Function at 0x97420c
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0x974214
push ecx
push ebx
push esi
push edi
mov eax, 0x974174
nop
nop
nop
nop
nop
xor eax, eax
push ebp
push 0x974ec0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x977778]
add eax, 5
mov dword [0x9786bc], eax
mov dword [0x9786c0], 0xd
call fcn.009724d8
cmp dword [0x97767c], 0x407e7e21
jne 0x9742d9
cmp dword [0x9776e8], 0x33435243
jne 0x9742d9
cmp dword [0x9776f4], 0x7e7e4032
jne 0x9742d9
cmp dword [0x9776fc], 0x407e7e21
jne 0x9742d9
cmp dword [0x977704], 0x33435243
jne 0x9742d9
cmp dword [0x977710], 0x7e7e4032
jne 0x9742d9
cmp dword [0x977774], 0x407e7e21
jne 0x9742d9
cmp dword [0x977784], 0x33435243
jne 0x9742d9
push 0x10
push 0
lea edx, [ebp - 0x10]
mov eax, 0x974ed8
call fcn.00971e20
mov eax, dword [ebp - 0x10]
call fcn.009657f4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x974e98
call fcn.00971e60
mov eax, dword [0x9777c4]
cmp eax, 0x7e7e4032
je 0x97435a
cmp eax, dword [0x977778]
jne 0x974380
push 0x30
lea edx, [ebp - 0x14]
mov eax, 0x974ef4
call fcn.00971e20
mov eax, dword [ebp - 0x14]
call fcn.009657f4
push eax
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00964790
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00968e04
push dword [ebp - 0x1c]
push 0x974f08
lea edx, [ebp - 0x24]
mov eax, 0x974f14
call fcn.00971e20
push dword [ebp - 0x24]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00965700
mov eax, dword [ebp - 0x18]
call fcn.009657f4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x974380
push 0x10
push 0
lea edx, [ebp - 0x28]
mov eax, 0x974ed8
call fcn.00971e20
mov eax, dword [ebp - 0x28]
call fcn.009657f4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x974e98
call fcn.009722fc
mov eax, dword [0x9776f8]
mov dword [0x97869c], eax
mov eax, dword [0x9786bc]
sub eax, 2
xor eax, dword [0x977778]
mov dword [0x9786ac], eax
je 0x9743c4
push dword [0x978af8]
call fcn.0097269c
lea ecx, [0x978af8]
cmp eax, dword [ecx]
jne 0x9744af
call fcn.009722fc
pop ecx
pop edx
push 0x978ad4
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [0x97869c]
mov dword [0x9786a0], eax
mov eax, dword [0x97869c]
mov dword [0x978664], eax
call fcn.00972120
call fcn.0096ef18
mov dword [0x9786a8], eax
push dword [0x978664]
call fcn.00971fe0
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x974496
mov bl, 0x43
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.0096558c
lea eax, [ebp - 0x2c]
mov edx, 0x974f34
call fcn.00965648
mov eax, dword [ebp - 0x2c]
call fcn.009657f4
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x97448c
mov eax, 0x978c10
xor ecx, ecx
mov edx, 0x400
call fcn.0096486c
mov byte [0x978c10], bl
push 0
push 0
push 0x9786ac
push 0x9786ac
push 0x978c11
push 0
push 0
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.0096558c
lea eax, [ebp - 0x30]
mov edx, 0x974f34
call fcn.00965648
mov eax, dword [ebp - 0x30]
call fcn.009657f4
push eax
call sub.kernel32.dll_GetVolumeInformationA
