Function at 0x107f981
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ecx]
push esi
push edi
xor edi, edi
sub eax, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x1c], 0x889573d2
mov word [ebp - 0x18], 0x8d67
mov word [ebp - 0x16], 0x4e91
mov byte [ebp - 0x14], 0xbe
mov byte [ebp - 0x13], 0x9f
mov byte [ebp - 0x12], 0xf1
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xf], 0x7e
mov byte [ebp - 0xe], 0xe9
mov byte [ebp - 0xd], 0x4d
je 0x107fdc7
dec eax
je 0x107fd63
dec eax
je 0x107fc7e
dec eax
je 0x107fb96
dec eax
je 0x107fb4f
dec eax
je 0x107fb21
dec eax
jne 0x10801be
cmp ebx, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], edi
je 0x10801be
mov eax, dword [ebx]
jmp 0x107fa2c
cmp dword [eax + 0x214], edi
je 0x107fa1c
inc dword [ebp + 8]
mov ecx, dword [eax + 0x210]
mov word [ecx + 0x32], di
mov eax, dword [eax + 0x218]
cmp eax, edi
jne 0x107fa11
mov eax, dword [ebx + 0x40]
cmp eax, edi
je 0x107fa5f
cmp dword [ebp + 8], edi
jle 0x107fa5f
mov ecx, dword [eax]
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp + 0x14]
push edx
push 0
push 2
sub esp, 0x10
mov edi, esp
lea esi, [ebx + 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x90]
xor edi, edi
mov eax, dword [ebx + 0x40]
cmp eax, edi
je 0x107fa6c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebx + 0x44]
cmp eax, edi
je 0x107fa79
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
shl eax, 2
push 1
push eax
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
call dword [sym.imp.msvcrt.dll_calloc]
cmp eax, edi
pop ecx
pop ecx
mov dword [ebx + 0x3c], eax
jne 0x107faa0
or ax, 0xffff
jmp 0x10801c1
mov eax, dword [ebx]
xor edx, edx
jmp 0x107fac5
mov ecx, dword [eax + 0x214]
cmp ecx, edi
je 0x107fabf
cmp edx, dword [ebp + 8]
jg 0x107fabf
mov esi, dword [ebx + 0x3c]
add ecx, 4
mov dword [esi + edx*4], ecx
inc edx
mov eax, dword [eax + 0x218]
cmp eax, edi
jne 0x107faa6
cmp byte [ebx + 0x1c], 0
je 0x107fad6
mov dword [ebp + 0x10], 1
lea eax, [ebx + 0x44]
push eax
push dword [ebx + 0x3c]
lea esi, [ebp - 0x1c]
push dword [ebp + 8]
push dword [ebp + 0x10]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sub.VSSAPI.DLL_Ordinal_3
test eax, eax
jge 0x107fb11
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebp + 8], eax
jne 0x107fbdb
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x20], eax
jmp 0x10801be
and dword [ebx + 0x38], 0
mov dword [ebx + 0x20], 1
jmp 0x10801be
cmp ebx, edi
je 0x10801be
mov eax, dword [ebx + 0x44]
cmp eax, edi
mov dword [ebx + 0x30], edi
je 0x107fb39
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ebx, dword [ebx + 0x40]
cmp ebx, edi
je 0x107fb46
mov eax, dword [ebx]
push ebx
call dword [eax + 0x38]
push 2
push edi
push edi
jmp 0x107fc3b
cmp ebx, edi
je 0x10801be
mov eax, dword [ebx + 0x30]
cmp eax, edi
jge 0x10801be
mov ebx, dword [ebx + 0x38]
cmp ebx, edi
push edi
jge 0x107fb80
push 0x23d
push ebx
push edi
push edi
call fcn.0107f1b8
mov ax, 0xfe40
jmp 0x10801c1
push 0x23e
push eax
push edi
push edi
call fcn.0107f1b8
mov ax, 0xfe3f
jmp 0x10801c1
cmp ebx, edi
je 0x107fbdb
cmp dword [ebx + 0x20], edi
mov eax, dword [ebx + 0x44]
je 0x107fbe4
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
lea esi, [ebx + 0x38]
push esi
push eax
call dword [ecx + 0x14]
cmp eax, edi
jge 0x107fbb9
mov dword [ebx + 0x30], eax
jmp 0x107fbc5
cmp dword [esi], 0x42309
je 0x10801be
mov eax, dword [ebx + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebx + 0x30], edi
mov dword [ebx + 0x44], edi
jl 0x107fbdb
mov eax, dword [esi]
mov dword [ebx + 0x30], eax
mov ax, 1
jmp 0x10801c1
cmp eax, edi
je 0x107fc6d
lea esi, [ebx + 0x30]
cmp dword [esi], edi
jl 0x107fc04
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push esi
push eax
call dword [ecx + 0x14]
cmp eax, edi
jge 0x107fc04
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, 0x42309
je 0x10801be
cmp dword [ebx + 0x14], edi
jne 0x107fc48
cmp eax, edi
jl 0x107fc48
cmp dword [ebx + 0x18], edi
je 0x10801be
mov eax, dword [ebx + 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi], edi
mov dword [ebx + 0x44], edi
jl 0x107fbdb
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0107f981
jmp 0x10801be
mov eax, dword [ebx + 0x44]
