Function at 0x1000fe50
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019e925
mov eax, dword fs:[0]
push eax
sub esp, 0x6f4
mov eax, dword [0x1020f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x700], esi
mov dword [ebp - 0x6f4], 0
mov dword [ebp - 0x6fc], esi
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x208
lea eax, [ebp - 0x258]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x6f4], 1
call fcn.10176a90
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ecx, ecx
mov edx, eax
mov dword [ebp - 0x6f0], edx
mov dword [ebp - 0x6e4], ecx
lea edi, [ecx + 0xa]
nop dword [eax + eax]
mov eax, 1
shl eax, cl
test edx, eax
je 0x10010a6b
lea eax, [ecx + 0x41]
push eax
push str._c:_
lea eax, [ebp - 0x258]
push 0x104
push eax
call fcn.10011da0
add esp, 0x10
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0x208
mov dword [ebp - 0x6ac], eax
lea eax, [ebp - 0x668]
push 0
push eax
call fcn.10176a90
push 0x208
lea eax, [ebp - 0x460]
push 0
push eax
call fcn.10176a90
add esp, 0x18
mov dword [ebp - 0x69c], 0
lea eax, [ebp - 0x460]
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], 0
push 0x104
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x6a4]
push eax
lea eax, [ebp - 0x69c]
push eax
push 0x104
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [ebp - 0x6f8], eax
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x688], 0
movups xmmword [ebp - 0x698], xmm0
mov dword [ebp - 0x684], 7
mov word [ebp - 0x698], ax
lea esi, [ebp - 0x258]
mov dword [ebp - 4], 1
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10010000
sub esi, ecx
sar esi, 1
cmp esi, 7
ja 0x1001003f
mov dword [ebp - 0x688], esi
lea eax, [ebp - 0x258]
add esi, esi
push esi
push eax
lea eax, [ebp - 0x698]
push eax
call fcn.10176510
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x698], ax
jmp 0x100100b0
cmp esi, 0x7ffffffe
ja 0x10010a98
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x1001005e
mov eax, SysReAllocString
jmp 0x10010064
cmp eax, 0xa
cmovb eax, edi
mov dword [ebp - 0x6a8], eax
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x698]
push eax
call fcn.1000eb50
mov edi, eax
mov dword [ebp - 0x688], esi
mov eax, dword [ebp - 0x6a8]
add esi, esi
mov dword [ebp - 0x684], eax
lea eax, [ebp - 0x258]
push esi
push eax
push edi
call fcn.10176510
add esp, 0x14
xor eax, eax
mov word [esi + edi], ax
mov dword [ebp - 0x698], edi
lea ecx, [ebp - 0x6ec]
mov dword [ebp - 0x6ec], 0x3d003d
lea eax, [ebp - 0x6e4]
mov dword [ebp - 0x6e8], 0x3e
sub eax, ecx
mov dword [ebp - 0x6b4], 0
sar eax, 1
xorps xmm0, xmm0
push eax
mov eax, ecx
mov dword [ebp - 0x6b0], 0
push eax
lea ecx, [ebp - 0x6c4]
movups xmmword [ebp - 0x6c4], xmm0
call fcn.1000ebb0
cmp dword [ebp - 0x6b0], 7
lea eax, [ebp - 0x6c4]
push dword [ebp - 0x6b4]
cmova eax, dword [ebp - 0x6c4]
lea ecx, [ebp - 0x698]
push eax
mov byte [ebp - 4], 2
call fcn.1000fc80
mov ecx, dword [ebp - 0x6b0]
mov byte [ebp - 4], 1
cmp ecx, 7
jbe 0x1001016f
mov edx, dword [ebp - 0x6c4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10010165
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010a9d
push ecx
push edx
call fcn.10172764
add esp, 8
lea eax, [ebp - 0x6d4]
mov dword [ebp - 0x678], 0
lea edi, [ebp - 0x6cf]
mov dword [ebp - 0x6d4], 0x65786946
mov byte [ebp - 0x6d0], 0x64
xorps xmm0, xmm0
movq qword [ebp - 0x680], xmm0
mov dword [ebp - 0x6c4], 0
mov dword [ebp - 0x6c0], 0
mov dword [ebp - 0x6bc], 0
sub edi, eax
je 0x100101fb
