Function at 0x2ab7000
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x48], 0
jmp 0x2ab7020
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x2ab7036
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x154], 3
jmp 0x2ab7019
mov dword [ebp - 0x24], 2
jmp 0x2ab7046
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x2ab7098
mov dword [ebp - 0x50], 0xede0b407
mov dword [ebp - 0x50], 0
jmp 0x2ab7063
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x2ab7096
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x2ab7094
push 0x10c7
push 0x9e0
push 0x21e3
push 0x782
push 0x1b8a
call dword [sym.imp.GDI32.dll_Ellipse]
jmp 0x2ab705c
jmp 0x2ab703f
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x30], 0x2ab7722
mov dword [ebp - 0x40], 0x7e2799ac
mov dword [ebp - 0x98], 0x8872fa4
mov dword [ebp - 0x40], 0
jmp 0x2ab70c7
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xa
jl 0x2ab7126
mov dword [ebp - 0xfc], 0x4d2edc75
mov dword [ebp - 0x2c], 0xffff
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0
jmp 0x2ab70f7
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1f
jge 0x2ab7124
mov byte [ebp - 0xc], 0
movzx eax, byte [ebp - 0xc]
test eax, eax
je 0x2ab7122
push 0x24f3
push 0x24c5
push 0
push 0x1817
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x2ab70f0
jmp 0x2ab70c0
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x30]
mov byte [eax + 1], 0
mov dword [ebp - 4], 0x82062403
mov dword [ebp - 8], 0xfffffff9
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0
jmp 0x2ab7187
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xfffffff1
jge 0x2ab7614
mov dword [ebp - 0x128], 0x60d2f38
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x68], 0
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x120], 0xa277ebd0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x64], 0xac77
mov dword [ebp - 0x5c], 0
jmp 0x2ab71db
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x2ab71ee
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x20], 0x9ab5c294
jmp 0x2ab71d4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
je 0x2ab7320
cmp dword [ebp - 0x38], 2
jle 0x2ab7213
mov dword [ebp - 0x60], 1
jmp 0x2ab7217
and dword [ebp - 0x60], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x60]
mov dword [ebp + eax - 0xec], ecx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x2ab7240
xor eax, eax
je 0x2ab7240
mov dword [ebp - 0x70], 1
jmp 0x2ab7244
and dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x128]
push 4
pop eax
imul eax, eax, 3
imul eax, dword [ebp + eax - 0xec], 0x11e7
cmp dword [ebp - 4], eax
jne 0x2ab726c
mov dword [ebp - 0xcc], 1
jmp 0x2ab7273
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0x34]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x20]
jge 0x2ab7291
mov dword [ebp - 0x78], 1
jmp 0x2ab7295
and dword [ebp - 0x78], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x78], eax
je 0x2ab72a9
mov dword [ebp - 0xd4], 1
jmp 0x2ab72b0
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xd4], eax
jge 0x2ab72c4
mov dword [ebp - 0x80], 1
jmp 0x2ab72c8
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x80], eax
jne 0x2ab72dc
mov dword [ebp - 0xdc], 1
jmp 0x2ab72e3
and dword [ebp - 0xdc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
cmp dword [ebp - 0xdc], eax
jg 0x2ab7301
mov dword [ebp - 0xc8], 1
jmp 0x2ab7308
and dword [ebp - 0xc8], 0
cmp dword [ebp - 0xc8], 0xfffe
je 0x2ab7320
mov dword [ebp - 0x8c], 1
jmp 0x2ab7327
and dword [ebp - 0x8c], 0
cmp dword [ebp - 0x8c], 0xc01e6e2b
jbe 0x2ab7340
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 0
jne 0x2ab7356
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 0
jne 0x2ab7356
and dword [ebp - 0x90], 0
jmp 0x2ab7360
mov dword [ebp - 0x90], 1
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x90], eax
jle 0x2ab7377
mov dword [ebp - 0xb8], 1
jmp 0x2ab737e
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jg 0x2ab739b
mov dword [ebp - 0x104], 1
jmp 0x2ab73a2
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x68], 0x25f8