cmp eax, edi
je 0x107fc58
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx + 0x44], edi
push dword [ebp + 8]
call fcn.0107f499
xor eax, eax
cmp dword [ebx + 0x20], edi
sete al
jmp 0x10801c1
cmp dword [ebx + 0x14], edi
jne 0x107fc7b
cmp dword [ebx + 0x30], edi
jge 0x107fbdb
push ecx
jmp 0x107fc5b
cmp ebx, edi
je 0x10801be
mov eax, dword [ebx + 0x40]
cmp eax, edi
je 0x107fcb0
mov ecx, dword [eax]
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp + 0x10]
push edx
push 1
push 2
sub esp, 0x10
mov edi, esp
lea esi, [ebx + 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x90]
jmp 0x107fcca
cmp dword [ebx + 0x20], edi
je 0x107fccc
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sub.VSSAPI.DLL_Ordinal_4
and dword [ebx + 0x20], 0
xor edi, edi
cmp dword [ebx], edi
je 0x107fd28
mov edi, dword [ebx]
lea esi, [edi + 0x210]
mov eax, dword [esi]
mov dword [ebp + 0x14], edi
call fcn.0107f172
mov eax, dword [esi]
and word [eax + 0x32], 0
mov eax, dword [esi]
and dword [eax + 0x3c], 0
lea eax, [edi + 0x200]
push 4
pop ecx
mov edi, 0x1012f28
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x107fd10
mov esi, 0x1012f28
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x218]
push eax
mov dword [ebx], ecx
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebx], 0
pop ecx
jne 0x107fcd0
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x107fd35
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x107fd42
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebx + 8]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
push dword [ebx + 0x3c]
call esi
push ebx
call esi
mov eax, dword [ebp + 8]
add esp, 0xc
and dword [eax], 0
jmp 0x10801be
cmp ebx, edi
je 0x10801be
mov eax, dword [ebx + 0x40]
cmp eax, edi
je 0x10801be
cmp dword [ebx + 0x18], edi
jne 0x107fda3
mov ecx, dword [eax]
xor edx, edx
mov dl, byte [ebx + 0x1c]
push edi
xor esi, esi
inc esi
push esi
push edx
push edi
push eax
call dword [ecx + 0x18]
cmp eax, edi
jl 0x107fdbf
mov eax, dword [ebx + 0x40]
mov ecx, dword [eax]
lea edx, [ebx + 0x44]
push edx
push eax
call dword [ecx + 0x34]
mov dword [ebx + 0x18], esi
jmp 0x107fdb7
lea edx, [ebx + 0x44]
push edx
mov dword [ebx + 0x14], 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x8c]
cmp eax, edi
jge 0x10801be
mov dword [ebx + 0x30], eax
jmp 0x10801be
mov esi, dword [ebp + 0xc]
cmp esi, edi
mov dword [ebp - 0xc], edi
je 0x10801be
mov al, byte [esi + 0x30]
cmp al, 6
jne 0x107fe1b
push 0x104
lea eax, [ebp - 0x238]
push eax
push 0x101082c
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x238]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 0x14]
call fcn.0107a960
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x10801be
jmp 0x107fe37
mov ecx, dword [ebp + 0x10]
cmp ecx, edi
je 0x107fe2f
test byte [ecx + 0x9f], 4
je 0x10801be
cmp al, 1
jne 0x10801be
cmp word [0x10dd1b8], di
je 0x10801be
cmp word [0x10dd1bc], di
je 0x10801be
test byte [esi + 0x60], 0x84
jne 0x10801be
mov eax, dword [esi + 0x34]
cmp word [eax + 2], 0x3a
jne 0x10801be
call fcn.0107f13b
cmp ebx, edi
jne 0x107ff0d
push 1
push 0x58
call dword [sym.imp.msvcrt.dll_calloc]
mov ebx, eax
cmp ebx, edi
pop ecx
pop ecx
je 0x107fa97
cmp dword [ebp - 8], edi
mov eax, dword [ebp + 8]
mov dword [eax], ebx
je 0x107fe9a
mov byte [ebx + 0x1c], 1
lea esi, [ebx + 0x40]
push esi
mov dword [ebp - 4], esi
call sub.VSSAPI.DLL_long_int___stdcall_CreateVssBackupComponents_class_IVssBackupComponents___
cmp eax, edi
mov dword [ebp + 0x10], eax
jl 0x107ff4c
mov eax, dword [esi]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
cmp eax, edi
mov dword [ebp + 0x10], eax
jl 0x107ff4c
mov eax, dword [esi]
cmp eax, edi
je 0x107ff08
lea edx, [ebp + 0x14]
push edx
mov dword [ebp + 0x14], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
cmp eax, edi
mov dword [ebp + 0x10], eax
jl 0x107ff4c
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp + 0x10], edi
jl 0x107ff4c
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebx + 0x2c]
push edx
push eax
call dword [ecx + 0x24]
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], edi
jl 0x107ff4c
lea esi, [ebx + 0x40]
mov eax, dword [esi]
cmp eax, edi