cmp edi, 0x7fffffff
ja 0x10010aa2
push edi
lea ecx, [ebp - 0x6c4]
call fcn.10009f20
mov esi, dword [ebp - 0x6c4]
lea eax, [ebp - 0x6d4]
push edi
push eax
push esi
call fcn.10176510
lea eax, [edi + esi]
add esp, 0xc
mov dword [ebp - 0x6c0], eax
lea eax, [ebp - 0x6e0]
mov byte [ebp - 4], 3
lea edi, [ebp - 0x6d7]
mov dword [ebp - 0x6e0], 0x6f6d6552
mov dword [ebp - 0x6dc], 0x6c626176
mov byte [ebp - 0x6d8], 0x65
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6b4], 0
mov dword [ebp - 0x6b0], 0
sub edi, eax
je 0x10010280
cmp edi, 0x7fffffff
ja 0x10010aa2
push edi
lea ecx, [ebp - 0x6b8]
call fcn.10009f20
mov esi, dword [ebp - 0x6b8]
lea eax, [ebp - 0x6e0]
push edi
push eax
push esi
call fcn.10176510
lea eax, [esi + edi]
add esp, 0xc
mov dword [ebp - 0x6b4], eax
lea eax, [ebp - 0x6a8]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x6c4]
mov dword [ebp - 0x680], 0
lea ecx, [ebp - 0x6ac]
mov dword [ebp - 0x6c8], edx
lea eax, [ebp - 0x6c8]
mov dword [ebp - 0x6a8], ecx
push eax
sub ecx, edx
mov dword [ebp - 0x67c], 0
mov eax, 0x2aaaaaab
mov dword [ebp - 0x678], 0
imul ecx
lea ecx, [ebp - 0x680]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
call fcn.10005350
push fcn.100021e0
push 2
push 0xc
lea eax, [ebp - 0x6c4]
mov byte [ebp - 4], 6
push eax
call fcn.10172c84
xorps xmm0, xmm0
mov dword [ebp - 0x66c], 0
xor edi, edi
movq qword [ebp - 0x674], xmm0
xor esi, esi
mov dword [ebp - 0x6cc], edi
mov dword [ebp - 0x674], edi
mov dword [ebp - 0x670], esi
mov dword [ebp - 0x66c], esi
mov eax, dword [ebp - 0x6ac]
mov byte [ebp - 4], 7
cmp eax, 3
jne 0x10010593
lea edx, [ebp - 0x674]
xor ecx, ecx
mov dword [ebp - 0x6ac], edx
xor eax, eax
mov edx, dword [ebp - 0x680]
cmp dword [ebp - 0x6ac], edx
je 0x100103c2
mov eax, dword [edx]
mov esi, dword [edx + 4]
mov dword [ebp - 0x6ac], eax
sub esi, eax
je 0x100103ac
cmp esi, 0x7fffffff
ja 0x10010aa2
push esi
lea ecx, [ebp - 0x674]
call fcn.10009f20
mov edi, dword [ebp - 0x674]
push esi
push dword [ebp - 0x6ac]
mov dword [ebp - 0x6cc], edi
push edi
call fcn.10176510
add esp, 0xc
add esi, edi
mov eax, esi
mov ecx, esi
jmp 0x100103bc
push esi
push eax
push 0
call fcn.10176510
mov eax, esi
add esp, 0xc
mov ecx, eax
mov dword [ebp - 0x670], esi
xorps xmm0, xmm0
movups xmmword [ebp - 0x6c4], xmm0
cmp edi, ecx
jne 0x100103f1
xor ecx, ecx
mov edx, 7
xor eax, eax
mov dword [ebp - 0x6b4], ecx
mov dword [ebp - 0x6b0], edx
mov word [ebp - 0x6c4], ax
jmp 0x100104ce
sub eax, edi
mov dword [ebp - 0x6b4], 0
mov dword [ebp - 0x6c8], eax
mov ecx, 7
mov dword [ebp - 0x6b0], ecx
cmp eax, 0x7ffffffe
ja 0x10010a98
cmp eax, ecx
jbe 0x1001046e
or eax, ecx
cmp eax, 0x7ffffffe
jbe 0x1001042d
mov eax, SysReAllocString
jmp 0x10010438
cmp eax, 0xa
mov ecx, 0xa
cmovb eax, ecx
mov dword [ebp - 0x6a8], eax
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x6c4]
push eax
call fcn.1000eb50
mov ecx, dword [ebp - 0x6a8]
mov edx, eax
mov eax, dword [ebp - 0x6c8]
add esp, 8
mov dword [ebp - 0x6c4], edx
mov dword [ebp - 0x6b0], ecx
cmp ecx, 7
mov dword [ebp - 0x6ac], eax
lea ecx, [ebp - 0x6c4]
mov edx, edi
cmova ecx, dword [ebp - 0x6c4]
mov dword [ebp - 0x6a8], ecx
test eax, eax
je 0x100104b0
mov edi, eax
movzx eax, byte [edx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
lea edx, [edx + 1]
sub edi, 1
jne 0x10010492
mov edi, dword [ebp - 0x6cc]
mov eax, dword [ebp - 0x6c8]
mov ecx, dword [ebp - 0x6a8]
xor edx, edx
mov dword [ebp - 0x6b4], eax