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x68], eax
jl 0x2ab7579
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0x58], 0xfffffffe
mov dword [ebp - 0x84], 0
cmp dword [ebp - 0x64], 0xeff85a04
jae 0x2ab73fa
mov dword [ebp - 0x124], 1
jmp 0x2ab7401
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 4]
neg eax
cmp eax, dword [ebp - 0x34]
je 0x2ab7419
xor eax, eax
inc eax
jne 0x2ab7419
and dword [ebp - 0xa0], 0
jmp 0x2ab7423
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0xd8], 0x90c37c50
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0xa0]
je 0x2ab7447
mov dword [ebp - 0xc0], 1
jmp 0x2ab744e
and dword [ebp - 0xc0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xec]
cmp dword [ebp - 0xc0], eax
jne 0x2ab746f
mov dword [ebp - 0xa8], 1
jmp 0x2ab7476
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xa8], eax
jg 0x2ab748d
mov dword [ebp - 0xd0], 1
jmp 0x2ab7494
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0xd0], eax
jge 0x2ab74ab
mov dword [ebp - 0xb0], 1
jmp 0x2ab74b2
and dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 0xffffffff
jge 0x2ab74c8
xor eax, eax
jne 0x2ab74c8
and dword [ebp - 0x88], 0
jmp 0x2ab74d2
mov dword [ebp - 0x88], 1
cmp dword [ebp - 0x88], 0xbb8911f7
jne 0x2ab74ea
mov dword [ebp - 0x10c], 1
jmp 0x2ab74f1
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x84]
test eax, eax
je 0x2ab7525
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xec], 0
je 0x2ab7525
mov dword [ebp - 0x94], 1
jmp 0x2ab752c
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x94], eax
jne 0x2ab7546
mov dword [ebp - 0x9c], 1
jmp 0x2ab754d
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x9c], eax
jl 0x2ab7564
mov dword [ebp - 0xa4], 1
jmp 0x2ab756b
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 8], eax
jmp 0x2ab760f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x134], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xec]
cmp dword [ebp - 0x38], eax
jl 0x2ab75a0
mov dword [ebp - 0x11c], 1
jmp 0x2ab75a7
and dword [ebp - 0x11c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
mov dword [ebp - 8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xec]
cmp eax, dword [ebp - 8]
jle 0x2ab75d2
mov dword [ebp - 0x114], 1
jmp 0x2ab75d9
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0xac], 0xffffffff
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xac]
mov dword [ebp + eax - 0xec], ecx
cmp dword [ebp - 0x64], 0
je 0x2ab760f
jmp 0x2ab7614
jmp 0x2ab7180
mov byte [ebp - 0xe], 0
movzx eax, byte [ebp - 0xe]
test eax, eax
je 0x2ab7630
push 0xf0a
push 0x1023
call dword [sym.imp.GDI32.dll_RestoreDC]
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0x2ab76c5
mov dword [ebp - 0x3c], 0x13dd33a4
mov dword [ebp - 0x3c], 0xffffffe3
jmp 0x2ab7658
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff9
jg 0x2ab76b0
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x44], 0xfffffff3
jmp 0x2ab7675
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffed
jge 0x2ab76ae
mov byte [ebp - 0xb], 0
movzx eax, byte [ebp - 0xb]
test eax, eax
je 0x2ab7698
push 0
push 0
push 0
push 0x91e
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [ebp - 0xf], 0
movzx eax, byte [ebp - 0xf]
test eax, eax
je 0x2ab76ac
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x2ab766e
jmp 0x2ab7651
mov eax, dword [ebp - 0x30]
mov byte [eax + 2], 0
mov eax, dword [ebp - 0x30]
mov byte [eax + 3], 0
mov eax, dword [ebp - 0x30]
mov byte [eax + 4], 0
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x4c], 0
jmp 0x2ab76dc
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x2ab76f2
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x164], 0x82062403
jmp 0x2ab76d5
mov dword [ebp - 0x1c], 3
jmp 0x2ab7702
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x2ab771c
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 9]
test eax, eax
je 0x2ab771a
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x2ab76fb
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x2ab78ff
mov esp, ebp
pop ebp
ret