inc ebx
cmp bl, 0x5b
jne 0x97440f
mov eax, dword [0x9786bc]
mov dword [0x97867c], eax
pop ecx
lea eax, [0x9786a0]
cmp dword [eax], ecx
jne 0x9743a2
mov eax, dword [0x97777c]
call fcn.0097269c
mov dword [0x978668], eax
mov eax, dword [0x978668]
mov ecx, 1
mov edx, dword [0x977780]
call fcn.0096ee8c
mov ebx, eax
lea edx, [ebp - 0x38]
mov eax, 0x974f40
call fcn.00971e20
mov eax, dword [ebp - 0x38]
push eax
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.00964790
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x34]
pop edx
call fcn.00968cdc
mov edx, dword [ebp - 0x34]
mov eax, 0x9786e8
call fcn.00965438
mov dword [0x978680], ebx
mov eax, dword [0x9786e8]
call fcn.00968bac
test al, al
jne 0x9745a5
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x9745a5
lea eax, [ebp - 0x40]
call fcn.00968eb0
mov edx, dword [ebp - 0x40]
mov eax, 0x979014
call fcn.00965438
mov eax, dword [0x979014]
call fcn.00965640
mov edx, dword [0x979014]
cmp byte [edx + eax - 1], 0x5c
je 0x974569
mov eax, 0x979014
mov edx, 0x974f50
call fcn.00965648
lea edx, [ebp - 0x44]
mov eax, dword [0x9786e8]
call fcn.00968e04
mov ecx, dword [ebp - 0x44]
mov eax, 0x9786e8
mov edx, dword [0x979014]
call fcn.0096568c
mov eax, dword [0x9786e8]
call fcn.00968bac
test al, al
jne 0x9745a5
xor edx, edx
mov al, 1
call fcn.009726f8
jmp 0x974e98
call fcn.009722fc
mov dword [0x978684], ebx
mov eax, 0x9786ec
xor ecx, ecx
mov edx, 0x3e8
call fcn.0096486c
mov eax, dword [0x9786bc]
inc eax
mov dword [0x978688], eax
call fcn.00972120
call fcn.00973c44
test al, al
jne 0x9745e8
xor edx, edx
mov al, 2
call fcn.009726f8
jmp 0x974e98
xor eax, eax
mov dword [0x9786b4], eax
call fcn.00969878
call fcn.00964834
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fstp qword [0x979018]
wait
fld qword [0x978a20]
call fcn.00964834
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fstp qword [0x979020]
wait
fld qword [0x979020]
fcomp dword [0x974f54]
fnstsw ax
sahf
jne 0x97464d
mov eax, dword [0x979018]
mov dword [0x979020], eax
mov eax, dword [0x97901c]
mov dword [0x979024], eax
call fcn.009724d8
fld qword [0x979020]
fcomp qword [0x979018]
fnstsw ax
sahf
ja 0x974693
mov eax, dword [0x979018]
mov dword [0x978a20], eax
mov eax, dword [0x97901c]
mov dword [0x978a24], eax
mov dword [0x9786c4], 0xffffffff
mov dword [0x9786c8], 0xffffffff
xor ebx, ebx
jmp 0x9746bb
mov eax, dword [0x978a20]
mov dword [0x979018], eax
mov eax, dword [0x978a24]
mov dword [0x97901c], eax
xor eax, eax
mov dword [0x9786c4], eax
xor eax, eax
mov dword [0x9786c8], eax
mov bl, 1
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x974722
fld qword [0x9786f0]
fcomp dword [0x974f54]
fnstsw ax
sahf
je 0x974722
fld qword [0x9786f0]
call fcn.00964834
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fcomp qword [0x979018]
fnstsw ax
sahf
jbe 0x974722
cmp dword [0x977798], 1
je 0x974714
call fcn.00973d80
mov dl, 1
mov al, 3
call fcn.009726f8
jmp 0x974e98
or dword [0x9786b4], 8
xor eax, eax