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 0x6b0]
mov ecx, dword [ebp - 0x6b4]
cmp edx, 7
mov byte [ebp - 4], 8
lea eax, [ebp - 0x6c4]
cmova eax, dword [ebp - 0x6c4]
push ecx
push eax
lea ecx, [ebp - 0x698]
call fcn.1000fc80
mov ecx, dword [ebp - 0x6b0]
mov byte [ebp - 4], 7
cmp ecx, 7
jbe 0x10010533
mov edx, dword [ebp - 0x6c4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10010529
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010a9d
push ecx
push edx
call fcn.10172764
add esp, 8
mov ecx, dword [ebp - 0x680]
lea eax, [ebp - 0x674]
cmp eax, ecx
je 0x100107f9
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov edx, dword [ebp - 0x66c]
sub ecx, eax
sub edx, edi
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 0x6c8], ecx
cmp ecx, edx
jbe 0x10010794
cmp ecx, 0x7fffffff
ja 0x10010aa2
mov esi, edx
mov eax, SysReAllocString
shr esi, 1
sub eax, esi
cmp edx, eax
jbe 0x10010711
mov esi, SysReAllocString
jmp 0x10010718
cmp eax, 2
jne 0x10010533
mov eax, dword [ebp - 0x680]
lea ecx, [ebp - 0x674]
add eax, 0xc
cmp ecx, eax
je 0x10010604
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x6ac], ecx
sub esi, ecx
je 0x100105f2
cmp esi, 0x7fffffff
ja 0x10010aa2
push esi
lea ecx, [ebp - 0x674]
call fcn.10009f20
mov edi, dword [ebp - 0x674]
push esi
push dword [ebp - 0x6ac]
mov dword [ebp - 0x6cc], edi
push edi
call fcn.10176510
add esp, 0xc
add esi, edi
jmp 0x100105fe
push esi
push ecx
push 0
call fcn.10176510
add esp, 0xc
mov dword [ebp - 0x670], esi
xorps xmm0, xmm0
movups xmmword [ebp - 0x6c4], xmm0
cmp edi, esi
jne 0x10010633
xor ecx, ecx
mov edx, 7
xor eax, eax
mov dword [ebp - 0x6b4], ecx
mov dword [ebp - 0x6b0], edx
mov word [ebp - 0x6c4], ax
jmp 0x10010708
sub esi, edi
mov dword [ebp - 0x6b4], 0
mov eax, 7
mov dword [ebp - 0x6b0], eax
cmp esi, 0x7ffffffe
ja 0x10010a98
cmp esi, eax
jbe 0x100106aa
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x1001066d
mov eax, SysReAllocString
jmp 0x10010678
cmp eax, 0xa
mov ecx, 0xa
cmovb eax, ecx
mov dword [ebp - 0x6a8], eax
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x6c4]
push eax
call fcn.1000eb50
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6c4], ecx
mov dword [ebp - 0x6b0], eax
jmp 0x100106b0
mov ecx, dword [ebp - 0x6c4]
cmp eax, 7
mov dword [ebp - 0x6ac], esi
lea edx, [ebp - 0x6c4]
cmova edx, ecx
mov dword [ebp - 0x6a8], edx
mov ecx, edx
mov edx, edi
test esi, esi
je 0x100106ea
mov edi, esi
movzx eax, byte [edx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
lea edx, [edx + 1]
sub edi, 1
jne 0x100106d2
mov edi, dword [ebp - 0x6cc]
mov eax, dword [ebp - 0x6a8]
xor ecx, ecx
mov dword [ebp - 0x6b4], esi
mov word [eax + esi*2], cx
mov edx, dword [ebp - 0x6b0]
mov ecx, dword [ebp - 0x6b4]
mov byte [ebp - 4], 9
jmp 0x1001090a
add esi, edx
cmp esi, ecx
cmovb esi, ecx
test edi, edi
je 0x10010762
mov eax, edi
cmp edx, 0x1000
jb 0x1001073a
mov edi, dword [eax - 4]
add edx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010a9d
push edx
push edi
call fcn.10172764
add esp, 8
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], 0
mov dword [ebp - 0x66c], 0
push esi
lea ecx, [ebp - 0x674]
call fcn.10009f20
mov esi, dword [ebp - 0x6c8]
mov edi, dword [ebp - 0x674]
push esi
push dword [ebp - 0x6a8]
mov dword [ebp - 0x6cc], edi
push edi
call fcn.10176510
add esp, 0xc
add esi, edi
jmp 0x100107f3
mov eax, esi
sub eax, edi
mov dword [ebp - 0x6ac], eax
cmp ecx, eax
jbe 0x100107e0
push eax
