Function at 0x10029b60
Capabilities:
Get disk information
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x100afe10
mov eax, dword fs:[0]
push eax
sub esp, 0x5c4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x5c0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x5d8]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0x24], eax
mov edi, ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], 0
xor ecx, ecx
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x64], edi
mov dword [esp + 0x7c], 7
mov dword [esp + 0x78], 0
mov word [esp + 0x68], cx
mov dword [esp + 0x5e0], 1
test eax, eax
jne 0x10029bfa
lea eax, [esp + 0x68]
mov ecx, edi
push eax
call fcn.100077b0
jmp 0x1002a20e
push 0xc
xor eax, eax
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
lea ecx, [esp + 0x50]
push str.Kernel32.dll
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
call fcn.10008230
mov byte [esp + 0x5e0], 2
mov eax, dword [0x100ef4e8]
test al, 1
jne 0x10029c76
or eax, 1
mov dword [0x100ef4e8], eax
mov byte [esp + 0x5e0], 3
mov dword [0x100ef4e4], 0
call fcn.1001f820
push 0x100baf40
call fcn.1003414c
add esp, 4
mov byte [esp + 0x5e0], 2
lea eax, [esp + 0x4c]
mov ecx, 0x100ef4e4
push eax
call fcn.1001f9e0
mov ebp, eax
mov dword [esp + 0x30], ebp
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x60], 8
jb 0x10029ca6
push dword [esp + 0x4c]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x60], 7
push 9
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x4c], eax
push str.Psapi.dll
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], eax
mov word [esp + 0x3c], ax
call fcn.10008230
mov byte [esp + 0x5e0], 4
mov eax, dword [0x100ef4e8]
test al, 1
jne 0x10029d2b
or eax, 1
mov dword [0x100ef4e8], eax
mov byte [esp + 0x5e0], 5
mov dword [0x100ef4e4], 0
call fcn.1001f820
push 0x100baf40
call fcn.1003414c
add esp, 4
mov byte [esp + 0x5e0], 4
lea eax, [esp + 0x34]
mov ecx, 0x100ef4e4
push eax
call fcn.1001f9e0
mov esi, eax
mov dword [esp + 0x14], esi
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x48], 8
jb 0x10029d5b
push dword [esp + 0x34]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
test esi, esi
je 0x1002a202
test ebp, ebp
je 0x1002a202
lea ecx, [esp + 0x9c]
call fcn.100201f0
cmp dword [esp + 0xa0], 6
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jb 0x10029e31
push str.QueryFullProcessImageNameW
push ebp
call ebx
mov esi, eax
test esi, esi
je 0x10029e2d
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.10037070
add esp, 0xc
mov dword [esp + 0x80], 0x208
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x1c0]
push eax
push 0
push dword [esp + 0x30]
call esi
test eax, eax
je 0x10029e2d
mov eax, dword [esp + 0x80]
cmp eax, 0x208
jae 0x10029e1c
add eax, eax
cmp eax, 0x412
jae 0x10029f62
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x6c]
call fcn.1000bc30
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x78], 0
jne 0x1002a16b
push str.GetProcessImageFileNameW
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x10029e58
push str.GetProcessImageFileNameW
push ebp
call ebx
mov esi, eax
test esi, esi
je 0x10029ebe
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.10037070
add esp, 0xc
lea eax, [esp + 0x1bc]
push 0x208
push eax
push dword [esp + 0x2c]
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x10029ebe
add eax, eax
cmp eax, 0x412
jae 0x10029f62
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x6c]
call fcn.1000bc30
cmp dword [esp + 0x78], 0
je 0x1002a0e4
push 0x410
call fcn.1009016e
add esp, 4
mov ebx, eax
push 0x410
push 0
push ebx
call fcn.10037070
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
movq qword [esp + 0x24], xmm0
add esp, 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x5e0], 6