mov dword [ebp - 4], esi
je 0x107ff60
cmp dword [ebx + 0x10], edi
jne 0x107ff60
mov ecx, dword [eax]
lea edx, [ebx + 0x48]
push edx
push eax
call dword [ecx + 0x84]
cmp eax, 0x80042301
mov dword [ebp + 0x10], eax
jne 0x107ff3e
mov ax, 0xfe41
jmp 0x10801c1
cmp dword [ebp + 0x10], edi
jl 0x107ff4c
mov dword [ebx + 0x10], 1
jmp 0x107ff60
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x30], eax
mov eax, dword [esi]
cmp eax, edi
je 0x107ff5e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], edi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x5c]
mov eax, dword [eax + 0x54]
cmp eax, edi
mov dword [ebp + 0x10], eax
jne 0x107ff81
call fcn.0107f13b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x5c]
mov eax, dword [eax + 0x54]
mov dword [ebp + 0x10], eax
cmp dword [ebp - 8], edi
je 0x107ff8a
mov byte [ebx + 0x1c], 1
cmp eax, edi
je 0x1080171
mov ecx, dword [ebp + 0x10]
add ecx, 4
test ecx, ecx
je 0x1080002
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x1080002
cmp dword [ebx], 0
jne 0x1080002
and dword [ebp + 0x14], 0
mov edx, dword [eax]
lea esi, [ebp + 0x14]
push esi
push ecx
sub esp, 0x10
mov edi, esp
mov esi, 0x1012f28
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [edx + 0xa8]
cmp byte [ebx + 0x1c], 1
je 0x1080002
xor edi, edi
cmp eax, edi
jl 0x107ffdb
cmp dword [ebp + 0x14], edi
jne 0x1080002
mov eax, dword [ebp + 0xc]
call fcn.0107f172
mov esi, dword [ebp - 4]
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
mov dword [esi], edi
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], edi
jmp 0x10801be
mov edi, dword [ebp + 0x10]
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x1080160
cmp eax, 2
je 0x1080160
mov esi, dword [ebx]
test esi, esi
je 0x1080056
mov eax, dword [esi + 0x214]
test eax, eax
je 0x1080045
add eax, 4
push eax
lea eax, [edi + 4]
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x108004f
mov esi, dword [esi + 0x218]
test esi, esi
jne 0x1080027
test esi, esi
je 0x1080056
mov dword [ebp - 0xc], esi
push 1
push 0x220
call dword [sym.imp.msvcrt.dll_calloc]
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
je 0x107fa97
cmp dword [ebp - 0xc], 0
jne 0x108010f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x108012e
and dword [ebp + 8], 0
mov edx, dword [eax]
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
sub esp, 0x10
mov edi, esp
mov esi, 0x1012f28
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [edx + 0xa8]
cmp byte [ebx + 0x1c], 1
je 0x10800bd
test eax, eax
jl 0x10800ff
cmp dword [ebp + 8], 0
je 0x10800ff
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [eax]
add ecx, 0x200
push ecx
mov ecx, dword [ebp + 0x10]
sub esp, 0x10
mov edi, esp
mov esi, 0x1012f28
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add ecx, 4
push ecx
push eax
movsd dword es:[edi], dword [esi]
call dword [edx + 0x88]
test eax, eax
jge 0x108012e
cmp eax, 0x80042308
jne 0x108010a
push dword [ebp + 0x14]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x404]
jmp 0x1080166
mov dword [ebx + 0x30], eax
jmp 0x108012e
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp - 0xc]
add esi, 0x200
lea edi, [eax + 0x200]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [eax + 0x21c], 1
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov dword [eax + 0x210], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x214], ecx
cmp dword [ebx], 0
jne 0x108014c
mov dword [ebx], eax
jmp 0x1080155
mov edx, dword [ebx + 4]
mov dword [edx + 0x218], eax
mov dword [ebx + 4], eax
mov eax, dword [ecx + 0x404]
jmp 0x1080166
mov eax, dword [edi + 0x404]
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x1080002
xor edi, edi
cmp dword [ebx + 4], edi
je 0x10801a8
mov esi, dword [ebp - 8]
cmp esi, edi
je 0x10801a8
push 1
push 0x220
call dword [sym.imp.msvcrt.dll_calloc]
cmp eax, edi
pop ecx
pop ecx
je 0x107fa97
mov dword [eax + 0x210], esi
mov ecx, dword [ebx + 4]
mov dword [ecx + 0x218], eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0x30], edi
jge 0x10801be
mov esi, dword [ebp - 4]
mov eax, dword [esi]
cmp eax, edi
je 0x10801bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], edi
xor ax, ax
pop edi
pop esi
pop ebx
leave
ret 0x10