push dword [ebp - 0x6a8]
push edi
call fcn.10176510
mov eax, dword [ebp - 0x6c8]
sub eax, dword [ebp - 0x6ac]
mov edx, dword [ebp - 0x6a8]
add edx, dword [ebp - 0x6ac]
push eax
push edx
push esi
mov dword [ebp - 0x6c8], eax
call fcn.10176510
add esp, 0x18
add esi, dword [ebp - 0x6c8]
jmp 0x100107f3
push ecx
push dword [ebp - 0x6a8]
lea esi, [edi + ecx]
push edi
call fcn.10176510
add esp, 0xc
mov dword [ebp - 0x670], esi
xorps xmm0, xmm0
movups xmmword [ebp - 0x6c4], xmm0
cmp edi, esi
jne 0x10010828
xor ecx, ecx
mov edx, 7
xor eax, eax
mov dword [ebp - 0x6b4], ecx
mov dword [ebp - 0x6b0], edx
mov word [ebp - 0x6c4], ax
jmp 0x10010906
sub esi, edi
mov dword [ebp - 0x6b4], 0
mov eax, 7
mov dword [ebp - 0x6b0], eax
cmp esi, 0x7ffffffe
ja 0x10010a98
cmp esi, eax
jbe 0x1001089f
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x10010862
mov eax, SysReAllocString
jmp 0x1001086d
cmp eax, 0xa
mov ecx, 0xa
cmovb eax, ecx
mov dword [ebp - 0x6a8], eax
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x6c4]
push eax
call fcn.1000eb50
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6c4], ecx
mov dword [ebp - 0x6b0], eax
jmp 0x100108a5
mov ecx, dword [ebp - 0x6c4]
cmp eax, 7
mov dword [ebp - 0x6ac], esi
lea edx, [ebp - 0x6c4]
cmova edx, ecx
mov dword [ebp - 0x6a8], edx
mov ecx, edx
mov edx, edi
test esi, esi
je 0x100108e8
mov edi, esi
nop word [eax + eax]
movzx eax, byte [edx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
lea edx, [edx + 1]
sub edi, 1
jne 0x100108d0
mov edi, dword [ebp - 0x6cc]
mov eax, dword [ebp - 0x6a8]
xor ecx, ecx
mov dword [ebp - 0x6b4], esi
mov word [eax + esi*2], cx
mov edx, dword [ebp - 0x6b0]
mov ecx, dword [ebp - 0x6b4]
mov byte [ebp - 4], 0xa
cmp edx, 7
lea eax, [ebp - 0x6c4]
push ecx
cmova eax, dword [ebp - 0x6c4]
lea ecx, [ebp - 0x698]
push eax
call fcn.1000fc80
mov ecx, dword [ebp - 0x6b0]
mov byte [ebp - 4], 7
cmp ecx, 7
jbe 0x1001096b
mov edx, dword [ebp - 0x6c4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10010961
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010a9d
push ecx
push edx
call fcn.10172764
add esp, 8
cmp dword [ebp - 0x6f8], 0
je 0x1001098d
push dword [ebp - 0x69c]
lea eax, [ebp - 0x50]
push str.__Serial:__08X_
push 0x20
push eax
call fcn.10011da0
add esp, 0x10
mov esi, dword [ebp - 0x6fc]
lea ecx, [ebp - 0x698]
push ecx
mov eax, dword [esi + 4]
push eax
cmp eax, dword [esi + 8]
je 0x100109b2
push esi
call fcn.1000f2b0
add esp, 0xc
add dword [esi + 4], 0x18
jmp 0x100109b9
mov ecx, esi
call fcn.1000ec60
mov byte [ebp - 4], 6
test edi, edi
je 0x10010a0f
mov ecx, dword [ebp - 0x66c]
mov eax, edi
sub ecx, edi
cmp ecx, 0x1000
jb 0x100109e7
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010a9d
push ecx
push edi
call fcn.10172764
add esp, 8
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], 0
mov dword [ebp - 0x66c], 0
lea ecx, [ebp - 0x680]
call fcn.1000a020
mov ecx, dword [ebp - 0x684]
mov byte [ebp - 4], 0
cmp ecx, 7
jbe 0x10010a5a
mov edx, dword [ebp - 0x698]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10010a50
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010a9d
push ecx
push edx
call fcn.10172764
add esp, 8
mov edx, dword [ebp - 0x6f0]
mov edi, 0xa
mov ecx, dword [ebp - 0x6e4]
inc ecx
mov dword [ebp - 0x6e4], ecx
cmp ecx, 0x1a
jl 0x1000ff00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10172772
mov esp, ebp
pop ebp
ret
call fcn.10002d10
call fcn.1017a16f
call fcn.10002d20
int3