Function at 0x40bba1
Capabilities:
Get disk information
Get disk size
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x19e4]
mov eax, 0x1a64
call fcn.00468c00
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x19e0], eax
mov eax, dword [ebp + 0x19ec]
mov ecx, dword [ebp + 0x19f8]
push ebx
mov ebx, dword [ebp + 0x19f4]
push esi
xor esi, esi
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x19f0]
push edi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
cmp eax, esi
jne 0x40bbfc
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x4c], eax
push 8
lea eax, [ebp - 0x70]
push eax
push str.X_dlf
call dword [sym.imp.PPLIB32W.DLL__GetCustData_12]
cmp dword [ebp + 0x19fc], esi
je 0x40bc25
or dword [ebp - 0x6c], 0x100
mov dword [ebp - 0x50], esi
mov edi, dword [ebp - 0x50]
add edi, 0x41
movzx esi, di
push esi
lea eax, [ebp + 0x1530]
push str.Network_c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor eax, eax
push 0x258
mov word [ebp + 0xe80], ax
lea eax, [ebp + 0xe80]
push eax
push str.RemotePath
lea eax, [ebp + 0x1530]
push eax
push 0x80000001
call dword [sym.imp.PPLIB32W.DLL__GetRegString_20]
cmp word [ebp + 0xe80], 0
jne 0x40bcb6
push esi
lea eax, [ebp + 0x1530]
push 0x474874
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x258
lea eax, [ebp + 0xe80]
push eax
lea eax, [ebp + 0x1530]
push eax
push str.SYSTEMCurrentControlSetControlSession_ManagerDOS_Devices
push 0x80000002
call dword [sym.imp.PPLIB32W.DLL__GetRegString_20]
mov eax, dword [ebp - 0x4c]
and eax, 1
jne 0x40bccb
cmp word [ebp + 0xe80], ax
je 0x40bec7
push 0x3a
pop ecx
push 9
mov word [ebp + 0x1532], cx
pop ecx
mov word [ebp + 0x1530], di
mov word [ebp + 0x1534], cx
test eax, eax
je 0x40be62
push dword [ebp + 0x1530]
lea eax, [ebp + 0x1536]
push eax
call dword [sym.imp.PPLIB32W.DLL__GetDriveNameTitle_8]
mov eax, dword [0x489558]
mov ecx, dword [ebp - 0x50]
shr eax, cl
test al, 1
jne 0x40bd2a
lea edi, [ebp + 0x1536]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x40bd17
mov esi, 0x4758a4
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp + 0xe80]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40bd33
sub eax, edx
sar eax, 1
cmp eax, 5
jbe 0x40bda0
cmp word [ebp + 0xe84], 0x3f
jne 0x40bda0
lea edi, [ebp + 0x1536]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x40bd58
mov esi, 0x4758a0
lea eax, [ebp + 0xe88]
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40bd71
sub eax, edx
lea edi, [ebp + 0x1536]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x40bd85
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test dword [ebp - 0x6c], 0x100
je 0x40be7e
mov ecx, str.Floppy
lea eax, [ebp + 0x1530]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40bdde
test dx, dx
je 0x40bdda
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40bdde
add eax, 4
add ecx, 4
test dx, dx
jne 0x40bdb8
xor eax, eax
jmp 0x40bde3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40be7e
movzx eax, word [ebp + 0x1530]
and dword [ebp - 0x58], 0
and dword [ebp - 0x5c], 0
push eax
lea eax, [ebp + 0xe80]
push str._c:_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xe80]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x5c]
or eax, dword [ebp - 0x58]
je 0x40be7e
lea eax, [ebp + 0x1536]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40be3a
push dword [ebp - 0x58]
sub eax, edx
push dword [ebp - 0x5c]
sar eax, 1
push 5
