Function at 0x10029e46
Capabilities:
Get disk size
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088279
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push esi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x178], 0x85faafe3
mov dword [ebp - 0x164], 0xffffffff
mov dword [ebp - 0x16c], 0xc2e7ccc8
mov dword [ebp - 0x174], 0xffffffff
mov dword [ebp - 0x17c], 0x8555145c
mov dword [ebp - 0x184], 0x245f5b1b
mov dword [ebp - 0xac], 0x66e9
mov dword [ebp - 0x50], 0
jmp 0x10029ec2
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jne 0x10029fb9
mov dword [ebp - 0x64], 0xfffffffa
mov dword [ebp - 0x1c], 0
jmp 0x10029ee3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10029ef9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x158], 0xe1d925b0
jmp 0x10029edc
mov dword [ebp - 0x1c], 0
jmp 0x10029f09
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10029f1f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x19c], 7
jmp 0x10029f02
mov dword [ebp - 0x64], 0
jmp 0x10029f2f
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jg 0x10029fb4
or dword [ebp - 0x13c], 0xffffffff
or dword [ebp - 0x138], 0xffffffff
or dword [ebp - 0x134], 0xffffffff
or dword [ebp - 0x130], 0xffffffff
lea ecx, [ebp - 0x6d]
call fcn.1000c103
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x1a4]
call fcn.10019b8e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x194]
call fcn.10019b54
mov dword [ebp - 0x154], 0x4c59cdc3
mov dword [ebp - 0x15c], 0xc13fe662
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
lea ecx, [ebp - 0x194]
call fcn.10019b7a
jmp 0x10029f28
jmp 0x10029ebb
mov byte [ebp - 0x30], 0
movzx eax, byte [ebp - 0x30]
test eax, eax
je 0x10029fe5
push 0x1500
push 0x334
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002a330
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xf8], 0x507b3925
mov dword [ebp - 0x58], 0
jmp 0x1002a019
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1002a02c
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x40], 8
jmp 0x1002a012
mov dword [ebp - 0x10], 0xe
jmp 0x1002a03c
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jle 0x1002a04b
mov dword [ebp - 0x18], 0
jmp 0x1002a035
mov dword [ebp - 0x18], 0
jmp 0x1002a05b
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1002a312
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0xd4], 0
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x1002a08a
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10], 0
jmp 0x1002a09a
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1002a30d
mov dword [ebp - 0xc4], 0xcc65ad6c
mov dword [ebp - 0x7c], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x40]
cmp dword [ebp + eax*4 - 0x40], ecx
jg 0x1002a0d1
mov dword [ebp - 0x84], 1
jmp 0x1002a0d8
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1002a0f6
cmp dword [ebp - 0x10], 0
je 0x1002a0f6
mov dword [ebp - 0x80], 1
jmp 0x1002a0fa
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x80], eax
jg 0x1002a10e
mov dword [ebp - 0xdc], 1
jmp 0x1002a115
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0xdc]
add eax, ecx
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ebp + ecx*4 - 0x40]
je 0x1002a145
cmp dword [ebp - 0x18], 0
je 0x1002a145
cmp dword [ebp - 0x14], 0
je 0x1002a145
mov dword [ebp - 0x8c], 1
jmp 0x1002a14c
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x8c]
je 0x1002a169
cmp dword [ebp - 0x14], 0
je 0x1002a169
mov dword [ebp - 0xbc], 1
jmp 0x1002a170
and dword [ebp - 0xbc], 0
cmp dword [ebp - 0xbc], 0
jb 0x1002a185
mov dword [ebp - 0x94], 1
jmp 0x1002a18c
and dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 0xffffffff
jne 0x1002a1a1
mov dword [ebp - 0x9c], 1
jmp 0x1002a1a8
and dword [ebp - 0x9c], 0
mov dword [ebp - 0xd4], 0xb79f
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x10]
sub ecx, dword [ebp + edx*4 - 0x40]
imul eax, ecx
