Function at 0x10008ba7
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebp
sub esp, 0x45c
lea ebp, [esp - 4]
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp + 0x45c], eax
push 8
mov eax, 0x101ecb65
call fcn.101d1901
mov eax, dword [ebp + 0x468]
mov edi, dword [ebp + 0x46c]
push str.AIL:VerifyDirectory
lea ecx, [ebp]
mov dword [ebp - 0x10], eax
call fcn.100010f3
xor esi, esi
mov dword [ebp - 4], esi
cmp edi, esi
je 0x10008bf8
cmp word [edi], si
je 0x10008bf8
push edi
jmp 0x10008bfd
push str.InstDir
call fcn.1000a6f3
mov ebx, eax
pop ecx
cmp ebx, esi
jne 0x10008c1e
push edi
lea eax, [ebp + 0x44]
push 0x104
push eax
call fcn.1000a481
add esp, 0xc
lea ebx, [ebp + 0x44]
push dword [ebp + 0x470]
push ebx
push str.Dir_s_Flag:_x
push 3
call fcn.101d1209
push closesocket
push ebx
call fcn.1001661b
push str.MaxInstDirLen
mov edi, eax
call fcn.1000a6f3
add esp, 0x1c
cmp eax, esi
je 0x10008c58
push eax
call fcn.101d1b9e
pop ecx
jmp 0x10008c5d
mov eax, 0xc0
cmp eax, esi
je 0x10008cb2
cmp edi, eax
jle 0x10008cb2
push 1
push esi
push esi
push 0x32810130
push dword [ebp - 0x10]
call fcn.1001931e
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 4]
push eax
mov dword [ebp], vtable.CLogFunc.0
call fcn.101d12b4
add esp, 0x18
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x45c]
xor ecx, ebp
call fcn.101d14d7
add ebp, 0x460
leave
ret
movzx eax, word [ebx]
push 0x5c
pop edi
mov dword [ebp - 0x14], esi
cmp ax, di
jne 0x10008cf8
cmp word [ebx + 2], di
jne 0x10008cf8
lea eax, [ebx + 4]
push edi
push eax
call fcn.101d1ba9
pop ecx
pop ecx
cmp eax, esi
je 0x10008cf3
add eax, 2
push edi
push eax
call fcn.101d1ba9
pop ecx
pop ecx
cmp eax, esi
je 0x10008cf3
cmp word [eax + 2], si
je 0x10008cf3
mov dword [ebp - 0x14], 1
lea edi, [ebx + 4]
jmp 0x10008d1f
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
je 0x10008d24
cmp word [ebx + 2], 0x3a
jne 0x10008d24
cmp word [ebx + 4], di
jne 0x10008d24
lea edi, [ebx + 6]
cmp word [edi], si
je 0x10008d1f
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], esi
jne 0x10008d32
push 1
push esi
push esi
push 0x32810134
jmp 0x10008c6e
push str.______:
push edi
call fcn.101d3891
pop ecx
pop ecx
cmp eax, esi
je 0x10008e33
push 1
push esi
push esi
push 0x32810131
jmp 0x10008c6e
cmp word [edi], 0x5c
je 0x10008d24
push 0x5c
push edi
call fcn.101d1ba9
pop ecx
pop ecx
mov dword [ebp + 0x458], eax
cmp eax, esi
je 0x10008d8b
sub eax, edi
sar eax, 1
push eax
push edi
lea eax, [ebp + 0x24c]
push 0x104
push eax
call fcn.10016ae1
add esp, 0x10
jmp 0x10008da0
push edi
lea eax, [ebp + 0x24c]
push 0x104
push eax
call fcn.10016ac1
add esp, 0xc
lea eax, [ebp + 0x24c]
push closesocket
push eax
call fcn.1001661b
mov edi, eax
mov eax, dword [0x102730b8]
pop ecx
pop ecx
mov dword [ebp - 0x14], esi
cmp word [eax], si
je 0x10008df2
mov eax, 0x102730b8
push dword [eax]
lea eax, [ebp + 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10008d47
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
lea eax, [eax*4 + 0x102730b8]
mov ecx, dword [eax]
cmp word [ecx], si
jne 0x10008dc7
cmp edi, 2
jl 0x10008e11
cmp word [ebp + edi*2 + 0x248], 0x2e
jne 0x10008e11
cmp word [ebp + edi*2 + 0x24a], 0x2e
je 0x10008d47
cmp word [ebp + 0x24c], 0x20
je 0x10008e60
cmp word [ebp + edi*2 + 0x24a], 0x20