push 3
lea eax, [ebp + eax*2 + 0x1536]
push eax
call dword [sym.imp.PPLIB32W.DLL__FormatNumber_20]
jmp 0x40be7e
lea eax, [ebp + 0xe80]
push eax
lea eax, [ebp + 0x1536]
push str.offline__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov cx, word [ebp + 0x1530]
mov edx, dword [ebp - 0x64]
xor eax, eax
cmp cx, word [edx + 0x584]
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x60]
sete al
push eax
lea eax, [ebp + 0x1530]
push eax
call fcn.00457186
inc dword [ebx]
cmp dword [ebp - 0x54], 0
je 0x40bec7
xor eax, eax
mov word [ebp + 0x1534], ax
lea eax, [ebp + 0x1530]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.PPLIB32W.DLL__ThAddString_8]
shr dword [ebp - 0x4c], 1
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0x1a
jl 0x40bc28
lea eax, [ebp - 0x4c]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSessionInfo
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c045
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x78]
push ecx
push eax
push eax
push eax
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp + 0x1430]
push ecx
mov dword [ebp - 0x58], eax
push eax
jmp 0x40c025
lea edi, [ebp + 0x1430]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x40bf23
push 0xb
pop ecx
lea eax, [ebp - 0x64]
push eax
push 0x20019
push 0
lea eax, [ebp + 0x1430]
push eax
push dword [ebp - 0x4c]
mov esi, str.MyComputerNamespace
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c00b
mov dword [ebp - 0x50], 0xc8
xor esi, esi
movzx ecx, word [eax + str.CLSID_]
mov word [ebp + eax + 0x1330], cx
inc eax
inc eax
cmp cx, si
jne 0x40bf64
lea eax, [ebp - 0x78]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x133c]
push eax
push esi
push dword [ebp - 0x64]
call ebx
test eax, eax
jne 0x40c002
lea edi, [ebp + 0x1330]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, si
jne 0x40bf9e
push 0xd
pop ecx
push 0x104
lea eax, [ebp + 0x7b8]
push eax
push str.Target
lea eax, [ebp + 0x1330]
push eax
mov esi, str.InstanceInitPropertyBag
push 0x80000000
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.PPLIB32W.DLL__GetRegString_20]
mov esi, dword [ebp - 0x68]
mov edx, dword [esi]
mov ecx, dword [ebp - 0x60]
lea eax, [ebp + 0x7b8]
push eax
call fcn.00457166
inc dword [esi]
cmp dword [ebp - 0x54], 0
je 0x40c002
lea eax, [ebp + 0x7b8]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.PPLIB32W.DLL__ThAddString_8]
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x58]
lea eax, [ebp - 0x78]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x1430]
push eax
push dword [ebp - 0x58]
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], 0x80
call ebx
test eax, eax
je 0x40bf1b
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x68]
xor eax, eax
push 0x254
mov word [ebp + 0x1534], ax
lea eax, [ebp + 0x1534]
push eax
push str.TriggerStartPrefix
push str.SYSTEMCurrentControlSetServicesP9NPNetworkProvider
push 0x80000002
call dword [sym.imp.PPLIB32W.DLL__GetRegString_20]
cmp word [ebp + 0x1534], 0
je 0x40c0b3
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x60]
push 0x5c
pop eax
mov word [ebp + 0x1532], ax
mov word [ebp + 0x1530], ax
lea eax, [ebp + 0x1530]
push eax
call fcn.00457166
inc dword [ebx]
cmp dword [ebp - 0x54], 0
je 0x40c0b3
lea eax, [ebp + 0x1530]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.PPLIB32W.DLL__ThAddString_8]
xor edi, edi
push edi
push str.17:_
push edi