lea ecx, [esp + 0x18]
call fcn.1002c120
mov ecx, dword [esp + 0x1c]
mov eax, 0x2aaaaaab
mov esi, dword [esp + 0x18]
xor ebp, ebp
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x80], eax
je 0x1002a08b
mov edi, esi
mov edi, edi
cmp dword [edi + 0x10], 3
jb 0x10029f81
mov ecx, dword [edi + 0x14]
cmp ecx, 8
jb 0x10029f67
mov eax, dword [edi]
jmp 0x10029f69
call fcn.100343e4
mov eax, edi
cmp word [eax + 4], 0x5c
jne 0x10029f81
cmp ecx, 8
jb 0x10029f79
mov eax, dword [edi]
jmp 0x10029f7b
mov eax, edi
xor ecx, ecx
mov word [eax + 4], cx
cmp dword [edi + 0x14], 8
jb 0x10029f8b
mov eax, dword [edi]
jmp 0x10029f8d
mov eax, edi
push 0x208
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x10029fa1
mov word [ebx], ax
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10029fa6
sub esi, ecx
sar esi, 1
je 0x10029fda
cmp esi, dword [esp + 0x78]
jae 0x10029fda
cmp dword [esp + 0x7c], 8
lea eax, [esp + 0x68]
push esi
cmovae eax, dword [esp + 0x6c]
push ebx
push eax
call fcn.100410aa
add esp, 0xc
test eax, eax
je 0x10029ff0
inc ebp
add edi, 0x18
cmp ebp, dword [esp + 0x80]
jb 0x10029f50
jmp 0x1002a083
xor eax, eax
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], 0
mov word [esp + 0x84], ax
mov byte [esp + 0x5e0], 7
lea eax, [esp + 0x68]
cmp dword [esp + 0x7c], 8
cmovae eax, dword [esp + 0x68]
cmp dword [edi + 0x14], 8
jb 0x1002a044
mov edi, dword [edi]
lea eax, [eax + esi*2]
push eax
push edi
lea eax, [esp + 0x8c]
push str._s_s
push eax
call fcn.100174e0
add esp, 0x10
lea eax, [esp + 0x84]
lea ecx, [esp + 0x68]
push eax
call fcn.100286a0
mov byte [esp + 0x5e0], 6
lea ecx, [esp + 0x84]
call fcn.10006f00
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x2c]
push ebx
call fcn.100342a7
add esp, 4
mov byte [esp + 0x5e0], 1
test esi, esi
je 0x1002a0cf
push dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
push esi
call fcn.10007e60
push esi
call fcn.10034183
add esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
cmp dword [esp + 0x78], 0
jne 0x1002a16b
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, dword [esp + 0x30]
push str.GetModuleFileNameExW
push dword [esp + 0x18]
call ebx
mov esi, eax
test esi, esi
jne 0x1002a103
push str.GetModuleFileNameExW
push ebp
call ebx
mov esi, eax
test esi, esi
je 0x1002a16b
xor eax, eax
push 0x410
push eax
mov word [esp + 0x1c4], ax
lea eax, [esp + 0x1c6]
push eax
call fcn.10037070
add esp, 0xc
lea eax, [esp + 0x1bc]
push 0x208
push eax
push 0
push dword [esp + 0x30]
call esi
lea ecx, [eax - 1]
cmp ecx, 0x206
ja 0x1002a16b
add eax, eax
cmp eax, 0x412
jae 0x10029f62
xor ecx, ecx
mov word [esp + eax + 0x1bc], cx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x6c]
call fcn.1000bc30
lea edx, [esp + 0x68]
lea ecx, [esp + 0x84]
call fcn.10018440
mov esi, eax
mov byte [esp + 0x5e0], 8
lea eax, [esp + 0x68]
cmp eax, esi
je 0x1002a1c1
cmp dword [esp + 0x7c], 8
jb 0x1002a1a0
push dword [esp + 0x68]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x7c], 7
push esi
lea ecx, [esp + 0x6c]
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
call fcn.10007c00
mov byte [esp + 0x5e0], 1
cmp dword [esp + 0x98], 8
jb 0x1002a1e2
push dword [esp + 0x84]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], 0
mov word [esp + 0x84], ax
lea eax, [esp + 0x68]
mov ecx, edi
push eax
call fcn.100077b0
mov dword [esp + 0x28], 1
mov byte [esp + 0x5e0], 0
cmp dword [esp + 0x7c], 8
jb 0x1002a231
push dword [esp + 0x68]
call fcn.10034183
add esp, 4
xor eax, eax
mov dword [esp + 0x7c], 7
mov dword [esp + 0x78], eax
mov word [esp + 0x68], ax
mov eax, edi
mov ecx, dword [esp + 0x5d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c0]
xor ecx, esp
call fcn.10033901
add esp, 0x5d0
ret