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ebp + ecx*4 - 0x40]
je 0x1002a2a9
mov dword [ebp - 0x74], 1
mov dword [ebp - 0xc4], 1
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x74], eax
jl 0x1002a200
mov dword [ebp - 0xcc], 1
jmp 0x1002a207
and dword [ebp - 0xcc], 0
cmp dword [ebp - 0x74], 1
jg 0x1002a219
mov dword [ebp - 0xa4], 1
jmp 0x1002a220
and dword [ebp - 0xa4], 0
cmp dword [ebp - 0xa4], 4
jle 0x1002a235
mov dword [ebp - 0xe4], 1
jmp 0x1002a23c
and dword [ebp - 0xe4], 0
cmp dword [ebp - 0xe4], 0xf12afbca
jbe 0x1002a251
mov dword [ebp - 0x78], 1
jmp 0x1002a255
and dword [ebp - 0x78], 0
imul eax, dword [ebp - 0x78], 0xffff
cmp dword [ebp - 0xcc], eax
jge 0x1002a270
mov dword [ebp - 0xb4], 1
jmp 0x1002a277
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x7c], eax
jl 0x1002a294
mov dword [ebp - 0x88], 1
jmp 0x1002a29b
and dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xf8], eax
jmp 0x1002a308
mov byte [ebp - 0x2f], 0
movzx eax, byte [ebp - 0x2f]
test eax, eax
je 0x1002a2d4
push 0
push 0
push 0x162c
push 0
push 0x141c
push 0
push 0x13a4
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x14], 0
jmp 0x1002a2e4
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1002a308
mov byte [ebp - 0x33], 0
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x1002a306
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1002a2dd
jmp 0x1002a093
jmp 0x1002a054
push 0
push 0xb6d
push 0
push 0x1d65
push 0xee8
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x1002a93d
push 3
lea ecx, [ebp - 0x11c]
call fcn.10019b12
and dword [ebp - 4], 0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x60], 0
jmp 0x1002a358
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1002a374
push dword [ebp - 0x60]
lea ecx, [ebp - 0x11c]
call fcn.10019b7f
mov dword [eax], 0x825e7a66
jmp 0x1002a351
mov dword [ebp - 0x38], 2
jmp 0x1002a384
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1002a482
push 4
lea ecx, [ebp - 0x108]
call fcn.10019b12
mov byte [ebp - 4], 1
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x48], 0
jmp 0x1002a3b9
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1002a3d5
push dword [ebp - 0x48]
lea ecx, [ebp - 0x108]
call fcn.10019b7f
mov dword [eax], 0x4d073ff8
jmp 0x1002a3b2
push dword [ebp - 0x38]
lea ecx, [ebp - 0x11c]
call fcn.10019b7f
mov esi, eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x11c]
call fcn.10019b7f
mov ecx, dword [esi]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x108]
call fcn.10019b7f
mov dword [eax], 2
jmp 0x1002a430
push 0
lea ecx, [ebp - 0x108]
call fcn.10019b7f
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x90]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x108]
call fcn.10019b7f
cmp dword [eax], 0
jl 0x1002a46e
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1002a462
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 0xfc], 0xe58d020b
jmp 0x1002a40c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x108]
call fcn.10019b7a
jmp 0x1002a37d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.10019b7a
push 1
lea ecx, [ebp - 0xf4]
call fcn.10019b12
mov dword [ebp - 4], 2
mov dword [ebp - 0x180], 0xcc86f803
mov dword [ebp - 0x24], 0
jmp 0x1002a4bf
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1002a4d2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6c], 0xc2e0cf57
jmp 0x1002a4b8
mov dword [ebp - 0x24], 0
jmp 0x1002a4e2
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1002a4fe
push dword [ebp - 0x24]
lea ecx, [ebp - 0xf4]
call fcn.10019b7f
mov dword [eax], 0xfffffffd
jmp 0x1002a4db
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x1002a519
push 0xcd0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0
lea ecx, [ebp - 0xf4]
call fcn.10019b7f
and dword [eax], 0
jmp 0x1002a54f
push 0
lea ecx, [ebp - 0xf4]
call fcn.10019b7f
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xf4]
call fcn.10019b7f
cmp dword [eax], 0
