Function at 0x10318f70
Capabilities:
Create thread
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103bcbdb
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x106a6100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a4], 0
mov ecx, 0x10a21b93
call fcn.103a4800
push 0x105
push 0
lea eax, [ebp - 0x220]
push eax
call fcn.101f8810
add esp, 0xc
push 0x105
push 0
lea ecx, [ebp - 0x118]
push ecx
call fcn.101f8810
add esp, 0xc
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
cmp dword [ebp + 0xc], 1
jne 0x103192e6
push 0x105
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 0x105
lea eax, [ebp - 0x220]
push eax
push 0x105f79cc
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x103192e6
xor ecx, ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], ecx
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x10a10864
call fcn.1016f990
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2b0]
push ecx
mov ecx, 0x10a10864
call fcn.1016faa0
mov dword [ebp - 0x278], eax
mov edx, dword [ebp - 0x278]
push edx
lea ecx, [ebp - 0x238]
call fcn.1016fe00
movzx eax, al
test eax, eax
jne 0x103190b2
mov dword [ebp - 0x270], 1
jmp 0x103190bc
mov dword [ebp - 0x270], 0
mov cl, byte [ebp - 0x270]
mov byte [ebp - 0x261], cl
mov dl, byte [ebp - 0x261]
mov byte [ebp - 0x262], dl
push 3
lea ecx, [ebp - 0x244]
call fcn.101b24a0
lea ecx, [ebp - 0x2b0]
call fcn.100539d0
lea ecx, [ebp - 0x244]
call fcn.101b2590
nop
movzx eax, byte [ebp - 0x262]
test eax, eax
je 0x103192cb
mov dword [ebp - 0x27c], 0x10a10864
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov edx, dword [ebp - 0x27c]
mov dword [ebp - 0x280], edx
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x284]
mov edx, dword [ecx + 4]
mov eax, dword [edx]
mov dword [ebp - 0x288], eax
mov ecx, dword [ebp - 0x288]
mov dword [ebp - 0x228], ecx
xor edx, edx
mov byte [ebp - 0x221], dl
jmp 0x10319164
lea ecx, [ebp - 0x228]
call fcn.1016fd10
nop
mov al, byte [ebp - 0x221]
mov byte [ebp - 0x268], al
mov ecx, dword [ebp - 0x228]
movsx edx, byte [ecx + 0xd]
test edx, edx
jne 0x1031918a
mov dword [ebp - 0x274], 1
jmp 0x10319194
mov dword [ebp - 0x274], 0
mov al, byte [ebp - 0x274]
mov byte [ebp - 0x263], al
movzx ecx, byte [ebp - 0x263]
test ecx, ecx
je 0x1031925b
mov edx, dword [ebp - 0x228]
add edx, 0x10
mov dword [ebp - 0x28c], edx
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x290]
mov dword [ebp - 0x26c], ecx
mov edx, dword [ebp - 0x26c]
mov eax, dword [edx]
mov dword [ebp - 0x294], eax
mov ecx, dword [ebp - 0x26c]
add ecx, 4
push ecx
lea ecx, [ebp - 0x260]
call fcn.10063520
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x294]
cmp edx, dword [ebp - 0x22c]
jne 0x10319246
lea eax, [ebp - 0x260]
push eax
mov ecx, 0x108e17f8
call fcn.100da480
mov ecx, dword [ebp - 0x26c]
mov edx, dword [ecx]
mov dword [0x108e1818], edx
mov byte [0x108e1814], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
call fcn.10063170
nop
jmp 0x10319158
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
call fcn.10063170
nop
jmp 0x10319158
push 0
push 0
push 0
push 0x102d0070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jne 0x103192a4
mov dword [ebp - 0x29c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.1016f790
nop
mov eax, dword [ebp - 0x29c]
jmp 0x103192ec
mov dword [ebp - 0x2a0], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.1016f790
nop
mov eax, dword [ebp - 0x2a0]
jmp 0x103192ec
push 0
call fcn.10251580
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.1016f790
nop
jmp 0x103192ea
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101f5040
mov esp, ebp
pop ebp
ret 0xc