Function at 0x4071b0
Capabilities:
Get disk information
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x43c
mov dx, word [0x428280]
push ebp
push esi
push edi
mov ecx, 6
mov esi, 0x426bac
lea edi, [esp + 0x18]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x30], eax
mov ecx, 0x81
lea edi, [esp + 0x3a]
mov dword [esp + 0x34], eax
mov word [esp + 0x38], dx
mov si, word [esp + 0x44c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x242]
mov word [esp + 0x240], dx
rep stosd dword es:[edi], eax
test si, si
stosw word es:[edi], ax
je 0x40726c
lea ecx, [esp + 0x38]
push 0x426ba4
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea edx, [esp + 0x3c]
mov word [esp + 0x38], si
push 0x104
push edx
push 0x426b8c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 3
jb 0x40744c
mov ebp, 0x3a
cmp word [esp + 0x3e], bp
jne 0x40744c
mov ax, word [esp + 0x3c]
mov word [esp + 0x3c], 0x5c
mov word [esp + 0x3e], ax
jmp 0x4072be
lea ecx, [esp + 0x38]
push 0x426b68
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea edx, [esp + 0x58]
push 0x104
push edx
push 0x426b8c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 3
jb 0x40744c
mov ebp, 0x3a
cmp word [esp + 0x5a], bp
jne 0x40744c
mov ax, word [esp + 0x58]
mov word [esp + 0x58], 0x5c
mov word [esp + 0x5a], ax
lea ecx, [esp + 0x10]
push ecx
push 0x426bac
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40744c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0xc]
push ebx
lea eax, [esp + 0x244]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push 0x426b50
push edx
mov dword [esp + 0x28], 0x208
call esi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40736b
lea eax, [esp + 0x4e]
lea ecx, [esp + 0x256]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x40736b
cmp word [esp + 0x246], bp
jne 0x4073ab
mov edx, dword [esp + 0x244]
and edx, 0xffff
push edx
call dword [sym.imp.MSVCRT.dll_tolower]
mov ecx, eax
mov ebp, 1
sub ecx, 0x61
add esp, 4
shl ebp, cl
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
test eax, ebp
jne 0x4073ab
lea eax, [esp + 0x3c]
push eax
call edi
mov edx, dword [esp + 0x18]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [esp + 0x3c]
push eax
push ecx
push 2
push 0
push 0x426b50
push edx
mov dword [esp + 0x28], eax
call ebx
test eax, eax
jne 0x4073ab
lea eax, [esp + 0x1c]
push eax
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x244]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push 0x426b3c
push ecx
mov dword [esp + 0x28], 0x208
call esi
test eax, eax
jne 0x4073f1
lea edx, [esp + 0x244]
push str.UbqDiskRLocalVfsDisk_Volume_Information8E725C92_A59B_4cb1_B396_198FBDD4EF8182D580F1_A466_49b5_8947_B12E6BEE94FE
push edx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x407440
lea eax, [esp + 0x3c]
push str.UbqDiskRLocalVfsDisk_Volume_Information8E725C92_A59B_4cb1_B396_198FBDD4EF8182D580F1_A466_49b5_8947_B12E6BEE94FE
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea ecx, [esp + 0x44]
push ecx
call edi
add esp, 0xc
lea eax, [eax + eax + 2]
lea edx, [esp + 0x3c]
mov dword [esp + 0x10], eax
push eax
mov eax, dword [esp + 0x18]
push edx
push 2
push 0
push 0x426b3c
push eax
call ebx
test eax, eax
jne 0x407440
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x43c
ret 4