jg 0x1002a7b5
mov dword [ebp - 0x2c], 0xb11accba
mov dword [ebp - 0x160], 0x979cd329
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0x2c], 0
jmp 0x1002a590
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1002a799
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x28], 0
jmp 0x1002a5bb
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x1002a6b4
mov dword [ebp - 0x4c], 0x6d0374c7
mov dword [ebp - 0x4c], 0
jmp 0x1002a5dc
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1002a6af
mov dword [ebp - 0x54], 0
jmp 0x1002a5f6
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x1002a60c
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x128], 0
jmp 0x1002a5ef
mov byte [ebp - 0x2e], 0
movzx eax, byte [ebp - 0x2e]
test eax, eax
je 0x1002a62a
push 0x13c4
push 0x1c95
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x128], 0
jmp 0x1002a658
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x128], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 0
jl 0x1002a6aa
mov dword [ebp - 0x5c], 0x79f6a715
mov dword [ebp - 0xa0], 0xe75d
mov dword [ebp - 0x5c], 0
jmp 0x1002a689
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jg 0x1002a6a8
mov dword [ebp - 0x14c], 1
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
jmp 0x1002a682
jmp 0x1002a63d
jmp 0x1002a5d5
jmp 0x1002a5b4
mov dword [ebp - 0x28], 0
jmp 0x1002a6c4
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x1002a794
push 0
lea ecx, [ebp - 0xf4]
call fcn.10019b7f
cmp dword [eax], 0x526c
jl 0x1002a6ef
mov dword [ebp - 0xb0], 1
jmp 0x1002a6f6
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0xa8], 2
je 0x1002a730
mov dword [ebp - 0xb8], 1
jmp 0x1002a737
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0xb8]
je 0x1002a751
mov dword [ebp - 0xc0], 1
jmp 0x1002a758
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp eax, dword [ebp - 0xc0]
je 0x1002a773
mov dword [ebp - 0xc8], 1
jmp 0x1002a77a
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x6c]
imul eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp + ecx*4 - 0x6c], eax
jmp 0x1002a6bd
jmp 0x1002a589
push 0
lea ecx, [ebp - 0xf4]
call fcn.10019b7f
cmp dword [eax], 0
je 0x1002a7b0
jmp 0x1002a52b
jmp 0x1002a52b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call fcn.10019b7a
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x44], 0xb2c41ac3
mov dword [ebp - 0x68], 0
jmp 0x1002a7e2
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1002a7f8
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x148], 9
jmp 0x1002a7db
mov dword [ebp - 0x3c], 0
jmp 0x1002a808
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffe5
jg 0x1002a8f4
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x20], 0
jmp 0x1002a829
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1002a8e3
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x148]
mov dword [ebp - 0x150], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x148], 6
jne 0x1002a85f
mov dword [ebp - 0xd0], 1
jmp 0x1002a866
and dword [ebp - 0xd0], 0
cmp dword [ebp - 0x20], 0
je 0x1002a87e
cmp dword [ebp - 0x20], 0
jb 0x1002a87e
mov dword [ebp - 0xd8], 1
jmp 0x1002a885
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd0]
sub eax, dword [ebp - 0xd8]
je 0x1002a8a5
cmp dword [ebp - 0x3c], 0
je 0x1002a8a5
mov dword [ebp - 0x10c], 1
jmp 0x1002a8ac
and dword [ebp - 0x10c], 0
cmp dword [ebp - 0x3c], 0xf823
jl 0x1002a8c1
mov dword [ebp - 0xe0], 1
jmp 0x1002a8c8
and dword [ebp - 0xe0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
add eax, dword [ebp - 0xe0]
mov dword [ebp - 0x44], eax
jmp 0x1002a822
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
jmp 0x1002a801
cmp dword [ebp - 0x44], 0xfffffff7
jl 0x1002a906
mov dword [ebp - 0xe8], 1
jmp 0x1002a90d
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x1002a93d
push 0x995
push 0
push 0x1e1c
push 0x708
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret