp 0x1000f024
lea ecx, [eax + 4]
jmp 0x1000f024
mov ecx, dword [ebp + 0x12b4]
push ecx
push 0x104
lea eax, [ebp + 0x1068]
push eax
mov ecx, esi
call fcn.1000d2b0
lea eax, [ebp + 0x1068]
push eax
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.1000df6e
jmp 0x1000f470
push ebx
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.1000e363
jmp 0x1000f470
mov eax, 0x80000
cmp edi, eax
jg 0x1000f23c
je 0x1000f1f8
cmp edi, 0x400
je 0x1000f19f
mov eax, 0x40000
cmp edi, 0x10000
je 0x1000f09c
cmp edi, 0x20000
je 0x1000f09c
cmp edi, eax
jne 0x1000f45e
mov dword [ebp - 0x14], 0x4d
cmp edi, eax
jne 0x1000f10e
cmp dword [ebp + 0x12c8], ebx
jne 0x1000f10e
push 8
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.1000d623
push ebx
lea ecx, [esi + 0x38]
call fcn.1000be6a
cmp dword [eax + 0x18], 8
jb 0x1000f0d0
mov eax, dword [eax + 4]
jmp 0x1000f0d3
add eax, 4
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.1000d5bf
pop ecx
pop ecx
push ebx
lea ecx, [esi + 4]
call fcn.1000c071
movzx eax, word [eax]
push eax
push str._drv:_c
lea eax, [ebp + 0xc]
push 8
push eax
call fcn.10016eef
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.1000d5bf
add esp, 0x18
jmp 0x1000f11b
push 4
lea eax, [ebp + 0x1c]
push eax
mov ecx, esi
call fcn.1000d623
mov eax, dword [0x1002addc]
mov dword [ebp + 0x12b0], eax
mov eax, dword [0x1002ade0]
mov dword [ebp + 0x12b4], eax
mov dword [ebp - 0x10], 0x5a
mov ax, word [ebp - 0x10]
mov word [ebp + 0x12b0], ax
lea eax, [ebp + 0x12b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x1000f160
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x41
jge 0x1000f138
jmp 0x1000f172
lea eax, [ebp + 0x12b0]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.1000d5bf
pop ecx
pop ecx
cmp edi, 0x20000
jne 0x1000f470
cmp dword [ebp + 0x12c8], ebx
jne 0x1000f470
push str._drv:0
lea eax, [ebp + 0x1c]
push eax
call fcn.1000d5bf
pop ecx
pop ecx
jmp 0x1000f470
lea eax, [ebp + 0x1c]
push 0x54
push eax
call fcn.1000d10e
pop ecx
pop ecx
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 7
call fcn.100014c0
push 2
lea eax, [ebp]
push eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.1000d623
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x1000f1d9
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.1000d5bf
pop ecx
pop ecx
lea ecx, [ebp]
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.100015a0
jmp 0x1000f470
cmp dword [esi + 0x1c], 8
mov dword [ebp - 0x14], 0x4d
jb 0x1000f20a
mov eax, dword [esi + 8]
jmp 0x1000f20d
lea eax, [esi + 8]
push eax
push str._unmount
lea eax, [ebp + 0x1270]
push str.__s___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp + 0x1270]
push eax
lea ecx, [ebp + 0x1c]
call fcn.1000a5fa
jmp 0x1000f470
cmp edi, 0x100000
je 0x1000f41d
cmp edi, 0x200000
je 0x1000f3df
cmp edi, 0x400000
je 0x1000f367
cmp edi, ecx
jne 0x1000f45e
mov edi, 0x1002a38c
push edi
lea ecx, [ebp - 0xc0]
call fcn.10001200
push eax
lea eax, [ebp - 0xa4]
push 0x1002ad9c
push eax
mov byte [ebp - 4], 1
call fcn.1000db7e
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call fcn.10001ac0
push ebx
push 1
lea ecx, [ebp - 0xa4]
call fcn.100015a0
push ebx
push 1
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], bl