mov dword [0x9786c4], eax
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x9747bc
fld qword [0x9786f8]
fcomp dword [0x974f54]
fnstsw ax
sahf
je 0x9747bc
fld qword [0x9786f8]
call fcn.00964834
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
fild qword [ebp - 0x4c]
fcomp qword [0x979018]
fnstsw ax
sahf
setb al
or al, bl
je 0x974794
cmp dword [0x977798], 1
je 0x974784
call fcn.00973d80
mov dl, 1
mov al, 4
call fcn.009726f8
jmp 0x974e98
or dword [0x9786b4], 0x10
xor eax, eax
mov dword [0x9786c4], eax
jmp 0x9747bc
fld qword [0x9786f8]
call fcn.00964834
mov esi, eax
fld qword [0x979018]
call fcn.00964834
sub esi, eax
cmp esi, dword [0x9786c4]
jae 0x9747bc
mov dword [0x9786c4], esi
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x974819
cmp byte [0x978710], 0
je 0x974819
lea eax, [ebp - 0x50]
mov edx, 0x978710
call fcn.00965608
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x54]
mov eax, 0x974f60
call fcn.00972a0c
mov edx, dword [ebp - 0x54]
pop eax
call fcn.00965750
je 0x974819
cmp dword [0x977798], 1
je 0x974812
mov dl, 1
mov al, 5
call fcn.009726f8
jmp 0x974e98
or dword [0x9786b4], 1
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x974876
cmp byte [0x978810], 0
je 0x974876
lea eax, [ebp - 0x58]
mov edx, 0x978810
call fcn.00965608
mov eax, dword [ebp - 0x58]
push eax
lea edx, [ebp - 0x5c]
mov eax, 0x974f78
call fcn.00972a0c
mov edx, dword [ebp - 0x5c]
pop eax
call fcn.00965750
je 0x974876
cmp dword [0x977798], 1
je 0x97486f
mov dl, 1
mov al, 6
call fcn.009726f8
jmp 0x974e98
or dword [0x9786b4], 2
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x9748b7
cmp dword [0x978708], 0
je 0x9748b7
mov eax, dword [0x978708]
cmp eax, dword [0x9786a8]
je 0x9748b7
cmp dword [0x977798], 1
je 0x9748b0
mov dl, 1
mov al, 7
call fcn.009726f8
jmp 0x974e98
or dword [0x9786b4], 4
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x97492f
mov eax, dword [0x9779f0]
mov eax, dword [eax]
and eax, dword [0x978700]
je 0x97492f
mov esi, dword [0x9779f0]
mov esi, dword [esi]
not esi
and esi, dword [0x978700]
test esi, esi
jbe 0x974905
dec esi
cmp esi, dword [0x9786c8]
jae 0x9748f6
mov dword [0x9786c8], esi
mov eax, dword [0x9779f0]
or esi, dword [eax]
mov dword [0x978700], esi
jmp 0x97492f
cmp dword [0x977798], 1
je 0x974921
call fcn.00973d80
mov dl, 1
mov al, 4
call fcn.009726f8
jmp 0x974e98
or dword [0x9786b4], 0x20
xor eax, eax
mov dword [0x9786c8], eax
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x974a12
mov eax, dword [0x9779f0]
mov eax, dword [eax]
and eax, dword [0x978704]
je 0x974a12
mov esi, dword [0x9779f0]
mov esi, dword [esi]
not esi
and esi, dword [0x978704]
test esi, esi
jbe 0x9749df
test bl, bl
jne 0x9749df
fld qword [0x979018]
fsub qword [0x979020]
fcomp dword [0x974f90]
fnstsw ax
sahf
jb 0x9749c3
cmp dword [0x978aac], 1
jne 0x9749c2
fld qword [0x979018]
fsub qword [0x979020]
mov dword [ebp - 0x4c], esi
xor eax, eax
mov dword [ebp - 0x48], eax
fild qword [ebp - 0x4c]