je 0x10008e60
mov edi, dword [ebp + 0x458]
cmp edi, esi
je 0x10008e3b
add edi, 2
cmp edi, esi
jne 0x10008d55
test byte [ebp + 0x470], 1
je 0x10008ea0
movzx eax, word [ebx]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x10008e6e
push 1
push esi
push esi
push 0x32810132
jmp 0x10008c6e
push 1
push esi
push esi
push 0x32810133
jmp 0x10008c6e
mov eax, dword [0x101f2440]
mov dword [ebp + 0x454], eax
mov eax, dword [0x101f2444]
mov dword [ebp + 0x458], eax
mov ax, word [ebx]
mov word [ebp + 0x454], ax
lea eax, [ebp + 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x10008e52
test byte [ebp + 0x470], 2
je 0x10008f24
xor eax, eax
mov word [ebp + 0x24c], ax
lea eax, [ebp + 0x24c]
push eax
push 0x10
call fcn.10016201
pop ecx
pop ecx
cmp word [ebp + 0x24c], si
je 0x10008ee2
lea eax, [ebp + 0x24c]
push ebx
push eax
call fcn.10007582
pop ecx
pop ecx
test eax, eax
jne 0x10008d24
call sym.AhnIEx.dll_AhnIEx_IsWinNT
test eax, eax
je 0x10008f24
xor eax, eax
mov word [ebp + 0x24c], ax
lea eax, [ebp + 0x24c]
push eax
push 0x19
call fcn.10016201
pop ecx
pop ecx
cmp word [ebp + 0x24c], si
je 0x10008f24
lea eax, [ebp + 0x24c]
push ebx
push eax
call fcn.10007582
pop ecx
pop ecx
test eax, eax
jne 0x10008d24
test byte [ebp + 0x470], 8
je 0x10008f49
push str.WinDir
call fcn.1000a6f3
push ebx
push eax
call fcn.10007582
add esp, 0xc
test eax, eax
jne 0x10008d24
test byte [ebp + 0x470], 4
je 0x10008f8a
push str.WinSysDir
call fcn.1000a6f3
push ebx
push eax
call fcn.10007582
add esp, 0xc
test eax, eax
jne 0x10008d24
push str.WinSysWow64Dir
call fcn.1000a6f3
push ebx
push eax
call fcn.10007582
add esp, 0xc
test eax, eax
jne 0x10008d24
test byte [ebp + 0x470], 0x10
je 0x1000903b
push esi
push 0x200000
call sym.AhnIEx.dll_AhnIEx_IsWinNTOrLater
pop ecx
pop ecx
test eax, eax
je 0x10008fea
xor eax, eax
mov word [ebp + 0x24c], ax
push 0x104
lea eax, [ebp + 0x24c]
push eax
push 0x1026b164
call fcn.100162e8
add esp, 0xc
cmp word [ebp + 0x24c], si
je 0x10008fea
lea eax, [ebp + 0x24c]
push ebx
push eax
call fcn.10007582
pop ecx
pop ecx
test eax, eax
jne 0x10008d24
push esi
push 0x40000
call sym.AhnIEx.dll_AhnIEx_IsWinNTOrLater
pop ecx
pop ecx
test eax, eax
je 0x1000903b
xor eax, eax
mov word [ebp + 0x24c], ax
push 0x104
lea eax, [ebp + 0x24c]
push eax
push str._SystemDrive_Documents_and_Settings
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [ebp + 0x24c], si
je 0x1000903b
lea eax, [ebp + 0x24c]
push ebx
push eax
call fcn.10007582
pop ecx
pop ecx
test eax, eax
jne 0x10008d24
test byte [ebp + 0x470], 0x20
je 0x100090b6
push esi
push esi
push 0xa
call sym.AhnIEx.dll_AhnIEx_IsWinNTOrLater2
add esp, 0xc
test eax, eax
je 0x100090b6
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [ebp - 0x14], esi
call fcn.100088d0
pop ecx
pop ecx
cmp eax, esi
je 0x10009081
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 4]
push eax
mov dword [ebp], vtable.CLogFunc.0
call fcn.101d12b4
pop ecx
jmp 0x10008c8d
cmp dword [ebp - 0x14], esi
je 0x100090b6
push 1
push esi
push esi
push 0x32810134
push dword [ebp - 0x10]
call fcn.1001931e
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 4]
push eax
mov dword [ebp], vtable.CLogFunc.0
call fcn.101d12b4
pop ecx
mov eax, esi
jmp 0x10008c8f
xor esi, esi
inc esi
jmp 0x1000909a