call fcn.100015a0
lea ecx, [esi + 0x38]
push ebx
call fcn.1000be6a
cmp dword [eax + 0x18], 8
jb 0x1000f2d5
mov eax, dword [eax + 4]
jmp 0x1000f2d8
add eax, 4
push edi
push eax
call fcn.10012fbd
pop ecx
pop ecx
test eax, eax
je 0x1000f34d
mov edi, 0x1002a5ec
push edi
lea ecx, [ebp - 0x6c]
call fcn.10001200
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call fcn.1000a129
push ebx
push 1
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], bl
call fcn.100015a0
push ebx
lea ecx, [esi + 0x38]
call fcn.1000be6a
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
call fcn.1000a129
push edi
lea ecx, [ebp - 0x88]
call fcn.10001200
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 4
call fcn.1000a129
lea ecx, [ebp - 0x88]
jmp 0x1000f1e8
push ebx
lea ecx, [esi + 0x38]
call fcn.1000be6a
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
call fcn.1000a129
jmp 0x1000f470
cmp dword [esi + 0x1c], 8
mov dword [ebp - 0x14], 0x4d
jb 0x1000f379
mov eax, dword [esi + 8]
jmp 0x1000f37c
lea eax, [esi + 8]
push eax
lea eax, [ebp + 0xe60]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
lea ecx, [esi + 0x38]
call fcn.1000be6a
cmp dword [eax + 0x18], 8
jb 0x1000f39e
mov eax, dword [eax + 4]
jmp 0x1000f3a1
add eax, 4
push eax
lea eax, [ebp + 0xe60]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0xe60]
push eax
push str._unmount
lea eax, [ebp + 0x38]
push 0x1002ad8c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.1000d5bf
add esp, 0x18
jmp 0x1000f470
push 0x4d
pop edi
lea eax, [ebp + 0x1c]
push edi
push eax
call fcn.1000d10e
pop ecx
pop ecx
push ebx
lea ecx, [esi + 4]
mov dword [ebp - 0x14], edi
call fcn.1000c071
movzx eax, word [eax]
push eax
push str._reomveimage:
lea eax, [ebp + 0x858]
push str._s_C
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0x858]
jmp 0x1000f3cd
push 0x4d
pop edi
lea eax, [ebp + 0x1c]
push edi
push eax
call fcn.1000d10e
pop ecx
pop ecx
push ebx
lea ecx, [esi + 4]
mov dword [ebp - 0x14], edi
call fcn.1000c071
movzx eax, word [eax]
push eax
push str._insertimage:
lea eax, [ebp + 0xa58]
push str._s_C
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp + 0xa58]
jmp 0x1000f3cd
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x12c8]
mov ecx, esi
push edi
call fcn.1000e64d
cmp dword [ebp + 0x30], ebx
je 0x1000f502
push dword [ebp - 0x14]
lea eax, [ebp + 0xc58]
push 0x104
push eax
call fcn.10009f51
add esp, 0xc
test eax, eax
je 0x1000f502
cmp dword [esi + 0x1c], 8
jb 0x1000f49f
mov edi, dword [esi + 8]
jmp 0x1000f4a2
lea edi, [esi + 8]
add esi, 0x9c
cmp word [esi], bx
je 0x1000f4af
mov edi, esi
push 0x38
lea eax, [ebp - 0x4c]
push ebx
push eax
mov dword [ebp - 0x50], 0x3c
call fcn.10013370
lea eax, [ebp + 0xc58]
add esp, 0xc
cmp dword [ebp + 0x34], 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x38], edi
jae 0x1000f4e4
lea eax, [ebp + 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push ebx
push 1
lea ecx, [ebp + 0x1c]
mov esi, eax
call fcn.100015a0
mov eax, esi
jmp 0x1000f50f
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.100015a0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x12b8]
xor ecx, ebp
call fcn.100135dc
add ebp, 0x12bc
leave
ret 8