Function at 0x1003de90
Capabilities:
Get disk information
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x101e4b96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa5c
push ebx
push ebp
mov ebp, dword [esp + 0xa74]
push esi
test ebp, ebp
push edi
mov dword [esp + 0x10], ecx
je 0x1003e2c3
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
push ebp
call ebx
add esp, 4
test eax, eax
je 0x1003e2c3
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x3e]
mov word [esp + 0x3c], 0
rep stosd dword es:[edi], eax
push 0x208
lea eax, [esp + 0x40]
push ebp
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
mov esi, 0x5c
add esp, 0xc
cmp word [esp + 0x3c], si
jne 0x1003e22c
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x452]
mov word [esp + 0x450], 0
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCRT.dll__wcsnicmp]
push 0xc
lea ecx, [esp + 0x40]
push str.SystemRoot_
push ecx
call edi
add esp, 0xc
test eax, eax
jne 0x1003dfa2
mov edi, dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [esp + 0x450]
push str._SystemRoot_
push edx
call edi
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x472]
push eax
push ecx
mov word [esp + 0x478], si
call edi
add esp, 0x10
lea edx, [esp + 0x3c]
lea eax, [esp + 0x450]
push 0x209
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1003e2c3
cmp eax, 0x104
jb 0x1003e22c
jmp 0x1003e2c3
push 4
push 0x1024a31c
push ebp
call edi
add esp, 0xc
test eax, eax
jne 0x1003dfe9
mov esi, dword [sym.imp.MSVCRT.dll_wcsncpy]
lea ecx, [esp + 0x44]
push 0x208
lea edx, [esp + 0x454]
push ecx
push edx
call esi
lea eax, [esp + 0x45c]
push 0x208
lea ecx, [esp + 0x4c]
push eax
push ecx
call esi
add esp, 0x18
jmp 0x1003e22c
push 0x10
push 0x1024caec
push ebp
call edi
add esp, 0xc
test eax, eax
jne 0x1003e106
lea edx, [esp + 0x3c]
push 0x208
lea eax, [esp + 0x454]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
lea ecx, [esp + 0x45c]
push ecx
call ebx
add esp, 0x10
lea ecx, [esp + 0x2c]
mov ebx, eax
call fcn.1007f200
xor edi, edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0xa74], edi
call fcn.1007f200
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x2c]
push edx
push eax
mov byte [esp + 0xa7c], 1
call fcn.1003db80
cmp dword [esp + 0x20], edi
jle 0x1003e0dc
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x450]
mov eax, dword [ecx + edi*4]
mov esi, dword [eax - 8]
push esi
push edx
push eax
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1003e096
mov ax, word [esp + esi*2 + 0x450]
cmp ax, 0x5c
je 0x1003e0a1
cmp ax, 0x2f
je 0x1003e0a1
mov eax, dword [esp + 0x20]
inc edi
cmp edi, eax
jl 0x1003e061
jmp 0x1003e0dc
mov eax, dword [esp + 0xa80]
sub ebx, esi
add ebx, 2
cmp ebx, eax
jae 0x1003e0dc
mov eax, dword [esp + 0x2c]
push 2
lea ecx, [esp + 0x40]
mov edi, dword [eax + edi*4]
push edi
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
lea edx, [esp + esi*2 + 0x45c]
lea eax, [esp + 0x4c]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 0x14
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa74], 0
call fcn.1007f210
lea ecx, [esp + 0x2c]
mov dword [esp + 0xa74], 0xffffffff
call fcn.1007f210
jmp 0x1003e22c
push 0x17
push str.DeviceTSafeDiskVolume
push ebp
call edi
add esp, 0xc
test eax, eax
jne 0x1003e22c
push str.DeviceTSafeDiskVolume
call ebx
push ebp
mov esi, eax
call ebx
mov ecx, 0x11
add esp, 8
sub ecx, esi
add eax, ecx
cmp eax, 0x208
ja 0x1003e169
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x3c]
lea edx, [ebp + esi*2 + 2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
push edx
mov ax, word [ebp + esi*2]
lea ecx, [esp + 0x40]
push eax
push str._TSD_VOLUME__c:_s
push ecx
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x10
push ebp
call ebx
add esp, 4
cmp eax, 0x19
jbe 0x1003e22c
mov ax, word [ebp + esi*2 + 2]
lea ebx, [ebp + esi*2 + 2]
cmp ax, 0x5c
je 0x1003e191
cmp ax, 0x2f
jne 0x1003e22c
mov ax, word [0x102459ac]
mov edx, dword [0x102459a8]
mov word [esp + 0x18], ax
mov ax, word [ebp + esi*2]
mov dword [esp + 0x14], edx
cmp ax, 0x43
mov word [esp + 0x14], ax
jb 0x1003e1bc
cmp ax, 0x5a
jbe 0x1003e1c8
cmp ax, 0x63
jb 0x1003e22c
cmp ax, 0x7a
ja 0x1003e22c
lea ecx, [esp + 0x450]
push 0x208
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jbe 0x1003e22c
cmp eax, 0x208
jae 0x1003e22c
lea eax, [esp + 0x450]
push 0x18
push eax
push ebp
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1003e22c
mov ecx, 0x104
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
xor ecx, ecx
push ebx
stosw word es:[edi], ax
mov cx, word [ebp + esi*2]
lea edx, [esp + 0x40]
push ecx
push str._c:_s
push edx
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x10
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x3c]
push 0x104
push eax
mov ecx, esi
call fcn.1003e370
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x866]
mov word [esp + 0x864], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 8]
test eax, eax
je 0x1003e2ab
lea ecx, [esp + 0x3c]
push 0x7e
push ecx
call dword [sym.imp.MSVCRT.dll_wcschr]
add esp, 8
test eax, eax
je 0x1003e2ab
lea edx, [esp + 0x864]
push 0x104
lea eax, [esp + 0x40]
push edx
push eax
call dword [esi + 8]
test eax, eax
jbe 0x1003e2ab
cmp eax, 0x104
jae 0x1003e2ab
mov ecx, dword [esp + 0xa80]
lea edx, [esp + 0x864]
dec ecx
push ecx
push edx
jmp 0x1003e2b9
mov eax, dword [esp + 0xa80]
lea ecx, [esp + 0x3c]
dec eax
push eax
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
mov ecx, dword [esp + 0xa6c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xa68
ret 8