Function at 0x4c0ad8
Capabilities:
Get disk information
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa84
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x57c], edx
mov dword [ebp - 0x578], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4c0e44
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x174]
call fcn.004c0788
xor ebx, ebx
test byte [ebp - 1], 1
je 0x4c0c6c
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push 0x4c0e58
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4c0bc2
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x574]
push eax
push 0
push 0
push 0x4c0e84
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c0bb9
mov byte [ebp - 0x15], 1
lea edx, [ebp - 0x574]
lea eax, [ebp - 0x174]
mov ecx, dword [ebp - 0x10]
call fcn.004c07d0
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x574]
push eax
push 0
push 0
push 0x4c0e94
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c0bb9
lea edx, [ebp - 0x574]
lea eax, [ebp - 0x174]
mov ecx, dword [ebp - 0x10]
call fcn.004c07d0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [ebp - 0x15], 0
jne 0x4c0c6c
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push 0x4c0eac
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4c0c6c
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x574]
push eax
push 0
push 0
push 0x4c0e84
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c0c63
lea edx, [ebp - 0x574]
lea eax, [ebp - 0x174]
mov ecx, dword [ebp - 0x10]
call fcn.004c07d0
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x574]
push eax
push 0
push 0
push 0x4c0e94
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c0c63
lea edx, [ebp - 0x574]
lea eax, [ebp - 0x174]
mov ecx, dword [ebp - 0x10]
call fcn.004c07d0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
test byte [ebp - 1], 2
je 0x4c0ca7
lea eax, [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetSystemInfo
lea eax, [ebp - 0x574]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
lea eax, [ebp - 0x570]
mov edx, dword [ebp - 0x44]
mov dword [eax], edx
lea edx, [ebp - 0x574]
lea eax, [ebp - 0x174]
mov ecx, 8
call fcn.004c07d0
test byte [ebp - 1], 4
je 0x4c0d57
lea eax, [ebp - 0x25]
push eax
call sub.ole32.dll_CoCreateGuid
lea eax, [ebp - 0x35]
push eax
call sub.ole32.dll_CoCreateGuid
push 0x4c0edc
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x4c0d00
push 0x4c0ee8
push esi
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x4c0cfa
lea eax, [ebp - 0x25]
push eax
call dword [ebp - 0xc]
test eax, eax
setne bl
lea eax, [ebp - 0x35]
push eax
call dword [ebp - 0xc]
push esi
call sub.kernel32.dll_FreeLibrary_1
test bl, bl
je 0x4c0d14
lea eax, [ebp - 0x25]
call fcn.004c0934
lea eax, [ebp - 0x35]
call fcn.004c0934
mov al, byte [ebp - 0x1b]
cmp al, byte [ebp - 0x2b]
jne 0x4c0d57
mov al, byte [ebp - 0x1a]
cmp al, byte [ebp - 0x2a]
jne 0x4c0d57
mov al, byte [ebp - 0x19]
cmp al, byte [ebp - 0x29]
jne 0x4c0d57
mov al, byte [ebp - 0x18]
cmp al, byte [ebp - 0x28]
jne 0x4c0d57
mov al, byte [ebp - 0x17]
cmp al, byte [ebp - 0x27]
jne 0x4c0d57
mov al, byte [ebp - 0x16]
cmp al, byte [ebp - 0x26]
jne 0x4c0d57
lea edx, [ebp - 0x1b]
lea eax, [ebp - 0x174]
mov ecx, 6
call fcn.004c07d0
test byte [ebp - 1], 8
je 0x4c0e13
mov bl, 0x43
lea eax, [ebp - 0x578]
mov edx, ebx
call fcn.00404910
lea eax, [ebp - 0x578]
mov edx, 0x4c0f08
call fcn.00404a00
mov eax, dword [ebp - 0x578]
call fcn.00404bf8
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4c0e09
lea eax, [ebp - 0x574]
xor ecx, ecx
mov edx, 0x400
call fcn.004032e8
mov byte [ebp - 0x574], bl
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x573]
push eax
push 0
push 0
lea eax, [ebp - 0x57c]
mov edx, ebx
call fcn.00404910
lea eax, [ebp - 0x57c]
mov edx, 0x4c0f08
call fcn.00404a00
mov eax, dword [ebp - 0x57c]
call fcn.00404bf8
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea edx, [ebp - 0x574]
lea eax, [ebp - 0x174]
mov ecx, 5
call fcn.004c07d0
inc ebx
cmp bl, 0x5b
jne 0x4c0d63
lea edx, [ebp - 8]
lea eax, [ebp - 0x174]
mov ecx, 4
call fcn.004c08d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0e4b
lea eax, [ebp - 0x57c]
mov edx, 2
call fcn.0040474c
ret