fcompp
fnstsw ax
sahf
jbe 0x9749be
fld qword [0x979018]
fsub qword [0x979020]
call fcn.00964834
sub esi, eax
jmp 0x9749c3
xor esi, esi
jmp 0x9749c3
dec esi
cmp esi, dword [0x9786c4]
jae 0x9749d1
mov dword [0x9786c4], esi
mov eax, dword [0x9779f0]
mov eax, dword [eax]
or eax, esi
mov dword [0x978704], eax
test esi, esi
setbe al
or bl, al
je 0x974a12
cmp dword [0x977798], 1
je 0x974a04
call fcn.00973d80
mov dl, 1
mov al, 4
call fcn.009726f8
jmp 0x974e98
or dword [0x9786b4], 0x40
xor eax, eax
mov dword [0x9786c4], eax
call fcn.009722fc
call fcn.00973d80
nop
nop
nop
nop
nop
call fcn.009724d8
mov eax, dword [0x977700]
add dword [0x9786a0], eax
mov eax, dword [0x9776f8]
mov dword [0x97869c], eax
mov eax, dword [0x97869c]
mov dword [0x978664], eax
xor esi, esi
mov ebx, 0x977714
cmp dword [ebx], 0
je 0x974a58
mov eax, ebx
call fcn.009728b8
inc esi
add ebx, 0xc
cmp esi, 8
jne 0x974a4c
mov eax, dword [0x978664]
mov edi, dword [eax + 0x3c]
add edi, dword [0x978664]
mov eax, dword [edi + 0x50]
mov dword [0x978698], eax
mov eax, dword [0x977688]
call fcn.0097269c
mov ebx, eax
mov eax, ebx
call fcn.00974038
test al, al
je 0x974e98
call fcn.009724d8
mov eax, dword [0x977690]
call fcn.0097269c
mov ebx, eax
cmp dword [0x9778d8], 0
jbe 0x974ab3
mov eax, ebx
call fcn.00973f0c
mov eax, dword [0x977694]
cmp dword [0x9778dc], 0
jbe 0x974af1
mov edx, ebx
mov ecx, 1
xchg edx, eax
call fcn.0096ee8c
and eax, 0xffff
mov edx, dword [0x9778dc]
and edx, 0xffff
cmp eax, edx
je 0x974af1
xor edx, edx
mov al, 8
call fcn.009726f8
jmp 0x974e98
call fcn.009724d8
sub dword [0x9786a0], 0x800
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x974c26
cmp dword [0x977798], 1
jne 0x974c26
mov eax, dword [0x9777a4]
call fcn.0097269c
mov edx, eax
mov eax, 0x978a10
mov ecx, 0x10
call fcn.009646d8
mov eax, dword [0x9777b0]
call fcn.0097269c
mov ebx, eax
lea eax, [ebp - 0x60]
mov edx, 0x978a2c
call fcn.00965608
mov edx, dword [ebp - 0x60]
mov eax, ebx
call fcn.00968f9c
mov eax, dword [0x97779c]
call fcn.0097269c
mov dword [0x97866c], eax
mov eax, dword [0x97866c]
mov edx, dword [0x9786b4]
mov dword [eax], edx
mov eax, dword [0x9777a0]
call fcn.0097269c
mov edx, dword [0x9786a8]
mov dword [eax], edx
mov eax, dword [0x9777a8]
call fcn.0097269c
mov edx, dword [0x9786c4]
mov dword [eax], edx
mov eax, dword [0x9777ac]
call fcn.0097269c
mov edx, dword [0x9786c8]
mov dword [eax], edx
mov eax, dword [0x9777b4]
call fcn.0097269c
mov edx, dword [0x9786d0]
mov dword [eax], edx
mov edx, dword [0x9786d4]
mov dword [eax + 4], edx
mov eax, dword [0x9777b8]
call fcn.0097269c
mov dword [0x978670], eax
mov eax, dword [0x978670]
mov edx, dword [0x9786d8]
mov dword [eax], edx
mov edx, dword [0x9786dc]
mov dword [eax + 4], edx
mov eax, dword [0x9777bc]
call fcn.0097269c
mov dword [0x978674], eax
mov eax, dword [0x978674]
mov edx, dword [0x9786e0]
mov dword [eax], edx
mov eax, dword [0x9777c0]
call fcn.0097269c
mov dword [0x978678], eax
mov eax, dword [0x978678]