call dword [sym.imp.PPLIB32W.DLL__VFPtoIShell_12]
mov esi, eax
cmp esi, edi
je 0x40c203
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp dword [0x48aa04], 6
mov eax, dword [esi]
lea ecx, [ebp - 0x58]
push ecx
sbb ecx, ecx
and ecx, 0xffffe000
add ecx, 0x20e0
push ecx
push edi
push esi
call dword [eax + 0x10]
test eax, eax
jne 0x40c1f4
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
lea edx, [ebp - 0x68]
push edx
lea edx, [ebp - 0x4c]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40c1eb
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
cmp dword [ebp - 0x68], 0
je 0x40c1eb
push dword [ebp - 0x4c]
lea eax, [ebp + 0x1530]
push esi
push eax
call fcn.00431a53
test eax, eax
je 0x40c1c4
cmp word [ebp + 0x1530], 0x5c
jne 0x40c1c4
cmp word [ebp + 0x1534], 0x3f
jne 0x40c1c4
push dword [ebp - 0x4c]
lea eax, [ebp + 0xe80]
push esi
push eax
call dword [sym.imp.PPLIB32W.DLL__PIDL2DisplayNameOf_12]
test eax, eax
je 0x40c1c4
lea eax, [ebp + 0xe80]
push eax
lea eax, [ebp + 0x1530]
push str._s_tmtp:
push eax
call edi
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x60]
add esp, 0xc
lea eax, [ebp + 0x1530]
push eax
call fcn.00457166
inc dword [ebx]
cmp dword [ebp - 0x54], 0
je 0x40c1c4
lea eax, [ebp + 0xe80]
push eax
lea eax, [ebp + 0x1530]
push str.17:_s
push eax
call edi
add esp, 0xc
lea eax, [ebp + 0x1530]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.PPLIB32W.DLL__ThAddString_8]
mov eax, dword [ebp - 0x64]
push dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
lea edx, [ebp - 0x68]
push edx
lea edx, [ebp - 0x4c]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x40c120
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov edi, dword [sym.imp.PPLIB32W.DLL__EnumCustData_16]
xor esi, esi
push esi
push esi
lea eax, [ebp + 0x9c0]
push eax
mov dword [ebp - 0x58], esi
push esi
jmp 0x40c335
cmp word [ebp + 0x9c0], 0x4d
je 0x40c235
cmp word [ebp + 0x9c0], 0x53
jne 0x40c324
cmp word [ebp + 0x9c2], 0x5f
jne 0x40c324
cmp word [ebp + 0x9c4], 0x61
jne 0x40c324
cmp word [ebp + 0x9c6], 0x75
jne 0x40c324
cmp word [ebp + 0x9c8], 0x78
jne 0x40c324
xor eax, eax
mov word [ebp - 0x48], ax
push 0x800
lea eax, [ebp - 0x48]
push eax
push 0x4750d0
lea eax, [ebp + 0x9c0]
push eax
call dword [sym.imp.PPLIB32W.DLL__GetCustTable_16]
cmp word [ebp - 0x48], 0
je 0x40c324
test esi, esi
jne 0x40c2b6
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push str.aux:
mov esi, eax
push esi
push 0x10
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_AppendMenuW]
lea eax, [ebp - 0x48]
push 0x4750dc
push eax
call fcn.0046896c
pop ecx
pop ecx
test eax, eax
je 0x40c2d4
xor ecx, ecx
mov word [eax], cx
add eax, 8
jmp 0x40c2d7
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x54], 0
push eax
jne 0x40c30c
lea eax, [ebp + 0x9c0]
push eax
lea eax, [ebp + 0x1530]
push str._s_t_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebx]
add esp, 0x10
lea eax, [ebp + 0x1530]
push eax
mov ecx, esi
call fcn.00457166
jmp 0x40c322
mov edx, dword [ebx]
mov ecx, esi
call fcn.00457166
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.PPLIB32W.DLL__ThAddString_8]
inc dword [ebx]
inc dword [ebp - 0x58]
push 0
push 0
lea eax, [ebp + 0x9c0]
push eax
push dword [ebp - 0x58]
call edi
test eax, eax
jge 0x40c21d
mov ecx, dword [ebp + 0x19e0]
mov eax, dword [ebp - 0x60]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0x19e4
leave
ret 0x14