mov edx, dword [0x9786e4]
mov dword [eax], edx
call sub.kernel32.dll_GetCurrentProcess
mov dword [0x97868c], eax
mov dword [0x978694], 0x138
push 0x9786a4
push 4
mov eax, dword [0x978694]
push eax
mov eax, dword [0x978664]
push eax
mov eax, dword [0x97868c]
push eax
call sub.kernel32.dll_VirtualProtectEx
test eax, eax
je 0x974ca2
xor esi, esi
mov ebx, 0x977680
cmp esi, 0xb
je 0x974c75
mov eax, dword [ebx]
mov dword [edi + esi*8 + 0x78], eax
mov eax, dword [ebx + 4]
mov dword [edi + esi*8 + 0x7c], eax
inc esi
add ebx, 8
cmp esi, 0xd
jne 0x974c63
push 0x9786a4
mov eax, dword [0x9786a4]
push eax
mov eax, dword [0x978694]
push eax
mov eax, dword [0x978664]
push eax
mov eax, dword [0x97868c]
push eax
call sub.kernel32.dll_VirtualProtectEx
jmp 0x974cae
xor eax, eax
call fcn.009726a4
jmp 0x974e98
call fcn.009724d8
mov eax, dword [0x97777c]
call fcn.0097269c
mov dword [0x978668], eax
mov eax, dword [0x978668]
mov ecx, 1
mov edx, dword [0x977780]
call fcn.0096ee8c
mov ebx, eax
mov eax, dword [0x9786bc]
add eax, 8
cmp ebx, eax
jne 0x974d22
mov eax, dword [0x9786c0]
add dword [0x9786a0], eax
xor eax, eax
push ebp
push 0x974d0f
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [0x9786a0]
ret
mov eax, dword [0x9786bc]
add dword [0x9786a0], eax
xor eax, eax
push ebp
push 0x974d4b
push dword fs:[eax]
mov dword fs:[eax], esp
call dword [0x9786a0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x974d5c
xor edx, edx
mov al, 8
call fcn.009726f8
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x974d8c
mov eax, dword [0x9776f8]
mov dword [0x97869c], eax
mov eax, dword [0x977700]
add eax, dword [0x97869c]
mov dword [0x9786a0], eax
mov ebx, dword [0x977710]
call fcn.00971e60
cmp ebx, dword [0x9786bc]
je 0x974e42
cmp dword [0x978708], 0
je 0x974e42
mov eax, dword [0x978708]
cmp eax, dword [0x9786a8]
je 0x974e42
or dword [0x9786b4], 4
cmp dword [0x977798], 1
je 0x974e42
push 0x10
lea edx, [ebp - 0x64]
mov eax, 0x974f9c
call fcn.00971e20
mov eax, dword [ebp - 0x64]
call fcn.009657f4
push eax
lea eax, [ebp - 0x6c]
mov edx, 0x978910
call fcn.00965608
push dword [ebp - 0x6c]
push 0x974fb8
lea edx, [ebp - 0x70]
mov eax, 0x974fc4
call fcn.00971e20
push dword [ebp - 0x70]
lea ecx, [ebp - 0x74]
mov eax, 0x9786a8
mov edx, 4
call fcn.0096ecf8
push dword [ebp - 0x74]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00965700
mov eax, dword [ebp - 0x68]
call fcn.009657f4
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x974e98
mov eax, dword [0x9786b4]
call fcn.0097269c
mov dword [0x978668], eax
mov eax, dword [0x978668]
mov ecx, 1
mov edx, dword [0x977780]
call fcn.0096ee8c
mov ebx, eax
mov eax, ebx
call fcn.0097269c
mov dword [0x97866c], eax
mov eax, dword [0x9777c4]
cmp eax, dword [0x977778]
je 0x974e89
jmp dword [0x97866c]
jmp dword [0x978668]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x974ec7
lea eax, [ebp - 0x74]
mov edx, 0xa
call fcn.00965408
lea eax, [ebp - 0x44]
mov edx, 0xe
call fcn.00965408
ret